Univention Bugzilla – Bug 51695
clamav: Multiple issues (4.4)
Last modified: 2020-07-29 16:50:31 CEST
New Debian clamav 0.102.3+dfsg-0~deb9u1A~4.4.5.202007221413 fixes: This update addresses the following issues: * A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. (CVE-2020-3123) * A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. (CVE-2020-3327) * A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. (CVE-2020-3341)
--- mirror/ftp/4.4/unmaintained/4.4-4/source/clamav_0.102.1+dfsg-0+deb9u2A~4.4.3.202002191052.dsc +++ apt/ucs_4.4-0-errata4.4-5/source/clamav_0.102.3+dfsg-0~deb9u1A~4.4.5.202007221413.dsc @@ -1,7 +1,30 @@ -0.102.1+dfsg-0+deb9u2A~4.4.3.202002191052 [Tue, 10 Mar 2020 07:43:26 +0100] Univention builddaemon <buildd@univention.de>: +0.102.3+dfsg-0~deb9u1A~4.4.5.202007221413 [Wed, 22 Jul 2020 14:17:03 +0200] Univention builddaemon <buildd@univention.de>: * UCS auto build. The following patches have been applied to the original source package 030-silence-version-msg + +0.102.3+dfsg-0~deb9u1 [Sat, 30 May 2020 00:12:26 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: + + [ Sebastian Andrzej Siewior ] + * Import 0.102.3 + - CVE-2020-3327 (A vulnerability in the ARJ archive parsing module) + - CVE-2020-3341 (A vulnerability in the PDF parsing module) + * Update symbol file. + + [ Scott Kitterman ] + * Add Suggests for unversioned libclamunrar package on clamav-daemon and + clamav binaries + +0.102.2+dfsg-0~deb9u1 [Sat, 22 Feb 2020 14:43:26 +0100] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: + + * Import 0.102.2 + - CVE-2020-3123 (DoS may occur in the optional DLP feature) + (Closes: 950944). + * Update symbol file. + * Set ReceiveTimeout to 0 which is upstream default. + * Add a patch to let freshclam consider CURL_CA_BUNDLE environment variable + to set the CA bundle (like curl does) (Closes: #951057). + * Recommend ca-certificates, new freshclash uses https by default. 0.102.1+dfsg-0+deb9u2 [Fri, 31 Jan 2020 16:49:37 -0500] Scott Kitterman <scott@kitterman.com>: <http://10.200.17.11/4.4-5/#4384953653234884626>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-5] e4efcae2a4 Bug #51695: clamav 0.102.3+dfsg-0~deb9u1A~4.4.5.202007221413 doc/errata/staging/clamav.yaml | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) [4.4-5] df8045da24 Bug #51695: clamav 0.102.3+dfsg-0~deb9u1A~4.4.5.202007221413 doc/errata/staging/clamav.yaml | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x653>