Security update for clamav SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0291-1 Final 1 1 2015-02-06T10:49:40Z current 2015-02-06T10:49:40Z 2015-02-06T10:49:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for clamav clamav was updated to version 0.98.6 to fix four security issues. These security issues were fixed: - CVE-2015-1462: ClamAV allowed remote attackers to have unspecified impact via a crafted upx packer file, related to a heap out of bounds condition (bnc#916214). - CVE-2015-1463: ClamAV allowed remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an incorrect compiler optimization (bnc#916215). - CVE-2014-9328: ClamAV allowed remote attackers to have unspecified impact via a crafted upack packer file, related to a heap out of bounds condition (bnc#915512). - CVE-2015-1461: ClamAV allowed remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a heap out of bounds condition (bnc#916217). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-2015-75,SUSE-SLE-SERVER-12-2015-75 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150291-1/ Link for SUSE-SU-2015:0291-1 https://lists.suse.com/pipermail/sle-security-updates/2015-February/001226.html E-Mail link for SUSE-SU-2015:0291-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/915512 SUSE Bug 915512 https://bugzilla.suse.com/916214 SUSE Bug 916214 https://bugzilla.suse.com/916215 SUSE Bug 916215 https://bugzilla.suse.com/916217 SUSE Bug 916217 https://www.suse.com/security/cve/CVE-2014-9328/ SUSE CVE CVE-2014-9328 page https://www.suse.com/security/cve/CVE-2015-1461/ SUSE CVE CVE-2015-1461 page https://www.suse.com/security/cve/CVE-2015-1462/ SUSE CVE CVE-2015-1462 page https://www.suse.com/security/cve/CVE-2015-1463/ SUSE CVE CVE-2015-1463 page SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server for SAP Applications 12 clamav-0.98.6-10.1 clamav-0.98.6-10.1 as a component of SUSE Linux Enterprise Desktop 12 clamav-0.98.6-10.1 as a component of SUSE Linux Enterprise Server 12 clamav-0.98.6-10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upack packer file, related to a "heap out of bounds condition." CVE-2014-9328 SUSE Linux Enterprise Desktop 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server for SAP Applications 12:clamav-0.98.6-10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150291-1/ https://www.suse.com/security/cve/CVE-2014-9328.html CVE-2014-9328 https://bugzilla.suse.com/1040662 SUSE Bug 1040662 https://bugzilla.suse.com/915512 SUSE Bug 915512 ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition." CVE-2015-1461 SUSE Linux Enterprise Desktop 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server for SAP Applications 12:clamav-0.98.6-10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150291-1/ https://www.suse.com/security/cve/CVE-2015-1461.html CVE-2015-1461 https://bugzilla.suse.com/1040662 SUSE Bug 1040662 https://bugzilla.suse.com/916217 SUSE Bug 916217 ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition." CVE-2015-1462 SUSE Linux Enterprise Desktop 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server for SAP Applications 12:clamav-0.98.6-10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150291-1/ https://www.suse.com/security/cve/CVE-2015-1462.html CVE-2015-1462 https://bugzilla.suse.com/1040662 SUSE Bug 1040662 https://bugzilla.suse.com/916214 SUSE Bug 916214 ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization." CVE-2015-1463 SUSE Linux Enterprise Desktop 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server 12:clamav-0.98.6-10.1 SUSE Linux Enterprise Server for SAP Applications 12:clamav-0.98.6-10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150291-1/ https://www.suse.com/security/cve/CVE-2015-1463.html CVE-2015-1463 https://bugzilla.suse.com/1040662 SUSE Bug 1040662 https://bugzilla.suse.com/916215 SUSE Bug 916215