Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 623534 - <app-antivirus/clamav-0.99.3-r2: libclamunrar: Vulnerable to VMSF_DELTA Filter Signedness Error (CVE-2012-6706)
Summary: <app-antivirus/clamav-0.99.3-r2: libclamunrar: Vulnerable to VMSF_DELTA Filte...
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa+ cve]
Depends on: CVE-2018-0202, CVE-2018-1000085
Blocks: CVE-2012-6706
  Show dependency tree
Reported: 2017-07-02 14:38 UTC by Thomas Deutschmann (RETIRED)
Modified: 2018-04-22 22:34 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2017-07-02 14:38:13 UTC
See tracker bug 622380 URL for details.

app-antivirus/clamav's libclamunrar is affected by the VMSF_DELTA Filter Signedness Error.

Possible fix:
Comment 1 Larry the Git Cow gentoo-dev 2018-02-23 19:00:37 UTC
The bug has been referenced in the following commit(s):

commit 69c038dd6c5f79aa46eb92543bed649d50857b66
Author:     Thomas Deutschmann <>
AuthorDate: 2018-02-23 19:00:09 +0000
Commit:     Thomas Deutschmann <>
CommitDate: 2018-02-23 19:00:23 +0000

    app-antivirus/clamav: Rev bump to add patch for CVE-2012-6706
    ...aka VMSF_DELTA Filter Signedness Error.
    Package-Manager: Portage-2.3.24, Repoman-2.3.6

 app-antivirus/clamav/clamav-0.99.3-r2.ebuild       | 160 ++++++++++++++++++
 ...lamav-0.99.3-VMSF_DELTA-fix-CVE-2012-6706.patch | 186 +++++++++++++++++++++
 2 files changed, 346 insertions(+)}
Comment 2 Thomas Raschbacher gentoo-dev 2018-03-02 06:14:29 UTC
I intend to add 0.99.4 later
(Release annoucement:
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2018-03-29 17:12:10 UTC
x86 stable

I marked =app-antivirus/clamav-0.99.3-r2 stable on x86 because this is the latest version which works on x86. So instead of waiting for a fixed 0.99.4 via bug 649314 which contains more security fixes it is better to get available working fixes ASAP than being vulnerable to everything.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2018-04-22 22:34:03 UTC
This issue was resolved and addressed in
 GLSA 201804-16 at
by GLSA coordinator Aaron Bauman (b-man).