ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parsehwp3_paragraph() in libclamav/hwp.c.

The remote host is affected by the vulnerability described in GLSA-201904-12 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for clamav to version 0.100.1 fixes the following issues:
The following security vulnerabilities were addressed :

  - CVE-2018-0360: HWP integer overflow, infinite loop     vulnerability (bsc#1101410)

  - CVE-2018-0361: PDF object length check, unreasonably     long time to parse relatively small file (bsc#1101412)

  - Buffer over-read in unRAR code due to missing max value     checks in table initialization

  - Libmspack heap buffer over-read in CHM parser     (bsc#1103040)

  - PDF parser bugs

The following other changes were made :

  - Disable YARA support for licensing reasons     (bsc#1101654).

  - Add HTTPS support for clamsubmit

  - Fix for DNS resolution for users on IPv4-only machines     where IPv6 is not available or is link-local only

This update was imported from the SUSE:SLE-15:Update update project.

This update for clamav to version 0.100.1 fixes the following issues:
The following security vulnerabilities were addressed :

  - CVE-2018-0360: HWP integer overflow, infinite loop     vulnerability (bsc#1101410)

  - CVE-2018-0361: PDF object length check, unreasonably     long time to parse relatively small file (bsc#1101412)

  - Buffer over-read in unRAR code due to missing max value     checks in table initialization

  - Libmspack heap buffer over-read in CHM parser     (bsc#1103040)

  - PDF parser bugs The following other changes were made :

  - Disable YARA support for licensing reasons     (bsc#1101654).

  - Add HTTPS support for clamsubmit

  - Fix for DNS resolution for users on IPv4-only machines     where IPv6 is not available or is link-local only

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav to version 0.100.1 fixes the following issues :

The following security vulnerabilities were addressed :

CVE-2018-0360: HWP integer overflow, infinite loop vulnerability (bsc#1101410)

CVE-2018-0361: PDF object length check, unreasonably long time to parse relatively small file (bsc#1101412)

CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR parser (bsc#1082858)

CVE-2018-14679: Libmspack heap buffer over-read in CHM parser (bsc#1103040)

Buffer over-read in unRAR code due to missing max value checks in table initialization

PDF parser bugs

The following other changes were made: Disable YARA support for licensing reasons (bsc#1101654).

Add HTTPS support for clamsubmit

Fix for DNS resolution for users on IPv4-only machines where IPv6 is not available or is link-local only

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ClamAV, an anti-virus utility for Unix, has released the version 0.100.1. Installing this new version is required to make use of all current virus signatures and to avoid warnings.

This version also fixes two security issues discovered after version 0.100.0 :

CVE-2018-0360

Integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. Reported by Secunia Research at Flexera.

CVE-2018-0361

PDF object length check, unreasonably long time to parse a relatively small file. Reported by aCaB.

For Debian 8 'Jessie', these problems have been fixed in version 0.100.1+dfsg-0+deb8u1.

We recommend that you upgrade your clamav packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav to version 0.100.1 fixes the following issues:
The following security vulnerabilities were addressed :

  - CVE-2018-0360: HWP integer overflow, infinite loop     vulnerability (bsc#1101410)

  - CVE-2018-0361: PDF object length check, unreasonably     long time to parse relatively small file (bsc#1101412)

  - CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR     parser (bsc#1082858)

  - CVE-2018-14679: Libmspack heap buffer over-read in CHM     parser (bsc#1103040)

  - Buffer over-read in unRAR code due to missing max value     checks in table initialization

  - PDF parser bugs

The following other changes were made :

  - Disable YARA support for licensing reasons     (bsc#1101654).

  - Add HTTPS support for clamsubmit

  - Fix for DNS resolution for users on IPv4-only machines     where IPv6 is not available or is link-local only

This update was imported from the SUSE:SLE-12:Update update project.

This update for clamav to version 0.100.1 fixes the following issues:
The following security vulnerabilities were addressed :

  - CVE-2018-0360: HWP integer overflow, infinite loop     vulnerability (bsc#1101410)

  - CVE-2018-0361: PDF object length check, unreasonably     long time to parse relatively small file (bsc#1101412)

  - CVE-2018-1000085: Fixed a out-of-bounds heap read in XAR     parser (bsc#1082858)

  - CVE-2018-14679: Libmspack heap buffer over-read in CHM     parser (bsc#1103040)

  - Buffer over-read in unRAR code due to missing max value     checks in table initialization

  - PDF parser bugs The following other changes were made :

  - Disable YARA support for licensing reasons     (bsc#1101654).

  - Add HTTPS support for clamsubmit

  - Fix for DNS resolution for users on IPv4-only machines     where IPv6 is not available or is link-local only

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version, the ClamAV clamd antivirus daemon running on the remote host is prior to 0.100.1. It is, therefore, affected by multiple vulnerabilities.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3722-1 advisory.

    It was discovered that ClamAV incorrectly handled parsing certain HWP files. A remote attacker could use     this issue to cause ClamAV to hang, resulting in a denial of service. (CVE-2018-0360)

    It was discovered that ClamAV incorrectly handled parsing certain PDF files. A remote attacker could use     this issue to cause ClamAV to hang, resulting in a denial of service. (CVE-2018-0361)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Joel Esler reports :

3 security fixes in this release :

- CVE-2017-16932: Vulnerability in libxml2 dependency (affects ClamAV on Windows only).

- CVE-2018-0360: HWP integer overflow, infinite loop vulnerability.
Reported by Secunia Research at Flexera.

- CVE-2018-0361: ClamAV PDF object length check, unreasonably long time to parse relatively small file. Report ed by aCaB.

ID	Name	Product	Family	Severity
123984	GLSA-201904-12 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123261	openSUSE Security Update : clamav (openSUSE-2019-598)	Nessus	SuSE Local Security Checks	medium
120072	SUSE SLED15 / SLES15 Security Update : clamav (SUSE-SU-2018:2230-1)	Nessus	SuSE Local Security Checks	medium
118280	SUSE SLES12 Security Update : clamav (SUSE-SU-2018:2323-2)	Nessus	SuSE Local Security Checks	medium
112047	Debian DLA-1461-1 : clamav security update	Nessus	Debian Local Security Checks	medium
111998	openSUSE Security Update : clamav (openSUSE-2018-889)	Nessus	SuSE Local Security Checks	medium
111744	SUSE SLED12 / SLES12 Security Update : clamav (SUSE-SU-2018:2323-1)	Nessus	SuSE Local Security Checks	medium
111598	openSUSE Security Update : clamav (openSUSE-2018-838)	Nessus	SuSE Local Security Checks	medium
111591	SUSE SLES11 Security Update : clamav (SUSE-SU-2018:2232-1)	Nessus	SuSE Local Security Checks	medium
111517	ClamAV < 0.100.1 Multiple Vulnerabilities	Nessus	Misc.	high
111331	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ClamAV vulnerabilities (USN-3722-1)	Nessus	Ubuntu Local Security Checks	medium
110970	FreeBSD : clamav -- multiple vulnerabilities (d1e9d8c5-839b-11e8-9610-9c5c8e75236a)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-0360

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

high