CVE-2019-15961
Description
A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.
Risk Information
Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
2.206
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2019-15961 are affected in Clamav 0.101.4 | Windows |
| Vulnerabilities CVE-2019-15961,CVE-2020-3123 are affected in Clamav 0.102.0 | Windows |
| SUSE-SU-2019:3177-1(SUSE Linux Enterprise Desktop 12-SP4 ) clamav-0.100.3-33.29.1.x86_64.rpm | Linux |
| SUSE-SU-2019:3177-1(SUSE Linux Enterprise Desktop 12-SP4 ) clamav-debuginfo-0.100.3-33.29.1.x86_64.rpm | Linux |
| SUSE-SU-2019:3177-1(SUSE Linux Enterprise Desktop 12-SP4 ) clamav-debugsource-0.100.3-33.29.1.x86_64.rpm | Linux |
| Anti-virus utility for Unix (USN-4230-1) clamav_0.102.1+dfsg-0ubuntu0.19.10.2_i386.deb | Linux |
| Anti-virus utility for Unix (USN-4230-1) clamav_0.102.1+dfsg-0ubuntu0.19.10.2_amd64.deb | Linux |
| SUSE-SU-2020:3729-1(SUSE Linux Enterprise Server 12-SP5 ) clamav-0.103.0-3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2020:3729-1(SUSE Linux Enterprise Server 12-SP5 ) clamav-debuginfo-0.103.0-3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2020:3729-1(SUSE Linux Enterprise Server 12-SP5 ) clamav-debugsource-0.103.0-3.3.1.x86_64.rpm | Linux |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-341177 | ClamAV (0.103.12) |
| PATCH-341177 | ClamAV (0.103.12) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234