CVE-2019-12625

ClamAV Zip Bomb Vulnerability

CVSS 7.5 HIGHEPSS 2.2%CWE-400

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 2.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

05 Nov 2019Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Cisco · ClamAV

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html