[USN-1258-1] ClamAV vulnerability
Jamie Strandboge
jamie at canonical.com
Thu Nov 10 18:47:05 UTC 2011
==========================================================================
Ubuntu Security Notice USN-1258-1
November 10, 2011
clamav vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
ClamAV could be made to crash or run programs as your login if it opened a
specially crafted file.
Software Description:
- clamav: Anti-virus utility for Unix
Details:
Stephane Chazelas discovered the bytecode engine of ClamAV improperly
handled recursion under certain circumstances. This could allow a remote
attacker to craft a file that could cause ClamAV to crash, resulting in a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
libclamav6 0.97.3+dfsg-1ubuntu0.11.10.1
Ubuntu 11.04:
libclamav6 0.97.3+dfsg-1ubuntu0.11.04.1
Ubuntu 10.10:
libclamav6 0.96.5+dfsg-1ubuntu1.10.10.3
Ubuntu 10.04 LTS:
libclamav6 0.96.5+dfsg-1ubuntu1.10.04.3
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1258-1
CVE-2011-3627
Package Information:
https://launchpad.net/ubuntu/+source/clamav/0.97.3+dfsg-1ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/clamav/0.97.3+dfsg-1ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/clamav/0.96.5+dfsg-1ubuntu1.10.10.3
https://launchpad.net/ubuntu/+source/clamav/0.96.5+dfsg-1ubuntu1.10.04.3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20111110/88fd6c43/attachment.sig>
More information about the ubuntu-security-announce
mailing list