CVE-2021-1405: cisco clamav Classic Buffer Overflow
Vulnerability summary
CVE-2021-1405 is a high (CVSS 7.5) Classic Buffer Overflow vulnerability in cisco clamav. EPSS estimates a 3.03% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 9Timeline
- 08-04-2021PublishedVulnerability first disclosed.
- 08-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted email to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.03%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.03% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-909Missing Initialization of ResourceThe product does not initialize a critical resource.
Affected systems
Debian2 products
- clamav< 0.103.2+dfsg-1 | < 0.102.4+dfsg-0+deb9u2
- debian_linuxEOL9.0
Mageia2 products
- clamav< 0.103.2-1.mga7
- clamav< 0.103.2-1.mga8
Alpine1 product
- clamav< 0.103.2-r0
Cisco1 product
- clamav≥ unspecified, ≤ 0.103.1
Clamav1 product
- clamav≤ 0.103.1
Ubuntu1 product
- clamav< 0.103.2+dfsg-0ubuntu0.14.04.1+esm1 | < 0.103.2+dfsg-0ubuntu0.16.04.1 | < 0.103.2+dfsg-0ubuntu0.18.04.1 | < 0.103.2+dfsg-0ubuntu0.20.04.1
6 vendors · 8 products
References
13 links- blog.clamav.net/2021/04/clamav-01032-security-patch-release.htmlVendor AdvisoryX Refsource CISCOWEBREPORTRelease Notes
lists.debian.org/debian-lts-announce/2021/04/msg00012.htmlMailing ListX Refsource MLISTThird Party Advisory
