Attachment 214467 Details for Bug 246451 – Patch file

[patch] Patch file

security_vuxml.patch (text/plain), 1.97 KB, created by Yasuhiro Kimura on 2020-05-13 23:08:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Yasuhiro Kimura

Created: 2020-05-13 23:08:32 UTC

Size: 1.97 KB

patch

obsolete

>Index: security/vuxml/vuln.xml
>===================================================================
>--- security/vuxml/vuln.xml	(revision 535073)
>+++ security/vuxml/vuln.xml	(working copy)
>@@ -58,6 +58,44 @@
> * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="91ce95d5-cd15-4105-b942-af5ccc7144c1">
>+ <topic>clamav -- multiple vulnerabilities</topic>
>+ <affects>
>+ <package>
>+	<name>clamav</name>
>+	<range><lt>0.102.3,1</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	Micah Snyder reports:
>+	<blockquote cite="https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html">
>+	 CVE-2020-3327: Fixed a vulnerability in the ARJ archive-parsing module
>+	 in ClamAV 0.102.2 that could cause a denial-of-service condition.
>+	 Improper bounds checking of an unsigned variable results in an
>+	 out-of-bounds read which causes a crash. Special thanks to Daehui Chang
>+	 and Fady Othman for helping identify the ARJ parsing vulnerability.
>+	 
>+	 CVE-2020-3341: Fixed a vulnerability in the PDF-parsing module in ClamAV
>+	 0.101 - 0.102.2 that could cause a denial-of-service condition. Improper
>+	 size checking of a buffer used to initialize AES decryption routines
>+	 results in an out-of-bounds read, which may cause a crash. OSS-Fuzz
>+	 discovered this vulnerability.
>+	 
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <url>https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html</url>
>+ <cvename>CVE-2020-3327</cvename>
>+ <cvename>CVE-2020-3341</cvename>
>+ </references>
>+ <dates>
>+ <discovery>2020-05-12</discovery>
>+ <entry>2020-05-14</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="0bfcae0b-947f-11ea-92ab-00163e433440">
> <topic>FreeBSD -- Insufficient cryptodev MAC key length check</topic>
> <affects>

Actions: View | Diff

Attachments on bug 246451: 214467