Search for vulnerabilities
Vulnerability details: VCID-6jeh-pfrs-aaam
Vulnerability ID VCID-6jeh-pfrs-aaam
Aliases CVE-2019-15961
Summary A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-400 Uncontrolled Resource Consumption
CWE-20 Improper Input Validation
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15961.html
epss 0.00442 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.00442 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.00442 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.00581 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.01728 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.02215 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.03957 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
epss 0.08505 https://api.first.org/data/v1/epss?cve=CVE-2019-15961
generic_textual Medium https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html
cvssv3.1 7.5 https://bugzilla.clamav.net/show_bug.cgi?id=12380
ssvc Track https://bugzilla.clamav.net/show_bug.cgi?id=12380
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15961
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2020/02/msg00016.html
ssvc Track https://lists.debian.org/debian-lts-announce/2020/02/msg00016.html
cvssv2 7.1 https://nvd.nist.gov/vuln/detail/CVE-2019-15961
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2019-15961
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2019-15961
cvssv3.1 7.5 https://quickview.cloudapps.cisco.com/quickview/bug/CSCvr56010
ssvc Track https://quickview.cloudapps.cisco.com/quickview/bug/CSCvr56010
cvssv3.1 7.5 https://security.gentoo.org/glsa/202003-46
ssvc Track https://security.gentoo.org/glsa/202003-46
generic_textual Medium https://ubuntu.com/security/notices/USN-4230-1
generic_textual Medium https://ubuntu.com/security/notices/USN-4230-2
cvssv3.1 7.5 https://usn.ubuntu.com/4230-2/
ssvc Track https://usn.ubuntu.com/4230-2/
generic_textual Medium https://usn.ubuntu.com/usn/usn-4230-1
generic_textual Medium https://usn.ubuntu.com/usn/usn-4230-2
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15961.html
https://api.first.org/data/v1/epss?cve=CVE-2019-15961
https://blog.clamav.net/2019/11/clamav-01021-and-01015-patches-have.html
https://bugzilla.clamav.net/show_bug.cgi?id=12380
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15961
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2020/02/msg00016.html
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvr56010
https://security.gentoo.org/glsa/202003-46
https://ubuntu.com/security/notices/USN-4230-1
https://ubuntu.com/security/notices/USN-4230-2
https://usn.ubuntu.com/4230-2/
https://usn.ubuntu.com/usn/usn-4230-1
https://usn.ubuntu.com/usn/usn-4230-2
945265 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945265
cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*
cpe:2.3:a:clamav:clamav:0.102.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:clamav:clamav:0.102.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.1-042:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.1-042:*:*:*:*:*:*:*
cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.2-023:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:cisco:email_security_appliance_firmware:11.1.2-023:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
CVE-2019-15961 https://nvd.nist.gov/vuln/detail/CVE-2019-15961
USN-4230-1 https://usn.ubuntu.com/4230-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://bugzilla.clamav.net/show_bug.cgi?id=12380
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T16:22:50Z/ Found at https://bugzilla.clamav.net/show_bug.cgi?id=12380
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2020/02/msg00016.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T16:22:50Z/ Found at https://lists.debian.org/debian-lts-announce/2020/02/msg00016.html
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2019-15961
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-15961
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-15961
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://quickview.cloudapps.cisco.com/quickview/bug/CSCvr56010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T16:22:50Z/ Found at https://quickview.cloudapps.cisco.com/quickview/bug/CSCvr56010
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.gentoo.org/glsa/202003-46
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T16:22:50Z/ Found at https://security.gentoo.org/glsa/202003-46
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://usn.ubuntu.com/4230-2/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-15T16:22:50Z/ Found at https://usn.ubuntu.com/4230-2/
Exploit Prediction Scoring System (EPSS)
Percentile 0.74526
EPSS Score 0.00442
Published At Dec. 17, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.