*** This bug is a security vulnerability ***
Public security bug reported:
Binary package hint: clamav
The following CVEs (got them from SUSE-SA:2008:024) are not yet tracked
as open bugs:
CVE-2007-6596
ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote
attackers to bypass the scanner via a Base64-UUEncoded file.
CVE 2008-1835
ClamAV before 0.93 allows remote attackers to bypass the scanning enging via a
RAR file with an invalid version number, which cannot be parsed by ClamAV but
can be extracted by Winrar.
CVE 2008-1836
The rfc2231 function in message.c in libclamav in ClamAV before 0.93 allows
remote attackers to cause a denial of service (crash) via a crafted message
that produces a string that is not null terminated, which triggers a buffer
over-read.
CVE 2008-1837
libclamunrar in ClamAV before 0.93 allows remote attackers to cause a denial of
service (crash) via crafted RAR files that trigger "memory problems," as
demonstrated by the PROTOS GENOME test suite for Archive Formats.
** Affects: clamav (Ubuntu)
Importance: Undecided
Status: New
** Visibility changed to: Public
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2007-6596
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2008-1835
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2008-1836
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2008-1837
--
[clamav] several open CVE issues
https://bugs.launchpad.net/bugs/227327
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
