CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-1386 – Cisco Advanced Malware Protection for Endpoints Windows Connector, ClamAV for Windows, and Immunet DLL Hijacking Vulnerability
https://notcve.org/view.php?id=CVE-2021-1386
07 Apr 2021 — A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Windows, and Immunet could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability, the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by... • https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-imm-dll-tu79hvkO • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-1404 – Clam AntiVirus (ClamAV) Email Parser Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-1404
07 Apr 2021 — A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in... • https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2021-1405 – Clam AntiVirus (ClamAV) PDF Parser Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2021-1405
07 Apr 2021 — A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted email to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, result... • https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-909: Missing Initialization of Resource •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-27506
https://notcve.org/view.php?id=CVE-2021-27506
19 Mar 2021 — The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1. El componente ClamAV Engine (versión 0.103.1 e inferior) incrustado en Storsmshield Network Security (SNS) está sujeto a DoS en caso de analizar archivos png malformados. Esto afecta a las versiones 9.1.0 a 9.1.11 de ... • https://advisories.stormshield.eu/2021-003 •
CVSS: 7.5EPSS: 4%CPEs: 9EXPL: 0CVE-2020-3481 – Clam AntiVirus (ClamAV) Software Null Pointer Dereference Vulnerability
https://notcve.org/view.php?id=CVE-2020-3481
16 Jul 2020 — A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. Una vulnera... • https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 3%CPEs: 7EXPL: 0CVE-2020-3123 – Gentoo Linux Security Advisory 202003-46
https://notcve.org/view.php?id=CVE-2020-3123
05 Feb 2020 — A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning proce... • https://blog.clamav.net/2020/02/clamav-01022-security-patch-released.html • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 4%CPEs: 7EXPL: 1CVE-2019-15961 – Clam AntiVirus (ClamAV) Software Email Parsing Vulnerability
https://notcve.org/view.php?id=CVE-2019-15961
21 Nov 2019 — A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the C... • https://bugzilla.clamav.net/show_bug.cgi?id=12380 • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2007-6745
https://notcve.org/view.php?id=CVE-2007-6745
07 Nov 2019 — clamav 0.91.2 suffers from a floating point exception when using ScanOLE2. clamav versión 0.91.2, sufre de una excepción de coma flotante cuando usa ScanOLE2. • http://www.openwall.com/lists/oss-security/2012/03/29/2 •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2007-0899
https://notcve.org/view.php?id=CVE-2007-0899
06 Nov 2019 — There is a possible heap overflow in libclamav/fsg.c before 0.100.0. Existe un posible desbordamiento de la pila en el archivo libclamav/fsg.c versiones anteriores a la versión 0.100.0. • https://security-tracker.debian.org/tracker/CVE-2007-0899 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2019-12625 – ClamAV Zip Bomb Vulnerability
https://notcve.org/view.php?id=CVE-2019-12625
21 Aug 2019 — ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. Las versiones anteriores a la versión 0.101.3 de ClamAV son susceptibles a una vulnerabilidad de bomba zip donde un atacante no autenticado puede causar una condición de denegación de servicio mediante el envío de mensajes especialmente diseñados en un sistema afectado. It was discovered that ClamAV incorrect... • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •