mailing list archives
Re: CVE request: ClamAV vulnerabilities
From: cve-assign () mitre org
Date: Mon, 9 Dec 2013 18:45:20 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE-----
I know that there are no details provided here, but secunia advisory
also points on 'unspecified vulnerabilities'.
It is possible to have a CVE ID for multiple unspecified
vulnerabilities but this can usually only occur when the expectation
is that no details will be available. In this case, a previous message
From: Kurt Seifried <kseifried () redhat com>
Just a heads up I know at least one person is trying to get details
from SourceFire (they bought ClamAV some time back). Until I can match
issues up I can't assign CVEs.
suggesting that some information gathering may be in progress.
Although these items:
1) A double-free error exists within the "unrar_extract_next_prepare()"
function (libclamunrar_iface/unrar_iface.c) when parsing a RAR file.
2) An unspecified error within the "wwunpack()" function
(libclamav/wwunpack.c) when unpacking a WWPack file can be exploited to
corrupt heap memory.
can have CVE IDs, we can't correctly define the scope of any CVE ID
until more is known about what was fixed in 0.9.7. For example, in
some cases, two different double-free issues fixed in 0.9.7 would be
covered by a single CVE ID.
So, it is probably best to wait a short time for the information
CVE assignment team, MITRE CVE Numbering Authority
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
-----END PGP SIGNATURE-----