Updated clamav packages fix security vulnerabilities

ClamAV 0.98.6 is a maintenance release to fix some bugs, some of them being security bugs: Fix a heap out of bounds condition with crafted Yoda's crypter files. This issue was discovered by Felix Groebert of the Google Security Team. Fix a heap out of bounds condition with crafted mew packer file...

Mandriva Linux Security Advisory : binutils (MDVSA-2015:029-1)

Multiple vulnerabilities has been found and corrected in binutils : Multiple integer overflows in the 1 objallocalloc function in objalloc.c and 2 objallocalloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service crash via...

CVE-2014-9328

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition."...

CVE-2015-1461

ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted 1 Yoda's crypter or 2 mew packer file, related to a "heap out of bounds condition."...

Fedora 21 : clamav-0.98.6-1.fc21 (2015-1461)

ClamAV 0.98.6 ============= ClamAV 0.98.6 is a bug fix release correcting the following : - library shared object revisions. - installation issues on some Mac OS X and FreeBSD platforms. - includes a patch from Sebastian Andrzej Siewior making ClamAV pid files compatible with systemd. - Fix a hea...

php: heap corruption issue in exif_thumbnail()

A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exifthumbnail function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application...

Dwarfdump Memory Misreference Denial of Service Vulnerability

Dwarfdump is free tool to easily detect apps and corresponding dSYM. Dwarfdump suffers from a memory misreference denial-of-service vulnerability that allows an attacker to construct malicious files that can be tricked into parsing the application, crashing it...

CVE-2011-3623

Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via 1 a crafted ASF file, related to the ASFObjectDumpDebug function in modules/demux/asf/libasf.c; 2 a crafted AVI file, related to the AVIChunkDumpDebuglevel function...

jasper: heap overflow in jp2_decode() (oCERT-2014-012)

A heap-based buffer overflow flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code...

UBUNTU-CVE-2014-8962

Stack-based buffer overflow in streamdecoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file...

binutils: multiple issues

CVE-2014-8484 invalid read Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 out-of-bounds write Lack of range checking leading to controlled write in bfdelfsetupsections which results in denial of service or possible code...

MS14-069: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3009710)

The remote Windows host has a version of Microsoft Office, Office Compatibility Pack, or Microsoft Word Viewer that is affected by one or more vulnerabilities : - A double delete remote code execution vulnerability due to Microsoft Word not properly handling objects in memory while parsing...

Adobe Flash Player Use After Free Code Execution (APSB14-21: CVE-2014-0553; CVE-2017-2992)

A remote code execution vulnerability has been reported in Adobe Flash Player. The vulnerability is due to a use-after-free error while loading specially crafted files. A remote attacker can exploit this issue by enticing the victim to open a specially crafted file...

DEBIAN-CVE-2014-3710

The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted ELF file...

file: cdf_unpack_summary_info() excessive looping DoS

A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

file: cdf_read_property_info insufficient boundary check

A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

PHP Fileinfo cdf_read_property_info Denial of Service (CVE-2014-3587)

A denial of service vulnerability exists in PHP. It is due to an integer overflow error in the FileInfo module while processing CDF files. A remote attacker can exploit the vulnerability by sending crafted CDF files to a web application running a vulnerable version of PHP...

wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)

The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service application crash via a crafted file...

file: out of bounds read in CDF parser

A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...

file: cdf_check_stream_offset insufficient boundary check

A denial of service flaw was found in the way the File Information fileinfo extension parsed certain Composite Document Format CDF files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file...