Date: Fri, 31 Aug 2007 19:36:35 -0600
From: [email protected]Subject: [ MDKSA-2007:172 ] - Updated clamav packages vulnerabilities
To: [email protected]
Reply-To: [email protected]
Message-id: <E1IRHud-00051Q-Jl@artemis.annvix.ca.>
X-SA-Exim-Connect-IP: 10.0.5.11
X-SA-Exim-Mail-From: [email protected]
X-SA-Exim-Version: 4.2.1 (built Fri, 02 Feb 2007 19:02:33 -0700)
X-SA-Exim-Scanned: Yes (on hades.annvix.org)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:172
http://www.mandriva.com/security/
_______________________________________________________________________
Package : clamav
Date : August 31, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
A vulnerability in ClamAV was discovered that could allow remote
attackers to cause a denial of service via a crafted RTF file or a
crafted HTML document with a data: URI, both of which trigger a NULL
dereference (CVE-2007-4510).
A vulnerability in clamav-milter, when run in black hole mode,
could allow remote attackers to execute arbitrary commands via shell
metacharacters that are used in a certain popen call (CVE-2007-4560).
Other bugs have also been corrected in 0.91.2 which is being provided
with this update.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4510http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4560
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
9cc355cd4581c9e15aed5c059263f201 2007.0/i586/clamav-0.91.2-1.1mdv2007.0.i586.rpm
cfcf00e1e77e0945c61fe88f9a47b6be 2007.0/i586/clamav-db-0.91.2-1.1mdv2007.0.i586.rpm
c7a2df49aead6c11e6134ce35f2ff39c 2007.0/i586/clamav-milter-0.91.2-1.1mdv2007.0.i586.rpm
f9ead23bd0d3b98b58687a02eafa3d18 2007.0/i586/clamd-0.91.2-1.1mdv2007.0.i586.rpm
e39d94f73442dbb2e6bd0034bbc242df 2007.0/i586/clamdmon-0.91.2-1.1mdv2007.0.i586.rpm
2c886e10cce4b366a2202c0374550d10 2007.0/i586/libclamav-devel-0.91.2-1.1mdv2007.0.i586.rpm
4b1d3207bfc97d0e75d098e53d227fcf 2007.0/i586/libclamav2-0.91.2-1.1mdv2007.0.i586.rpm
46173382db18fa6776e0c11239d34727 2007.0/SRPMS/clamav-0.91.2-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
0004b985905afd8cd892d8565d2c6f84 2007.0/x86_64/clamav-0.91.2-1.1mdv2007.0.x86_64.rpm
604ef50bbb41cba7a46998a872cceb5e 2007.0/x86_64/clamav-db-0.91.2-1.1mdv2007.0.x86_64.rpm
f451326de1cda70b72f78e799702a714 2007.0/x86_64/clamav-milter-0.91.2-1.1mdv2007.0.x86_64.rpm
d459c0ce7eb70fa26f473130b9e2aca3 2007.0/x86_64/clamd-0.91.2-1.1mdv2007.0.x86_64.rpm
7e407178e6b31b27f28ea86a9a812b7e 2007.0/x86_64/clamdmon-0.91.2-1.1mdv2007.0.x86_64.rpm
194efc9b8d8f454a6d40aa02311550ad 2007.0/x86_64/lib64clamav-devel-0.91.2-1.1mdv2007.0.x86_64.rpm
7302c856810696ee9d2da5436a26a5f2 2007.0/x86_64/lib64clamav2-0.91.2-1.1mdv2007.0.x86_64.rpm
46173382db18fa6776e0c11239d34727 2007.0/SRPMS/clamav-0.91.2-1.1mdv2007.0.src.rpm
Mandriva Linux 2007.1:
b314b45eda90a4fc914f980063b08f16 2007.1/i586/clamav-0.91.2-1.1mdv2007.1.i586.rpm
8bbddc576a178213a167285e676f6367 2007.1/i586/clamav-db-0.91.2-1.1mdv2007.1.i586.rpm
d5fc2163cf848f73a686299866bb8e12 2007.1/i586/clamav-milter-0.91.2-1.1mdv2007.1.i586.rpm
0da0d4bdf458feb3a8f01e590603277d 2007.1/i586/clamd-0.91.2-1.1mdv2007.1.i586.rpm
7048492d9a19e3e8805de3838e30efcd 2007.1/i586/clamdmon-0.91.2-1.1mdv2007.1.i586.rpm
f1a6165d185c2bc8bacc1f6a3f6f0583 2007.1/i586/libclamav-devel-0.91.2-1.1mdv2007.1.i586.rpm
82626c97b6c4d0ede2affb6dab4bbb20 2007.1/i586/libclamav2-0.91.2-1.1mdv2007.1.i586.rpm
1aa3e75e6fd71c98a85671f7073eef53 2007.1/SRPMS/clamav-0.91.2-1.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
ce936aaf4aac71db278525b626f7db71 2007.1/x86_64/clamav-0.91.2-1.1mdv2007.1.x86_64.rpm
ab831b70524ef3e7e49ad2e421965d10 2007.1/x86_64/clamav-db-0.91.2-1.1mdv2007.1.x86_64.rpm
053f0b5017f2107edc95e33d77827854 2007.1/x86_64/clamav-milter-0.91.2-1.1mdv2007.1.x86_64.rpm
29d1c23377beda7601da3bf160620d75 2007.1/x86_64/clamd-0.91.2-1.1mdv2007.1.x86_64.rpm
f917158048deac5163697c6dbb5882c9 2007.1/x86_64/clamdmon-0.91.2-1.1mdv2007.1.x86_64.rpm
b0e2b52d8d538f29ffbcfe266a540b67 2007.1/x86_64/lib64clamav-devel-0.91.2-1.1mdv2007.1.x86_64.rpm
5e3cd3617c0e719bc7af09781e0dfcb6 2007.1/x86_64/lib64clamav2-0.91.2-1.1mdv2007.1.x86_64.rpm
1aa3e75e6fd71c98a85671f7073eef53 2007.1/SRPMS/clamav-0.91.2-1.1mdv2007.1.src.rpm
Corporate 3.0:
3f54f8a01c5926fe7b5285e1aa5bd8a0 corporate/3.0/i586/clamav-0.91.2-0.1.C30mdk.i586.rpm
e4f84e94bb49ae6a30db55c0eb3e1f37 corporate/3.0/i586/clamav-db-0.91.2-0.1.C30mdk.i586.rpm
62b32759d1ef5100c7a9d4df5662df4e corporate/3.0/i586/clamav-milter-0.91.2-0.1.C30mdk.i586.rpm
da52811fa2422350fb10aa66b82e7345 corporate/3.0/i586/clamd-0.91.2-0.1.C30mdk.i586.rpm
5b479b2416b7b2a3185a1ea1444e871d corporate/3.0/i586/clamdmon-0.91.2-0.1.C30mdk.i586.rpm
9dac547edcaadc6d91e049dfcfd4c8ef corporate/3.0/i586/libclamav-devel-0.91.2-0.1.C30mdk.i586.rpm
549d6c10620fb7440dbf28df5c8a21de corporate/3.0/i586/libclamav2-0.91.2-0.1.C30mdk.i586.rpm
161aad73d855e835420c4e2cc4d37867 corporate/3.0/SRPMS/clamav-0.91.2-0.1.C30mdk.src.rpm
Corporate 3.0/X86_64:
8558b7b8084cd0b0c3d23c1289830947 corporate/3.0/x86_64/clamav-0.91.2-0.1.C30mdk.x86_64.rpm
62376f79cde45931384e81f267205b54 corporate/3.0/x86_64/clamav-db-0.91.2-0.1.C30mdk.x86_64.rpm
57d93dd2c249d800de1fa22324b4b688 corporate/3.0/x86_64/clamav-milter-0.91.2-0.1.C30mdk.x86_64.rpm
5f7cc43fc89623177e3864194d86dd62 corporate/3.0/x86_64/clamd-0.91.2-0.1.C30mdk.x86_64.rpm
dafb5a003f164d742bcfc2775b1a72ec corporate/3.0/x86_64/clamdmon-0.91.2-0.1.C30mdk.x86_64.rpm
29c3fc98485a4912179438b66be722dc corporate/3.0/x86_64/lib64clamav-devel-0.91.2-0.1.C30mdk.x86_64.rpm
4a49f8d6b1e652a58216d6f20f9d11e8 corporate/3.0/x86_64/lib64clamav2-0.91.2-0.1.C30mdk.x86_64.rpm
161aad73d855e835420c4e2cc4d37867 corporate/3.0/SRPMS/clamav-0.91.2-0.1.C30mdk.src.rpm
Corporate 4.0:
77469fc267c49b8727e9c8d7dfbe1dbe corporate/4.0/i586/clamav-0.91.2-0.1.20060mlcs4.i586.rpm
524a97ee0a548a61503a3d2805148adb corporate/4.0/i586/clamav-db-0.91.2-0.1.20060mlcs4.i586.rpm
b30b5e2ecc63f527a270df87fb236235 corporate/4.0/i586/clamav-milter-0.91.2-0.1.20060mlcs4.i586.rpm
6fdb3fb5e172ac5142cf668013e18f2a corporate/4.0/i586/clamd-0.91.2-0.1.20060mlcs4.i586.rpm
63862acdb343759ad132eb7851de094f corporate/4.0/i586/clamdmon-0.91.2-0.1.20060mlcs4.i586.rpm
d8410aeca30a43ef80dba02181eab604 corporate/4.0/i586/libclamav-devel-0.91.2-0.1.20060mlcs4.i586.rpm
28c9e2d2058116c19230b46686f211af corporate/4.0/i586/libclamav2-0.91.2-0.1.20060mlcs4.i586.rpm
e28ad7b384a7df0d3a457b9cab2e45a5 corporate/4.0/SRPMS/clamav-0.91.2-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
23813b996a2fde23ffb7d34c50464576 corporate/4.0/x86_64/clamav-0.91.2-0.1.20060mlcs4.x86_64.rpm
9de86112dede4437ec8de4792602c697 corporate/4.0/x86_64/clamav-db-0.91.2-0.1.20060mlcs4.x86_64.rpm
d7c4ca09b53acf38161206b9b0288f50 corporate/4.0/x86_64/clamav-milter-0.91.2-0.1.20060mlcs4.x86_64.rpm
cc043effd109ea56c076ade68e642007 corporate/4.0/x86_64/clamd-0.91.2-0.1.20060mlcs4.x86_64.rpm
d84d812febc122043602a7cbef4025f7 corporate/4.0/x86_64/clamdmon-0.91.2-0.1.20060mlcs4.x86_64.rpm
7d64c08753f48cd26932b0a047a841c6 corporate/4.0/x86_64/lib64clamav-devel-0.91.2-0.1.20060mlcs4.x86_64.rpm
4c33eb78a714a00844e918c18179ce27 corporate/4.0/x86_64/lib64clamav2-0.91.2-0.1.20060mlcs4.x86_64.rpm
e28ad7b384a7df0d3a457b9cab2e45a5 corporate/4.0/SRPMS/clamav-0.91.2-0.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFG2JaAmqjQ0CJFipgRAnI0AJ9fgAIDhVfdbipB/oUayk0fVNyMJQCgq/Do
qkx9vOAIP/sETiOBojGnhkQ=
=6TkG
-----END PGP SIGNATURE-----
