PT-2019-5068 · Cisco+3 · Clamav+3
David Fifield
·
Publicado
2019-08-12
·
Atualizado
2026-02-06
·
CVE-2019-12625
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ClamAV versions prior to 0.101.3
Description
The issue is related to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. It is also associated with incorrect cleanup or release of resources, which can be exploited by an attacker to cause a denial of service by sending specially crafted messages to the vulnerable system.
Recommendations
For ClamAV versions prior to 0.101.3, update to version 0.101.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation. Avoid processing untrusted zip files until the issue is resolved.
Correção
DoS
Resource Exhaustion
Improper Resource Release
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Clamav
Suse
Ubuntu