oss-sec mailing list archives
Re: CVE id request: Clamav
From: Tomas Hoger <thoger () redhat com>
Date: Tue, 8 Jul 2008 15:42:33 +0200
On Mon, 16 Jun 2008 16:41:27 +0200 Tomas Hoger <thoger () redhat com> wrote:
On Sun, 15 Jun 2008 21:21:30 +1000 Steffen Joeris <steffen.joeris () skolelinux de> wrote:The upstream changelog says: * libclamav/petite.c: fix possible invalid memory access (bb#1000) Reported by Damian PutFor the sake of CVE description completeness, I'm adding that it's from the clamav 0.93.1 changelog. Applied patch: http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&path=/branches/0.93/libclamav/petite.c&rev=3886
Btw, following is mentioned in the 0.93.2 changelog: Thu Jul 3 16:15:23 CEST 2008 ----------------------------- * libclamav/petite.c: fix another out of bounds memory read (bb#1000) Reported by Secunia (CVE-2008-2713) Referring to the same bug as before, which is now restricted (was it publicly accessible before?). The announcement mentions it too, but without specifying any implications: http://lurker.clamav.net/message/20080707.155612.ad411b00.en.html The fix does not even seem to be committed in the public clamav SVN (either trunk or 0.93 branch). Does anyone have more info? From commit message, it looks like DoS, so probably worth new id for an incomplete fix. -- Tomas Hoger / Red Hat Security Response Team
Current thread:
- Re: CVE id request: Clamav Tomas Hoger (Jul 08)
- Re: CVE id request: Clamav Tomas Hoger (Jul 15)
- Re: CVE id request: Clamav Steven M. Christey (Jul 18)