[SECURITY] [DSA 1680-1] New clamav packages fix potential code execution

------------------------------------------------------------------------ Debian Security Advisory DSA-1680-1 [email protected] http://www.debian.org/security/ Florian Weimer December 04, 2008 http://www.debian.org/security/faq -...

Debian DSA-1680-1 : clamav - buffer overflow, stack consumption

Moritz Jodeit discovered that ClamAV, an anti-virus solution, suffers from an off-by-one-error in its VBA project file processing, leading to a heap-based buffer overflow and potentially arbitrary code execution CVE-2008-5050 . Ilja van Sprundel discovered that ClamAV contains a denial of service...

Design/Logic Flaw

Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service daemon crash via a crafted JPEG file, related to the clicheckjpegexploit, jpegcheckphotoshop, and jpegcheckphotoshop8bim functions...

CVE-2008-5314

Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service daemon crash via a crafted JPEG file, related to the clicheckjpegexploit, jpegcheckphotoshop, and jpegcheckphotoshop8bim functions...

CVE-2008-5314

Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service daemon crash via a crafted JPEG file, related to the clicheckjpegexploit, jpegcheckphotoshop, and jpegcheckphotoshop8bim functions...

CVE-2008-5314

Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service daemon crash via a crafted JPEG file, related to the clicheckjpegexploit, jpegcheckphotoshop, and jpegcheckphotoshop8bim functions...

CVE-2008-5314: Undefined Security Weakness

Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service daemon crash via a crafted JPEG file, related to the clicheckjpegexploit, jpegcheckphotoshop, and jpegcheckphotoshop8bim functions...

CVE-2008-4482

The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service stack consumption and crash via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file...

Code injection

Multiple unspecified vulnerabilities in ReSIProcate before 1.3.4 allow remote attackers to cause a denial of service stack consumption via unknown network traffic with a large "bytes-in-memory/bytes-on-wire ratio."...

CVE-2008-3199

Multiple unspecified vulnerabilities in ReSIProcate before 1.3.4 allow remote attackers to cause a denial of service stack consumption via unknown network traffic with a large "bytes-in-memory/bytes-on-wire ratio."...

CVE-2008-3199

CVE-2008-3199 concerns multiple unspecified vulnerabilities in ReSIProcate prior to 1.3.4 that allow remote attackers to cause a denial of service (stack consumption) through unknown network traffic characterized by a large bytes-in-memory/bytes-on-wire ratio. The affected product is ReSIProcate;...

CVE-2008-3199: Improper Input Validation

Multiple unspecified vulnerabilities in ReSIProcate before 1.3.4 allow remote attackers to cause a denial of service stack consumption via unknown network traffic with a large "bytes-in-memory/bytes-on-wire ratio."...

CVE-2008-1689

Stack consumption vulnerability in WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service daemon crash via a long request header in an HTTP request to TCP port 801. NOTE: some of these details are obtained from third party...

CVE-2008-1689

CVE-2008-1689 is a stack consumption vulnerability affecting WebContainer.exe up to version 1.0.0.336 and SLMail Pro up to 6.3.1.0. A remote attacker can cause a denial of service (daemon crash) by sending a long request header in an HTTP request to TCP port 801. The provided documents identify t...

CVE-2008-1689: Undefined Security Weakness

Stack consumption vulnerability in WebContainer.exe 1.0.0.336 and earlier in SLMail Pro 6.3.1.0 and earlier allows remote attackers to cause a denial of service daemon crash via a long request header in an HTTP request to TCP port 801. NOTE: some of these details are obtained from third party...

Stack overflow

Stack consumption vulnerability in Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service daemon crash via a certain packet that triggers the recursive calling of a function...

CVE-2008-0979

Stack consumption vulnerability in Double-Take 5.0.0.2865 and earlier, distributed under the HP StorageWorks Storage Mirroring name and other names, allows remote attackers to cause a denial of service daemon crash via a certain packet that triggers the recursive calling of a function...

CVE-2008-0979

CVE-2008-0979 concerns a stack consumption vulnerability in Double-Take 5.0.0.2865 and earlier (also under HP StorageWorks Storage Mirroring and other names). The issue allows a remote attacker to cause a denial of service (daemon crash) by sending a certain packet that triggers recursive calling...

Heap overflow

Stack consumption vulnerability in AkkyWareHOUSE 7-zip32.dll before 4.42.00.04, as derived from Igor Pavlov 7-Zip before 4.53 beta, allows user-assisted remote attackers to execute arbitrary code via a long filename in an archive, leading to a heap-based buffer overflow...

CVE-2007-4725

The CVE-2007-4725 issue affects 7-ZIP32.DLL, a compression/decompression library used by AkkyWareHOUSE’s 7-zip32.dll. The vulnerability is a heap-based buffer overflow triggered by a long filename inside a specially crafted archive, allowing a remote attacker to potentially execute arbitrary code...