Bugzilla – Bug 816865
VUL-0: CVE-2013-2020 CVE-2013-2021: clamav 0.97.8 fixes security issues
Last modified: 2017-12-03 09:03:51 UTC
A new clamav seems to be available: http://freecode.com/projects/clamav/releases/354139
As per upstream these are the commits: commit 270e368b99e93aa5447d46c797c92c3f9f39f375 commit 24ff855c82d3f5c62bc5788a5776cefbffce2971 commit c6870a6c857dd722dffaf6d37ae52ec259d12492 commit 3cbd8b5668bd0f262a8c00b1fd57eb03c117b00a
bugbot adjusting priority
Via OSS-sec: From: Felix Gröbert Date: Sat, 27 Apr 2013 Hi, sorry for the delayed response, I'm OOO. The bugs should be public now: https://bugzilla.clamav.net/show_bug.cgi?id=7055 heap corruption, potentially exploitable. https://bugzilla.clamav.net/show_bug.cgi?id=7053 overflow due to PDF key length computation. Potentially exploitable. https://bugzilla.clamav.net/show_bug.cgi?id=7054 NULL pointer dereference in sis parsing. When building clamav I recommend disabling legacy or unneeded features (e.g. sis). I guess that's common sense though. Cheers Felix
This is an autogenerated message for OBS integration: This bug (816865) was mentioned in https://build.opensuse.org/request/show/173707 Factory / clamav
Vis OSS-sec: > https://bugzilla.clamav.net/show_bug.cgi?id=7055 heap corruption, > potentially exploitable. Please use CVE-2013-2020 for this issue. > https://bugzilla.clamav.net/show_bug.cgi?id=7053 overflow due to > PDF key length computation. Potentially exploitable. Please use CVE-2013-2021 for this issue. [Fixed; was accidantly given same CVE as above before]
This is an autogenerated message for OBS integration: This bug (816865) was mentioned in https://build.opensuse.org/request/show/173882 Factory / clamav
Package submitted to 12.1, 12.2, 12.3, SLE9-SP3, SLE10-SP3, and SLE11.
This is an autogenerated message for OBS integration: This bug (816865) was mentioned in https://build.opensuse.org/request/show/174453 Maintenance /
This is an autogenerated message for OBS integration: This bug (816865) was mentioned in https://build.opensuse.org/request/show/175830 Maintenance /
This is an autogenerated message for OBS integration: This bug (816865) was mentioned in https://build.opensuse.org/request/show/176113 Evergreen:11.2 / clamav
openSUSE-SU-2013:0813-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 816865 CVE References: CVE-2013-2020,CVE-2013-2021 Sources used: openSUSE 12.1 (src): clamav-0.97.8-15.1
openSUSE-SU-2013:0813-2: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 816865 CVE References: CVE-2013-2020,CVE-2013-2021 Sources used: openSUSE 12.2 (src): clamav-0.97.8-1.12.1
This is an autogenerated message for OBS integration: This bug (816865) was mentioned in https://build.opensuse.org/request/show/176285 Evergreen:11.2 / clamav
Reinhard, we did not see your submission for SLES... and i do not see any requests. do you have the submit ids? can you resubmit?
The SWAMPID for this issue is 52771. This issue was rated as moderate. Please submit fixed packages until 2013-06-17. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
openSUSE-SU-2013:0881-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 816865 CVE References: CVE-2013-2020,CVE-2013-2021 Sources used: openSUSE 12.3 (src): clamav-0.97.8-5.8.1
openSUSE-SU-2013:0883-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 816865 CVE References: CVE-2013-2020,CVE-2013-2021 Sources used: openSUSE 11.4 (src): clamav-0.97.8-21.1
Whoops, forgot to reassign, but I guess this can be closed by now.
released all but sles11 sp3
Update released for: clamav, clamav-db, clamav-debuginfo, clamav-debugsource Products: SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP2 (i386, x86_64) SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64)
Update released for: clamav, clamav-db Products: SUSE-CORE 9-SP3-TERADATA (x86_64)
Update released for: clamav, clamav-db, clamav-debuginfo Products: SLE-SERVER 10-SP3-TERADATA (x86_64)
Update released for: clamav, clamav-db, clamav-debuginfo Products: SLE-DESKTOP 10-SP4 (i386, x86_64) SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64) SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Update released for: clamav, clamav-db, clamav-debuginfo, clamav-debugsource Products: SLE-SERVER 11-SP1-TERADATA (x86_64)
Update released for: clamav, clamav-db, clamav-debuginfo, clamav-debugsource Products: SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP3 (i386, x86_64) SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP3 (i386, x86_64)
This is an autogenerated message for OBS integration: This bug (816865) was mentioned in https://build.opensuse.org/request/show/547654 15.0 / clamav