Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can use several vulnerabilities of ClamAV.

– Impacted products: ClamAV, Fedora, MBS, openSUSE, Ubuntu
– Severity: 2/4
– Creation date: 29/04/2015

DESCRIPTION OF THE VULNERABILITY

Several vulnerabilities were announced in ClamAV.

An attacker can generate an infinite loop with a y0da file, in
order to trigger a denial of service. [severity:2/4; CVE-2015-2221]

An attacker can use a Petite Packed file, in order to trigger a
denial of service. [severity:2/4; CVE-2015-2222]

An attacker can use a Upack Packed file, in order to trigger a
denial of service. [severity:2/4]

An attacker can use a PE file, in order to trigger a denial of
service. [severity:2/4]

An attacker can generate an infinite loop with an xz file, in
order to trigger a denial of service. [severity:2/4; CVE-2015-2668]

An attacker can generate a buffer overflow in the regcomp()
function of Henry Spencer regex, in order to trigger a denial of
service, and possibly to execute code (VIGILANCE-VUL-16412).
[severity:2/4; CVE-2015-2305]

An attacker can use an upx file, in order to trigger a denial of
service. [severity:2/4; CVE-2015-2170]

An attacker can use an HTML file, in order to trigger a denial of
service. [severity:2/4]

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/ClamAV-eight-vulnerabilities-16759