Debian Security Advisory
DSA-1660-1 clamav -- null pointer dereference, resource exhaustion
- Date Reported:
- 26 Oct 2008
- Affected Packages:
- clamav
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2008-3912, CVE-2008-3913, CVE-2008-3914.
- More information:
-
Several denial-of-service vulnerabilities have been discovered in the ClamAV anti-virus toolkit:
Insufficient checking for out-of-memory conditions results in null pointer dereferences (CVE-2008-3912).
Incorrect error handling logic leads to memory leaks (CVE-2008-3913) and file descriptor leaks (CVE-2008-3914).
For the stable distribution (etch), these problems have been fixed in version 0.90.1dfsg-4etch15.
For the unstable distribution (sid) and the testing distribution (lenny), these problems have been fixed in version 0.94.dfsg-1.
We recommend that you upgrade your clamav package.
- Fixed in:
-
Debian GNU/Linux 4.0 (etch)
- Source:
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15.diff.gz
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg.orig.tar.gz
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15.dsc
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg.orig.tar.gz
- Architecture-independent component:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.90.1dfsg-4etch15_all.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.90.1dfsg-4etch15_all.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-testfiles_0.90.1dfsg-4etch15_all.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.90.1dfsg-4etch15_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_alpha.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_alpha.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_alpha.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_alpha.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_alpha.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_alpha.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_alpha.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_amd64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_amd64.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_amd64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_amd64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_amd64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_amd64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_amd64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_arm.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_arm.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_arm.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_arm.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_arm.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_arm.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_arm.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_arm.deb
- HP Precision:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_hppa.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_hppa.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_hppa.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_hppa.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_hppa.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_hppa.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_hppa.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_hppa.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_i386.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_i386.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_i386.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_i386.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_i386.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_i386.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_i386.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_ia64.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_ia64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_ia64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_ia64.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_ia64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_ia64.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_ia64.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_ia64.deb
- Big-endian MIPS:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_mips.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_mips.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_mips.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_mips.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_mips.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_mips.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_mips.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_mips.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_powerpc.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_powerpc.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_powerpc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_powerpc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_powerpc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_powerpc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_powerpc.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_s390.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_s390.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_s390.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_s390.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_s390.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_s390.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_s390.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1dfsg-4etch15_sparc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_sparc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1dfsg-4etch15_sparc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1dfsg-4etch15_sparc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1dfsg-4etch15_sparc.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1dfsg-4etch15_sparc.deb
- http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1dfsg-4etch15_sparc.deb
- http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1dfsg-4etch15_sparc.deb
MD5 checksums of the listed files are available in the original advisory.