[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201312130309.rBD38wIA015706@linus.mitre.org>
Date: Thu, 12 Dec 2013 22:08:58 -0500 (EST)
From: cve-assign@...re.org
To: pinkbyte@...too.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: ClamAV vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://github.com/vrtadmin/clamav-devel/commit/71990820d01c246e4e61408a3659dd9d92949b38
> from https://github.com/vrtadmin/clamav-devel/commits/master/libclamav/wwunpack.c
>
> in which input validation was added. This commit did make it into
> 0.97.7 (and it's not in 0.97.6). It is also apparently discussed in
> https://bugzilla.clamav.net/show_bug.cgi?id=6806 Comment 2.
Use CVE-2013-7087.
> https://bugzilla.clamav.net/show_bug.cgi?id=6809 possible buffer overflow
> https://github.com/vrtadmin/clamav-devel/commit/e8e3746266dd3f82054ca137b81b800e54de6ebd
>
> For example, libclamav/yc.c in 0.97.7 has the max_emu variable that is
> apparently involved in preventing the overflow. libclamav/yc.c in 0.97.6
> does not have the max_emu variable at all.
Use CVE-2013-7088.
> https://bugzilla.clamav.net/show_bug.cgi?id=6804 dbg_printhex possible information leak
>
> We don't know the commit for this, but libclamav/pdf.c in 0.97.6 has
> 'dbg_printhex("md5", result, 32)' whereas libclamav/pdf.c in 0.97.7
> has 'dbg_printhex("md5", result, 16)' instead. We realize that the
> security impact might occur in very limited situations (e.g., the
> debug output is given to an untrusted person and the 16 extra bytes
> are somehow sensitive data). But the vendor describes it as "The
> vulnerability is merely debug-level printing" and the word
> "vulnerability" is enough for us in this context.
Use CVE-2013-7089.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJSqnnrAAoJEKllVAevmvmsty0H/16a7n4zs1ogQ2AL0dDDUf4f
ebW5FWnsQNa6hTKNYuO71eLbFfjAE/G+uVDGOc++nQ2Vv6gYbG61ufpeN2iaRibs
rkmdEW18vFTcWZQArx4WU5XBtZlA4A7ndugGi1cQPztZgaw8N7e9htLPH+Jc6ab2
GPcHnfILRS+enV0VOIOmQyfvuIGAYMDOrFjc90bT5Mz150U3rPZpAX0sAUi+DQQT
XwVcFbkzmBA9Gp/gwrQpmRLXO9aijMKuGN4l90G/4UpVG5ypxRafAxe4Nszug4ZQ
9RnzTaPKghVAtHzYK/zMAFxqPs2JWL03NqzyYZNBZpW+gsul/WNbSdKJUo8GSQw=
=bnPX
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
