CVE-2018-1000085

ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.

ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.

Clamav has been updated to fix 2 security issues and also contains a lot of bugfixes.

Out-of-bounds access in the PDF parser (CVE-2018-0202) Out-of-bounds heap read in XAR parser (CVE-2018-1000085)

These are all security issues fixed in the clamav-0.103.3-1.4 package on the GA media of openSUSE Tumbleweed.

This update for clamav fixes the following issues:

Security issues fixed:

• CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
• CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
• CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
• CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
• CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).

This update for clamav fixes the following issues:

Security issues fixed:

• CVE-2012-6706: VMSF_DELTA filter inside the unrar implementation allows an arbitrary memory write (bsc#1045315).
• CVE-2017-6419: A heap-based buffer overflow that can lead to a denial of service in libmspack via a crafted CHM file (bsc#1052449).
• CVE-2017-11423: A stack-based buffer over-read that can lead to a denial of service in mspack via a crafted CAB file (bsc#1049423).
• CVE-2018-1000085: An out-of-bounds heap read vulnerability was found in XAR parser that can lead to a denial of service (bsc#1082858).
• CVE-2018-0202: Fixed two vulnerabilities in the PDF parsing code (bsc#1083915).

This update for clamav to version 0.100.1 fixes the following issues:

The following security vulnerabilities were addressed:

• CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410)
• CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412)
• CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR parser (bsc#1082858)
• CVE-2018-14679: Libmspack heap buffer over-read in CHM parser (bsc#1103040)
• Buffer over-read in unRAR code due to missing max value checks in table initialization
• PDF parser bugs

The following other changes were made:

• Disable YARA support for licensing reasons (bsc#1101654).
• Add HTTPS support for clamsubmit
• Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only

This update for clamav to version 0.100.1 fixes the following issues:

The following security vulnerabilities were addressed:

• CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410)
• CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412)
• CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR parser (bsc#1082858)
• CVE-2018-14679: Libmspack heap buffer over-read in CHM parser (bsc#1103040)
• Buffer over-read in unRAR code due to missing max value checks in table initialization
• PDF parser bugs

The following other changes were made:

• Disable YARA support for licensing reasons (bsc#1101654).
• Add HTTPS support for clamsubmit
• Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only

It was discovered that ClamAV incorrectly handled parsing certain PDF files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-0202)

Hanno Böck discovered that ClamAV incorrectly handled parsing certain XAR files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2018-1000085)