oss-sec mailing list archives
Further issue details about flaws corrected in upstream ClamAV 0.97.7 version
From: Jan Lieskovsky <jlieskov () redhat com>
Date: Fri, 15 Mar 2013 10:08:19 -0400 (EDT)
Hello Mateusz, Gynvael, vendors, this is due the following ones: [1] https://bugs.mageia.org/show_bug.cgi?id=9399 [2] http://blog.clamav.net/2013/03/clamav-0977-has-been-released.html [3] https://github.com/vrtadmin/clamav-devel/blob/0.97/ChangeLog I have tried to grep CLamAV's git log for further information, but many of the commits prior to 2013-02-20 have form of: 'Fix CID#...' :(. The only two security related ones seem to be the following two: commit b2212def1bb92b5ac45c82da100dc0d1376de6a3 Author: Steve Morgan <smorgan () sourcefire com> Date: Thu Feb 14 18:29:53 2013 -0500 cid 10776 - fix double free commit 71990820d01c246e4e61408a3659dd9d92949b38 Author: Ryan Pentney <rpentney () sourcefire com> Date: Fri Feb 15 03:10:50 2013 -0800 Fixed heap corruption in wwunpack.c We to be better able to tell, which concrete security flaws got corrected in 0.97.7 version and based on that to properly allocate CVE identifiers, could you please provide further information about: a) how many and what kind of issues got corrected in that version?, b) links to relevant upstream patches? (since patch log telling CID# wouldn't be enough either to find out the appropriate commits). Thank you for your time, look && cooperation in advance. Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Current thread:
- Further issue details about flaws corrected in upstream ClamAV 0.97.7 version Jan Lieskovsky (Mar 15)
- Re: Further issue details about flaws corrected in upstream ClamAV 0.97.7 version Kurt Seifried (Mar 19)
- Re: Further issue details about flaws corrected in upstream ClamAV 0.97.7 version Gynvael Coldwind (Mar 19)
- Re: Further issue details about flaws corrected in upstream ClamAV 0.97.7 version Kurt Seifried (Mar 19)