oss-security - Further issue details about flaws corrected in upstream ClamAV 0.97.7 version

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1075211583.8128053.1363356499117.JavaMail.root@redhat.com>
Date: Fri, 15 Mar 2013 10:08:19 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Mateusz ‘j00ru’ Jurczyk <j00ru.vx@...il.com>,
        "Gynvael \"GynDream\" Coldwind" <gynvael@...dwind.pl>
Cc: oss-security@...ts.openwall.com
Subject: Further issue details about flaws corrected in upstream ClamAV
 0.97.7 version

Hello Mateusz, Gynvael, vendors,

  this is due the following ones:
  [1] https://bugs.mageia.org/show_bug.cgi?id=9399
  [2] http://blog.clamav.net/2013/03/clamav-0977-has-been-released.html
  [3] https://github.com/vrtadmin/clamav-devel/blob/0.97/ChangeLog

I have tried to grep CLamAV's git log for further information, but many
of the commits prior to 2013-02-20 have form of:

'Fix CID#...' :(.

The only two security related ones seem to be the following two:
commit b2212def1bb92b5ac45c82da100dc0d1376de6a3
Author: Steve Morgan <smorgan@...rcefire.com>
Date:   Thu Feb 14 18:29:53 2013 -0500

    cid 10776 - fix double free

commit 71990820d01c246e4e61408a3659dd9d92949b38
Author: Ryan Pentney <rpentney@...rcefire.com>
Date:   Fri Feb 15 03:10:50 2013 -0800

    Fixed heap corruption in wwunpack.c

We to be better able to tell, which concrete security flaws
got corrected in 0.97.7 version and based on that to properly
allocate CVE identifiers, could you please provide further
information about:
a) how many and what kind of issues got corrected in that
   version?,
b) links to relevant upstream patches? (since patch log telling
   CID# wouldn't be enough either to find out the appropriate
   commits).

Thank you for your time, look && cooperation in advance.

Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.