kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

- Document security/clamav vulnerabilities

Browse source
This commit is contained in:
Ryan Steinmetz 2020-05-17 20:42:24 +00:00
parent f7b60f861f
commit 10b524a0c8
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=535678
1 changed files with 38 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
security/vuxml/vuln.xml
View file

@ -58,6 +58,44 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="91ce95d5-cd15-4105-b942-af5ccc7144c1">
<topic>clamav -- multiple vulnerabilities</topic>
<affects>
<package>
<name>clamav</name>
<range><lt>0.102.3,1</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Micah Snyder reports:</p>
<blockquote cite="https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html">
<p>CVE-2020-3327: Fixed a vulnerability in the ARJ archive-parsing module
in ClamAV 0.102.2 that could cause a denial-of-service condition.
Improper bounds checking of an unsigned variable results in an
out-of-bounds read which causes a crash. Special thanks to Daehui Chang
and Fady Othman for helping identify the ARJ parsing vulnerability.
</p>
<p>CVE-2020-3341: Fixed a vulnerability in the PDF-parsing module in ClamAV
0.101 - 0.102.2 that could cause a denial-of-service condition. Improper
size checking of a buffer used to initialize AES decryption routines
results in an out-of-bounds read, which may cause a crash. OSS-Fuzz
discovered this vulnerability.
</p>
</blockquote>
</body>
</description>
<references>
<url>https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html</url>
<cvename>CVE-2020-3327</cvename>
<cvename>CVE-2020-3341</cvename>
</references>
<dates>
<discovery>2020-05-12</discovery>
<entry>2020-05-14</entry>
</dates>
</vuln>
<vuln vid="ce6db19b-976e-11ea-93c4-08002728f74c">
<topic>Rails -- remote code execution vulnerability</topic>
<affects>