CVE-2013-2021

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out...

4.3 MediumFix available

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

Exploit likelihood

3.50%Down 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

Record: CVE-2013-2021
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

Record: CVE-2013-2021
Updated: 2026-11-02

EUVDEUVD-2013-2010 No score

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

Record: EUVD-2013-2010
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8rc2-m544-5vqh No score

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out...

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

Record: GHSA-8rc2-m544-5vqh
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

Record: CVE-2013-2021
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-2021 No score

pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.

Record: DEBIAN-CVE-2013-2021
Updated: 2026-11-02

OSVSUSE-SU-2015:0298-1 No score

Recommended update for clamav

The antivirus scanner ClamAV has been updated to version 0.98.3, which includes the following fixes and enhancements:

* Support for common raw disk image formats using 512 byte sectors,
  specifically GPT, APM, and MBR partitioning.
* All ClamAV sockets (clamd, freshclam, clamav-milter, clamdscan,
  clamdtop) now support IPV6 addresses and configuration parameters.
* Use OpenSSL file hash functions for improved performance.
* Improved detection of malware scripts within image files.
* Miscellaneous bug fixes and documentation improvements.

Record: SUSE-SU-2015:0298-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0871-1 No score

Recommended update for clamav

The antivirus scanner ClamAV has been updated to version 0.98.3, which includes the following fixes and enhancements:

* Support for common raw disk image formats using 512 byte sectors,
  specifically GPT, APM, and MBR partitioning.
* All ClamAV sockets (clamd, freshclam, clamav-milter, clamdscan,
  clamdtop) now support IPV6 addresses and configuration parameters.
* Use OpenSSL file hash functions for improved performance.
* Improved detection of malware scripts within image files.
* Miscellaneous bug fixes and documentation improvements.

Record: SUSE-SU-2015:0871-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`clamav` Debian:12	before 0.97.8+dfsg-1	0.97.8+dfsg-1
`clamav` Debian:13	before 0.97.8+dfsg-1	0.97.8+dfsg-1
`clamav` Debian:14	before 0.97.8+dfsg-1	0.97.8+dfsg-1

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2021 is a medium vulnerability (CVSS 4.3) in Clamav, published May 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.50%, the 89th percentile. Fixed in clamav 0.97.8+dfsg-1.

References

Show 47 moreShow less