ClamAV 0.101.4 is a security patch release that addresses the following issues.
An out of bounds write was possible within ClamAV's NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.
Thanks to Martin Simmons for reporting the issue here.
The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.
The default scan time limit is 2 minutes (120000 milliseconds).
To customize the time limit: - use the clamscan --max-scantime option - use the clamd MaxScanTime config option
Libclamav users may customize the time limit using the cl_engine_set_num function. For example:
C cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, time_limit_milliseconds)
Thanks to David Fifield for reviewing the zip-bomb mitigation in 0.101.3 and reporting the issue.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2019-5c2dc50262Please log in to add feedback.
| 0 | 0 | Test Case ClamAV |
This update has been submitted for testing by orion.
This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
Thanks!
This update can be pushed to stable now if the maintainer wishes
Works for me. No regressions noted compared to previous version.
This update has been submitted for stable by bodhi.
This update has been pushed to stable.