svn commit: r542407 - head/security/vuxml

Fri Jul 17 05:44:11 UTC 2020

Author: pi
Date: Fri Jul 17 05:44:10 2020
New Revision: 542407
URL: https://svnweb.freebsd.org/changeset/ports/542407

Log:
  security/vuxml: Document multiple vulnerabilities in clamav
  
  - CVE-2020-3350, CVE-2020-3327, CVE-2020-3481
  
  PR:		248027
  Submitted by:	Yasuhiro KIMURA <yasu at utahime.org>

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Fri Jul 17 05:40:38 2020	(r542406)
+++ head/security/vuxml/vuln.xml	Fri Jul 17 05:44:10 2020	(r542407)
@@ -58,9 +58,65 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="f7a02651-c798-11ea-81d6-6805cabe6ebb">
+    <topic>clamav -- multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>clamav</name>
+	<range><lt>0.102.4,1</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Micah Snyder reports:</p>
+	<blockquote cite="https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html">
+	  <dl>
+	    <dt>CVE-2020-3350</dt>
+	    <dd>
+	      Fixed a vulnerability a malicious user could exploit to replace
+	      a scan target's directory with a symlink to another path to trick
+	      clamscan, clamdscan, or clamonacc into removing or moving a different
+	      file (such as a critical system file). The issue would affect users
+	      that use the --move or --remove options for clamscan, clamdscan and
+	      clamonacc.
+	    </dd>
+	    <dt>CVE-2020-3327</dt>
+	    <dd>
+	      Fixed a vulnerability in the ARJ archive-parsing module in ClamAV
+	      0.102.3 that could cause a denial-of-service (DoS) condition.
+	      Improper bounds checking resulted in an out-of-bounds read that could
+	      cause a crash. The previous fix for this CVE in version 0.102.3 was
+	      incomplete. This fix correctly resolves the issue.
+	    </dd>
+	    <dt>CVE-2020-3481</dt>
+	    <dd>
+	      Fixed a vulnerability in the EGG archive module in ClamAV 0.102.0
+	      - 0.102.3 that could cause a denial-of-service (DoS) condition.
+	      Improper error handling could cause a crash due to a NULL pointer
+	      dereference. This vulnerability is mitigated for those using the
+	      official ClamAV signature databases because the file type signatures
+	      in daily.cvd will not enable the EGG archive parser in affected
+	      versions.
+	    </dd>
+	  </dl>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html</url>
+      <cvename>CVE-2020-3350</cvename>
+      <cvename>CVE-2020-3327</cvename>
+      <cvename>CVE-2020-3481</cvename>
+    </references>
+    <dates>
+      <discovery>2020-07-16</discovery>
+      <entry>2020-07-16</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="714e6c35-c75b-11ea-aa29-d74973d1f9f3">
     <topic>OpenEXR/ilmbase 2.5.2 -- patch release with various bug/security fixes</topic>
-    <affects>
+     <affects>
       <package>
 	<name>ilmbase</name>
 	<range><lt>2.5.2</lt></range>
