--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2019-ae72f875d9
2019-08-27 00:31:28.165611
--------------------------------------------------------------------------------
Name : clamav
Product : Fedora EPEL 7
Version : 0.101.4
Release : 1.el7
URL :
https://www.clamav.net/
Summary : End-user tools for the Clam Antivirus scanner
Description :
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this
software is the integration with mail servers (attachment scanning). The
package provides a flexible and scalable multi-threaded daemon, a command
line scanner, and a tool for automatic updating via Internet. The programs
are based on a shared library distributed with the Clam AntiVirus package,
which you can use with your own software. The virus database is based on
the virus database from OpenAntiVirus, but contains additional signatures
(including signatures for popular polymorphic viruses, too) and is KEPT UP
TO DATE.
--------------------------------------------------------------------------------
Update Information:
ClamAV 0.101.4 is a security patch release that addresses the following issues.
- An out of bounds write was possible within ClamAV's NSIS bzip2 library when
attempting decompression in cases where the number of selectors exceeded the max
limit set by the library (CVE-2019-12900). The issue has been resolved by
respecting that limit. Thanks to Martin Simmons for reporting the issue
here. - The zip bomb vulnerability mitigated in 0.101.3 has been assigned
the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb
mitigation was immediately identified. To remediate the zip-bomb scan time
issue, a scan time limit has been introduced in 0.101.4. This limit now resolves
ClamAV's vulnerability to CVE-2019-12625. The default scan time limit is 2
minutes (120000 milliseconds). To customize the time limit: - use the
clamscan --max-scantime option - use the clamd MaxScanTime config option
Libclamav users may customize the time limit using the cl_engine_set_num
function. For example: C cl_engine_set_num(engine,
CL_ENGINE_MAX_SCANTIME, time_limit_milliseconds) Thanks to David Fifield
for reviewing the zip-bomb mitigation in 0.101.3 and reporting the issue.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1744273 - clamav-0.101.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1744273
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update clamav' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------