Date: Wed, 24 Apr 2013 07:59:04 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Felix Groebert <groebert@...gle.com>
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
Subject: Multiple potential security issues fixed in ClamAV 0.97.8 - any
this is due the ClamAV 0.97.8 release:
Could you clarify how many and what kind of possible security issues
has been corrected within this release? (so we would know how many
CVE identifiers should be allocated to these)
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team
Steps to Reproduce:
This update is now in mga2/updates/testing
it fixes (from upstream)
âClamAV 0.97.8 addresses several reported potential security bugs. Thanks to
Felix Groebert of the Google Security Team for finding and reporting these issues.â
(The upgrade request has also been submitted to Cauldron)
Fixed in Cauldron in clamav-0.97.8-1.mga3. Thanks Thomas.
Tested i586 in VM using clamtk - no regressions noticed after update.
Tested x86_64 on real hw using clamtk - no regressions noticed after update.
See comment 2 for advisory.
Could sysadmin please push from core/updates_testing to core/updates.
heap corruption, potentially exploitable.
overflow due to PDF key length computation. Potentially exploitable.
NULL pointer dereference in sis parsing.
Here's Mandriva's advisory with the CVE and upstream bug references:
Original bug URL: