Security update for clamav

Announcement ID:	SUSE-SU-2018:0255-1
Rating:	important
References:	bsc#1040662 bsc#1049423 bsc#1052448 bsc#1052449 bsc#1052466 bsc#1077732
Cross-References:	CVE-2017-11423 CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 CVE-2017-6418 CVE-2017-6419 CVE-2017-6420
CVSS scores:	CVE-2017-11423 ( SUSE ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-11423 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-12374 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-12374 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-12375 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2017-12375 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-12376 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-12376 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-12377 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2017-12377 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-12378 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2017-12378 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-12379 ( SUSE ): 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2017-12379 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-12380 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-12380 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-6418 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2017-6418 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-6419 ( SUSE ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-6419 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-6420 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-6420 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 LTSS 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 SUSE OpenStack Cloud 6

An update that solves 11 vulnerabilities can now be installed.

Description:

This update for clamav fixes the following issues:

• Update to security release 0.99.3 (bsc#1077732)
• CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability)
• CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability)
• CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability)
  • these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device.
• CVE-2017-12374 (ClamAV use-after-free Vulnerabilities)
• CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability)
• CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability)
• CVE-2017-12380 (ClamAV Null Dereference Vulnerability)
  • these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
• CVE-2017-6420 (bsc#1052448)
  • this vulnerability could have allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.
• CVE-2017-6419 (bsc#1052449)
  • ClamAV could have allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
• CVE-2017-11423 (bsc#1049423)
  • ClamAV could have allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.
• CVE-2017-6418 (bsc#1052466)
  • ClamAV could have allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.

• update upstream keys in the keyring

• provide and obsolete clamav-nodb to trigger it's removal in Leap bsc#1040662

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE OpenStack Cloud 6
  zypper in -t patch SUSE-OpenStack-Cloud-6-2018-176=1
• SUSE Linux Enterprise Desktop 12 SP2
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2018-176=1
• SUSE Linux Enterprise Desktop 12 SP3
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-176=1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
  zypper in -t patch SUSE-SLE-RPI-12-SP2-2018-176=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-176=1
• SUSE Linux Enterprise Server for SAP Applications 12
  zypper in -t patch SUSE-SLE-SAP-12-2018-176=1
• SUSE Linux Enterprise Server 12 LTSS 12
  zypper in -t patch SUSE-SLE-SERVER-12-2018-176=1
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1
  zypper in -t patch SUSE-SLE-SERVER-12-SP1-2018-176=1
• SUSE Linux Enterprise High Performance Computing 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-176=1
• SUSE Linux Enterprise Server 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-176=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-2018-176=1
• SUSE Linux Enterprise Server 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-176=1
• SUSE Linux Enterprise High Performance Computing 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-176=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-2018-176=1

Package List:

• SUSE OpenStack Cloud 6 (x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Desktop 12 SP2 (x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Desktop 12 SP3 (x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (aarch64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server for SAP Applications 12 (x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server 12 LTSS 12 (ppc64le s390x x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server 12 SP1 LTSS 12-SP1 (ppc64le s390x x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise High Performance Computing 12 SP2 (aarch64 x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server 12 SP2 (aarch64 ppc64le s390x x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server 12 SP3 (aarch64 ppc64le s390x x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise High Performance Computing 12 SP3 (aarch64 x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3 (ppc64le x86_64)
  • clamav-debuginfo-0.99.3-33.5.1
  • clamav-debugsource-0.99.3-33.5.1
  • clamav-0.99.3-33.5.1

References:

• https://www.suse.com/security/cve/CVE-2017-11423.html
• https://www.suse.com/security/cve/CVE-2017-12374.html
• https://www.suse.com/security/cve/CVE-2017-12375.html
• https://www.suse.com/security/cve/CVE-2017-12376.html
• https://www.suse.com/security/cve/CVE-2017-12377.html
• https://www.suse.com/security/cve/CVE-2017-12378.html
• https://www.suse.com/security/cve/CVE-2017-12379.html
• https://www.suse.com/security/cve/CVE-2017-12380.html
• https://www.suse.com/security/cve/CVE-2017-6418.html
• https://www.suse.com/security/cve/CVE-2017-6419.html
• https://www.suse.com/security/cve/CVE-2017-6420.html
• https://bugzilla.suse.com/show_bug.cgi?id=1040662
• https://bugzilla.suse.com/show_bug.cgi?id=1049423
• https://bugzilla.suse.com/show_bug.cgi?id=1052448
• https://bugzilla.suse.com/show_bug.cgi?id=1052449
• https://bugzilla.suse.com/show_bug.cgi?id=1052466
• https://bugzilla.suse.com/show_bug.cgi?id=1077732