[Security Announce] [ MDVSA-2015:221 ] clamav

Fabricante: Mandriva
Fecha: 04/05/2015
Identificador: MDVSA-2015:221
[Security Announce] [ MDVSA-2015:221 ] clamav
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:221 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : clamav Date : May 4, 2015 Affected: Business Server 1.0, Business Server 2.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in clamav: Fix infinite loop condition on crafted y0da cryptor file. Identified and patch suggested by Sebastian Andrzej Siewior (CVE-2015-2221). Fix crash on crafted petite packed file. Reported and patch supplied by Sebastian Andrzej Siewior (CVE-2015-2222). Fix an infinite loop condition on a crafted xz archive file. This was reported by Dimitri Kirchner and Goulven Guiheux (CVE-2015-2668). Apply upstream patch for possible heap overflow in Henry Spencer's regex library (CVE-2015-2305). Fix crash in upx decoder with crafted file. Discovered and patch supplied by Sebastian Andrzej Siewior (CVE-2015-2170). The updated packages provides a solution for these security issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2221 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2222 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2668 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2305 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2170 http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 08dc8e91ad1e4e9be9546c0064e2541f mbs1/x86_64/clamav-0.98.7-1.mbs1.x86_64.rpm 464c5a0a2b885615a389070102002f56 mbs1/x86_64/clamav-db-0.98.7-1.mbs1.noarch.rpm 02df4640dc8a9875296c191dbc912544 mbs1/x86_64/clamav-milter-0.98.7-1.mbs1.x86_64.rpm c176cc81d442bc1be4ddc790d64f6e88 mbs1/x86_64/clamd-0.98.7-1.mbs1.x86_64.rpm e1c501cdf28c80c40b877fe621aebdab mbs1/x86_64/lib64clamav6-0.98.7-1.mbs1.x86_64.rpm 9225e5155238bf80b2657b6db1a0e780 mbs1/x86_64/lib64clamav-devel-0.98.7-1.mbs1.x86_64.rpm fd715766b77fd1238c1d3703a8285665 mbs1/SRPMS/clamav-0.98.7-1.mbs1.src.rpm Mandriva Business Server 2/X86_64: 7b655dae38e803eae1e90fd6b2c6970d mbs2/x86_64/clamav-0.98.7-1.mbs2.x86_64.rpm ed5f01c0f87d87d66c85e935ad089a92 mbs2/x86_64/clamav-db-0.98.7-1.mbs2.noarch.rpm 3522ea30954becd285b7a093259a358e mbs2/x86_64/clamav-milter-0.98.7-1.mbs2.x86_64.rpm 9c51856cccb47bfb86b732305f3a8bda mbs2/x86_64/clamd-0.98.7-1.mbs2.x86_64.rpm 906dea5cd49f538f338737b9d255f6b4 mbs2/x86_64/lib64clamav6-0.98.7-1.mbs2.x86_64.rpm 3320f014bf5186b1a3829efa2e97c45e mbs2/x86_64/lib64clamav-devel-0.98.7-1.mbs2.x86_64.rpm bf873cdf7851d0b5ad54b861159e525f mbs2/SRPMS/clamav-0.98.7-1.mbs2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVR4ZpmqjQ0CJFipgRAoRpAKDlXWTe7hIR5ko1y0BvaInQ6CYCpACg6WTR Lb3clbwD9jDU0kmggXCR6JA= =7767 -----END PGP SIGNATURE-----