oss-sec mailing list archives
Re: CVE request: ClamAV vulnerabilities
From: cve-assign () mitre org
Date: Mon, 9 Dec 2013 18:45:20 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
I know that there are no details provided here, but secunia advisory also points on 'unspecified vulnerabilities'.
It is possible to have a CVE ID for multiple unspecified vulnerabilities but this can usually only occur when the expectation is that no details will be available. In this case, a previous message said:
From: Kurt Seifried <kseifried () redhat com> Just a heads up I know at least one person is trying to get details from SourceFire (they bought ClamAV some time back). Until I can match issues up I can't assign CVEs.
suggesting that some information gathering may be in progress. Although these items:
1) A double-free error exists within the "unrar_extract_next_prepare()" function (libclamunrar_iface/unrar_iface.c) when parsing a RAR file. 2) An unspecified error within the "wwunpack()" function (libclamav/wwunpack.c) when unpacking a WWPack file can be exploited to corrupt heap memory.
can have CVE IDs, we can't correctly define the scope of any CVE ID until more is known about what was fixed in 0.9.7. For example, in some cases, two different double-free issues fixed in 0.9.7 would be covered by a single CVE ID. So, it is probably best to wait a short time for the information gathering. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSplJmAAoJEKllVAevmvms+dkH/inM5aP+TvcychU/CygZUIBo eCaMOYwaoCgq1PIAKAIHkSxe8RQMvcZqF4W4V2YzXMDYFGRDOocOv7celNz213tJ Ur2vbIBN7eq9ZenenYZ4kr1mv9E84tRpVIm69Th5tBwEbPKbQiJcCVFsmHmMKQ80 C/aDHpVngu6gCkcEdgUX2GTaC7xAc+QkHlFFcaDbxdr860lpiJB7FaF5BysCs69M 035c9SQEr0S/eiRJnNFRFNu+rcJvLSCK+NBsiPXGZqS0u9riUx2//0V0ilXNZzt1 K7dPazHgVvb5cwWMqfVHCwOGN5Nk/xqCOgDNBffNjGC+SaZggCWq/NLM+5foeMM= =hkx8 -----END PGP SIGNATURE-----
Current thread:
- CVE request: ClamAV vulnerabilities Sergey Popov (Nov 29)
- Re: CVE request: ClamAV vulnerabilities Kurt Seifried (Nov 29)
- Re: CVE request: ClamAV vulnerabilities George Theall (Nov 29)
- Re: CVE request: ClamAV vulnerabilities Kurt Seifried (Dec 06)
- Re: CVE request: ClamAV vulnerabilities Sergey Popov (Dec 09)
- Re: CVE request: ClamAV vulnerabilities cve-assign (Dec 09)
- Re: CVE request: ClamAV vulnerabilities cve-assign (Dec 11)
- Re: CVE request: ClamAV vulnerabilities cve-assign (Dec 12)
- Re: CVE request: ClamAV vulnerabilities George Theall (Nov 29)
- Re: CVE request: ClamAV vulnerabilities Kurt Seifried (Nov 29)