Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 494
Alerts This Week
Warning Icon 1 494

Ubuntu 12.04 ESM: USN-3722-4 Critical: ClamAV Regression Issue

ubuntu
Calendar Grey July 26, 2018
Dist Ubuntu Esm H88
Ubuntu Security Notice USN-3722-4 July 26, 2018 clamav regression A security issue affects these rel
USN-3722-1 introduced a regression in ClamAV.

Summary

USN-3722-1 introduced a regression in ClamAV.

Software Description:

- clamav: Anti-virus utility for Unix

Details:

USN-3722-1 fixed vulnerabilities in ClamAV. The updated ClamAV version

removed some configuration options which caused the daemon to fail to

start in environments where the ClamAV configuration file was manually

edited. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

 It was discovered that ClamAV incorrectly handled parsing certain HWP

 files. A remote attacker could use this issue to cause ClamAV to hang,

 resulting in a denial of service. (CVE-2018-0360)

 It was discovered that ClamAV incorrectly handled parsing certain PDF

 files. A remote attacker could use this issue to cause ClamAV to hang,

 resulting in a denial of service. (CVE-2018-0361)

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu clamav regression issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
  clamav                          0.100.1+dfsg-1ubuntu0.12.04.2

In general, a standard system update will make all the necessary
changes.

References

  https://ubuntu.com/security/notices/USN-3722-4

  https://ubuntu.com/security/notices/USN-3722-1

  https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1783632

Severity
critical
Lowest
Low
Medium
High
Critical

July 26, 2018

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu clamav regression issue

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.