[SECURITY] [DLA 2626-1] clamav security update

2021-04-1409:01:57

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

72.9%

JSON

Debian LTS Advisory DLA-2626-1 [email protected]
https://www.debian.org/lts/security/ Utkarsh Gupta
April 14, 2021 https://wiki.debian.org/LTS

Package : clamav
Version : 0.102.4+dfsg-0+deb9u2
CVE ID : CVE-2021-1405
Debian Bug : 986622 986790

A vulnerability in the email parsing module in Clam AntiVirus
(ClamAV) Software version 0.103.1 and all prior versions could
allow an unauthenticated, remote attacker to cause a denial of
service condition on an affected device. The vulnerability is
due to improper variable initialization that may result in an
NULL pointer read. An attacker could exploit this vulnerability
by sending a crafted email to an affected device. An exploit
could allow the attacker to cause the ClamAV scanning process
crash, resulting in a denial of service condition.

For Debian 9 stretch, this problem has been fixed in version
0.102.4+dfsg-0+deb9u2.

We recommend that you upgrade your clamav packages.

For the detailed security status of clamav please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/clamav

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10s390xclamav-milter< 0.103.2+dfsg-0+deb10u1clamav-milter_0.103.2+dfsg-0+deb10u1_s390x.deb
Debian10mips64elclamav-milter-dbgsym< 0.103.2+dfsg-0+deb10u1clamav-milter-dbgsym_0.103.2+dfsg-0+deb10u1_mips64el.deb
Debian10armelclamav-daemon< 0.103.2+dfsg-0+deb10u1clamav-daemon_0.103.2+dfsg-0+deb10u1_armel.deb
Debian10mipsclamdscan-dbgsym< 0.103.2+dfsg-0+deb10u1clamdscan-dbgsym_0.103.2+dfsg-0+deb10u1_mips.deb
Debian9allclamav-base< 0.102.4+dfsg-0+deb9u2clamav-base_0.102.4+dfsg-0+deb9u2_all.deb
Debian10i386libclamav-dev< 0.103.2+dfsg-0+deb10u1libclamav-dev_0.103.2+dfsg-0+deb10u1_i386.deb
Debian10ppc64elclamav-dbgsym< 0.103.2+dfsg-0+deb10u1clamav-dbgsym_0.103.2+dfsg-0+deb10u1_ppc64el.deb
Debian9armelclamav< 0.102.4+dfsg-0+deb9u2clamav_0.102.4+dfsg-0+deb9u2_armel.deb
Debian9armhfclamdscan< 0.102.4+dfsg-0+deb9u2clamdscan_0.102.4+dfsg-0+deb9u2_armhf.deb
Debian10arm64clamdscan-dbgsym< 0.103.2+dfsg-0+deb10u1clamdscan-dbgsym_0.103.2+dfsg-0+deb10u1_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	s390x	clamav-milter	< 0.103.2+dfsg-0+deb10u1	clamav-milter_0.103.2+dfsg-0+deb10u1_s390x.deb
Debian	10	mips64el	clamav-milter-dbgsym	< 0.103.2+dfsg-0+deb10u1	clamav-milter-dbgsym_0.103.2+dfsg-0+deb10u1_mips64el.deb
Debian	10	armel	clamav-daemon	< 0.103.2+dfsg-0+deb10u1	clamav-daemon_0.103.2+dfsg-0+deb10u1_armel.deb
Debian	10	mips	clamdscan-dbgsym	< 0.103.2+dfsg-0+deb10u1	clamdscan-dbgsym_0.103.2+dfsg-0+deb10u1_mips.deb
Debian	9	all	clamav-base	< 0.102.4+dfsg-0+deb9u2	clamav-base_0.102.4+dfsg-0+deb9u2_all.deb
Debian	10	i386	libclamav-dev	< 0.103.2+dfsg-0+deb10u1	libclamav-dev_0.103.2+dfsg-0+deb10u1_i386.deb
Debian	10	ppc64el	clamav-dbgsym	< 0.103.2+dfsg-0+deb10u1	clamav-dbgsym_0.103.2+dfsg-0+deb10u1_ppc64el.deb
Debian	9	armel	clamav	< 0.102.4+dfsg-0+deb9u2	clamav_0.102.4+dfsg-0+deb9u2_armel.deb
Debian	9	armhf	clamdscan	< 0.102.4+dfsg-0+deb9u2	clamdscan_0.102.4+dfsg-0+deb9u2_armhf.deb
Debian	10	arm64	clamdscan-dbgsym	< 0.103.2+dfsg-0+deb10u1	clamdscan-dbgsym_0.103.2+dfsg-0+deb10u1_arm64.deb