USN-4146-1: ClamAV vulnerabilities
It was discovered that ClamAV incorrectly handled unpacking ZIP files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2019-12625) It was discovered that ClamAV incorrectly handled unpacking bzip2 files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12900)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/clamavto a version that resolves this vulnerability.Fixed in 0.101.4+dfsg-0ubuntu0.19.04.1 - Upgrade
Upgrade
ubuntu/clamavto a version that resolves this vulnerability.Fixed in 0.101.4+dfsg-0ubuntu0.18.04.1 - Upgrade
Upgrade
ubuntu/clamavto a version that resolves this vulnerability.Fixed in 0.101.4+dfsg-0ubuntu0.16.04.1
Event History
Frequently Asked Questions
What is the vulnerability ID for the ClamAV vulnerabilities?
The vulnerability ID for the ClamAV vulnerabilities is CVE-2019-12625.
How does the ClamAV vulnerabilities impact users?
The vulnerabilities could allow a remote attacker to cause ClamAV to crash, resulting in a denial of service.
Which version of ClamAV is affected by the vulnerabilities?
ClamAV version 0.101.4+dfsg-0ubuntu0.19.04.1, 0.101.4+dfsg-0ubuntu0.18.04.1, and 0.101.4+dfsg-0ubuntu0.16.04.1 are affected by the vulnerabilities.
How can I fix the ClamAV vulnerabilities?
Update ClamAV to version 0.101.4+dfsg-0ubuntu0.19.04.1, 0.101.4+dfsg-0ubuntu0.18.04.1, or 0.101.4+dfsg-0ubuntu0.16.04.1 to fix the vulnerabilities.
Where can I find more information about the ClamAV vulnerabilities?
You can find more information about the ClamAV vulnerabilities at the following references: [CVE-2019-12625](https://ubuntu.com/security/CVE-2019-12625), [CVE-2019-12900](https://ubuntu.com/security/CVE-2019-12900), [USN-4146-2](https://ubuntu.com/security/notices/USN-4146-2)