oss-sec mailing list archives
clamav CVE ids?
From: Marcus Meissner <meissner () suse de>
Date: Wed, 17 Jun 2009 17:22:28 +0200
Hi, Clamav 0.95.2 brings some fixes for Thierry Zollers issues, which probably deserve (a) CVE id ... Are there already some assigned? --- from our bug: ( https://sourceforge.net/project/shownotes.php?release_id=688880&group_id=86638 ) These messages from the ChangeLog could have some security relevance, but I haven't yet checked the mentioned bug reports: * libclamav: detect and handle archives hidden inside other files (eg. images), which can be unpacked by WinZip, WinRAR and other tools (bb#1554) Reported by ROGER Mickael and Thierry Zoller * libclamav/mspack.c, cab.c: don't rely on file sizes stored in CAB headers (bb#1562) Reported by Thierry*Zoller <Thierry*Zoller.lu> * libclamunrar/unrarvm.c: fix handling of some broken rar files * libclamav/mbox.c: handle malformed emails with embedded \0s (bb #1573) * libclamav/readdb.c: add offset checks (bb#1615) --- And also: http://blog.zoller.lu/2009/05/advisory-clamav-generic-bypass.html http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html http://www.heise.de/newsticker/Update-fuer-freien-Virenscanner-ClamAV-beseitigt-Sehschwaeche--/meldung/140595 Ciao, Marcus
Current thread:
- clamav CVE ids? Marcus Meissner (Jun 17)
- Re: clamav CVE ids? Tavis Ormandy (Jun 17)
- Re: clamav CVE ids? Hanno Böck (Jun 17)
- Re: clamav CVE ids? Tavis Ormandy (Jun 17)