SUSE-SU-2018:0254-1

Dashboard / Vulnerabilities / SUSE-SU-2018:0254-1

SUSE-SU-2018:0254-1

Summary: Security update for clamav

Details: This update for clamav fixes the following issues: - Update to security release 0.99.3 (bsc#1077732) * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability) * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability) * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities) * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability) * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability) * CVE-2017-12380 (ClamAV Null Dereference Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. * CVE-2017-6420 (bsc#1052448) - this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. * CVE-2017-6419 (bsc#1052449) - ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. * CVE-2017-11423 (bsc#1049423) - ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. * CVE-2017-6418 (bsc#1052466) - ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.

References: https://www.suse.com/support/update/announcement/2018/suse-su-20180254-1/, https://bugzilla.suse.com/1049423, https://bugzilla.suse.com/1052448, https://bugzilla.suse.com/1052449, https://bugzilla.suse.com/1052466, https://bugzilla.suse.com/1077732, https://www.suse.com/security/cve/CVE-2017-11423, https://www.suse.com/security/cve/CVE-2017-12374, https://www.suse.com/security/cve/CVE-2017-12375, https://www.suse.com/security/cve/CVE-2017-12376, https://www.suse.com/security/cve/CVE-2017-12377, https://www.suse.com/security/cve/CVE-2017-12378, https://www.suse.com/security/cve/CVE-2017-12379, https://www.suse.com/security/cve/CVE-2017-12380, https://www.suse.com/security/cve/CVE-2017-6418, https://www.suse.com/security/cve/CVE-2017-6419, https://www.suse.com/security/cve/CVE-2017-6420