Univention Bugzilla – Bug 48052
clamav: Multiple issues (4.3)
Last modified: 2018-11-01 13:44:11 CET
+++ This bug was initially created as a clone of Bug #48050 +++ New Debian clamav 0.100.2+dfsg-0+deb8u1A~4.2.5.201810250824 fixes: This update addresses the following issue: * A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file. (CVE-2018-15378) FYI: The 3 other CVE 2018-14680,2018-14681,2018-14628 are bugs in libmspack, which Debian links dynamically and thus were fixed in that package by Bug #47513
--- mirror/ftp/4.3/unmaintained/4.3-2/source/clamav_0.100.1+dfsg-0+deb9u1A~4.3.0.201807301921.dsc +++ apt/ucs_4.3-0-errata4.3-2/source/clamav_0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854.dsc @@ -1,7 +1,16 @@ -0.100.1+dfsg-0+deb9u1A~4.3.0.201807301921 [Mon, 30 Jul 2018 19:21:41 +0200] Univention builddaemon <buildd@univention.de>: +0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854 [Thu, 25 Oct 2018 08:54:49 +0200] Univention builddaemon <buildd@univention.de>: * UCS auto build. The following patches have been applied to the original source package 030-silence-version-msg + +0.100.2+dfsg-0+deb9u1 [Fri, 12 Oct 2018 23:44:44 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: + + * Import new upstream + - Bump symbol version due to new version. + - CVE-2018-15378 (Closes: #910430). + * add NEWS.md and README.md from upstream + * Fix infinite loop in dpkg-reconfigure, Patch by Santiago Ruano Rincón + (Closes: #905044). 0.100.1+dfsg-0+deb9u1 [Sat, 21 Jul 2018 13:13:59 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: <http://10.200.17.11/4.3-2/#952998585170573336>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.3-2] 38e33d319a Bug #48052: clamav 0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854 doc/errata/staging/clamav.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) [4.3-2] 8d82b5770a Bug #48051: clamav 0.100.2+dfsg-0+deb9u1A~4.3.0.201810250854 doc/errata/staging/clamav.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
<http://errata.software-univention.de/ucs/4.3/292.html>