USN-4146-2: ClamAV vulnerabilities
USN-4146-1 fixed several vulnerabilities in ClamAV. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that ClamAV incorrectly handled unpacking ZIP files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2019-12625) It was discovered that ClamAV incorrectly handled unpacking bzip2 files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12900)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/clamavto a version that resolves this vulnerability.Fixed in 0.101.4+dfsg-0ubuntu0.14.04.1+esm1 - Upgrade
Upgrade
ubuntu/clamavto a version that resolves this vulnerability.Fixed in 0.101.4+dfsg-0ubuntu0.12.04.1 - Upgrade
Upgrade
ClamAVto a version that resolves this vulnerability.Patch USN-4146-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is USN-4146-2.
What software is affected by this vulnerability?
ClamAV with versions 0.101.4+dfsg-0ubuntu0.14.04.1+esm1 and 0.101.4+dfsg-0ubuntu0.12.04.1 are affected by this vulnerability.
What is the severity of this vulnerability?
The severity of this vulnerability is not specified in the advisory.
How can I fix this vulnerability?
To fix this vulnerability, you should update ClamAV to version 0.101.4+dfsg-0ubuntu0.14.04.1+esm1 for Ubuntu 14.04 ESM, or update to version 0.101.4+dfsg-0ubuntu0.12.04.1 for Ubuntu 12.04 ESM.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability in the advisory USN-4146-1.