ClamAV® blog: ClamAV 0.10 2.3 security patch released
"Joel Esler (jesler)" <[email protected]> Tue, 12 May 2020 15:28:40 +0000
| Newsgroups | gmane.comp.security.virus.clamav.announce,gmane.comp.security.virus.clamav.devel,gmane.comp.security.virus.clamav.win32 |
|---|---|
| Message-ID | <[email protected]> |
--===============8057524788857429567==
Content-Language: en-US
Content-Type: multipart/signed;
boundary="Apple-Mail=_7B0EB15A-8F11-4C76-9A6F-550DAF6C40E8";
protocol="application/pkcs7-signature";
micalg=sha-256
--Apple-Mail=_7B0EB15A-8F11-4C76-9A6F-550DAF6C40E8
Content-Type: multipart/alternative;
boundary="Apple-Mail=_885726DE-37E0-4C68-AB3E-4954DF9E7743"
--Apple-Mail=_885726DE-37E0-4C68-AB3E-4954DF9E7743
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=us-ascii
> =
https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html =
<https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html=
>
>=20
> ClamAV 0.102.3 security patch released
>=20
> Today, we're publishing 0.102.3. Navigate to ClamAV's downloads page =
<http://www.clamav.net/downloads> to download the release materials.
>=20
> ClamAV 0.102.3
>=20
>=20
> ClamAV 0.102.3 is a bug patch release to address the following issues.
>=20
> - CVE-2020-3327 =
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3327>: Fix a =
vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that =
could cause a Denial-of-Service (DoS) condition. Improper bounds =
checking of an unsigned variable results in an out-of-bounds read which =
causes a crash.
>=20
> Special thanks to Daehui Chang and Fady Othman for helping identify =
the ARJ parsing vulnerability.
>=20
> - CVE-2020-3341 =
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2020-3341>: Fix a =
vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that =
could cause a Denial-of-Service (DoS) condition. Improper size checking =
of a buffer used to initialize AES decryption routines results in an =
out-of-bounds read which may cause a crash. Bug found by OSS-Fuzz.
>=20
> - Fix "Attempt to allocate 0 bytes" error when parsing some PDF =
documents.
>=20
> - Fix a couple of minor memory leaks.
>=20
> - Updated libclamunrar to UnRAR 5.9.2.
>=20
> Please join us on the ClamAV mailing lists =
<https://www.clamav.net/contact#ml>, on irc.freenode.net in #clamav, or =
on Discord <https://discord.gg/sGaxA5Q> for further discussion. Thanks! =20=
--Apple-Mail=_885726DE-37E0-4C68-AB3E-4954DF9E7743
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset=us-ascii
<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><base></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><base class=""><div class="Apple-Mail-URLShareUserContentTopClass"><br class=""></div><div class="Apple-Mail-URLShareWrapperClass"><blockquote type="cite" style="border-left-style: none; color: inherit; padding: inherit; margin: inherit;" class=""><div class=""><div class="original-url"><a href="https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html" class="">https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html</a><br class=""><br class=""></div><div id="article" role="article" style="text-rendering: optimizeLegibility; font-family: -apple-system-font; fon
t-size: 1.2em; line-height: 1.5em; margin: 0px; padding: 0px;" class="system exported">
<!-- This node will contain a number of div.page. -->
<div class="page" style="word-wrap: break-word; max-width: 100%;"><h1 class="title" style="font-size: 1.95552em; line-height: 1.2141em; margin-top: 0px; margin-bottom: 0.5em; max-width: 100%;">ClamAV 0.102.3 security patch released</h1>
Today, we're publishing 0.102.3. Navigate to ClamAV's <a href="http://www.clamav.net/downloads" rel="nofollow" target="_blank" style="color: rgb(73, 129, 254); max-width: 100%;" class="">downloads page</a> to download the release materials.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
<h3 style="font-size: 1.25em; max-width: 100%;" class="">
ClamAV 0.102.3</h3>
<br style="max-width: 100%;" class="">
ClamAV 0.102.3 is a bug patch release to address the following issues.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
- <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3327" rel="nofollow" target="_blank" style="color: rgb(73, 129, 254); max-width: 100%;" class="">CVE-2020-3327</a>: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
Special thanks to Daehui Chang and Fady Othman for helping identify the ARJ parsing vulnerability.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
- <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3341" rel="nofollow" target="_blank" style="color: rgb(73, 129, 254); max-width: 100%;" class="">CVE-2020-3341</a>: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. Bug found by OSS-Fuzz.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
- Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
- Fix a couple of minor memory leaks.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
- Updated libclamunrar to UnRAR 5.9.2.<br style="max-width: 100%;" class="">
<br style="max-width: 100%;" class="">
Please join us on the <a href="https://www.clamav.net/contact#ml" rel="nofollow" target="_blank" style="color: rgb(73, 129, 254); max-width: 100%;" class="">ClamAV mailing lists</a>, on <a href="http://irc.freenode.net" class="">irc.freenode.net</a> in #clamav, or on <a href="https://discord.gg/sGaxA5Q" rel="nofollow" target="_blank" style="color: rgb(73, 129, 254); max-width: 100%;" class="">Discord</a> for further discussion. Thanks! </div></div></div></blockquote></div></body></html>
--Apple-Mail=_885726DE-37E0-4C68-AB3E-4954DF9E7743--
--Apple-Mail=_7B0EB15A-8F11-4C76-9A6F-550DAF6C40E8
Content-Disposition: attachment; filename="smime.p7s"
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCRYw
ggRuMIIDVqADAgECAgphEIBtAAAAAAAOMA0GCSqGSIb3DQEBBQUAMDUxFjAUBgNVBAoTDUNpc2Nv
IFN5c3RlbXMxGzAZBgNVBAMTEkNpc2NvIFJvb3QgQ0EgMjA0ODAeFw0xNDA0MDQyMDI0MThaFw0y
OTA1MTQyMDI1NDJaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBD
QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMrffhZMUxX7I1bNxrllCgSV5d5MRWeM
DMcG4KsfbV83Knvn7aOtgH8RyPOC6+6fUNnJvz2hL7s8EQc177il2VFO2bD3U6CUgCwskmWtEG+h
hmtfQAqZpVBEGpBNz+ZM+0YGjUjjB9fhrWPX1egnABW/bgeyQ7tlBi999lldmxLFLH2960SwUuHC
/B7tnVn3HZOnqzGmQkI5J9OBYsZULCaM2z0U0KiOFeoopBv+vaw8nk3W1UyvjMv/S58FbA9xgTIk
Ye0Zq77qcbRojLvI9OSLP3dTon4VnnML41d0XoPS6JPGzDSRDAKXndcHk3VUtF+DLAIXqLCQZXfZ
UuTuIncCAwEAAaOCAYcwggGDMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBSflTa0jl3VS8MK
wacpk0NRBv2JUTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwEgYDVR0T
AQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQn88gVHm6aAgkWrSugiWBf2nsvqjBDBgNVHR8EPDA6
MDigNqA0hjJodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY3JsL2NyY2EyMDQ4LmNy
bDBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3Vy
aXR5L3BraS9jZXJ0cy9jcmNhMjA0OC5jZXIwXAYDVR0gBFUwUzBRBgorBgEEAQkVARUAMEMwQQYI
KwYBBQUHAgEWNWh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3VyaXR5L3BraS9wb2xpY2llcy9pbmRl
eC5odG1sMA0GCSqGSIb3DQEBBQUAA4IBAQA+Tr4jGkYCjV5r24oCNAtjm+UBPCZdjHCyJOtgXuyK
hGQuG1kVo2ca4Rbj/eBNfUSaIyjS7bb3oh/nRM3tbeqGIVQorGxhvPvIZVAEQIoqi/yfbhie9cU+
paKpHACucaYXu0kyS0pYE5NMNun3Lw3ogOs4XVR5yoVSpKTiVnfTDQchTpwkMgzivqXDcS1OiDfU
8C9WaEZHRWtdUIgl9zoppPGIQa1TflcxhirW4GeH2FOrgaN1d77bIcg6R7RpJ9Xu3/f01nGNunrR
cy993c2meJQoZcOJd15C6ugHwhAxeXY6QXYgkY8KQVCCGwkpshEgbwPrC+I/Itb6P7hGq7awMIIE
oDCCA4igAwIBAgIKAYYRaDD7OEqcKzANBgkqhkiG9w0BAQsFADAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwHhcNMTgxMTIxMDAwMDAwWhcNMjAxMTIwMDAxMDAw
WjCBlTEcMBoGA1UEAxMTSm9lbCBFc2xlciAoamVzbGVyKTEUMBIGA1UECxMLQ2lzY28gVXNlcnMx
EjAQBgNVBAsTCUVtcGxveWVlczETMBEGCgmSJomT8ixkARkTA2NvbTEVMBMGCgmSJomT8ixkARkT
BWNpc2NvMR8wHQYJKoZIhvcNAQkBDBBqZXNsZXJAY2lzY28uY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAjY9Yo3zw0WCxtdtE4oQyXJqoSbeuJULMuLBbZbmalv2w7vNluXG9Qhsh
7zttHIU+z1j0XpG2BnYZMl4AgO23yOyghTAo5u8hBH9Riox9bw0hRkB/pAE89QeZ+1kNOGLuZfN8
B5sTFFmRTztX+TZtIkFONq7q9Wj+h0P5ikvyCgr3tjsbnJRNVSAynEfWGFxIxAGyEYIGMHeSz1ej
SenHps4yI8qTKsX9o3KLRz1nLucUDpm/TCLbQEI87Uv9Phd2v0FptbWUKik9agDjTW4/Q7PjBTPc
OpXem/8w8H9S7TKa248Opt2Nv24oqJZMVAUu6It9oQZWubO0bsYYp8yiDQIDAQABo4IBWDCCAVQw
DgYDVR0PAQH/BAQDAgTwMAwGA1UdEwEB/wQCMAAwegYIKwYBBQUHAQEEbjBsMDwGCCsGAQUFBzAC
hjBodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY2VjYS5jZXIwLAYIKwYB
BQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1UdIwQYMBaAFJ+VNrSO
XdVLwwrBpymTQ1EG/YlRMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jaXNjb2NlcnRzLmNpc2Nv
LmNvbS9maWxlL2NlY2EuY3JsMBsGA1UdEQQUMBKBEGplc2xlckBjaXNjby5jb20wHQYDVR0OBBYE
FDTmAUtoBuQRY6GKIvCllZGSohm5MB8GA1UdJQQYMBYGCisGAQQBgjcKAwwGCCsGAQUFBwMEMA0G
CSqGSIb3DQEBCwUAA4IBAQA3p6fJ3fQlcqszfVLrike+NXunUtbNejhKDOPMhVc3bsozBPggAZbo
m62BvhsvgVLj/+IS2qIEflQxhS2ToplJi8nXRpZ9Qtsu4mhCByy0Z0Xtaw0v2f78B1pskPxDdXZm
T47sc84h0iW+wuZ4yADZb2azb+2j7GNd/vdPLnVyDE209ksjrYyYNO7LifZqmSqIipBYOyG3JZ25
BMTQP7ttExfRKbrkRFSHapvISiFoBeakwGRSqiF7aTAnilXm0Kp1Aj6cQH0Ju3xgXSUpxQewDvZm
Q+AYG6sV6V0yy4fwa1UQAOVKH0dadXp1z9K5WcrqC8Wqz0ojBLT/Avhfy3sXMYICajCCAmYCAQEw
OjAsMQ4wDAYDVQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhK
nCswDQYJYIZIAWUDBAIBBQCgggEBMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN
AQkFMQ8XDTIwMDUxMjE1MjgzOVowLwYJKoZIhvcNAQkEMSIEICRrXA/RiI8COvjBk6rLgc2cuQIA
DDj3ymULAzw+DaRSMEkGCSsGAQQBgjcQBDE8MDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMT
EUNpc2NvIEVtcGxveWVlIENBAgoBhhFoMPs4SpwrMEsGCyqGSIb3DQEJEAILMTygOjAsMQ4wDAYD
VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhKnCswDQYJKoZI
hvcNAQEBBQAEggEAKie2dyPWvZtpusvCtyewLubKom8yN7Ox3RIXG/n0XLaW3VfmQuABik7kwyd+
x5XtnbRChGVom9WoJ/Le8A1qA9NLYd4mvBi0y1V9eO4UBX1YOVYAJgn3RikGgUGUKSBvcy2FTe87
SmrzcqYGJcRNsmRuCPOfKL+KwrZTvzb5Gg9oBzKRGLfXk+qrlCK9UnHm1C4qWyxzRKkLqAauGBW3
BO4EeqkegfplMMjgJXspd12f3gQTBVEkVXcUGuGLA2Gt5dFmAwNCda9KVHUFKrOgDD/sA2nIU32I
RV0U/CNokQSWQbbKGepO6S2qQfxQsQJdpg8zgH5uWOANuAfgzXmGhgAAAAAAAA==
--Apple-Mail=_7B0EB15A-8F11-4C76-9A6F-550DAF6C40E8--
--===============8057524788857429567==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce
http://www.clamav.net/contact.html#ml
--===============8057524788857429567==--