SUSE-SU-2020:3918-1: important: Security update for clamav

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Tue Dec 22 10:16:52 MST 2020


   SUSE Security Update: Security update for clamav
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3918-1
Rating:             important
References:         #1118459 #1119353 #1144504 #1149458 #1157763 
                    #1171981 #1174250 #1174255 ECO-3010 
Cross-References:   CVE-2019-12900 CVE-2019-15961 CVE-2020-3123
                    CVE-2020-3327 CVE-2020-3341 CVE-2020-3350
                    CVE-2020-3481
Affected Products:
                    SUSE OpenStack Cloud Crowbar 9
                    SUSE OpenStack Cloud Crowbar 8
                    SUSE OpenStack Cloud 9
                    SUSE OpenStack Cloud 8
                    SUSE OpenStack Cloud 7
                    SUSE Linux Enterprise Server for SAP 12-SP4
                    SUSE Linux Enterprise Server for SAP 12-SP3
                    SUSE Linux Enterprise Server for SAP 12-SP2
                    SUSE Linux Enterprise Server 12-SP4-LTSS
                    SUSE Linux Enterprise Server 12-SP3-LTSS
                    SUSE Linux Enterprise Server 12-SP3-BCL
                    SUSE Linux Enterprise Server 12-SP2-LTSS
                    SUSE Linux Enterprise Server 12-SP2-BCL
                    SUSE Enterprise Storage 5
                    HPE Helion Openstack 8
______________________________________________________________________________

   An update that solves 7 vulnerabilities, contains one
   feature and has one errata is now available.

Description:

   This update for clamav fixes the following issues:

   clamav was updated to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459.

   * clamd can now reload the signature database without blocking scanning.
     This multi-threaded database reload improvement was made possible thanks
     to a community effort.
     - Non-blocking database reloads are now the default behavior. Some
       systems that are more constrained on RAM may need to disable
       non-blocking reloads as it will temporarily consume two times as much
       memory. We added a new clamd config option ConcurrentDatabaseReload,
       which may be set to no.
   * Fix clamav-milter.service (requires clamd.service to run)
   * bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
   * Partial sync with SLE15.

   Update to version 0.102.4

   Accumulated security fixes:

   * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
     replace a scan target's directory with a symlink to another path to
     trick clamscan, clamdscan, or clamonacc into removing or moving a
     different file (eg. a critical system file). The issue would affect
     users that use the --move or --remove options for clamscan, clamdscan,
     and clamonacc. (bsc#1174255)
   * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in
     ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition.
     Improper bounds checking results in an
     out-of-bounds read which could cause a crash. The previous fix for this
      CVE in 0.102.3 was incomplete. This fix correctly resolves the issue.
   * CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV
     0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition.
     Improper error handling may result in a crash due to a NULL pointer
     dereference. This vulnerability is mitigated for those using the
     official ClamAV signature databases because the file type signatures in
     daily.cvd will not enable the EGG archive parser in versions affected by
     the vulnerability. (bsc#1174250)
   * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV
     0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition.
     Improper size checking of a buffer used to initialize AES decryption
     routines results in an out-of-bounds read which may cause a crash.
     (bsc#1171981)
   * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using
     the optional credit card data-loss-prevention (DLP) feature. Improper
     bounds checking of an unsigned variable resulted in an
     out-of-bounds read, which causes a crash.
   * CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may
     occur when scanning a specially crafted email file as a result
     of excessively long scan times. The issue is resolved by implementing
      several maximums in parsing MIME messages and by
     optimizing use of memory allocation. (bsc#1157763).
   * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458)
   * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb
     vulnerability completely. Default is 2 minutes, configurable useing the
     clamscan --max-scantime and for clamd using the MaxScanTime config
     option (bsc#1144504)

   Update to version 0.101.3:

   * ZIP bomb causes extreme CPU spikes (bsc#1144504)

   Update to version 0.101.2 (bsc#1118459):

   * Support for RAR v5 archive extraction.
   * Incompatible changes to the arguments of cl_scandesc,
     cl_scandesc_callback, and cl_scanmap_callback.
   * Scanning options have been converted from a single flag bit-field into a
     structure of multiple categorized flag bit-fields.
   * The CL_SCAN_HEURISTIC_ENCRYPTED scan option was replaced by 2 new scan
     options: CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE, and
     CL_SCAN_HEURISTIC_ENCRYPTED_DOC
   * Incompatible clamd.conf and command line interface changes.
   * Heuristic Alerts" (aka "Algorithmic Detection") options have been
     changed to make the names more consistent. The original
     options are deprecated in 0.101, and will be removed in a future feature
      release.
   * For details, see
     https://blog.clamav.net/2018/12/clamav-01010-has-been-released.html


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE OpenStack Cloud Crowbar 9:

      zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2020-3918=1

   - SUSE OpenStack Cloud Crowbar 8:

      zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2020-3918=1

   - SUSE OpenStack Cloud 9:

      zypper in -t patch SUSE-OpenStack-Cloud-9-2020-3918=1

   - SUSE OpenStack Cloud 8:

      zypper in -t patch SUSE-OpenStack-Cloud-8-2020-3918=1

   - SUSE OpenStack Cloud 7:

      zypper in -t patch SUSE-OpenStack-Cloud-7-2020-3918=1

   - SUSE Linux Enterprise Server for SAP 12-SP4:

      zypper in -t patch SUSE-SLE-SAP-12-SP4-2020-3918=1

   - SUSE Linux Enterprise Server for SAP 12-SP3:

      zypper in -t patch SUSE-SLE-SAP-12-SP3-2020-3918=1

   - SUSE Linux Enterprise Server for SAP 12-SP2:

      zypper in -t patch SUSE-SLE-SAP-12-SP2-2020-3918=1

   - SUSE Linux Enterprise Server 12-SP4-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2020-3918=1

   - SUSE Linux Enterprise Server 12-SP3-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-2020-3918=1

   - SUSE Linux Enterprise Server 12-SP3-BCL:

      zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2020-3918=1

   - SUSE Linux Enterprise Server 12-SP2-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-2020-3918=1

   - SUSE Linux Enterprise Server 12-SP2-BCL:

      zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2020-3918=1

   - SUSE Enterprise Storage 5:

      zypper in -t patch SUSE-Storage-5-2020-3918=1

   - HPE Helion Openstack 8:

      zypper in -t patch HPE-Helion-OpenStack-8-2020-3918=1



Package List:

   - SUSE OpenStack Cloud Crowbar 9 (x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE OpenStack Cloud Crowbar 8 (x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE OpenStack Cloud 9 (x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE OpenStack Cloud 8 (x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE OpenStack Cloud 7 (s390x x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server for SAP 12-SP4 (ppc64le x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server for SAP 12-SP3 (ppc64le x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server for SAP 12-SP2 (ppc64le x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server 12-SP4-LTSS (aarch64 ppc64le s390x x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server 12-SP3-LTSS (aarch64 ppc64le s390x x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server 12-SP3-BCL (x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server 12-SP2-LTSS (ppc64le s390x x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Linux Enterprise Server 12-SP2-BCL (x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - SUSE Enterprise Storage 5 (aarch64 x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1

   - HPE Helion Openstack 8 (x86_64):

      clamav-0.103.0-33.32.1
      clamav-debuginfo-0.103.0-33.32.1
      clamav-debugsource-0.103.0-33.32.1


References:

   https://www.suse.com/security/cve/CVE-2019-12900.html
   https://www.suse.com/security/cve/CVE-2019-15961.html
   https://www.suse.com/security/cve/CVE-2020-3123.html
   https://www.suse.com/security/cve/CVE-2020-3327.html
   https://www.suse.com/security/cve/CVE-2020-3341.html
   https://www.suse.com/security/cve/CVE-2020-3350.html
   https://www.suse.com/security/cve/CVE-2020-3481.html
   https://bugzilla.suse.com/1118459
   https://bugzilla.suse.com/1119353
   https://bugzilla.suse.com/1144504
   https://bugzilla.suse.com/1149458
   https://bugzilla.suse.com/1157763
   https://bugzilla.suse.com/1171981
   https://bugzilla.suse.com/1174250
   https://bugzilla.suse.com/1174255



More information about the sle-security-updates mailing list