clamav-0.103.8-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:12696 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z clamav-0.103.8-1.1 on GA media These are all security issues fixed in the clamav-0.103.8-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-12696 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:12696 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2023-20032/ SUSE CVE CVE-2023-20032 page https://www.suse.com/security/cve/CVE-2023-20052/ SUSE CVE CVE-2023-20052 page openSUSE Tumbleweed clamav-0.103.8-1.1 clamav-devel-0.103.8-1.1 clamav-docs-html-0.103.8-1.1 clamav-milter-0.103.8-1.1 libclamav9-0.103.8-1.1 libfreshclam2-0.103.8-1.1 clamav-0.103.8-1.1 as a component of openSUSE Tumbleweed clamav-devel-0.103.8-1.1 as a component of openSUSE Tumbleweed clamav-docs-html-0.103.8-1.1 as a component of openSUSE Tumbleweed clamav-milter-0.103.8-1.1 as a component of openSUSE Tumbleweed libclamav9-0.103.8-1.1 as a component of openSUSE Tumbleweed libfreshclam2-0.103.8-1.1 as a component of openSUSE Tumbleweed On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"]. CVE-2023-20032 openSUSE Tumbleweed:clamav-0.103.8-1.1 openSUSE Tumbleweed:clamav-devel-0.103.8-1.1 openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1 openSUSE Tumbleweed:clamav-milter-0.103.8-1.1 openSUSE Tumbleweed:libclamav9-0.103.8-1.1 openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-20032.html CVE-2023-20032 https://bugzilla.suse.com/1208363 SUSE Bug 1208363 https://bugzilla.suse.com/1211720 SUSE Bug 1211720 On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process. CVE-2023-20052 openSUSE Tumbleweed:clamav-0.103.8-1.1 openSUSE Tumbleweed:clamav-devel-0.103.8-1.1 openSUSE Tumbleweed:clamav-docs-html-0.103.8-1.1 openSUSE Tumbleweed:clamav-milter-0.103.8-1.1 openSUSE Tumbleweed:libclamav9-0.103.8-1.1 openSUSE Tumbleweed:libfreshclam2-0.103.8-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-20052.html CVE-2023-20052 https://bugzilla.suse.com/1208365 SUSE Bug 1208365