[SECURITY] [DLA 1014-1] libclamunrar security update

2017-07-0521:30:58

lists.debian.org

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:N/A:P

0.005 Low

EPSS

Percentile

76.1%

JSON

Package : libclamunrar
Version : 0.99-0+deb7u2
CVE ID : CVE-2017-7520
Debian Bug : #867223

It was discovered that there was an arbitrary code execution vulnerability in
libcamunrar, a library to add unrar support to the Clam anti-virus software.

This was caused by an integer overflow resulting in a negative value of the
DestPos variable, which allows the attacker to write out of bounds when
setting Mem[DestPos].

For Debian 7 "Wheezy", this issue has been fixed in libclamunrar version
0.99-0+deb7u2.

We recommend that you upgrade your libclamunrar packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian9amd64openvpn< 2.4.0-6+deb9u1openvpn_2.4.0-6+deb9u1_amd64.deb
Debian9mipselopenvpn< 2.4.0-6+deb9u1openvpn_2.4.0-6+deb9u1_mipsel.deb
Debian8amd64openvpn< 2.3.4-5+deb8u2openvpn_2.3.4-5+deb8u2_amd64.deb
Debian7amd64libclamunrar7< 0.99-0+deb7u2libclamunrar7_0.99-0+deb7u2_amd64.deb
Debian8powerpcopenvpn< 2.3.4-5+deb8u2openvpn_2.3.4-5+deb8u2_powerpc.deb
Debian8s390xopenvpn< 2.3.4-5+deb8u2openvpn_2.3.4-5+deb8u2_s390x.deb
Debian8mipsopenvpn< 2.3.4-5+deb8u2openvpn_2.3.4-5+deb8u2_mips.deb
Debian7alllibclamunrar< 0.99-0+deb7u2libclamunrar_0.99-0+deb7u2_all.deb
Debian8ppc64elopenvpn< 2.3.4-5+deb8u2openvpn_2.3.4-5+deb8u2_ppc64el.deb
Debian9armhfopenvpn-dbgsym< 2.4.0-6+deb9u1openvpn-dbgsym_2.4.0-6+deb9u1_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	amd64	openvpn	< 2.4.0-6+deb9u1	openvpn_2.4.0-6+deb9u1_amd64.deb
Debian	9	mipsel	openvpn	< 2.4.0-6+deb9u1	openvpn_2.4.0-6+deb9u1_mipsel.deb
Debian	8	amd64	openvpn	< 2.3.4-5+deb8u2	openvpn_2.3.4-5+deb8u2_amd64.deb
Debian	7	amd64	libclamunrar7	< 0.99-0+deb7u2	libclamunrar7_0.99-0+deb7u2_amd64.deb
Debian	8	powerpc	openvpn	< 2.3.4-5+deb8u2	openvpn_2.3.4-5+deb8u2_powerpc.deb
Debian	8	s390x	openvpn	< 2.3.4-5+deb8u2	openvpn_2.3.4-5+deb8u2_s390x.deb
Debian	8	mips	openvpn	< 2.3.4-5+deb8u2	openvpn_2.3.4-5+deb8u2_mips.deb
Debian	7	all	libclamunrar	< 0.99-0+deb7u2	libclamunrar_0.99-0+deb7u2_all.deb
Debian	8	ppc64el	openvpn	< 2.3.4-5+deb8u2	openvpn_2.3.4-5+deb8u2_ppc64el.deb
Debian	9	armhf	openvpn-dbgsym	< 2.4.0-6+deb9u1	openvpn-dbgsym_2.4.0-6+deb9u1_armhf.deb