CVE-2021-1404

CWE-20 — Improper Input ValidationCWE-125 — Out-of-bounds Read13 documents8 sources
Severity
7.5HIGH
EPSS
0.4%
top 36.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco ClamavClamav Clamav
Timeline
PublishedApr 8
Latest updateMay 24

Description

A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶Debianclamav< 0.103.2+dfsg-1+3
▶Ubuntuclamav< 0.103.2+dfsg-0ubuntu0.16.04.1+2
▶CVEListV5cisco/clamav0.103.0, 0.103.1+1
▶NVDclamav/clamav0.103.0, 0.103.1+1

🔴Vulnerability Details

6
GHSA
GHSA-95rx-jp6p-3cmx: A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0↗2022-05-24
▶
OSV
clamav regression↗2021-05-03
▶
OSV
clamav vulnerabilities↗2021-04-20
▶
OSV
clamav vulnerabilities↗2021-04-19
▶
OSV
CVE-2021-1404: A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0↗2021-04-08
▶

📋Vendor Advisories

4
Ubuntu
ClamAV vulnerabilities↗2021-04-20
▶
Ubuntu
ClamAV vulnerabilities↗2021-04-19
▶
Microsoft
Clam AntiVirus (ClamAV) Email Parser Denial of Service Vulnerability↗2021-04-13
▶
Debian
CVE-2021-1404: clamav - A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software ve...↗2021
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
Talos
Vulnerability Spotlight: Vulnerabilities in Gerbv could lead to code execution, information disclosure↗2022-02-24
▶
CVE-2021-1404 (HIGH CVSS 7.5) | A vulnerability in the PDF parsing | cvebase.io