Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 623534

Summary: <app-antivirus/clamav-0.99.3-r2: libclamunrar: Vulnerable to VMSF_DELTA Filter Signedness Error (CVE-2012-6706)
Product: Gentoo Security Reporter: Thomas Deutschmann <whissi>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: antivirus, candrews, net-mail+disabled
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
See Also:
Whiteboard: B2 [glsa+ cve]
Package list:
Runtime testing required: ---
Bug Depends on: 649314    
Bug Blocks: 622380    

Description Thomas Deutschmann gentoo-dev Security 2017-07-02 14:38:13 UTC
See tracker bug 622380 URL for details.

app-antivirus/clamav's libclamunrar is affected by the VMSF_DELTA Filter Signedness Error.

Possible fix:
Comment 1 Larry the Git Cow gentoo-dev 2018-02-23 19:00:37 UTC
The bug has been referenced in the following commit(s):

commit 69c038dd6c5f79aa46eb92543bed649d50857b66
Author:     Thomas Deutschmann <>
AuthorDate: 2018-02-23 19:00:09 +0000
Commit:     Thomas Deutschmann <>
CommitDate: 2018-02-23 19:00:23 +0000

    app-antivirus/clamav: Rev bump to add patch for CVE-2012-6706
    ...aka VMSF_DELTA Filter Signedness Error.
    Package-Manager: Portage-2.3.24, Repoman-2.3.6

 app-antivirus/clamav/clamav-0.99.3-r2.ebuild       | 160 ++++++++++++++++++
 ...lamav-0.99.3-VMSF_DELTA-fix-CVE-2012-6706.patch | 186 +++++++++++++++++++++
 2 files changed, 346 insertions(+)}
Comment 2 Thomas Raschbacher gentoo-dev 2018-03-02 06:14:29 UTC
I intend to add 0.99.4 later
(Release annoucement:
Comment 3 Thomas Deutschmann gentoo-dev Security 2018-03-29 17:12:10 UTC
x86 stable

I marked =app-antivirus/clamav-0.99.3-r2 stable on x86 because this is the latest version which works on x86. So instead of waiting for a fixed 0.99.4 via bug 649314 which contains more security fixes it is better to get available working fixes ASAP than being vulnerable to everything.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2018-04-22 22:34:03 UTC
This issue was resolved and addressed in
 GLSA 201804-16 at
by GLSA coordinator Aaron Bauman (b-man).