Bug 623538 (CVE-2016-1372)

Summary:	<app-antivirus/clamav-0.99.2: multiple vulnerabilities when processing crafted 7z files
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	antivirus, candrews, net-mail+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://foxglovesecurity.com/2016/06/13/finding-pearls-fuzzing-clamav/
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=623534
Whiteboard:	B3 [noglsa cve]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2017-07-02 14:51:26 UTC

CVE-2016-1372 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1372):
  ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a
  denial of service (application crash) via a crafted 7z file.

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2017-07-02 14:55:23 UTC

@ Maintainer(s): Can you please rev bump and add the patch for bug 623534 so we can handle stabilization together?

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-01-21 03:20:19 UTC

0.99.2-r1 is stable now.

@maintainer(s), please clean the vulnerable versions.

Comment 3 Aaron Bauman (RETIRED) gentoo-dev

2018-01-21 03:24:30 UTC

Sorry, cleanup will be tracked in bug 636212.