Debian Security Advisory

DLA-1261-1 clamav -- LTS security update

Date Reported:
28 Jan 2018
Affected Packages:
clamav
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 888484, Bug 824196.
In Mitre's CVE dictionary: CVE-2017-12374, CVE-2017-12375, CVE-2017-12376, CVE-2017-12377, CVE-2017-12378, CVE-2017-12379, CVE-2017-12380.
More information:

Multiple vulnerabilities have been discovered in clamav, the ClamAV AntiVirus toolkit for Unix. Effects range from denial of service to potential arbitrary code execution. Additionally, this version fixes a longstanding issue that has recently resurfaced whereby a malformed virus signature database can cause an application crash and denial of service.

  • CVE-2017-12374

    ClamAV has a use-after-free condition arising from a lack of input validation. A remote attacker could exploit this vulnerability with a crafted email message to cause a denial of service.

  • CVE-2017-12375

    ClamAV has a buffer overflow vulnerability arising from a lack of input validation. An unauthenticated remote attacker could send a crafted email message to the affected device, triggering a buffer overflow and potentially a denial of service when the malicious message is scanned.

  • CVE-2017-12376

    ClamAV has a buffer overflow vulnerability arising from improper input validation when handling Portable Document Format (PDF) files. An unauthenticated remote attacker could send a crafted PDF file to the affected device, triggering a buffer overflow and potentially a denial of service or arbitrary code execution when the malicious file is scanned.

  • CVE-2017-12377

    ClamAV has a heap overflow vulnerability arising from improper input validation when handling mew packets. An attacker could exploit this by sending a crafted message to the affected device, triggering a denial of service or possible arbitrary code execution when the malicious file is scanned.

  • CVE-2017-12378

    ClamAV has a buffer overread vulnerability arising from improper input validation when handling tape archive (TAR) files. An unauthenticated remote attacker could send a crafted TAR file to the affected device, triggering a buffer overread and potentially a denial of service when the malicious file is scanned.

  • CVE-2017-12379

    ClamAV has a buffer overflow vulnerability arising from improper input validation in the message parsing function. An unauthenticated remote attacker could send a crafted email message to the affected device, triggering a buffer overflow and potentially a denial of service or arbitrary code execution when the malicious message is scanned.

  • CVE-2017-12380

    ClamAV has a NULL dereference vulnerability arising from improper input validation in the message parsing function. An unauthenticated remote attacker could send a crafted email message to the affected device, triggering a NULL pointer dereference, which may result in a denial of service.

  • Debian Bug #824196

    A malformed virus signature database could cause an application crash and denial of service.

For Debian 7 Wheezy, these problems have been fixed in version 0.99.2+dfsg-0+deb7u4.

We recommend that you upgrade your clamav packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS