CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12625 – ClamAV Zip Bomb Vulnerability
https://notcve.org/view.php?id=CVE-2019-12625
ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. Las versiones anteriores a la versión 0.101.3 de ClamAV son susceptibles a una vulnerabilidad de bomba zip donde un atacante no autenticado puede causar una condición de denegación de servicio mediante el envío de mensajes especialmente diseñados en un sistema afectado. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1785 – Clam AntiVirus RAR Directory Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2019-1785
A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system. Una vulnerabilidad en la funcionalidad de análisis de archivos RAR del software Clam AntiVirus (ClamAV) versiones 0.101.1 y 0.101.0 podría permitir que un atacante remoto no autenticado cause una condición de denegación de servicio en un dispositivo afectado. • https://bugzilla.clamav.net/show_bug.cgi?id=12284 https://security.gentoo.org/glsa/201904-12 • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-1786 – Clam AntiVirus PDF Out-of-Bounds Read Vulnerability
https://notcve.org/view.php?id=CVE-2019-1786
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. Una vulnerabilidad en la funcionalidad de escaneo del Formato de Documento Portátil (PDF) de las versiones 0.101.1 y 0.101.0 del software Clam AntiVirus (ClamAV), podría permitir que un atacante remoto no autenticado cause una condición de denegación de servicio (DoS) en un dispositivo afectado. • https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12149 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12168 https://security.gentoo.org/glsa/201904-12 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2019-1787 – Clam AntiVirus PDF Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2019-1787
A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. Una vulnerabilidad en la funcionalidad de escaneo del PDF (Portable Document Format) en las versiones de software 0.101.1 y anteriores de Clam AntiVirus (ClamAV), podría permitir a un atacante remoto no autenticado causar una condición de denegación de servicio (DoS) en un dispositivo afectado. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00062.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00064.html https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12181 https://lists.debian.org/debian-lts-announce/2019/04/msg00019.html https://security.gentoo.org/glsa/201904-12 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 8%CPEs: 4EXPL: 1CVE-2019-1788 – ClamAV OLE2 File Out-Of-Bounds Write Vulnerability
https://notcve.org/view.php?id=CVE-2019-1788
A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition, resulting in a crash that could result in a denial of service condition on an affected device. Una vulnerabilidad en la funcionalidad de análisis de archivos Object Linking & Embedding (OLE2) de las versiones 0.101.1 y anteriores del software Clam AntiVirus (ClamAV) podría permitir que un atacante remoto no autenticado cause una condición de denegación de servicio en un dispositivo afectado. • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00062.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00064.html https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12166 https://lists.debian.org/debian-lts-announce/2019/04/msg00019.html https://security.gentoo.org/glsa/201904-12 • CWE-20: Improper Input Validation CWE-787: Out-of-bounds Write •