PT-2019-5068 · Cisco+3 · Clamav+3
David Fifield
·
Published
2019-08-12
·
Updated
2026-02-06
·
CVE-2019-12625
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ClamAV versions prior to 0.101.3
Description
The issue is related to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. It is also associated with incorrect cleanup or release of resources, which can be exploited by an attacker to cause a denial of service by sending specially crafted messages to the vulnerable system.
Recommendations
For ClamAV versions prior to 0.101.3, update to version 0.101.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation. Avoid processing untrusted zip files until the issue is resolved.
Fix
DoS
Resource Exhaustion
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Clamav
Suse
Ubuntu