View | Details | Raw Unified | Return to bug 240020
Collapse All | Expand All

(-)vuln.xml (+34 lines)
Lines 58-63 Link Here
58 
  * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 58 
  * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
59 
-->
 59 
-->
60 
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
 60 
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
61 
  <vuln vid="dbd1f627-c43b-11e9-a923-9c5c8e75236a">
62 
    <topic>clamav -- multiple vulnerabilities</topic>
63 
    <affects>
64 
      <package>
65 
	<name>clamav</name>
66 
	<range><lt>0.101.4,1</lt></range>
67 
      </package>
68 
      <package>
69 
	<name>clamav-milter</name>
70 
	<range><lt>0.101.4,1</lt></range>
71 
      </package>
72 
    </affects>
73 
    <description>
74 
      <body xmlns="http://www.w3.org/1999/xhtml">
75 
	<p>Micah Snyder reports:</p>
76 
	<blockquote cite="https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html">
77 
	  <ul>
78 
	    <li>An out of bounds write was possible within ClamAV&amp;s NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.</li>
79 
	    <li> The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.</li>
80 
	  </ul>
81 
	</blockquote>
82 
      </body>
83 
    </description>
84 
    <references>
85 
      <url>https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html</url>
86 
      <cvename>CVE-2019-12625</cvename>
87 
      <cvename>CVE-2019-12900</cvename>
88 
    </references>
89 
    <dates>
90 
      <discovery>2019-08-21</discovery>
91 
      <entry>2019-08-21</entry>
92 
    </dates>
93 
  </vuln>
94 

            

        

          61
          
  <vuln vid="56778a31-c2a1-11e9-9051-4c72b94353b5">

          95
          
  <vuln vid="56778a31-c2a1-11e9-9051-4c72b94353b5">

        

        

          62
          
    <topic>nsd -- Stack-based Buffer Overflow</topic>

          96
          
    <topic>nsd -- Stack-based Buffer Overflow</topic>

        

        

          63
          
    <affects>

          97
          
    <affects>

        






  

  Return to bug 240020