clamav: Vulnerability in the Data-Loss-Prevention (DLP) module

Debian Bug report logs - #950944
clamav: Vulnerability in the Data-Loss-Prevention (DLP) module

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Scott Kitterman <debian@kitterman.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: clamav: Vulnerability in the Data-Loss-Prevention (DLP) module

Date: Sat, 08 Feb 2020 11:07:12 -0500

Package: clamav
Version: 0.102.1+dfsg-0+deb10u2
Severity: important
Tags: upstream

CVE-2020-3123

A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus
(ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated,
remote attacker to cause a denial of service condition on an affected device.
The vulnerability is due to an out-of-bounds read affecting users that have
enabled the optional DLP feature. An attacker could exploit this vulnerability
by sending a crafted email file to an affected device. An exploit could allow
the attacker to cause the ClamAV scanning process crash, resulting in a denial
of service condition.

Fixed in 0.102.2.

Send a report that this bug log contains spam.