[SECURITY] [DSA 1435-1] New clamav packages fix several vulnerabilities
Date: Wed, 19 Dec 2007 18:38:04 +0100
From: Moritz Muehlenhoff <jmm@debian.org.>
Subject: [SECURITY] [DSA 1435-1] New clamav packages fix several vulnerabilities
Priority: urgent
Resent-Message-ID: <Mrm6bKXTIJN.A.-vG.IcVaHB@liszt.>
Reply-To: [email protected]
Mail-Followup-To: [email protected]
To: [email protected]
Resent-Date: Wed, 19 Dec 2007 17:38:16 +0000 (UTC)
Resent-From: [email protected] (Mailing List Manager)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1435-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
December 19, 2007 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : clamav
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2007-6335 CVE-2007-6336
Several remote vulnerabilities have been discovered in the Clam
anti-virus toolkit. The Common Vulnerabilities and Exposures project
identifies the following problems:
CVE-2007-6335
It was discovered that an integer overflow in the decompression code
for MEW archives may lead to the execution of arbitrary code.
CVE-2007-6336
It was discovered that on off-by-one in the MS-ZIP decompression
code may lead to the execution of arbitrary code.
For the stable distribution (etch), these problems have been fixed in
version 0.90.1-3etch8.
The old stable distribution (sarge) is not affected by these problems.
However, since the clamav version from Sarge cannot process all current
Clam malware signatures any longer, support for the ClamAV in Sarge is
now discontinued. We recommend to upgrade the the stable distribution
or run a backport of the stable version.
The unstable distribution (sid) will be fixed soon.
We recommend that you upgrade your clamav packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian 4.0 (stable)
- -------------------
Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1.orig.tar.gz
Size/MD5 checksum: 11643310 cd11c05b5476262eaea4fa3bd7dc25bf
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8.dsc
Size/MD5 checksum: 886 749c91e6c5ba5fc237e8a2176fdadb95
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8.diff.gz
Size/MD5 checksum: 207113 333bd216cf5347d99f59258a3c3a66ed
Architecture independent packages:
http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.90.1-3etch8_all.deb
Size/MD5 checksum: 1005018 117b5356ff6f6b661c1e40fc9d801684
http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.90.1-3etch8_all.deb
Size/MD5 checksum: 201722 aa2b7f1a58ca407b390449ca46f4ab27
http://security.debian.org/pool/updates/main/c/clamav/clamav-testfiles_0.90.1-3etch8_all.deb
Size/MD5 checksum: 157958 49b16840258b5ceedfe0b71b96dbcedb
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 644446 694b0ad3130abf2e2db1e63760362836
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 406370 83cc1d74a4c6f0972d13d06f3a797fb2
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 511388 07bfeca8da437193d8e37bfa67e1795e
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 9303942 40bc5413ec2757d45afaafeb4dd780ca
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 184780 ce83079b346a0677478fcda3e8eb82c2
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 180400 ac5d647a73691f65ab65c9c7abf30d2a
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_alpha.deb
Size/MD5 checksum: 863570 9020d874cea3fb66cfcad4f13853c714
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 177672 b41de0132a31e306926a539208c9040e
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 9301374 ef7c3f347faae5dfeeeb0b23443299f1
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 385814 4ac88e34ed1a21766867874d1147a883
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 639602 1b1cd8162ea42086321c0a4863b23a60
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 177104 560d52f19f0a3faf7aad14ee96b53810
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 367736 206ba38fb4ecaf940159e2cff5471ab4
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_amd64.deb
Size/MD5 checksum: 856186 e507b156b818853bafa5ac249759f8ec
arm architecture (ARM)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 363636 cffe11f51a8a7da7805e0653da528742
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 171294 e37b91b2d63de0b2502f27ad3ada1bff
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 598070 2640254d36f5a409f21c3282f3ae9973
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 853018 81f2af2c8dd9549f732a5f71031d48a2
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 9299274 b7db8bdfb726918d10c06e54676e51db
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 175440 f6dc5d29f78684c13c4d49aa9fff7c94
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_arm.deb
Size/MD5 checksum: 366796 ec589953394837dc9e7262881748d1d5
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 405300 f638617d5d10ad818efff8fef2815f9d
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 9303368 f759a6ecd5f1727f5cff479774a2602f
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 618512 e8cbc9c8eca895318be39d9ca4f04523
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 177502 bb227c43e15ee60249c8a5a5f16f1fbd
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 433084 2ce4b1d59e41c5c291c7199bcc6fb9d5
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 178236 7cc4ba752cd13f70620ff7137dbce8a0
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_hppa.deb
Size/MD5 checksum: 857310 f7c02fb3d1dee8f7decdffd2a3b6bd3f
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 175186 a9c3384d138654c8e88d68f32cd2d145
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 172496 425b78dc05726d6665e0aafe0997ec3b
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 855838 eee3404134bb37263f0ef0f04bf0337a
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 368002 c4272fb334334b1605ff79c176c00e3e
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 9300764 89bd6809bba1487479f7c4aa9cfd06b7
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 604926 5304dab5e5f0c0900b33896ded343b2b
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_i386.deb
Size/MD5 checksum: 365918 b8772ed7682c2028bf275cdcb9230e58
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 521858 ef5910b4071a93492e37ffaa792e54c6
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 9315402 abb8f40eb67f00eb44a7ccbf1ae3d9a5
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 192068 9e517f5aa84a7d3ba7f853aaacd0f194
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 878588 9815569fb986a09e7e0283b46c279cbd
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 201788 30ef29ed88c0f577d441613db29d7134
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 657300 2698e002dad3f5ca8a2daa30f5aa36f6
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_ia64.deb
Size/MD5 checksum: 475254 cdbb3e6d452e0bee37691c8d1e21e80d
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 647472 89dcd677a82c850725d27a427074e417
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 175790 2920bababb9c8abc7577aaf2571236c5
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 9301644 210081a84344c3f0fe1f75e3a69f4ccd
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 435676 3fd14c67c544b5072aa40573ed13e86a
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 854796 e2c92a765a76b8c1f28d4b378146ddbc
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 180006 e8827073df24db0522bb7bf825ffeece
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_mips.deb
Size/MD5 checksum: 372486 aa30a661b9ff5547f6abed40e1f78485
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 854742 57beb6f74e26662127429e1d78a824d7
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 180116 846c6c45d717ff883c9cc7e11cc82765
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 365774 d8a1ceb423b0d77b54951002976ac3d8
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 636366 b379e0789244a3bd9dd90b7e21e1c58b
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 9301788 497419c8c083968fc0d54e3121a1095f
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 176030 ac35e877599031d1895304b921d44ae2
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_mipsel.deb
Size/MD5 checksum: 427180 d682d96e183083ef4a571ec2f7c4298b
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 378618 ac31fa084fdaf402f87afb992d0e4919
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 637410 a814ede334af4f81d029ac4ac8c0fb83
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 405942 effc00cf153a20ed907eed3de9c76a8f
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 181936 e0d817c4c004ff2d180e5c87d5ec26b6
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 176484 dae82dca5708965c50779c18285039f8
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 857412 77892bc52041b4296a19c63f3538028f
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_powerpc.deb
Size/MD5 checksum: 9302416 db25b250486fc1e45b51c48c71ed8807
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 401940 00f65f05d9cdff66947f94ddb59a6d80
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 391738 5a298a20cd909782920da383ae77ddbd
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 628426 d77305723f25d00e28ec2523b4759da4
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 9301000 4a540d3fffade4b41a28be56e0a9d24f
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 855364 c1e3fc44c8ac430ad96c9a13f2ea8c58
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 177254 ca9f49f7d4836d4db368379bc120c0b6
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_s390.deb
Size/MD5 checksum: 176500 3d0b34e3944ad7b350d52be7cd70a8cd
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/c/clamav/libclamav2_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 377600 9cd5d18a4719d28d879ba501b45f0582
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 851500 03ec16f173cdb84ea5dbddc775d99788
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 174144 943695d2439ce05aaedaa219c172ca35
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 389560 c3f81ec42378fcd6071ceeec99c8ff65
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 172228 33bd227c0c8ea1c0fb7db99e1e8824bb
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 9298896 2168cb8008c1b7cb0bd593beb567a569
http://security.debian.org/pool/updates/main/c/clamav/clamav-dbg_0.90.1-3etch8_sparc.deb
Size/MD5 checksum: 584086 bded082a151f4bcc4a5be6d798b99cd7
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<;pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFHaVa3Xm3vHE4uyloRAkIlAJ9YeMDZX5mvNpv2rAVgcePjaUpKRQCeP9CR
tNi2ydb9KfZ7Td8mFOWk9eY=
=BLYc
-----END PGP SIGNATURE-----
