Summary
It was discovered that ClamAV incorrectly handled unpacking ZIP files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2019-12625)
It was discovered that ClamAV incorrectly handled unpacking bzip2 files. A
remote attacker could use this issue to cause ClamAV to crash, resulting in
a denial of service, or possibly execute arbitrary code. (CVE-2019-12900)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | clamav | 0.101.4+dfsg-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | clamav | 0.101.4+dfsg-0ubuntu0.18.04.1 |
Vulnerabilities 2
-
Critical 9.8
out-of-bounds write when there are many bzip2 selectors
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
-
High 7.5
ClamAV Zip Bomb Vulnerability
ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system.