File _patchinfo of Package patchinfo.17551

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.17551

<patchinfo incident="17551">
  <issue tracker="jsc" id="ECO-3010"/>
  <issue tracker="bnc" id="1118459">VUL-0: clamav: 0.101.1 release</issue>
  <issue tracker="bnc" id="1157763">VUL-0: CVE-2019-15961: clamav: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times</issue>
  <issue tracker="bnc" id="1149458">VUL-0: CVE-2019-12900: clamav: BZ2_decompress out-of-bounds write when there are many selectors</issue>
  <issue tracker="bnc" id="1171981">VUL-0: CVE-2020-3341: clamav: stack-based buffer overflow via a crafted PDF file</issue>
  <issue tracker="bnc" id="1174255">VUL-0: CVE-2020-3350: clamav:  potential symlink attack by replacing scan target's directory</issue>
  <issue tracker="bnc" id="1174250">VUL-1: CVE-2020-3481: clamav: improper error handling causing crash due to NULL pointer dereference</issue>
  <issue tracker="bnc" id="1119353">[SLES15SP2][SECURITY][FIPS] ClamAV : freshclam verification error about cannot allocate memory</issue>
  <issue tracker="bnc" id="1144504">VUL-0: CVE-2019-12625: clamav: ZIP bomb causes extreme CPU spikes</issue>
  <issue tracker="cve" id="2020-3341"/>
  <issue tracker="cve" id="2020-3327"/>
  <issue tracker="cve" id="2020-3350"/>
  <issue tracker="cve" id="2019-15961"/>
  <issue tracker="cve" id="2020-3481"/>
  <issue tracker="cve" id="2019-12900"/>
  <issue tracker="cve" id="2020-3123"/>
  <packager>rmax</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for clamav</summary>
  <description>This update for clamav fixes the following issues:

clamav was updated to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459.

* clamd can now reload the signature database without blocking
  scanning. This multi-threaded database reload improvement was made
  possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
* Fix clamav-milter.service (requires clamd.service to run)
* bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
* Partial sync with SLE15.

Update to version 0.102.4

Accumulated security fixes:

* CVE-2020-3350: Fix a vulnerability wherein a malicious user could
  replace a scan target's directory with a symlink to another path
  to trick clamscan, clamdscan, or clamonacc into removing or moving
  a different file (eg. a critical system file). The issue would
  affect users that use the --move or --remove options for clamscan,
  clamdscan, and clamonacc. (bsc#1174255)
* CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
  module in ClamAV 0.102.3 that could cause a Denial-of-Service
  (DoS) condition. Improper bounds checking results in an
  out-of-bounds read which could cause a crash. The previous fix for
  this CVE in 0.102.3 was incomplete. This fix correctly resolves
  the issue.
* CVE-2020-3481: Fix a vulnerability in the EGG archive module in
  ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
  condition. Improper error handling may result in a crash due to a
  NULL pointer dereference. This vulnerability is mitigated for
  those using the official ClamAV signature databases because the
  file type signatures in daily.cvd will not enable the EGG archive
  parser in versions affected by the vulnerability. (bsc#1174250)
* CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
  ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
  condition. Improper size checking of a buffer used to initialize AES
  decryption routines results in an out-of-bounds read which may cause
  a crash. (bsc#1171981)
* CVE-2020-3123: A denial-of-service (DoS) condition may occur when
  using the optional credit card data-loss-prevention (DLP) feature.
  Improper bounds checking of an unsigned variable resulted in an
  out-of-bounds read, which causes a crash.
* CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may
  occur when scanning a specially crafted email file as a result
  of excessively long scan times. The issue is resolved by
  implementing several maximums in parsing MIME messages and by
  optimizing use of memory allocation. (bsc#1157763).
* CVE-2019-12900: An out of bounds write in the NSIS bzip2
  (bsc#1149458)
* CVE-2019-12625: Introduce a configurable time limit to mitigate
  zip bomb vulnerability completely. Default is 2 minutes,
  configurable useing the clamscan --max-scantime and for clamd
  using the MaxScanTime config option (bsc#1144504)

Update to version 0.101.3:

* ZIP bomb causes extreme CPU spikes (bsc#1144504)

Update to version 0.101.2 (bsc#1118459):

* Support for RAR v5 archive extraction.
* Incompatible changes to the arguments of cl_scandesc,
  cl_scandesc_callback, and cl_scanmap_callback.
* Scanning options have been converted from a single flag
  bit-field into a structure of multiple categorized flag
  bit-fields.
* The CL_SCAN_HEURISTIC_ENCRYPTED scan option was replaced by
  2 new scan options: CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE, and
  CL_SCAN_HEURISTIC_ENCRYPTED_DOC
* Incompatible clamd.conf and command line interface changes.
* Heuristic Alerts" (aka "Algorithmic Detection") options have
  been changed to make the names more consistent. The original
  options are deprecated in 0.101, and will be removed in a
  future feature release.
* For details, see https://blog.clamav.net/2018/12/clamav-01010-has-been-released.html</description>
</patchinfo>

Places

File _patchinfo of Package patchinfo.17551

Places