Linux Security
    Linux Security
    Linux Security

    openSUSE: 2020:2268-1 moderate: clamav

    Date 17 Dec 2020
    79
    Posted By LinuxSecurity Advisories
    An update that fixes 14 vulnerabilities is now available.
    
       openSUSE Security Update: Security update for clamav
    ______________________________________________________________________________
    
    Announcement ID:    openSUSE-SU-2020:2268-1
    Rating:             moderate
    References:         #1104457 #1118459 #1130721 #1144504 #1149458 
                        #1157763 
    Cross-References:   CVE-2019-12625 CVE-2019-12900 CVE-2019-15961
                        CVE-2019-1785 CVE-2019-1786 CVE-2019-1787
                        CVE-2019-1788 CVE-2019-1789 CVE-2019-1798
                        CVE-2020-3123 CVE-2020-3327 CVE-2020-3341
                        CVE-2020-3350 CVE-2020-3481
    Affected Products:
                        openSUSE Leap 15.1
    ______________________________________________________________________________
    
       An update that fixes 14 vulnerabilities is now available.
    
    Description:
    
       This update for clamav fixes the following issues:
    
       clamav was updated to the new major release 0.103.0.
       (jsc#ECO-3010,bsc#1118459)
    
       Note that libclamav was changed incompatible, if you have a 3rd party
       application that uses libclamav, it needs to be rebuilt.
    
       Update to 0.103.0
    
       * clamd can now reload the signature database without blocking scanning.
         This multi-threaded database reload improvement was made possible thanks
         to a community effort.
    
         - Non-blocking database reloads are now the default behavior. Some
           systems that are more constrained on RAM may need to disable
           non-blocking reloads as it will temporarily consume two times as much
           memory. We added a new clamd config option ConcurrentDatabaseReload,
           which may be set to no.
    
         * Fix clamav-milter.service (requires clamd.service to run)
    
       Update to 0.102.4
    
         * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
           replace a scan target's directory with a symlink to another path to
           trick clamscan, clamdscan, or clamonacc into removing or moving a
           different file (eg. a critical system file). The issue would affect
           users that use the --move or --remove options for clamscan, clamdscan,
           and clamonacc.
         * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module
           in ClamAV 0.102.3 that could cause a Denial-of-Service (DoS)
           condition. Improper bounds checking results in an
           out-of-bounds read which could cause a crash. The previous fix for
            this CVE in 0.102.3 was incomplete. This fix correctly resolves the
            issue.
         * CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV
           0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition.
           Improper error handling may result in a crash due to a NULL pointer
           dereference. This vulnerability is mitigated for those using the
           official ClamAV signature databases because the file type signatures
           in daily.cvd will not enable the EGG archive parser in versions
           affected by the vulnerability.
    
       Update to 0.102.3
    
         * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module
           in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
           condition. Improper bounds checking of an unsigned variable results in
           an out-of-bounds read which causes a crash.
         * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV
           0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition.
           Improper size checking of a buffer used to initialize AES decryption
           routines results in an out-of-bounds read which may cause a crash.
         * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
           documents.
         * Fix a couple of minor memory leaks.
         * Updated libclamunrar to UnRAR 5.9.2.
    
       Update to 0.102.2:
    
         * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
           using the optional credit card data-loss-prevention (DLP) feature.
           Improper bounds checking of an unsigned variable resulted in an
           out-of-bounds read, which causes a crash.
         * Significantly improved the scan speed of PDF files on Windows.
         * Re-applied a fix to alleviate file access issues when scanning RAR
           files in downstream projects that use libclamav where the scanning
           engine is operating in a low-privilege process. This bug was
           originally fixed in 0.101.2 and the fix was mistakenly omitted from
           0.102.0.
         * Fixed an issue where freshclam failed to update if the database
           version downloaded is one version older than advertised. This
           situation may
           occur after a new database version is published. The issue affected
            users downloading the whole CVD database file.
         * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
           The ReceiveTimeout had caused needless database update failures for
           users with slower internet connections.
         * Correctly display the number of kilobytes (KiB) in progress bar and
           reduced the size of the progress bar to accommodate 80-character width
           terminals.
         * Fixed an issue where running freshclam manually causes a daemonized
           freshclam process to fail when it updates because the manual instance
           deletes the temporary download directory. The freshclam temporary
           files will now download to a unique directory created at the time of
           an update instead of using a hardcoded directory created/destroyed at
           the program start/exit.
         * Fix for freshclam's OnOutdatedExecute config option.
         * Fixes a memory leak in the error condition handling for the email
           parser.
         * Improved bound checking and error handling in ARJ archive parser.
         * Improved error handling in PDF parser.
         * Fix for memory leak in byte-compare signature handler.
    
       - The freshclam.service should not be started before the network is
         online (it checks for updates immediately upon service start)
    
       Update to 0.102.1:
    
         * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS) vulnerability
           may occur when scanning a specially crafted email file as a result of
           excessively long scan times. The issue is resolved by implementing
           several maximums in parsing MIME messages and by optimizing use of
           memory allocation.
         * Build system fixes to build clamav-milter, to correctly link with
           libxml2 when detected, and to correctly detect fanotify for on-access
           scanning feature support.
         * Signature load time is significantly reduced by changing to a more
           efficient algorithm for loading signature patterns and allocating the
           AC trie. Patch courtesy of Alberto Wu.
         * Introduced a new configure option to statically link libjson-c with
           libclamav. Static linking with libjson is highly recommended to
           prevent crashes in applications that use libclamav alongside another
           JSON parsing library.
         * Null-dereference fix in email parser when using the
           --gen-json metadata option.
         * Fixes for Authenticode parsing and certificate signature (.crb
           database) bugs.
    
       Update to 0.102.0:
    
         * The On-Access Scanning feature has been migrated out of clamd and into
           a brand new utility named clamonacc. This utility is similar to
           clamdscan and clamav-milter in that it acts as a client to clamd. This
           separation from clamd means that clamd no longer needs to run with
           root privileges while scanning potentially malicious files. Instead,
           clamd may drop privileges to run under an account that does not have
           super-user. In addition to improving the security posture of running
           clamd with On-Access enabled, this update fixed a few outstanding
           defects:
           - On-Access scanning for created and moved files (Extra-Scanning) is
             fixed.
           - VirusEvent for On-Access scans is fixed.
           - With clamonacc, it is now possible to copy, move, or remove a file
             if the scan triggered an alert, just like with clamdscan.
         * The freshclam database update utility has undergone a significant
           update. This includes:
           - Added support for HTTPS.
           - Support for database mirrors hosted on ports other than 80.
           - Removal of the mirror management feature (mirrors.dat).
           - An all new libfreshclam library API.
       - created new subpackage libfreshclam2
    
       Update to 0.101.4:
    
         * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458)
         * CVE-2019-12625: Introduce a configurable time limit to mitigate zip
           bomb vulnerability completely. Default is 2 minutes, configurable
           useing the clamscan --max-scantime and for clamd using the MaxScanTime
           config option (bsc#1144504)
    
       Update to version 0.101.3:
    
         * bsc#1144504: ZIP bomb causes extreme CPU spikes
    
       Update to version 0.101.2 (bsc#1130721)
    
         * CVE-2019-1787: An out-of-bounds heap read condition may occur when
           scanning PDF documents. The defect is a failure to correctly keep
           track of the number
           of bytes remaining in a buffer when indexing file data.
         * CVE-2019-1789: An out-of-bounds heap read condition may occur when
           scanning PE files (i.e. Windows EXE and DLL files) that have been
           packed using Aspack as a result of inadequate bound-checking.
         * CVE-2019-1788: An out-of-bounds heap write condition may occur when
           scanning OLE2 files such as Microsoft Office 97-2003 documents. The
           invalid write happens when an invalid pointer is mistakenly used to
           initialize a 32bit integer to zero. This is likely to crash the
           application.
         * CVE-2019-1786: An out-of-bounds heap read condition may occur when
           scanning malformed PDF documents as a result of improper
           bounds-checking.
         * CVE-2019-1785: A path-traversal write condition may occur as a result
           of improper input validation when scanning RAR archives.
         * CVE-2019-1798: A use-after-free condition may occur as a result of
           improper error handling when scanning nested RAR archives.
    
       This update was imported from the SUSE:SLE-15:Update update project.
    
    
    Patch Instructions:
    
       To install this openSUSE Security Update use the SUSE recommended installation methods
       like YaST online_update or "zypper patch".
    
       Alternatively you can run the command listed for your product:
    
       - openSUSE Leap 15.1:
    
          zypper in -t patch openSUSE-2020-2268=1
    
    
    
    Package List:
    
       - openSUSE Leap 15.1 (x86_64):
    
          clamav-0.103.0-lp151.2.12.1
          clamav-debuginfo-0.103.0-lp151.2.12.1
          clamav-debugsource-0.103.0-lp151.2.12.1
          clamav-devel-0.103.0-lp151.2.12.1
          libclamav9-0.103.0-lp151.2.12.1
          libclamav9-debuginfo-0.103.0-lp151.2.12.1
          libfreshclam2-0.103.0-lp151.2.12.1
          libfreshclam2-debuginfo-0.103.0-lp151.2.12.1
    
    
    References:
    
       https://www.suse.com/security/cve/CVE-2019-12625.html
       https://www.suse.com/security/cve/CVE-2019-12900.html
       https://www.suse.com/security/cve/CVE-2019-15961.html
       https://www.suse.com/security/cve/CVE-2019-1785.html
       https://www.suse.com/security/cve/CVE-2019-1786.html
       https://www.suse.com/security/cve/CVE-2019-1787.html
       https://www.suse.com/security/cve/CVE-2019-1788.html
       https://www.suse.com/security/cve/CVE-2019-1789.html
       https://www.suse.com/security/cve/CVE-2019-1798.html
       https://www.suse.com/security/cve/CVE-2020-3123.html
       https://www.suse.com/security/cve/CVE-2020-3327.html
       https://www.suse.com/security/cve/CVE-2020-3341.html
       https://www.suse.com/security/cve/CVE-2020-3350.html
       https://www.suse.com/security/cve/CVE-2020-3481.html
       https://bugzilla.suse.com/1104457
       https://bugzilla.suse.com/1118459
       https://bugzilla.suse.com/1130721
       https://bugzilla.suse.com/1144504
       https://bugzilla.suse.com/1149458
       https://bugzilla.suse.com/1157763
    _______________________________________________
    openSUSE Security Announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it.
    To unsubscribe, email This email address is being protected from spambots. You need JavaScript enabled to view it.
    List Netiquette: https://en.opensuse.org/openSUSE:Mailing_list_netiquette
    List Archives: https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it.
    

    Advisories

    LinuxSecurity Poll

    'Tis the season of giving! How have you given back to the open-source community?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/49-tis-the-season-of-giving-how-have-you-given-back-to-the-open-source-community?task=poll.vote&format=json
    49
    radio
    [{"id":"171","title":"I've contributed to the development of an open-source project.","votes":"22","type":"x","order":"1","pct":34.92,"resources":[]},{"id":"172","title":"I've reviewed open-source code for security bugs.","votes":"13","type":"x","order":"2","pct":20.63,"resources":[]},{"id":"173","title":"I've made a donation to an open-source project.","votes":"28","type":"x","order":"3","pct":44.44,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.