Security update for clamav SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2323-1 Final 1 1 2018-08-14T12:45:20Z current 2018-08-14T12:45:20Z 2018-08-14T12:45:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for clamav This update for clamav to version 0.100.1 fixes the following issues: The following security vulnerabilities were addressed: - CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410) - CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412) - CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR parser (bsc#1082858) - CVE-2018-14679: Libmspack heap buffer over-read in CHM parser (bsc#1103040) - Buffer over-read in unRAR code due to missing max value checks in table initialization - PDF parser bugs The following other changes were made: - Disable YARA support for licensing reasons (bsc#1101654). - Add HTTPS support for clamsubmit - Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-1561,SUSE-SLE-DESKTOP-12-SP3-2018-1561,SUSE-SLE-SAP-12-SP1-2018-1561,SUSE-SLE-SAP-12-SP2-2018-1561,SUSE-SLE-SERVER-12-2018-1561,SUSE-SLE-SERVER-12-SP1-2018-1561,SUSE-SLE-SERVER-12-SP2-2018-1561,SUSE-SLE-SERVER-12-SP3-2018-1561,SUSE-Storage-4-2018-1561 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182323-1/ Link for SUSE-SU-2018:2323-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004412.html E-Mail link for SUSE-SU-2018:2323-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1082858 SUSE Bug 1082858 https://bugzilla.suse.com/1101410 SUSE Bug 1101410 https://bugzilla.suse.com/1101412 SUSE Bug 1101412 https://bugzilla.suse.com/1101654 SUSE Bug 1101654 https://bugzilla.suse.com/1103040 SUSE Bug 1103040 https://www.suse.com/security/cve/CVE-2018-0360/ SUSE CVE CVE-2018-0360 page https://www.suse.com/security/cve/CVE-2018-0361/ SUSE CVE CVE-2018-0361 page https://www.suse.com/security/cve/CVE-2018-1000085/ SUSE CVE CVE-2018-1000085 page https://www.suse.com/security/cve/CVE-2018-14679/ SUSE CVE CVE-2018-14679 page SUSE Enterprise Storage 4 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE OpenStack Cloud 7 clamav-0.100.1-33.15.2 clamav-0.100.1-33.15.2 as a component of SUSE Enterprise Storage 4 clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Server 12 SP1-LTSS clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Server 12 SP3 clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Server 12-LTSS clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 clamav-0.100.1-33.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 clamav-0.100.1-33.15.2 as a component of SUSE OpenStack Cloud 7 ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c. CVE-2018-0360 SUSE Enterprise Storage 4:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Desktop 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP1-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP2-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:clamav-0.100.1-33.15.2 SUSE OpenStack Cloud 7:clamav-0.100.1-33.15.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182323-1/ https://www.suse.com/security/cve/CVE-2018-0360.html CVE-2018-0360 https://bugzilla.suse.com/1101410 SUSE Bug 1101410 https://bugzilla.suse.com/1103091 SUSE Bug 1103091 https://bugzilla.suse.com/1103092 SUSE Bug 1103092 https://bugzilla.suse.com/1103099 SUSE Bug 1103099 ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. CVE-2018-0361 SUSE Enterprise Storage 4:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Desktop 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP1-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP2-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:clamav-0.100.1-33.15.2 SUSE OpenStack Cloud 7:clamav-0.100.1-33.15.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182323-1/ https://www.suse.com/security/cve/CVE-2018-0361.html CVE-2018-0361 https://bugzilla.suse.com/1101410 SUSE Bug 1101410 https://bugzilla.suse.com/1101412 SUSE Bug 1101412 https://bugzilla.suse.com/1103091 SUSE Bug 1103091 https://bugzilla.suse.com/1103092 SUSE Bug 1103092 https://bugzilla.suse.com/1103099 SUSE Bug 1103099 ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6. CVE-2018-1000085 SUSE Enterprise Storage 4:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Desktop 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP1-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP2-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:clamav-0.100.1-33.15.2 SUSE OpenStack Cloud 7:clamav-0.100.1-33.15.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182323-1/ https://www.suse.com/security/cve/CVE-2018-1000085.html CVE-2018-1000085 https://bugzilla.suse.com/1082858 SUSE Bug 1082858 https://bugzilla.suse.com/1083915 SUSE Bug 1083915 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash). CVE-2018-14679 SUSE Enterprise Storage 4:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Desktop 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP1-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP2-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12 SP3:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server 12-LTSS:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP1:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:clamav-0.100.1-33.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:clamav-0.100.1-33.15.2 SUSE OpenStack Cloud 7:clamav-0.100.1-33.15.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182323-1/ https://www.suse.com/security/cve/CVE-2018-14679.html CVE-2018-14679 https://bugzilla.suse.com/1102922 SUSE Bug 1102922 https://bugzilla.suse.com/1103032 SUSE Bug 1103032 https://bugzilla.suse.com/1103040 SUSE Bug 1103040