CVE-2021-1404: Clam AntiVirus (ClamAV) Email Parser Denial of Service Vulnerability
A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this ClamAV vulnerability?
The vulnerability ID for this ClamAV vulnerability is CVE-2021-1404.
What is the affected software for CVE-2021-1404?
The affected software for CVE-2021-1404 is ClamAV Software versions 0.103.0 and 0.103.1.
What is the severity level of CVE-2021-1404?
The severity level of CVE-2021-1404 is high with a CVSS score of 7.5.
How can an attacker exploit CVE-2021-1404?
An unauthenticated, remote attacker can exploit CVE-2021-1404 by causing a denial of service condition on an affected device.
Is there a fix available for CVE-2021-1404?
Yes, a security patch is available. Please refer to the official ClamAV blog post for more details and instructions.