Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 18 Jul 2008 11:43:55 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: steffen.joeris@...lelinux.de
Subject: Re: CVE id request: Clamav


On Tue, 8 Jul 2008, Tomas Hoger wrote:

> Does anyone have more info?  From commit message, it looks like DoS, so
> probably worth new id for an incomplete fix.

======================================================
Name: CVE-2008-3215
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3215
Reference: MLIST:[oss-security] 20080708 Re: CVE id request: Clamav
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/08/5
Reference: MLIST:[oss-security] 20080715 Re: CVE id request: Clamav
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/15/1
Reference: CONFIRM:http://lurker.clamav.net/message/20080707.155612.ad411b00.en.html
Reference: CONFIRM:http://svn.clamav.net/websvn/diff.php?repname=clamav-devel&path=/branches/0.93/libclamav/petite.c&rev=3920
Reference: CONFIRM:https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1000#c4

libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to
cause a denial of service via a malformed Petite file that triggers an
out-of-bounds memory access.  NOTE: this issue exists because of an
incomplete fix for CVE-2008-2713.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.