CVE-2019-12625

ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system.

References

Affected packages

Git / github.com/cisco-talos/clamav

Affected ranges

Type

GIT

Repo

https://github.com/cisco-talos/clamav

Events

Introduced

Fixed

0ba5d6fd7efea6ef2fc20fc170a7f5bbae60cf0e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.101.3"
        }
    ]
}

Affected versions

clamav-0.*

clamav-0.101.0

clamav-0.101.1

clamav-0.101.2

clamav-0.96

clamav-0.96.2

clamav-0.96.3

clamav-0.96.4

clamav-0.96.5

clamav-0.96rc1

clamav-0.96rc2

clamav-0.97

clamav-0.97rc

Other

merge-llvm-97877

r5076

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12625.json"