Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 455
Alerts This Week
Warning Icon 1 455

Mageia 7 MGASA-2019-0328: Critical Denial Of Service Threat Resolved

mageia
Calendar Grey November 19, 2019
Scroller Mageia
New ClamAV updates address critical security flaws in Mageia 7. Major threats involve potential denial of service attacks.
The updated packages fix security vulnerabilities: ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denia...

Summary

The updated packages fix security vulnerabilities:
ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. (CVE-2019-12625)
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. (CVE-2019-12900)

References

- https://bugs.mageia.org/show_bug.cgi?id=25231

- https://blog.clamav.net/2019/08/clamav-01013-security-patch-release-and.html

- https://blog.clamav.net/2019/08/clamav-01014-security-patch-release-has.html

- https://www.openwall.com/lists/oss-security/2019/08/06/3

- https://ubuntu.com/security/notices/USN-4146-1

- https://www.cve.org/CVERecord?id=CVE-2019-12625

- https://www.cve.org/CVERecord?id=CVE-2019-12900

Topics%20covered

Topics Covered

security advisory denial of service software update clamav Mageia zip bomb fixed patches

Resolution

SRPMS

- 7/core/clamav-0.101.4-1.1.mga7

- 7/core/c-icap-modules-extra-0.5.3-1.mga7

- 7/core/ecap-clamav-2.0.0-3.1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 19 Nov 2019
URL: https://advisories.mageia.org/MGASA-2019-0328.html
Type: security
CVE: CVE-2019-12625, CVE-2019-12900

Topics%20covered

Topics Covered

security advisory denial of service software update clamav Mageia zip bomb fixed patches

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.