SUSE-SU-2020:3729-1: important: Security update for clamav
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Wed Dec 9 10:21:59 MST 2020
SUSE Security Update: Security update for clamav
Announcement ID: SUSE-SU-2020:3729-1
References: #1118459 #1119353 #1144504 #1149458 #1151839
#1157763 #1171981 #1174250 #1174255 ECO-3010
Cross-References: CVE-2019-12625 CVE-2019-12900 CVE-2019-15961
CVE-2020-3123 CVE-2020-3327 CVE-2020-3341
SUSE Linux Enterprise Server 12-SP5
An update that solves 8 vulnerabilities, contains one
feature and has one errata is now available.
This update for clamav fixes the following issues:
clamav was updated to 0.103.0 to implement jsc#ECO-3010 and bsc#1118459.
* clamd can now reload the signature database without blocking scanning.
This multi-threaded database reload improvement was made possible thanks
to a community effort.
- Non-blocking database reloads are now the default behavior. Some
systems that are more constrained on RAM may need to disable
non-blocking reloads as it will temporarily consume two times as much
memory. We added a new clamd config option ConcurrentDatabaseReload,
which may be set to no.
* Fix clamav-milter.service (requires clamd.service to run)
* Fix freshclam crash in FIPS mode. (bsc#1119353)
Update to version 0.102.4:
Accumulated security fixes:
* CVE-2020-3350: Fix a vulnerability wherein a malicious user could
replace a scan target's directory with a symlink to another path to
trick clamscan, clamdscan, or clamonacc into removing or moving a
different file (eg. a critical system file). The issue would affect
users that use the --move or --remove options for clamscan, clamdscan,
and clamonacc. (bsc#1174255)
* CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in
ClamAV 0.102.3 that could cause a Denial-of-Service (DoS) condition.
Improper bounds checking results in an
out-of-bounds read which could cause a crash. The previous fix for this
CVE in 0.102.3 was incomplete. This fix correctly resolves the issue.
* CVE-2020-3481: Fix a vulnerability in the EGG archive module in ClamAV
0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS) condition.
Improper error handling may result in a crash due to a NULL pointer
dereference. This vulnerability is mitigated for those using the
official ClamAV signature databases because the file type signatures in
daily.cvd will not enable the EGG archive parser in versions affected by
the vulnerability. (bsc#1174250)
* CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV
0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition.
Improper size checking of a buffer used to initialize AES decryption
routines results in an out-of-bounds read which may cause a crash.
* CVE-2020-3123: A denial-of-service (DoS) condition may occur when using
the optional credit card data-loss-prevention (DLP) feature. Improper
bounds checking of an unsigned variable resulted in an
out-of-bounds read, which causes a crash.
* CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may
occur when scanning a specially crafted email file as a result
of excessively long scan times. The issue is resolved by implementing
several maximums in parsing MIME messages and by
optimizing use of memory allocation. (bsc#1157763).
* CVE-2019-12900: An out of bounds write in the NSIS bzip2 (bsc#1149458)
* CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb
vulnerability completely. Default is 2 minutes, configurable useing the
clamscan --max-scantime and for clamd using the MaxScanTime config
- Increase the startup timeout of clamd to 5 minutes to cater for the
grown virus database as a workaround until clamd has learned to talk to
systemd to extend the timeout as long as needed. (bsc#1151839)
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 12-SP5:
zypper in -t patch SUSE-SLE-SERVER-12-SP5-2020-3729=1
- SUSE Linux Enterprise Server 12-SP5 (aarch64 ppc64le s390x x86_64):
More information about the sle-updates