Kurt Seifried discovered that ClamAV incorrectly handled certain JavaScript files. An attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2013-6497)

Damien Millescamp discovered that ClamAV incorrectly handled certain PE files. An attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-9050).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2488-1 fixed a vulnerability in ClamAV for Ubuntu 14.10, Ubuntu 14.04 LTS, and Ubuntu 12.04 LTS. This update provides the corresponding update for Ubuntu 10.04 LTS.

Sebastian Andrzej Siewior discovered that ClamAV incorrectly handled certain upack packer files. An attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the ClamAV clamd antivirus daemon on the remote host is prior to 0.98.5. It is, therefore, potentially affected by the following vulnerabilities :

  - An error exists related to using the 'clamscan -a'     command to scan certain JavaScript files that could     cause the application to crash. (CVE-2013-6497)

  - Errors exist related to scanning maliciously crafted     Yoda's Crypter files that could cause a heap-based     buffer overflow or an application crash.
    (CVE-2014-9050)

clamav was updated to version 0.98.5 to fix two security issues.

These security issues were fixed :

  - Segmentation fault when processing certain files     (CVE-2013-6497).

  - Heap-based buffer overflow when scanning crypted PE     files (CVE-2014-9050).

The following non-security issues were fixed :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.

  - Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures.

  - Enhancements to the clambc command line utility to     assist ClamAV bytecode signature authors by providing     introspection into compiled bytecode programs.

  - Resolution of many of the warning messages from ClamAV     compilation.

  - Improved detection of malicious PE files.

  - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant     mode (bnc#904207).

  - Fix server socket setup code in clamd (bnc#903489).

  - Change updateclamconf to prefer the state of the old     config file even for commented-out options (bnc#903719).

ClamAV 0.98.5 addresses several reported potential security bugs.

Certain JavaScript files causes ClamAV to segfault when scanned with the -a (list archived files) (CVE-2013-6497).

ClamAV 0.98.5 =============

ClamAV 0.98.5 also includes these new features and bug fixes :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.
    Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures. Andreas Cadhalpun     submitted the patch implementing this support.

    - Enhancements to the clambc command line utility to       assist ClamAV bytecode signature authors by providing       introspection into compiled bytecode programs.

    - Resolution of many of the warning messages from ClamAV       compilation.

    - Improved detection of malicious PE files.

    - Security fix for ClamAV crash when using 'clamscan
      -a'. This issue was identified by Kurt Siefried of Red       Hat.

    - Security fix for ClamAV crash when scanning       maliciously crafted yoda's crypter files. This issue,       as well as several other bugs fixed in this release,       were identified by Damien Millescamp of Oppida.

    - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant       mode. Thanks to Reinhard Max for supplying the patch.

    - Bug fixes and other feature enhancements.

Please see the ChangeLog file or GIT log for further details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file.

clamav was updated to version 0.98.5 to fix three security issues and several non-security issues.

These security issues have been fixed :

  - Crash when scanning maliciously crafted yoda's crypter     files. (CVE-2013-6497)

  - Heap-based buffer overflow when scanning crypted PE     files. (CVE-2014-9050)

  - Crash when using 'clamscan -a'. These non-security     issues have been fixed :

  - Support for the XDP file format and extracting,     decoding, and scanning PDF files within XDP files.

  - Addition of shared library support for LLVM versions 3.1
    - 3.5 for the purpose of just-in-time(JIT) compilation     of ClamAV bytecode signatures.

  - Enhancements to the clambc command line utility to     assist ClamAV bytecode signature authors by providing     introspection into compiled bytecode programs.

  - Resolution of many of the warning messages from ClamAV     compilation.

  - Improved detection of malicious PE files.

  - ClamAV 0.98.5 now works with OpenSSL in FIPS compliant     mode. (bnc#904207)

  - Fix server socket setup code in clamd. (bnc#903489)

  - Change updateclamconf to prefer the state of the old     config file even for commented-out options. (bnc#903719)

  - Fix infinite loop in clamdscan when clamd is not     running.

  - Fix buffer underruns when handling multi-part MIME email     attachments.

  - Fix configuration of OpenSSL on various platforms.

  - Fix linking issues with libclamunrar.

Two bugs were discovered in clamav and are fixed by this release.

One issue is in clamscan, the command line anti-virus scanner included in the package, which could lead to crashes when scanning certain files. (CVE-2013-6497)

The second issue is in libclamav which caused a heap buffer overflow when scanning a specially crafted y0da Crypter obfuscated PE file.
(CVE-2014-9050) 

If you use clamav, we highly recommend that you upgrade to this version.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of ClamAV earlier than 0.98.5 are potentially affected by the following vulnerabilities : 

  - A flaw in the 'clamscan -a' command may cause a denial of service. The issue is triggered when a user opens a malformed JavaScript or Yoda Crypter file, resulting in a loss of availability of the program. (CVE-2013-6497) 

 - An overflow condition in the 'cli_scanpe()' function in 'libclamav/pe.c' may be triggered as user-supplied input is not properly validated when scanning a specially crafted Yoda Crypter file potentially allowing a remote attacker to cause a heap-based buffer overflow resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2013-9050)

ID	Name	Product	Family	Published	Updated	Severity
79598	Ubuntu 14.04 LTS : ClamAV vulnerabilities (USN-2423-1)	Nessus	Ubuntu Local Security Checks	11/27/2014	10/20/2023	high
81341	Ubuntu 10.04 LTS : clamav vulnerability (USN-2488-2)	Nessus	Ubuntu Local Security Checks	2/13/2015	1/19/2021	high
79388	ClamAV < 0.98.5 Multiple Vulnerabilities	Nessus	Misc.	11/21/2014	11/25/2019	medium
79754	openSUSE Security Update : clamav (openSUSE-SU-2014:1560-1)	Nessus	SuSE Local Security Checks	12/6/2014	1/19/2021	medium
79367	Mandriva Linux Security Advisory : clamav (MDVSA-2014:217)	Nessus	Mandriva Local Security Checks	11/21/2014	1/6/2021	low
79772	Fedora 21 : clamav-0.98.5-1.fc21 (2014-15434)	Nessus	Fedora Local Security Checks	12/7/2014	1/11/2021	medium
79399	Fedora 20 : clamav-0.98.5-1.fc20 (2014-15473)	Nessus	Fedora Local Security Checks	11/24/2014	1/11/2021	low
79841	Amazon Linux AMI : clamav (ALAS-2014-457)	Nessus	Amazon Linux Local Security Checks	12/10/2014	4/18/2018	low
79607	Fedora 19 : clamav-0.98.5-1.fc19 (2014-15463)	Nessus	Fedora Local Security Checks	11/28/2014	1/11/2021	medium
79760	SuSE 11.3 Security Update : clamav (SAT Patch Number 10016)	Nessus	SuSE Local Security Checks	12/6/2014	1/19/2021	medium
82240	Debian DLA-95-1 : clamav security update	Nessus	Debian Local Security Checks	3/26/2015	1/11/2021	medium
8825	ClamAV < 0.98.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	7/24/2015	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

low

medium

low

low

medium

medium

medium

medium