PT-2019-15254 · Cisco+3 · Clamav+3

Published 2019-03-28 · Updated 2026-02-06 · CVE-2019-1787

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ClamAV Software versions 0.101.1 and prior

Description A vulnerability in the Portable Document Format (PDF) scanning functionality could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data. An attacker could exploit this by sending crafted PDF files to an affected device, potentially causing a heap buffer out-of-bounds read condition and resulting in a crash.

Recommendations For ClamAV Software versions 0.101.1 and prior, update to a version later than 0.101.1 to resolve the issue. As a temporary workaround, consider restricting the handling of PDF files by the ClamAV software until a patch is available.

Exploit

Fix

DoS

Out of bounds Read

RCE

Weakness Enumeration

CWE-125

CWE-20

Related Identifiers

ALT-PU-2019-1538

CLEANSTART-2026-LA13761

CLEANSTART-2026-NJ87139

CLEANSTART-2026-TC95380

CLEANSTART-2026-WX01708

CVE-2019-1787

DLA-1759-1

MGASA-2019-0162

OPENSUSE-SU-2019:1210-1

OPENSUSE-SU-2019_1208-1

OPENSUSE-SU-2019_1210-1

OPENSUSE-SU-2020:2268-1

OPENSUSE-SU-2020:2276-1

OPENSUSE-SU-2020_2268-1

OPENSUSE-SU-2020_2276-1

OPENSUSE-SU-2024:10685-1

SUSE-SU-2019:0861-1

SUSE-SU-2019:0897-1

SUSE-SU-2019:14015-1

SUSE-SU-2019_0861-1

SUSE-SU-2019_0897-1

SUSE-SU-2019_14015-1

SUSE-SU-2020:3790-1

USN-3940-1

USN-3940-2

Affected Products

Alt Linux

Clamav

Suse

Ubuntu

References · 182

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12181 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11423 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48579 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12376 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:2268-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00064.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0361 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-20197 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0202 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-1404 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0861-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20698 · Security Note
• https://ubuntu.com/security/CVE-2019-1787 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NJ87139 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3940-2 · Vendor Advisory