[SECURITY] [DLA 1759-1] clamav security update

2019-04-2211:32:55

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

41.6%

JSON

Package : clamav
Version : 0.100.3+dfsg-0+deb8u1
CVE ID : CVE-2019-1787 CVE-2019-1788 CVE-2019-1789
Debian Bug :

Out-of-bounds read and write conditions have been fixed in clamav.

CVE-2019-1787

An out-of-bounds heap read condition may occur when scanning PDF
documents. The defect is a failure to correctly keep track of the number
of bytes remaining in a buffer when indexing file data.

CVE-2019-1788

An out-of-bounds heap write condition may occur when scanning OLE2 files
such as Microsoft Office 97-2003 documents. The invalid write happens when
an invalid pointer is mistakenly used to initialize a 32bit integer to
zero. This is likely to crash the application.

CVE-2019-1789

An out-of-bounds heap read condition may occur when scanning PE files
(i.e. Windows EXE and DLL files) that have been packed using Aspack as a
result of inadequate bound-checking.

For Debian 8 "Jessie", these problems have been fixed in version
0.100.3+dfsg-0+deb8u1.

We recommend that you upgrade your clamav packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian9amd64libclamav7< 0.100.3+dfsg-0+deb9u1libclamav7_0.100.3+dfsg-0+deb9u1_amd64.deb
Debian9armhfclamdscan-dbgsym< 0.100.3+dfsg-0+deb9u1clamdscan-dbgsym_0.100.3+dfsg-0+deb9u1_armhf.deb
Debian9mips64elclamav-milter< 0.100.3+dfsg-0+deb9u1clamav-milter_0.100.3+dfsg-0+deb9u1_mips64el.deb
Debian8i386clamav-dbg< 0.100.3+dfsg-0+deb8u1clamav-dbg_0.100.3+dfsg-0+deb8u1_i386.deb
Debian9arm64clamav-dbgsym< 0.100.3+dfsg-0+deb9u1clamav-dbgsym_0.100.3+dfsg-0+deb9u1_arm64.deb
Debian9arm64clamav< 0.100.3+dfsg-0+deb9u1clamav_0.100.3+dfsg-0+deb9u1_arm64.deb
Debian9i386libclamav7-dbgsym< 0.100.3+dfsg-0+deb9u1libclamav7-dbgsym_0.100.3+dfsg-0+deb9u1_i386.deb
Debian9armelclamav-milter-dbgsym< 0.100.3+dfsg-0+deb9u1clamav-milter-dbgsym_0.100.3+dfsg-0+deb9u1_armel.deb
Debian8amd64clamdscan< 0.100.3+dfsg-0+deb8u1clamdscan_0.100.3+dfsg-0+deb8u1_amd64.deb
Debian9ppc64ellibclamav7-dbgsym< 0.100.3+dfsg-0+deb9u1libclamav7-dbgsym_0.100.3+dfsg-0+deb9u1_ppc64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	amd64	libclamav7	< 0.100.3+dfsg-0+deb9u1	libclamav7_0.100.3+dfsg-0+deb9u1_amd64.deb
Debian	9	armhf	clamdscan-dbgsym	< 0.100.3+dfsg-0+deb9u1	clamdscan-dbgsym_0.100.3+dfsg-0+deb9u1_armhf.deb
Debian	9	mips64el	clamav-milter	< 0.100.3+dfsg-0+deb9u1	clamav-milter_0.100.3+dfsg-0+deb9u1_mips64el.deb
Debian	8	i386	clamav-dbg	< 0.100.3+dfsg-0+deb8u1	clamav-dbg_0.100.3+dfsg-0+deb8u1_i386.deb
Debian	9	arm64	clamav-dbgsym	< 0.100.3+dfsg-0+deb9u1	clamav-dbgsym_0.100.3+dfsg-0+deb9u1_arm64.deb
Debian	9	arm64	clamav	< 0.100.3+dfsg-0+deb9u1	clamav_0.100.3+dfsg-0+deb9u1_arm64.deb
Debian	9	i386	libclamav7-dbgsym	< 0.100.3+dfsg-0+deb9u1	libclamav7-dbgsym_0.100.3+dfsg-0+deb9u1_i386.deb
Debian	9	armel	clamav-milter-dbgsym	< 0.100.3+dfsg-0+deb9u1	clamav-milter-dbgsym_0.100.3+dfsg-0+deb9u1_armel.deb
Debian	8	amd64	clamdscan	< 0.100.3+dfsg-0+deb8u1	clamdscan_0.100.3+dfsg-0+deb8u1_amd64.deb
Debian	9	ppc64el	libclamav7-dbgsym	< 0.100.3+dfsg-0+deb9u1	libclamav7-dbgsym_0.100.3+dfsg-0+deb9u1_ppc64el.deb