Bug 50137 - clamav: Multiple issues (4.3)
clamav: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-4-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-09-09 14:39 CEST by Quality Assurance
Modified: 2019-09-11 15:56 CEST (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 4.0 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Debian RedHat


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2019-09-09 14:39:42 CEST
New Debian clamav 0.101.4+dfsg-0+deb9u1A~4.3.4.201909091438 fixes:
This update addresses the following issues:
* clamav (CVE-2019-12625)
* out-of-bounds write in function BZ2_decompress (CVE-2019-12900)
Comment 1 Quality Assurance univentionstaff 2019-09-09 17:00:51 CEST
--- mirror/ftp/4.3/unmaintained/component/4.3-4-errata/source/clamav_0.100.3+dfsg-0+deb9u1A~4.3.4.201904290751.dsc
+++ apt/ucs_4.3-0-errata4.3-4/source/clamav_0.101.4+dfsg-0+deb9u1A~4.3.0.201909091532.dsc
@@ -1,27 +1,61 @@
-0.100.3+dfsg-0+deb9u1A~4.3.4.201904290751 [Mon, 29 Apr 2019 07:52:01 +0200] Univention builddaemon <buildd@univention.de>:
+0.101.4+dfsg-0+deb9u1A~4.3.0.201909091532 [Mon, 09 Sep 2019 15:32:25 +0200] Univention builddaemon <buildd@univention.de>:
 
   * UCS auto build. The following patches have been applied to the original source package
     030-silence-version-msg
 
-0.100.3+dfsg-0+deb9u1 [Fri, 29 Mar 2019 19:40:34 -0400] Scott Kitterman <scott@kitterman.com>:
+0.101.4+dfsg-0+deb9u1 [Sun, 25 Aug 2019 14:08:40 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>:
 
-  * New upstream security release
-    - Fixes for the following vulnerabilities:
-      - [CVE-2019-1787]:
-        An out-of-bounds heap read condition may occur when scanning PDF
-        documents. The defect is a failure to correctly keep track of the number
-        of bytes remaining in a buffer when indexing file data.
-      - [CVE-2019-1789]:
-        An out-of-bounds heap read condition may occur when scanning PE files
-        (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
-        result of inadequate bound-checking.
-      - [CVE-2019-1788]:
-        An out-of-bounds heap write condition may occur when scanning OLE2 files
-        such as Microsoft Office 97-2003 documents. The invalid write happens when
-        an invalid pointer is mistakenly used to initialize a 32bit integer to
-        zero. This is likely to crash the application.
-  * Update debian/copyright
-  * Update private symbols for new upstream release
+  * Import 0.101.4 (Closes: 921190)
+   - CVE-2019-12625 (Add scan time limit to limit the processing zip-bombs)
+     (Closes:934359)
+   - CVE-2019-12900 (An out of bounds write was possible within ClamAV's
+     NSIS bzip)
+   - update symbols file (bump to 101.4 and drop unused cli_strnstr).
+
+0.101.2+dfsg-0+deb9u1 [Fri, 05 Apr 2019 22:07:01 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>:
+
+  * Import 0.101.2
+   - CVE-2019-1787 (An out-of-bounds heap read condition may occur when
+     scanning PDF documents)
+   - CVE-2019-1789 (An out-of-bounds heap read condition may occur when
+     scanning PE files)
+   - CVE-2019-1788 (An out-of-bounds heap write condition may occur when
+     scanning OLE2 files)
+   - CVE-2019-1786 (An out-of-bounds heap read condition may occur when
+     scanning malformed PDF documents)
+   - CVE-2019-1785 (A path-traversal write condition may occur as a result of
+     improper input validation when scanning RAR archives)
+   - CVE-2019-1798 (A use-after-free condition may occur as a result of
+     improper error handling when scanning nested RAR archives)
+   - update symbols file
+   - Remove DetectBrokenExecutables option from clamd template, it is
+     deprecated.
+
+0.101.1+dfsg-0+deb9u1 [Sun, 10 Mar 2019 16:49:51 +0100] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>:
+
+  [ Scott Kitterman ]
+  * Increase clamd socket command read timeout to 30 seconds (Closes: #915098)
+  * Add information to README.Debian on configuring clamav-milter's socket to
+    work with postfix
+  * Add lintian override for source-is-missing on test file that happens
+    to have long line length
+
+  [ Sebastian Andrzej Siewior ]
+  * Import new upstream release.
+   - update symbol file.
+   - add new options to the config file.
+   - package libclamav9
+  * Import 0.101.1
+    - update symbol file
+    - add back the json/curl configure options (don't rely on autodetect).
+  * Add abstractions/openssl to apparmor's profile. Thanks to intrigeri for
+    the help (Closes: #913020).
+  * Load the apparmor profile before starting the daemon. Thanks to intrigeri
+    for the help (Closes: #903834).
+  * Add attach_disconnected to freshclam's apparmor profile to hopefully get
+    it properly working in overlayfs enviroment. Thanks to Vincas Dargis
+    (Closes: #917648).
+  * debian/libclamav-dev.install: also install clamav-types.h
 
 0.100.2+dfsg-0+deb9u1 [Fri, 12 Oct 2018 23:44:44 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>:
 

<http://10.200.17.11/4.3-4/#277066780870356732>
Comment 2 Philipp Hahn univentionstaff 2019-09-10 11:39:49 CEST
OK: yaml
OK: announce_errata
OK: patch
~OK: piuparts
 new packages

[4.3-4] 664c73dbe5 Bug #50137: clamav 0.101.4+dfsg-0+deb9u1A~4.3.0.201909091532
 doc/errata/staging/clamav.yaml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
Comment 3 Erik Damrose univentionstaff 2019-09-11 15:56:09 CEST
<http://errata.software-univention.de/ucs/4.3/571.html>