Debian Long Term Support / LTS Security Information / 2018 / Security Information -- DLA-1261-1 clamav

Debian Security Advisory

DLA-1261-1 clamav -- LTS security update

Date Reported:

28 Jan 2018

Affected Packages:

clamav

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 888484, Bug 824196.
In Mitre's CVE dictionary: CVE-2017-12374, CVE-2017-12375, CVE-2017-12376, CVE-2017-12377, CVE-2017-12378, CVE-2017-12379, CVE-2017-12380.

More information:

Multiple vulnerabilities have been discovered in clamav, the ClamAV AntiVirus toolkit for Unix. Effects range from denial of service to potential arbitrary code execution. Additionally, this version fixes a longstanding issue that has recently resurfaced whereby a malformed virus signature database can cause an application crash and denial of service.

• CVE-2017-12374

  ClamAV has a use-after-free condition arising from a lack of input validation. A remote attacker could exploit this vulnerability with a crafted email message to cause a denial of service.

• CVE-2017-12375

  ClamAV has a buffer overflow vulnerability arising from a lack of input validation. An unauthenticated remote attacker could send a crafted email message to the affected device, triggering a buffer overflow and potentially a denial of service when the malicious message is scanned.

• CVE-2017-12376

  ClamAV has a buffer overflow vulnerability arising from improper input validation when handling Portable Document Format (PDF) files. An unauthenticated remote attacker could send a crafted PDF file to the affected device, triggering a buffer overflow and potentially a denial of service or arbitrary code execution when the malicious file is scanned.

• CVE-2017-12377

  ClamAV has a heap overflow vulnerability arising from improper input validation when handling mew packets. An attacker could exploit this by sending a crafted message to the affected device, triggering a denial of service or possible arbitrary code execution when the malicious file is scanned.

• CVE-2017-12378

  ClamAV has a buffer overread vulnerability arising from improper input validation when handling tape archive (TAR) files. An unauthenticated remote attacker could send a crafted TAR file to the affected device, triggering a buffer overread and potentially a denial of service when the malicious file is scanned.

• CVE-2017-12379

  ClamAV has a buffer overflow vulnerability arising from improper input validation in the message parsing function. An unauthenticated remote attacker could send a crafted email message to the affected device, triggering a buffer overflow and potentially a denial of service or arbitrary code execution when the malicious message is scanned.

• CVE-2017-12380

  ClamAV has a NULL dereference vulnerability arising from improper input validation in the message parsing function. An unauthenticated remote attacker could send a crafted email message to the affected device, triggering a NULL pointer dereference, which may result in a denial of service.

• Debian Bug #824196

  A malformed virus signature database could cause an application crash and denial of service.

For Debian 7 Wheezy, these problems have been fixed in version 0.99.2+dfsg-0+deb7u4.

We recommend that you upgrade your clamav packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS