Lucene search

DebianDEBIAN:DLA-1105-1:10F58

HistorySep 22, 2017 - 8:48 p.m.

[SECURITY] [DLA 1105-1] clamav security update

2017-09-2220:48:00

lists.debian.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

6.2 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.7%

JSON

Package : clamav
Version : 0.99.2+dfsg-0+deb7u3
CVE ID : CVE-2017-6418 CVE-2017-6420

clamav is vulnerable to multiple issues that can lead
to denial of service when processing untrusted content.

CVE-2017-6418

out-of-bounds read in libclamav/message.c, allowing remote attackers
to cause a denial of service via a crafted e-mail message.

CVE-2017-6420

use-after-free in the wwunpack function (libclamav/wwunpack.c), allowing
remote attackers to cause a denial of service via a crafted PE file with
WWPack compression.

For Debian 7 "Wheezy", these problems have been fixed in version
0.99.2+dfsg-0+deb7u3.

We recommend that you upgrade your clamav packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian7i386clamav-daemon< 0.99.2+dfsg-0+deb7u4clamav-daemon_0.99.2+dfsg-0+deb7u4_i386.deb
Debian8mipsclamav-daemon< 0.99.2+dfsg-0+deb8u3clamav-daemon_0.99.2+dfsg-0+deb8u3_mips.deb
Debian7amd64clamav-freshclam< 0.99.2+dfsg-0+deb7u4clamav-freshclam_0.99.2+dfsg-0+deb7u4_amd64.deb
Debian8arm64clamav< 0.99.2+dfsg-0+deb8u3clamav_0.99.2+dfsg-0+deb8u3_arm64.deb
Debian8i386clamav-dbg< 0.99.2+dfsg-0+deb8u3clamav-dbg_0.99.2+dfsg-0+deb8u3_i386.deb
Debian7amd64clamav-daemon< 0.99.2+dfsg-0+deb7u3clamav-daemon_0.99.2+dfsg-0+deb7u3_amd64.deb
Debian7i386clamav-daemon< 0.99.2+dfsg-0+deb7u3clamav-daemon_0.99.2+dfsg-0+deb7u3_i386.deb
Debian9mipselclamdscan< 0.99.2+dfsg-6+deb9u1clamdscan_0.99.2+dfsg-6+deb9u1_mipsel.deb
Debian8i386clamav-daemon< 0.99.2+dfsg-0+deb8u3clamav-daemon_0.99.2+dfsg-0+deb8u3_i386.deb
Debian7armhfclamav< 0.99.2+dfsg-0+deb7u3clamav_0.99.2+dfsg-0+deb7u3_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	i386	clamav-daemon	< 0.99.2+dfsg-0+deb7u4	clamav-daemon_0.99.2+dfsg-0+deb7u4_i386.deb
Debian	8	mips	clamav-daemon	< 0.99.2+dfsg-0+deb8u3	clamav-daemon_0.99.2+dfsg-0+deb8u3_mips.deb
Debian	7	amd64	clamav-freshclam	< 0.99.2+dfsg-0+deb7u4	clamav-freshclam_0.99.2+dfsg-0+deb7u4_amd64.deb
Debian	8	arm64	clamav	< 0.99.2+dfsg-0+deb8u3	clamav_0.99.2+dfsg-0+deb8u3_arm64.deb
Debian	8	i386	clamav-dbg	< 0.99.2+dfsg-0+deb8u3	clamav-dbg_0.99.2+dfsg-0+deb8u3_i386.deb
Debian	7	amd64	clamav-daemon	< 0.99.2+dfsg-0+deb7u3	clamav-daemon_0.99.2+dfsg-0+deb7u3_amd64.deb
Debian	7	i386	clamav-daemon	< 0.99.2+dfsg-0+deb7u3	clamav-daemon_0.99.2+dfsg-0+deb7u3_i386.deb
Debian	9	mipsel	clamdscan	< 0.99.2+dfsg-6+deb9u1	clamdscan_0.99.2+dfsg-6+deb9u1_mipsel.deb
Debian	8	i386	clamav-daemon	< 0.99.2+dfsg-0+deb8u3	clamav-daemon_0.99.2+dfsg-0+deb8u3_i386.deb
Debian	7	armhf	clamav	< 0.99.2+dfsg-0+deb7u3	clamav_0.99.2+dfsg-0+deb7u3_armhf.deb