First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 218064
Alias:
Product:
Component:
Status: ASSIGNED
Resolution:
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Hanno Boeck <hanno@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 218064 depends on: Show dependency tree
Show dependency graph
Bug 218064 blocks:

Additional Comments: (this is where you put emerge --info)








View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2008-04-17 08:16 0000 
unrar-gpl shares code from libclamav, thus is also affected by CVE-2008-1837.

I can't reproduce the issue on current cvs snapshot (just committed), thus I
assume it's safe, although it hasn't seen any updates recently.

------- Comment #1 From Markus Meier 2008-04-17 21:43:07 0000 ------- 
amd64/x86 stable, last arches.

------- Comment #2 From Robert Buchholz 2008-04-18 00:03:16 0000 ------- 
Hanno, can you please confirm that this is actually fixed? What makes me wonder
is that the last CVS commit is 7 months old, and the latest affected clamav
version was released only 2 months ago.

------- Comment #3 From Hanno Boeck 2008-04-18 10:53:20 0000 ------- 
rbu, I'm not really sure, I was wondering the same.

I wrote to the clamav-dev asking for the samples and he sent me three rar-files
crashing clamav < 0.93. All three don't crash latest unrar (while they crash
the older snapshot), so from my tests they are safe. I don't have an
explanation for that though.

------- Comment #4 From Robert Buchholz 2008-04-18 11:14:11 0000 ------- 
If you still have contact upstream, you could ask for the patch fixing
CVE-2008-1837.

------- Comment #5 From Robert Buchholz 2008-04-23 17:12:34 0000 ------- 
Hanno: The only difference between the two versions you tried was removing
"unrar30" code, which is removed from the upstream libclamav for some time. The
diff that is called "check in 0.93 patches" is this:
http://svn.clamav.net/websvn/comp.php?repname=clamav-devel&path=&compare%5B%5D=%2Ftrunk%2Flibclamunrar%2F@3787&compare%5B%5D=%2Ftrunk%2Flibclamunrar%2F@3788

------- Comment #6 From Pierre-Yves Rofes 2008-05-05 21:26:54 0000 ------- 
any news here?
First Last Prev Next    No search results available      Search page      Enter new bug