Attachment 216497 Details for Bug 248027 – Patch file

[patch] Patch file

security_vuxml.patch (text/plain), 2.62 KB, created by Yasuhiro Kimura on 2020-07-16 19:50:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Yasuhiro Kimura

Created: 2020-07-16 19:50:13 UTC

Size: 2.62 KB

patch

obsolete

>Index: security/vuxml/vuln.xml
>===================================================================
>--- security/vuxml/vuln.xml	(revision 542330)
>+++ security/vuxml/vuln.xml	(working copy)
>@@ -58,6 +58,62 @@
>   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+  <vuln vid="f7a02651-c798-11ea-81d6-6805cabe6ebb">
>+    <topic>clamav -- multiple vulnerabilities</topic>
>+    <affects>
>+      <package>
>+	<name>clamav</name>
>+	<range><lt>0.102.4,1</lt></range>
>+      </package>
>+    </affects>
>+    <description>
>+      <body xmlns="http://www.w3.org/1999/xhtml">
>+	<p>Micah Snyder reports:</p>
>+	<blockquote cite="https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html">
>+	  <dl>
>+	    <dt>CVE-2020-3350</dt>
>+	    <dd>
>+	      Fixed a vulnerability a malicious user could exploit to replace
>+	      a scan target's directory with a symlink to another path to trick
>+	      clamscan, clamdscan, or clamonacc into removing or moving a different
>+	      file (such as a critical system file). The issue would affect users
>+	      that use the --move or --remove options for clamscan, clamdscan and
>+	      clamonacc.
>+	    </dd>
>+	    <dt>CVE-2020-3327</dt>
>+	    <dd>
>+	      Fixed a vulnerability in the ARJ archive-parsing module in ClamAV
>+	      0.102.3 that could cause a denial-of-service (DoS) condition.
>+	      Improper bounds checking resulted in an out-of-bounds read that could
>+	      cause a crash. The previous fix for this CVE in version 0.102.3 was
>+	      incomplete. This fix correctly resolves the issue.
>+	    </dd>
>+	    <dt>CVE-2020-3481</dt>
>+	    <dd>
>+	      Fixed a vulnerability in the EGG archive module in ClamAV 0.102.0
>+	      - 0.102.3 that could cause a denial-of-service (DoS) condition.
>+	      Improper error handling could cause a crash due to a NULL pointer
>+	      dereference. This vulnerability is mitigated for those using the
>+	      official ClamAV signature databases because the file type signatures
>+	      in daily.cvd will not enable the EGG archive parser in affected
>+	      versions.
>+	    </dd>
>+	  </dl>
>+	</blockquote>
>+      </body>
>+    </description>
>+    <references>
>+      <url>https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html</url>
>+      <cvename>CVE-2020-3350</cvename>
>+      <cvename>CVE-2020-3327</cvename>
>+      <cvename>CVE-2020-3481</cvename>
>+    </references>
>+    <dates>
>+      <discovery>2020-07-16</discovery>
>+      <entry>2020-07-16</entry>
>+    </dates>
>+  </vuln>
>+
>   <vuln vid="870d59b0-c6c4-11ea-8015-e09467587c17">
>     <topic>chromium -- multiple vulnerabilities</topic>
>     <affects>

Actions: View | Diff

Attachments on bug 248027: 216497