-------------------------------------------------------------------------------- Fedora EPEL Update Notification FEDORA-EPEL-2019-ae72f875d9 2019-08-27 00:31:28.165611 --------------------------------------------------------------------------------
Name : clamav Product : Fedora EPEL 7 Version : 0.101.4 Release : 1.el7 URL : https://www.clamav.net/ Summary : End-user tools for the Clam Antivirus scanner Description : Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. The virus database is based on the virus database from OpenAntiVirus, but contains additional signatures (including signatures for popular polymorphic viruses, too) and is KEPT UP TO DATE.
-------------------------------------------------------------------------------- Update Information:
ClamAV 0.101.4 is a security patch release that addresses the following issues. - An out of bounds write was possible within ClamAV's NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit. Thanks to Martin Simmons for reporting the issue here. - The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625. The default scan time limit is 2 minutes (120000 milliseconds). To customize the time limit: - use the clamscan --max-scantime option - use the clamd MaxScanTime config option Libclamav users may customize the time limit using the cl_engine_set_num function. For example: C cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, time_limit_milliseconds) Thanks to David Fifield for reviewing the zip-bomb mitigation in 0.101.3 and reporting the issue. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1744273 - clamav-0.101.4 is available https://bugzilla.redhat.com/show_bug.cgi?id=1744273 --------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use su -c 'yum update clamav' at the command line. For more information, refer to "YUM", available at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7%5C /html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
epel-package-announce@lists.fedoraproject.org