CVE Vulnerabilities

CVE-2021-1252

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Apr 08, 2021 | Modified: Aug 05, 2022
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
7.8 HIGH
AV:N/AC:L/Au:N/C:N/I:N/A:C
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper error handling that may result in an infinite loop. An attacker could exploit this vulnerability by sending a crafted Excel file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process hang, resulting in a denial of service condition.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Clamav Clamav 0.103.0 (including) 0.103.0 (including)
Clamav Clamav 0.103.1 (including) 0.103.1 (including)
Clamav Ubuntu bionic *
Clamav Ubuntu focal *
Clamav Ubuntu groovy *
Clamav Ubuntu precise/esm *
Clamav Ubuntu trusty *
Clamav Ubuntu trusty/esm *
Clamav Ubuntu xenial *

References