SUSE update for clamav
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2021-1252 CVE-2021-1404 CVE-2021-1405 |
| CWE-ID | CWE-835 CWE-125 CWE-476 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Point of Sale Operating systems & Components / Operating system SUSE Linux Enterprise Debuginfo Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system clamav-debugsource Operating systems & Components / Operating system package or component clamav-debuginfo Operating systems & Components / Operating system package or component clamav Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Infinite loop
EUVDB-ID: #VU52792
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-1252
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the Excel XLM macro parsing module. A remote attacker can consume all available system resources and cause denial of service conditions.
MitigationUpdate the affected package clamav to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Point of Sale: 11-SP3
SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4
SUSE Linux Enterprise Server: 11-SP4-LTSS
clamav-debugsource: before 0.103.2-0.20.35.1
clamav-debuginfo: before 0.103.2-0.20.35.1
clamav: before 0.103.2-0.20.35.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_point_of_sale:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:11-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:a:suse:clamav-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:clamav-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:clamav:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-202114692-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Out-of-bounds read
EUVDB-ID: #VU52793
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-1404
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in the PDF parsing module. A remote attacker can create a specially crafted PDF file, pass it to the application, trigger out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package clamav to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Point of Sale: 11-SP3
SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4
SUSE Linux Enterprise Server: 11-SP4-LTSS
clamav-debugsource: before 0.103.2-0.20.35.1
clamav-debuginfo: before 0.103.2-0.20.35.1
clamav: before 0.103.2-0.20.35.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_point_of_sale:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:11-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:a:suse:clamav-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:clamav-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:clamav:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-202114692-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) NULL pointer dereference
EUVDB-ID: #VU52784
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-1405
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send a specially crafted email to the server and perform a denial of service (DoS) attack.
MitigationUpdate the affected package clamav to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Point of Sale: 11-SP3
SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4
SUSE Linux Enterprise Server: 11-SP4-LTSS
clamav-debugsource: before 0.103.2-0.20.35.1
clamav-debuginfo: before 0.103.2-0.20.35.1
clamav: before 0.103.2-0.20.35.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_point_of_sale:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_debuginfo:11-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:11-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:a:suse:clamav-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:clamav-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:clamav:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2021/suse-su-202114692-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
