Security update for clamav SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0453-1 Final 1 1 2023-02-20T11:05:33Z current 2023-02-20T11:05:33Z 2023-02-20T11:05:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for clamav This update for clamav fixes the following issues: - CVE-2023-20032: Fixed a possible remote code execution vulnerability in the HFS+ file parser (bsc#1208363). - CVE-2023-20052: Fixed a possible remote information leak vulnerability in the DMG file parser (bsc#1208365). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-453,SUSE-OpenStack-Cloud-9-2023-453,SUSE-OpenStack-Cloud-Crowbar-9-2023-453,SUSE-SLE-SAP-12-SP4-2023-453,SUSE-SLE-SERVER-12-SP2-BCL-2023-453,SUSE-SLE-SERVER-12-SP4-LTSS-2023-453 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230453-1/ Link for SUSE-SU-2023:0453-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013839.html E-Mail link for SUSE-SU-2023:0453-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1208363 SUSE Bug 1208363 https://bugzilla.suse.com/1208365 SUSE Bug 1208365 https://www.suse.com/security/cve/CVE-2023-20032/ SUSE CVE CVE-2023-20032 page https://www.suse.com/security/cve/CVE-2023-20052/ SUSE CVE CVE-2023-20052 page SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 clamav-0.103.8-33.53.1 clamav-0.103.8-33.53.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL clamav-0.103.8-33.53.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS clamav-0.103.8-33.53.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 clamav-0.103.8-33.53.1 as a component of SUSE OpenStack Cloud 9 clamav-0.103.8-33.53.1 as a component of SUSE OpenStack Cloud Crowbar 9 On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"]. CVE-2023-20032 SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1 SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1 SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1 SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230453-1/ https://www.suse.com/security/cve/CVE-2023-20032.html CVE-2023-20032 https://bugzilla.suse.com/1208363 SUSE Bug 1208363 https://bugzilla.suse.com/1211720 SUSE Bug 1211720 On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process. CVE-2023-20052 SUSE Linux Enterprise Server 12 SP2-BCL:clamav-0.103.8-33.53.1 SUSE Linux Enterprise Server 12 SP4-LTSS:clamav-0.103.8-33.53.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:clamav-0.103.8-33.53.1 SUSE OpenStack Cloud 9:clamav-0.103.8-33.53.1 SUSE OpenStack Cloud Crowbar 9:clamav-0.103.8-33.53.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230453-1/ https://www.suse.com/security/cve/CVE-2023-20052.html CVE-2023-20052 https://bugzilla.suse.com/1208365 SUSE Bug 1208365