clamav-0.103.3-1.4 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10685-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z clamav-0.103.3-1.4 on GA media These are all security issues fixed in the clamav-0.103.3-1.4 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10685 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2005-3239/ SUSE CVE CVE-2005-3239 page https://www.suse.com/security/cve/CVE-2005-3303/ SUSE CVE CVE-2005-3303 page https://www.suse.com/security/cve/CVE-2006-1614/ SUSE CVE CVE-2006-1614 page https://www.suse.com/security/cve/CVE-2006-1989/ SUSE CVE CVE-2006-1989 page https://www.suse.com/security/cve/CVE-2006-4182/ SUSE CVE CVE-2006-4182 page https://www.suse.com/security/cve/CVE-2006-5874/ SUSE CVE CVE-2006-5874 page https://www.suse.com/security/cve/CVE-2007-0897/ SUSE CVE CVE-2007-0897 page https://www.suse.com/security/cve/CVE-2007-0898/ SUSE CVE CVE-2007-0898 page https://www.suse.com/security/cve/CVE-2007-1745/ SUSE CVE CVE-2007-1745 page https://www.suse.com/security/cve/CVE-2007-1997/ SUSE CVE CVE-2007-1997 page https://www.suse.com/security/cve/CVE-2007-6335/ SUSE CVE CVE-2007-6335 page https://www.suse.com/security/cve/CVE-2007-6336/ SUSE CVE CVE-2007-6336 page https://www.suse.com/security/cve/CVE-2007-6337/ SUSE CVE CVE-2007-6337 page https://www.suse.com/security/cve/CVE-2007-6595/ SUSE CVE CVE-2007-6595 page https://www.suse.com/security/cve/CVE-2007-6596/ SUSE CVE CVE-2007-6596 page https://www.suse.com/security/cve/CVE-2008-0318/ SUSE CVE CVE-2008-0318 page https://www.suse.com/security/cve/CVE-2008-0728/ SUSE CVE CVE-2008-0728 page https://www.suse.com/security/cve/CVE-2008-1100/ SUSE CVE CVE-2008-1100 page https://www.suse.com/security/cve/CVE-2008-2713/ SUSE CVE CVE-2008-2713 page https://www.suse.com/security/cve/CVE-2010-1205/ SUSE CVE CVE-2010-1205 page https://www.suse.com/security/cve/CVE-2012-6706/ SUSE CVE CVE-2012-6706 page https://www.suse.com/security/cve/CVE-2017-11423/ SUSE CVE CVE-2017-11423 page https://www.suse.com/security/cve/CVE-2017-12374/ SUSE CVE CVE-2017-12374 page https://www.suse.com/security/cve/CVE-2017-12375/ SUSE CVE CVE-2017-12375 page https://www.suse.com/security/cve/CVE-2017-12376/ SUSE CVE CVE-2017-12376 page https://www.suse.com/security/cve/CVE-2017-12377/ SUSE CVE CVE-2017-12377 page https://www.suse.com/security/cve/CVE-2017-12378/ SUSE CVE CVE-2017-12378 page https://www.suse.com/security/cve/CVE-2017-12379/ SUSE CVE CVE-2017-12379 page https://www.suse.com/security/cve/CVE-2017-12380/ SUSE CVE CVE-2017-12380 page https://www.suse.com/security/cve/CVE-2017-6418/ SUSE CVE CVE-2017-6418 page https://www.suse.com/security/cve/CVE-2017-6419/ SUSE CVE CVE-2017-6419 page https://www.suse.com/security/cve/CVE-2017-6420/ SUSE CVE CVE-2017-6420 page https://www.suse.com/security/cve/CVE-2018-0202/ SUSE CVE CVE-2018-0202 page https://www.suse.com/security/cve/CVE-2018-0360/ SUSE CVE CVE-2018-0360 page https://www.suse.com/security/cve/CVE-2018-0361/ SUSE CVE CVE-2018-0361 page https://www.suse.com/security/cve/CVE-2018-1000085/ SUSE CVE CVE-2018-1000085 page https://www.suse.com/security/cve/CVE-2018-14680/ SUSE CVE CVE-2018-14680 page https://www.suse.com/security/cve/CVE-2018-15378/ SUSE CVE CVE-2018-15378 page https://www.suse.com/security/cve/CVE-2019-12625/ SUSE CVE CVE-2019-12625 page https://www.suse.com/security/cve/CVE-2019-12900/ SUSE CVE CVE-2019-12900 page https://www.suse.com/security/cve/CVE-2019-15961/ SUSE CVE CVE-2019-15961 page https://www.suse.com/security/cve/CVE-2019-1785/ SUSE CVE CVE-2019-1785 page https://www.suse.com/security/cve/CVE-2019-1786/ SUSE CVE CVE-2019-1786 page https://www.suse.com/security/cve/CVE-2019-1787/ SUSE CVE CVE-2019-1787 page https://www.suse.com/security/cve/CVE-2019-1788/ SUSE CVE CVE-2019-1788 page https://www.suse.com/security/cve/CVE-2019-1789/ SUSE CVE CVE-2019-1789 page https://www.suse.com/security/cve/CVE-2019-1798/ SUSE CVE CVE-2019-1798 page https://www.suse.com/security/cve/CVE-2020-3123/ SUSE CVE CVE-2020-3123 page https://www.suse.com/security/cve/CVE-2020-3327/ SUSE CVE CVE-2020-3327 page https://www.suse.com/security/cve/CVE-2020-3341/ SUSE CVE CVE-2020-3341 page https://www.suse.com/security/cve/CVE-2020-3350/ SUSE CVE CVE-2020-3350 page https://www.suse.com/security/cve/CVE-2020-3481/ SUSE CVE CVE-2020-3481 page https://www.suse.com/security/cve/CVE-2021-1252/ SUSE CVE CVE-2021-1252 page https://www.suse.com/security/cve/CVE-2021-1404/ SUSE CVE CVE-2021-1404 page https://www.suse.com/security/cve/CVE-2021-1405/ SUSE CVE CVE-2021-1405 page openSUSE Tumbleweed clamav-0.103.3-1.4 clamav-devel-0.103.3-1.4 clamav-milter-0.103.3-1.4 libclamav9-0.103.3-1.4 libfreshclam2-0.103.3-1.4 clamav-0.103.3-1.4 as a component of openSUSE Tumbleweed clamav-devel-0.103.3-1.4 as a component of openSUSE Tumbleweed clamav-milter-0.103.3-1.4 as a component of openSUSE Tumbleweed libclamav9-0.103.3-1.4 as a component of openSUSE Tumbleweed libfreshclam2-0.103.3-1.4 as a component of openSUSE Tumbleweed The OLE2 unpacker in clamd in Clam AntiVirus (ClamAV) 0.87-1 allows remote attackers to cause a denial of service (segmentation fault) via a DOC file with an invalid property tree, which triggers an infinite recursion in the ole2_walk_property_tree function. CVE-2005-3239 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2005-3239.html CVE-2005-3239 https://bugzilla.suse.com/132305 SUSE Bug 132305 The FSG unpacker (fsg.c) in Clam AntiVirus (ClamAV) 0.80 through 0.87 allows remote attackers to cause "memory corruption" and execute arbitrary code via a crafted FSG 1.33 file. CVE-2005-3303 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2005-3303.html CVE-2005-3303 https://bugzilla.suse.com/132305 SUSE Bug 132305 Integer overflow in the cli_scanpe function in the PE header parser (libclamav/pe.c) in Clam AntiVirus (ClamAV) before 0.88.1, when ArchiveMaxFileSize is disabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code. CVE-2006-1614 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-1614.html CVE-2006-1614 https://bugzilla.suse.com/164039 SUSE Bug 164039 Buffer overflow in the get_database function in the HTTP client in Freshclam in ClamAV 0.80 to 0.88.1 might allow remote web servers to execute arbitrary code via long HTTP headers. CVE-2006-1989 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-1989.html CVE-2006-1989 https://bugzilla.suse.com/171496 SUSE Bug 171496 Integer overflow in ClamAV 0.88.1 and 0.88.4, and other versions before 0.88.5, allows remote attackers to cause a denial of service (scanning service crash) and execute arbitrary code via a crafted Portable Executable (PE) file that leads to a heap-based buffer overflow when less memory is allocated than expected. CVE-2006-4182 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-4182.html CVE-2006-4182 https://bugzilla.suse.com/212898 SUSE Bug 212898 Clam AntiVirus (ClamAV) 0.88 and earlier allows remote attackers to cause a denial of service (crash) via a malformed base64-encoded MIME attachment that triggers a null pointer dereference. CVE-2006-5874 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2006-5874.html CVE-2006-5874 https://bugzilla.suse.com/227827 SUSE Bug 227827 Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor. CVE-2007-0897 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-0897.html CVE-2007-0897 https://bugzilla.suse.com/246214 SUSE Bug 246214 Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message. CVE-2007-0898 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-0898.html CVE-2007-0898 https://bugzilla.suse.com/246214 SUSE Bug 246214 The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897. NOTE: some of these details are obtained from third party information. CVE-2007-1745 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-1745.html CVE-2007-1745 https://bugzilla.suse.com/264189 SUSE Bug 264189 Integer signedness error in the (1) cab_unstore and (2) cab_extract functions in libclamav/cab.c in Clam AntiVirus (ClamAV) before 0.90.2 allow remote attackers to execute arbitrary code via a crafted CHM file that contains a negative integer, which passes a signed comparison and leads to a stack-based buffer overflow. CVE-2007-1997 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-1997.html CVE-2007-1997 https://bugzilla.suse.com/264189 SUSE Bug 264189 Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, which triggers a heap-based buffer overflow. CVE-2007-6335 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-6335.html CVE-2007-6335 https://bugzilla.suse.com/343277 SUSE Bug 343277 Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file. CVE-2007-6336 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-6336.html CVE-2007-6336 https://bugzilla.suse.com/343277 SUSE Bug 343277 Unspecified vulnerability in the bzip2 decompression algorithm in nsis/bzlib_private.h in ClamAV before 0.92 has unknown impact and remote attack vectors. CVE-2007-6337 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-6337.html CVE-2007-6337 https://bugzilla.suse.com/343277 SUSE Bug 343277 ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on (1) temporary files used by the cli_gentempfd function in libclamav/others.c or on (2) .ascii files used by sigtool, when utf16-decode is enabled. CVE-2007-6595 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-6595.html CVE-2007-6595 https://bugzilla.suse.com/350987 SUSE Bug 350987 ClamAV 0.92 does not recognize Base64 UUEncoded archives, which allows remote attackers to bypass the scanner via a Base64-UUEncoded file. CVE-2007-6596 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2007-6596.html CVE-2007-6596 https://bugzilla.suse.com/350987 SUSE Bug 350987 Integer overflow in the cli_scanpe function in libclamav in ClamAV before 0.92.1, as used in clamd, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Petite packed PE file, which triggers a heap-based buffer overflow. CVE-2008-0318 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-0318.html CVE-2008-0318 https://bugzilla.suse.com/361374 SUSE Bug 361374 The unmew11 function in libclamav/mew.c in libclamav in ClamAV before 0.92.1 has unknown impact and attack vectors that trigger "heap corruption." CVE-2008-0728 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-0728.html CVE-2008-0728 https://bugzilla.suse.com/361403 SUSE Bug 361403 Buffer overflow in the cli_scanpe function in libclamav (libclamav/pe.c) for ClamAV 0.92 and 0.92.1 allows remote attackers to execute arbitrary code via a crafted Upack PE file. CVE-2008-1100 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-1100.html CVE-2008-1100 https://bugzilla.suse.com/368963 SUSE Bug 368963 https://bugzilla.suse.com/379695 SUSE Bug 379695 libclamav/petite.c in ClamAV before 0.93.1 allows remote attackers to cause a denial of service via a crafted Petite file that triggers an out-of-bounds read. CVE-2008-2713 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2008-2713.html CVE-2008-2713 https://bugzilla.suse.com/399302 SUSE Bug 399302 https://bugzilla.suse.com/406994 SUSE Bug 406994 Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row. CVE-2010-1205 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 critical 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2010-1205.html CVE-2010-1205 https://bugzilla.suse.com/1188284 SUSE Bug 1188284 https://bugzilla.suse.com/617866 SUSE Bug 617866 https://bugzilla.suse.com/622506 SUSE Bug 622506 https://bugzilla.suse.com/639941 SUSE Bug 639941 https://bugzilla.suse.com/854395 SUSE Bug 854395 A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos]. CVE-2012-6706 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 critical 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2012-6706.html CVE-2012-6706 https://bugzilla.suse.com/1045315 SUSE Bug 1045315 https://bugzilla.suse.com/1045490 SUSE Bug 1045490 https://bugzilla.suse.com/1053919 SUSE Bug 1053919 https://bugzilla.suse.com/1083915 SUSE Bug 1083915 The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. CVE-2017-11423 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-11423.html CVE-2017-11423 https://bugzilla.suse.com/1049423 SUSE Bug 1049423 https://bugzilla.suse.com/1083915 SUSE Bug 1083915 The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing operations (mbox.c operations on bounce messages). If successfully exploited, the ClamAV software could allow a variable pointing to the mail body which could cause a used after being free (use-after-free) instance which may lead to a disruption of services on an affected device to include a denial of service condition. CVE-2017-12374 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12374.html CVE-2017-12374 https://bugzilla.suse.com/1077732 SUSE Bug 1077732 The ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of input validation checking mechanisms during certain mail parsing functions (the rfc2047 function in mbox.c). An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition on an affected device. CVE-2017-12375 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12375.html CVE-2017-12375 https://bugzilla.suse.com/1077732 SUSE Bug 1077732 ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause a handle_pdfname (in pdf.c) buffer overflow when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code. CVE-2017-12376 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12376.html CVE-2017-12376 https://bugzilla.suse.com/1077732 SUSE Bug 1077732 ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in mew packet files sent to an affected device. A successful exploit could cause a heap-based buffer over-read condition in mew.c when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition or potentially execute arbitrary code on the affected device. CVE-2017-12377 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12377.html CVE-2017-12377 https://bugzilla.suse.com/1077732 SUSE Bug 1077732 ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms of .tar (Tape Archive) files sent to an affected device. A successful exploit could cause a checksum buffer over-read condition when ClamAV scans the malicious .tar file, potentially allowing the attacker to cause a DoS condition on the affected device. CVE-2017-12378 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12378.html CVE-2017-12378 https://bugzilla.suse.com/1077732 SUSE Bug 1077732 ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. The vulnerability is due to improper input validation checking mechanisms in the message parsing function on an affected system. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. This action could cause a messageAddArgument (in message.c) buffer overflow condition when ClamAV scans the malicious email, allowing the attacker to potentially cause a DoS condition or execute arbitrary code on an affected device. CVE-2017-12379 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12379.html CVE-2017-12379 https://bugzilla.suse.com/1077732 SUSE Bug 1077732 ClamAV AntiVirus software versions 0.99.2 and prior contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms in mbox.c during certain mail parsing functions of the ClamAV software. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted email to the affected device. An exploit could trigger a NULL pointer dereference condition when ClamAV scans the malicious email, which may result in a DoS condition. CVE-2017-12380 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-12380.html CVE-2017-12380 https://bugzilla.suse.com/1077732 SUSE Bug 1077732 libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. CVE-2017-6418 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6418.html CVE-2017-6418 https://bugzilla.suse.com/1052466 SUSE Bug 1052466 mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. CVE-2017-6419 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6419.html CVE-2017-6419 https://bugzilla.suse.com/1052449 SUSE Bug 1052449 https://bugzilla.suse.com/1083915 SUSE Bug 1083915 The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. CVE-2017-6420 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6420.html CVE-2017-6420 https://bugzilla.suse.com/1052448 SUSE Bug 1052448 clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format (.pdf) files sent to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending a crafted .pdf file to an affected device. This action could cause an out-of-bounds read when ClamAV scans the malicious file, allowing the attacker to cause a DoS condition. This concerns pdf_parse_array and pdf_parse_string in libclamav/pdfng.c. Cisco Bug IDs: CSCvh91380, CSCvh91400. CVE-2018-0202 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-0202.html CVE-2018-0202 https://bugzilla.suse.com/1083915 SUSE Bug 1083915 ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c. CVE-2018-0360 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-0360.html CVE-2018-0360 https://bugzilla.suse.com/1101410 SUSE Bug 1101410 https://bugzilla.suse.com/1103091 SUSE Bug 1103091 https://bugzilla.suse.com/1103092 SUSE Bug 1103092 https://bugzilla.suse.com/1103099 SUSE Bug 1103099 ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file. CVE-2018-0361 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-0361.html CVE-2018-0361 https://bugzilla.suse.com/1101410 SUSE Bug 1101410 https://bugzilla.suse.com/1101412 SUSE Bug 1101412 https://bugzilla.suse.com/1103091 SUSE Bug 1103091 https://bugzilla.suse.com/1103092 SUSE Bug 1103092 https://bugzilla.suse.com/1103099 SUSE Bug 1103099 ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6. CVE-2018-1000085 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1000085.html CVE-2018-1000085 https://bugzilla.suse.com/1082858 SUSE Bug 1082858 https://bugzilla.suse.com/1083915 SUSE Bug 1083915 An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames. CVE-2018-14680 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-14680.html CVE-2018-14680 https://bugzilla.suse.com/1102922 SUSE Bug 1102922 https://bugzilla.suse.com/1103032 SUSE Bug 1103032 https://bugzilla.suse.com/1103040 SUSE Bug 1103040 A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file. CVE-2018-15378 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-15378.html CVE-2018-15378 https://bugzilla.suse.com/1110723 SUSE Bug 1110723 ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. CVE-2019-12625 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-12625.html CVE-2019-12625 https://bugzilla.suse.com/1144504 SUSE Bug 1144504 BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-12900 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-12900.html CVE-2019-12900 https://bugzilla.suse.com/1139083 SUSE Bug 1139083 https://bugzilla.suse.com/1141513 SUSE Bug 1141513 https://bugzilla.suse.com/1149458 SUSE Bug 1149458 A vulnerability in the email parsing module Clam AntiVirus (ClamAV) Software versions 0.102.0, 0.101.4 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to inefficient MIME parsing routines that result in extremely long scan times of specially formatted email files. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to scan the crafted email file indefinitely, resulting in a denial of service condition. CVE-2019-15961 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-15961.html CVE-2019-15961 https://bugzilla.suse.com/1157763 SUSE Bug 1157763 https://bugzilla.suse.com/1180082 SUSE Bug 1180082 A vulnerability in the RAR file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper error-handling mechanisms when processing nested RAR files sent to an affected device. An attacker could exploit this vulnerability by sending a crafted RAR file to an affected device. An exploit could allow the attacker to view or create arbitrary files on the targeted system. CVE-2019-1785 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 low 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1785.html CVE-2019-1785 https://bugzilla.suse.com/1130721 SUSE Bug 1130721 https://bugzilla.suse.com/1137508 SUSE Bug 1137508 A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and 0.101.0 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. CVE-2019-1786 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1786.html CVE-2019-1786 https://bugzilla.suse.com/1130721 SUSE Bug 1130721 https://bugzilla.suse.com/1137510 SUSE Bug 1137510 A vulnerability in the Portable Document Format (PDF) scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of proper data handling mechanisms within the device buffer while indexing remaining file data on an affected device. An attacker could exploit this vulnerability by sending crafted PDF files to an affected device. A successful exploit could allow the attacker to cause a heap buffer out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. CVE-2019-1787 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1787.html CVE-2019-1787 https://bugzilla.suse.com/1130721 SUSE Bug 1130721 A vulnerability in the Object Linking & Embedding (OLE2) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for OLE2 files sent an affected device. An attacker could exploit this vulnerability by sending malformed OLE2 files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds write condition, resulting in a crash that could result in a denial of service condition on an affected device. CVE-2019-1788 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1788.html CVE-2019-1788 https://bugzilla.suse.com/1130721 SUSE Bug 1130721 ClamAV versions prior to 0.101.2 are susceptible to a denial of service (DoS) vulnerability. An out-of-bounds heap read condition may occur when scanning PE files. An example is Windows EXE and DLL files that have been packed using Aspack as a result of inadequate bound-checking. CVE-2019-1789 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1789.html CVE-2019-1789 https://bugzilla.suse.com/1130721 SUSE Bug 1130721 A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. CVE-2019-1798 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1798.html CVE-2019-1798 https://bugzilla.suse.com/1130721 SUSE Bug 1130721 https://bugzilla.suse.com/1137513 SUSE Bug 1137513 A vulnerability in the Data-Loss-Prevention (DLP) module in Clam AntiVirus (ClamAV) Software versions 0.102.1 and 0.102.0 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to an out-of-bounds read affecting users that have enabled the optional DLP feature. An attacker could exploit this vulnerability by sending a crafted email file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3123 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-3123.html CVE-2020-3123 https://bugzilla.suse.com/1162921 SUSE Bug 1162921 A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a heap buffer overflow read. An attacker could exploit this vulnerability by sending a crafted ARJ file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3327 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-3327.html CVE-2020-3327 https://bugzilla.suse.com/1171980 SUSE Bug 1171980 https://bugzilla.suse.com/1174250 SUSE Bug 1174250 A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a stack buffer overflow read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3341 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-3341.html CVE-2020-3341 https://bugzilla.suse.com/1171981 SUSE Bug 1171981 A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated, local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete, producing system instability or causing the endpoint software to stop working. CVE-2020-3350 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 moderate 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-3350.html CVE-2020-3350 https://bugzilla.suse.com/1174250 SUSE Bug 1174250 https://bugzilla.suse.com/1174255 SUSE Bug 1174255 A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2020-3481 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-3481.html CVE-2020-3481 https://bugzilla.suse.com/1174250 SUSE Bug 1174250 A vulnerability in the Excel XLM macro parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper error handling that may result in an infinite loop. An attacker could exploit this vulnerability by sending a crafted Excel file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process hang, resulting in a denial of service condition. CVE-2021-1252 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-1252.html CVE-2021-1252 https://bugzilla.suse.com/1184532 SUSE Bug 1184532 A vulnerability in the PDF parsing module in Clam AntiVirus (ClamAV) Software versions 0.103.0 and 0.103.1 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper buffer size tracking that may result in a heap buffer over-read. An attacker could exploit this vulnerability by sending a crafted PDF file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition. CVE-2021-1404 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-1404.html CVE-2021-1404 https://bugzilla.suse.com/1184533 SUSE Bug 1184533 A vulnerability in the email parsing module in Clam AntiVirus (ClamAV) Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper variable initialization that may result in an NULL pointer read. An attacker could exploit this vulnerability by sending a crafted email to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition. CVE-2021-1405 openSUSE Tumbleweed:clamav-0.103.3-1.4 openSUSE Tumbleweed:clamav-devel-0.103.3-1.4 openSUSE Tumbleweed:clamav-milter-0.103.3-1.4 openSUSE Tumbleweed:libclamav9-0.103.3-1.4 openSUSE Tumbleweed:libfreshclam2-0.103.3-1.4 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-1405.html CVE-2021-1405 https://bugzilla.suse.com/1184534 SUSE Bug 1184534