CVE-2006-0162 - Clamav buffer overflow vulnerability

[Jeff Balderson]

Heap-based buffer overflow in libclamav/upx.c in Clam Antivirus (ClamAV) before 0.88 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted UPX files.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0162

This has been fixed in Debian Sarge since Jan 21 2006:
http://www.debian.org/security/2006/dsa-947

Please update packages for both Hoary and Breezy.

[Martin Pitt (pitti)]

Fixed in dapper, up to date in ubuntu-cve

http://people.ubuntu.com/~pitti/ubuntu-cve/unfixed.html

[Patrick Ancillotti (patricka)]

Update causes segfaults when scannning mail with clamsmtp.

random segfaults, at random times.

If more information required, email me please :)

Thanks

[Vassilis Pandis (pandisv)]

Patrick is referring to bug #40229, which has been fixed as of 0.88.2.

[Vassilis Pandis (pandisv)]

I added the tasks for the backports according to the backports forum.

[Vassilis Pandis (pandisv)]

closing... will request a backport

[Vassilis Pandis (pandisv)]

I think it's safe to close this task as this is no longer a problem in edgy/dapper - please reopen if I'm doing something wrong.