Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: ClamAV vulnerabilities
From: cve-assign () mitre org
Date: Mon, 9 Dec 2013 18:45:20 -0500 (EST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I know that there are no details provided here, but secunia advisory
also points on 'unspecified vulnerabilities'.

It is possible to have a CVE ID for multiple unspecified
vulnerabilities but this can usually only occur when the expectation
is that no details will be available. In this case, a previous message
said:

From: Kurt Seifried <kseifried () redhat com>

Just a heads up I know at least one person is trying to get details
from SourceFire (they bought ClamAV some time back). Until I can match
issues up I can't assign CVEs.

suggesting that some information gathering may be in progress.

Although these items:

1) A double-free error exists within the "unrar_extract_next_prepare()"
function (libclamunrar_iface/unrar_iface.c) when parsing a RAR file.

2) An unspecified error within the "wwunpack()" function
(libclamav/wwunpack.c) when unpacking a WWPack file can be exploited to
corrupt heap memory.

can have CVE IDs, we can't correctly define the scope of any CVE ID
until more is known about what was fixed in 0.9.7. For example, in
some cases, two different double-free issues fixed in 0.9.7 would be
covered by a single CVE ID.

So, it is probably best to wait a short time for the information
gathering.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSplJmAAoJEKllVAevmvms+dkH/inM5aP+TvcychU/CygZUIBo
eCaMOYwaoCgq1PIAKAIHkSxe8RQMvcZqF4W4V2YzXMDYFGRDOocOv7celNz213tJ
Ur2vbIBN7eq9ZenenYZ4kr1mv9E84tRpVIm69Th5tBwEbPKbQiJcCVFsmHmMKQ80
C/aDHpVngu6gCkcEdgUX2GTaC7xAc+QkHlFFcaDbxdr860lpiJB7FaF5BysCs69M
035c9SQEr0S/eiRJnNFRFNu+rcJvLSCK+NBsiPXGZqS0u9riUx2//0V0ilXNZzt1
K7dPazHgVvb5cwWMqfVHCwOGN5Nk/xqCOgDNBffNjGC+SaZggCWq/NLM+5foeMM=
=hkx8
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault