USN-945-1: ClamAV vulnerabilities

Releases

• Ubuntu 10.04
• Ubuntu 9.10
• Ubuntu 9.04

Packages

• clamav - anti-virus utility for Unix

Details

It was discovered that ClamAV did not properly reallocate memory when
processing certain PDF files. A remote attacker could send a specially
crafted PDF and crash ClamAV. (CVE-2010-1639)

An out of bounds memory access flaw was discovered in ClamAV. A remote
attacker could send a specially crafted Portable Executable (PE) file
and crash ClamAV. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-2077)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• libclamav6 - 0.95.3+dfsg-1ubuntu0.09.10.2

Ubuntu 9.04

• libclamav6 - 0.95.3+dfsg-1ubuntu0.09.04.2

Ubuntu 10.04

• libclamav6 - 0.96.1+dfsg-0ubuntu0.10.04.1

In general, a standard system update will make all the necessary
changes. For Ubuntu 10.04 LTS, this update uses a new upstream release,
which includes additional bug fixes.

References

• CVE-2010-1639
• CVE-2010-2077