clamav vulnerabilities

27 May 2010

clamav vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 10.04 LTS
• Ubuntu 9.10
• Ubuntu 9.04

Summary

An attacker could send crafted input to ClamAV and cause it to crash.

Software Description

• clamav - anti-virus utility for Unix

Details

It was discovered that ClamAV did not properly reallocate memory when processing certain PDF files. A remote attacker could send a specially crafted PDF and crash ClamAV. (CVE-2010-1639)

An out of bounds memory access flaw was discovered in ClamAV. A remote attacker could send a specially crafted Portable Executable (PE) file and crash ClamAV. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-2077)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 10.04 LTS

libclamav6 - 0.96.1+dfsg-0ubuntu0.10.04.1

Ubuntu 9.10

libclamav6 - 0.95.3+dfsg-1ubuntu0.09.10.2

Ubuntu 9.04

libclamav6 - 0.95.3+dfsg-1ubuntu0.09.04.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes. For Ubuntu 10.04 LTS, this update uses a new upstream release, which includes additional bug fixes.

References

• CVE-2010-1639
• CVE-2010-2077