Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 15 Apr 2008 10:37:04 +0200
From: Tomas Hoger <>
Subject: CVE id request - clamav


Clamav 0.93 was released yesterday.  According to the ChangeLog, couple
of security-related issue were fixed (some references in between):

Mon Apr 14 21:35:11 CEST 2008 (tk)
  * Check in 0.93 patches:
    - libclamunrar: bb#541 (RAR - Version required to extract - Evasion)

    - libclamav/spin.c: bb#876 (PeSpin Heap Overflow Vulnerability)
(This may already have CVE id, as it seems to be some (not yet
published?) iDefense advisory - IDEF2957)

    - libclamav/pe.c: bb#878 (Upack Buffer Overflow Vulnerability)

    - libclamav/message.c: bb#881 (message.c: read beyond allocated

    - libclamav/unarj.c: bb#897 (ARJ: Sample from CERT-FI hangs clamav)
bug mentions CVE-2008-1387

    - libclamunrar: bb#898 (RAR crashes on some fuzzed files from

And even some fixes not mentioned in the changelog:

Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.