Marcus Meissner
06d9b1e3a6
- Update to security release 0.99.3 (bsc#1077732)
* CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability)
* CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability)
* CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability)
- these vulnerabilities could have allowed an unauthenticated,
remote attacker to cause a denial of service (DoS) condition
or potentially execute arbitrary code on an affected device.
* CVE-2017-12374 (ClamAV use-after-free Vulnerabilities)
* CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability)
* CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability)
* CVE-2017-12380 (ClamAV Null Dereference Vulnerability)
- these vulnerabilities could have allowed an unauthenticated,
remote attacker to cause a denial of service (DoS) condition on an affected device.
* CVE-2017-6420 (bsc#1052448)
- this vulnerability allowed remote attackers to cause a denial of service
(use-after-free) via a crafted PE file with WWPack compression.
* CVE-2017-6419 (bsc#1052449)
- ClamAV allowed remote attackers to cause a denial of service
(heap-based buffer overflow and application crash) or possibly
have unspecified other impact via a crafted CHM file.
* CVE-2017-11423 (bsc#1049423)
- The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha
allowed remote attackers to cause a denial of service
(stack-based buffer over-read and application crash) via a crafted CAB file.
* CVE-2017-6418 (bsc#1052466)
- ClamAV 0.99.2 allowed remote attackers to cause a denial
of service (out-of-bounds read) via a crafted e-mail message.
- drop clamav-0.99.2-openssl-1.1.patch (upstream)
OBS-URL: https://build.opensuse.org/request/show/569976
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=151
86 lines
2.7 KiB
Diff
86 lines
2.7 KiB
Diff
Index: clamav-0.99.3/libclamav/tomsfastmath/misc/fp_ident.c
|
|
===================================================================
|
|
--- clamav-0.99.3.orig/libclamav/tomsfastmath/misc/fp_ident.c 2018-01-26 16:31:35.516009696 +0100
|
|
+++ clamav-0.99.3/libclamav/tomsfastmath/misc/fp_ident.c 2018-01-26 16:31:36.912029598 +0100
|
|
@@ -15,7 +15,11 @@ const char *fp_ident(void)
|
|
|
|
memset(buf, 0, sizeof(buf));
|
|
snprintf(buf, sizeof(buf)-1,
|
|
-"TomsFastMath (%s)\n"
|
|
+#if (ENABLE_TIMESTAMPS == 1)
|
|
+ "TomsFastMath (%s)\n"
|
|
+#else
|
|
+ "TomsFastMath\n"
|
|
+#endif
|
|
"\n"
|
|
"Sizeofs\n"
|
|
"\tfp_digit = %llu\n"
|
|
@@ -70,7 +74,11 @@ const char *fp_ident(void)
|
|
#ifdef TFM_HUGE
|
|
" TFM_HUGE "
|
|
#endif
|
|
+#if (ENABLE_TIMESTAMPS == 1)
|
|
"\n", __DATE__, (long long unsigned)sizeof(fp_digit), (long long unsigned)sizeof(fp_word), FP_MAX_SIZE);
|
|
+#else
|
|
+ "\n", (long long unsigned)sizeof(fp_digit), (long long unsigned)sizeof(fp_word), FP_MAX_SIZE);
|
|
+#endif
|
|
|
|
if (sizeof(fp_digit) == sizeof(fp_word)) {
|
|
strncat(buf, "WARNING: sizeof(fp_digit) == sizeof(fp_word), this build is likely to not work properly.\n",
|
|
Index: clamav-0.99.3/configure
|
|
===================================================================
|
|
--- clamav-0.99.3.orig/configure 2018-01-26 16:31:35.532009924 +0100
|
|
+++ clamav-0.99.3/configure 2018-01-26 16:32:20.112645407 +0100
|
|
@@ -783,6 +783,7 @@ FGREP
|
|
SED
|
|
LIBTOOL
|
|
LIBCLAMAV_VERSION
|
|
+ENABLE_TIMESTAMPS
|
|
EGREP
|
|
GREP
|
|
CPP
|
|
@@ -885,6 +886,7 @@ ac_user_opts='
|
|
enable_option_checking
|
|
enable_silent_rules
|
|
enable_dependency_tracking
|
|
+enable_timestamps
|
|
enable_static
|
|
enable_shared
|
|
with_pic
|
|
@@ -1591,6 +1593,8 @@ Optional Features:
|
|
--disable-dependency-tracking speeds up one-time build
|
|
--enable-dependency-tracking do not reject slow dependency extractors
|
|
--enable-static[=PKGS] build static libraries [default=no]
|
|
+ --enable-timestamps Enable embedding timestamp information in build
|
|
+ (default is YES)
|
|
--enable-shared[=PKGS] build shared libraries [default=yes]
|
|
--enable-fast-install[=PKGS]
|
|
optimize for fast installation [default=yes]
|
|
@@ -4967,6 +4971,26 @@ $as_echo "$ac_cv_safe_to_define___extens
|
|
|
|
$as_echo "#define _TANDEM_SOURCE 1" >>confdefs.h
|
|
|
|
+# Check whether --enable-timestamps was given.
|
|
+if test "${enable_timestamps+set}" = set; then :
|
|
+ enableval=$enable_timestamps;
|
|
+else
|
|
+ enableval=default
|
|
+fi
|
|
+
|
|
+case "$enableval" in
|
|
+ yes) ENABLE_TIMESTAMPS=1
|
|
+ ;;
|
|
+ no) ENABLE_TIMESTAMPS=0
|
|
+ ;;
|
|
+ default) ENABLE_TIMESTAMPS=1
|
|
+ ;;
|
|
+ *) as_fn_error $? "Invalid setting for --enable-timestamps. Use \"yes\" or \"no\"" "$LINENO" 5 ;;
|
|
+esac
|
|
+
|
|
+cat >>confdefs.h <<_ACEOF
|
|
+#define ENABLE_TIMESTAMPS $ENABLE_TIMESTAMPS
|
|
+_ACEOF
|
|
|
|
|
|
VERSION="0.99.3"
|