Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 623538 (CVE-2016-1372)

Summary: <app-antivirus/clamav-0.99.2: multiple vulnerabilities when processing crafted 7z files
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: antivirus, candrews, net-mail
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://foxglovesecurity.com/2016/06/13/finding-pearls-fuzzing-clamav/
See Also: https://bugs.gentoo.org/show_bug.cgi?id=623534
Whiteboard: B3 [noglsa cve]
Package list:
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2017-07-02 14:51:26 UTC
CVE-2016-1372 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1372):
  ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a
  denial of service (application crash) via a crafted 7z file.
Comment 1 Thomas Deutschmann gentoo-dev Security 2017-07-02 14:55:23 UTC
@ Maintainer(s): Can you please rev bump and add the patch for bug 623534 so we can handle stabilization together?
Comment 2 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2018-01-21 03:20:19 UTC
0.99.2-r1 is stable now.

@maintainer(s), please clean the vulnerable versions.
Comment 3 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2018-01-21 03:24:30 UTC
Sorry, cleanup will be tracked in bug 636212.