Ubuntu: USN-5233-1 Severe: ClamAV Crash Risk Denial of Service

ubuntu

January 18, 2022

ClamAV could be made to crash if it opened a specially crafted file.

Summary

ClamAV could be made to crash if it opened a specially crafted file.

Software Description:

- clamav: Anti-virus utility for Unix

Details:

It was discovered that ClamAV incorrectly handled memory when the

CL_SCAN_GENERAL_COLLECT_METADATA scan option was enabled. A remote attacker

could possibly use this issue to cause ClamAV to crash, resulting in a

denial of service.

Topics Covered

security advisory denial of service ubuntu severe clamav crash risk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  clamav                          0.103.5+dfsg-1~21.10.1

Ubuntu 21.04:
  clamav                          0.103.5+dfsg-1~21.04.1

Ubuntu 20.04 LTS:
  clamav                          0.103.5+dfsg-1~20.04.1

Ubuntu 18.04 LTS:
  clamav                          0.103.5+dfsg-0ubuntu0.18.04.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.