CVE Request: SquidClamav insufficient escaping flaws

[Sean Amoss <ackle () gentoo org>]

Hi Kurt,

It appears that this has not yet received a CVE:

The upstream notification [1] shows SquidClamav 5.8 and 6.7 fixes a URL
escaping issue which could lead to a daemon crash [2]. SquidClamav 5.8
also fixes escaping issues in CGI scripts [3].


References:
[1] http://squidclamav.darold.net/news.html
[2] https://github.com/darold/squidclamav/commit/80f74451f628264d1d9a1f1c0bbcebc932ba5e00
[3] https://github.com/darold/squidclamav/commit/5806d10a31183a0b0d18eccc3a3e04e536e2315b
[4] https://bugs.gentoo.org/show_bug.cgi?id=428778


Thanks,
Sean

-- 
Sean Amoss
Gentoo Security | GLSA Coordinator
E-Mail    : ackle () gentoo org
GnuPG ID  : E928357A
GnuPG FP  : E58A AABD DD2D 03AF 0A7A 2F14 1877 72EC E928 357A

Attachment: signature.asc
Description: OpenPGP digital signature