A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM
    filenames. (CVE-2018-14680)

  - An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ
    file header extensions could cause a one or two byte overwrite. (CVE-2018-14681)

  - An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the
    TOLOWER() macro for CHM decompression. (CVE-2018-14682)

  - A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service
    (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()"
    function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a
    specially crafted EXE file. (CVE-2018-15378)

The remote host is affected by the vulnerability described in GLSA-201904-12 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for clamav fixes the following issues :

clamav was updated to version 0.100.2.

Following security issues were fixed :

  - CVE-2018-15378: Vulnerability in ClamAV's MEW unpacking     feature that could allow an unauthenticated, remote     attacker to cause a denial of service (DoS) condition on     an affected device. (bsc#1110723)

  - CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: more     fixes for embedded libmspack. (bsc#1103040)

Following non-security issues were addressed :

  - Make freshclam more robust against lagging signature     mirrors.

  - On-Access 'Extra Scanning', an opt-in minor feature of     OnAccess scanning on Linux systems, has been disabled     due to a known issue with resource cleanup     OnAccessExtraScanning will be re-enabled in a future     release when the issue is resolved. In the mean-time,     users who enabled the feature in clamd.conf will see a     warning informing them that the feature is not active.
    For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048

  - Restore exit code compatibility of freshclam with     versions before 0.100.0 when the virus database is     already up to date (bsc#1104457)

This update was imported from the SUSE:SLE-15:Update update project.

An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.(CVE-2018-14681)

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha.
There is an off-by-one error in the TOLOWER() macro for CHM decompression.(CVE-2018-14682)

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha.
It does not reject blank CHM filenames.(CVE-2018-14680)

A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the 'unmew11()' function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file.(CVE-2018-15378)

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha.
There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).(CVE-2018-14679)

ClamAV 0.100.2 has been released! This is a patch release to address several vulnerabilities.

Fixes for the following ClamAV vulnerabilities: CVE-2018-15378:
Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition on an affected device. Reported by Secunia Research at Flexera. Fix for a two-byte buffer over-read bug in ClamAV's PDF parsing code. Reported by Alex Gaynor. Fixes for the following vulnerabilities in bundled third-party libraries: CVE-2018-14680: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames. CVE-2018-14681: An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one- or two-byte overwrite. CVE-2018-14682: An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place

Other changes: Some users have reported freshclam signature update failures as a result of a delay between the time the new signature database content is announced and the time that the content-delivery-network has the content available for download. To mitigate these errors, this patch release includes some modifications to freshclam to make it more lenient, and to reduce the time that freshclam will ignore a mirror when it detects an issue. On-Access 'Extra Scanning,' an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active.
For details, click here.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav fixes the following issues :

clamav was updated to version 0.100.2.

Following security issues were fixed :

CVE-2018-15378: Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. (bsc#1110723)

CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: more fixes for embedded libmspack. (bsc#1103040)

Following non-security issues were addressed: Make freshclam more robust against lagging signature mirrors.

On-Access 'Extra Scanning', an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active. For details, see:
https://bugzilla.clamav.net/show_bug.cgi?id=12048

Restore exit code compatibility of freshclam with versions before 0.100.0 when the virus database is already up to date (bsc#1104457)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav fixes the following issues :

clamav was updated to version 0.100.2 :

  - CVE-2018-15378: Vulnerability in ClamAV's MEW unpacking     feature that could allow an unauthenticated, remote     attacker to cause a denial of service (DoS) condition on     an affected device. (bsc#1110723)

  - CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: more     fixes for embedded libmspack. (bsc#1103040)

  - Make freshclam more robust against lagging signature     mirrors.

  - On-Access 'Extra Scanning', an opt-in minor feature of     OnAccess scanning on Linux systems, has been disabled     due to a known issue with resource cleanup     OnAccessExtraScanning will be re-enabled in a future     release when the issue is resolved. In the mean-time,     users who enabled the feature in clamd.conf will see a     warning informing them that the feature is not active.
    For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048

  - Restore exit code compatibility of freshclam with     versions before 0.100.0 when the virus database is     already up to date (bsc#1104457).

This update was imported from the SUSE:SLE-12:Update update project.

This update for clamav fixes the following issues :

Clamav was updated to version 0.100.2 :

CVE-2018-15378: Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. (bsc#1110723)

CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: more fixes for embedded libmspack. (bsc#1103040)

Make freshclam more robust against lagging signature mirrors.

On-Access 'Extra Scanning', an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active. For details, see:
https://bugzilla.clamav.net/show_bug.cgi?id=12048

Restore exit code compatibility of freshclam with versions before 0.100.0 when the virus database is already up to date (bsc#1104457).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav fixes the following issues :

clamav was updated to version 0.100.2 :

CVE-2018-15378: Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. (bsc#1110723)

CVE-2018-14680, CVE-2018-14681, CVE-2018-14682: more fixes for embedded libmspack. (bsc#1103040)

Make freshclam more robust against lagging signature mirrors.

On-Access 'Extra Scanning', an opt-in minor feature of OnAccess scanning on Linux systems, has been disabled due to a known issue with resource cleanup OnAccessExtraScanning will be re-enabled in a future release when the issue is resolved. In the mean-time, users who enabled the feature in clamd.conf will see a warning informing them that the feature is not active. For details, see:
https://bugzilla.clamav.net/show_bug.cgi?id=12048

Restore exit code compatibility of freshclam with versions before 0.100.0 when the virus database is already up to date (bsc#1104457).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ClamAV is an anti-virus utility for Unix, whose upstream developers have released the version 0.100.2. Installing this new version is required to make use of all current virus signatures and to avoid warnings.

This version also fixes a security issue discovered after version 0.100.1 :

CVE-2018-15378 :

A vulnerability in ClamAV's MEW unpacker may allow unauthenticated remote offenders to cause a denial of service (DoS) via a specially crafted EXE file.

For Debian 8 'Jessie', this problem has been fixed in version 0.100.2+dfsg-0+deb8u1.

We recommend that you upgrade your clamav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3789-1 advisory.

    It was discovered that ClamAV incorrectly handled unpacking MEW executables. A remote attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Joel Esler reports :

- CVE-2018-15378 :

- Vulnerability in ClamAV's MEW unpacking feature that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

- Reported by Secunia Research at Flexera.

- Fix for a 2-byte buffer over-read bug in ClamAV&s PDF parsing code.

- Reported by Alex Gaynor.

- CVE-2018-14680 :

- An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.

- CVE-2018-14681 :

- An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.

- CVE-2018-14682 :

- An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression. Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied libmspack's version of the fix in its place.

ID	Name	Product	Family	Severity
403839	Alpine: multiple clamav packages, multiple freshclam packages: security update to 0.100.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403839	Alpine: multiple clamav packages, multiple freshclam packages: security update to 0.100.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400664	Alpine: multiple clamav packages, multiple freshclam packages: security update to 0.100.1-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400664	Alpine: multiple clamav packages, multiple freshclam packages: security update to 0.100.1-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
123984	GLSA-201904-12 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123346	openSUSE Security Update : clamav (openSUSE-2019-821)	Nessus	SuSE Local Security Checks	high
121131	Amazon Linux AMI : clamav (ALAS-2019-1146)	Nessus	Amazon Linux Local Security Checks	high
120891	Fedora 28 : clamav (2018-eff94da132)	Nessus	Fedora Local Security Checks	high
120579	Fedora 29 : clamav (2018-847fe2ed61)	Nessus	Fedora Local Security Checks	high
120135	SUSE SLED15 / SLES15 Security Update : clamav (SUSE-SU-2018:3250-1)	Nessus	SuSE Local Security Checks	high
118483	openSUSE Security Update : clamav (openSUSE-2018-1310)	Nessus	SuSE Local Security Checks	high
118455	SUSE SLES11 Security Update : clamav (SUSE-SU-2018:3441-1)	Nessus	SuSE Local Security Checks	high
118454	SUSE SLED12 / SLES12 Security Update : clamav (SUSE-SU-2018:3436-1)	Nessus	SuSE Local Security Checks	high
118364	Debian DLA-1553-1 : clamav security update	Nessus	Debian Local Security Checks	medium
118342	openSUSE Security Update : clamav (openSUSE-2018-1227)	Nessus	SuSE Local Security Checks	high
118159	Fedora 27 : clamav (2018-1fc39f2d13)	Nessus	Fedora Local Security Checks	high
118082	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ClamAV vulnerability (USN-3789-1)	Nessus	Ubuntu Local Security Checks	medium
117911	FreeBSD : clamav -- multiple vulnerabilities (8b812395-c739-11e8-ab5b-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-15378

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

medium

high