clamav
Page content
- Author: voroskoi
- Vulnerable: 0.88.7-1siwenna1
- Unaffected: 0.90-1siwenna1
Two vulnerabilities have been reported in ClamAV, which can be exploited by malicious people to cause a DoS (Denial of Service).
- Input passed via the “id” parameter when parsing MIME headers is not properly sanitised before being used to create local files. This can be exploited to e.g. overwrite the anti-virus signature file via directory traversal attacks, preventing malware from being detected.
- An file descriptor leak error in the processing of CAB files can be exploited to e.g. prevent legitimate users from sending out valid archives via a specially crafted CAB file with a cabinet header containing a record length of zero.
- Bug Tracker URL: http://bugs.frugalware.org/task/1714