Bug 48052

Summary:	clamav: Multiple issues (4.3)
Product:	UCS	Reporter:	Philipp Hahn <hahn>
Component:	Security updates	Assignee:	Quality Assurance <qa>
Status:	CLOSED FIXED	QA Contact:	UCS maintainers <ucs-maintainers>
Severity:	normal
Priority:	P5	CC:	qa
Version:	UCS 4.3
Target Milestone:	UCS 4.3-2-errata
Hardware:	All
OS:	Linux
URL:	https://blog.clamav.net/2018/10/clamav-01002-has-been-released.html
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:	6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) PMH
Bug Depends on:	48051
Bug Blocks:

Description Philipp Hahn

2018-10-25 09:04:13 CEST

+++ This bug was initially created as a clone of Bug #48050 +++

New Debian clamav 0.100.2+dfsg-0+deb8u1A~4.2.5.201810250824 fixes:
This update addresses the following issue:

* A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker  to cause a denial of service (DoS) condition. The vulnerability is due to  an error related to the MEW unpacker within the "unmew11()" function  (libclamav/mew.c), which can be exploited to trigger an invalid read memory  access via a specially crafted EXE file. (CVE-2018-15378)

FYI: The 3 other CVE 2018-14680,2018-14681,2018-14628 are bugs in libmspack, which Debian links dynamically and thus were fixed in that package by Bug #47513

Comment 1 Quality Assurance

2018-10-26 13:25:20 CEST

--- mirror/ftp/4.3/unmaintained/4.3-2/source/clamav_0.100.1+dfsg-0+deb9u1A~4.3.0.201807301921.dsc
+++ apt/ucs_4.3-0-errata4.3-2/source/clamav_0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854.dsc
@@ -1,7 +1,16 @@
-0.100.1+dfsg-0+deb9u1A~4.3.0.201807301921 [Mon, 30 Jul 2018 19:21:41 +0200] Univention builddaemon <buildd@univention.de>:
+0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854 [Thu, 25 Oct 2018 08:54:49 +0200] Univention builddaemon <buildd@univention.de>:
 
   * UCS auto build. The following patches have been applied to the original source package
     030-silence-version-msg
+
+0.100.2+dfsg-0+deb9u1 [Fri, 12 Oct 2018 23:44:44 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>:
+
+  * Import new upstream
+    - Bump symbol version due to new version.
+    - CVE-2018-15378 (Closes: #910430).
+  * add NEWS.md and README.md from upstream
+  * Fix infinite loop in dpkg-reconfigure, Patch by Santiago Ruano Rincón
+    (Closes: #905044).
 
 0.100.1+dfsg-0+deb9u1 [Sat, 21 Jul 2018 13:13:59 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>:
 

<http://10.200.17.11/4.3-2/#952998585170573336>

Comment 2 Philipp Hahn

2018-10-26 13:26:19 CEST

OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.3-2] 38e33d319a Bug #48052: clamav 0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854
 doc/errata/staging/clamav.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[4.3-2] 8d82b5770a Bug #48051: clamav 0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854
 doc/errata/staging/clamav.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

Comment 3 Arvid Requate

2018-11-01 13:44:11 CET

<http://errata.software-univention.de/ucs/4.3/292.html>