CVE-2021-1404

Name	CVE-2021-1404
Description	A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	986622, 986790

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
clamav (PTS)	bullseye	0.103.10+dfsg-0+deb11u1	fixed
	bullseye (security)	1.0.7+dfsg-1~deb11u2	fixed
	bookworm	1.0.7+dfsg-1~deb12u1	fixed
	sid, trixie	1.4.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
clamav	source	stretch	(not affected)
clamav	source	buster	(not affected)
clamav	source	(unstable)	0.103.2+dfsg-1	986622, 986790

Notes

[buster] - clamav <not-affected> (Affects only 0.103.0 and 0.103.1)
[stretch] - clamav <not-affected> (Affects only 0.103.0 and 0.103.1)
https://blog.clamav.net/2021/04/clamav-01032-security-patch-release.html