FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2007-3123

This CVE name corresponds to:

Entered	Topic
2007-06-19	clamav -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2007-3123 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2007-3123
Phase	Assigned(20070607)

Description

unrar.c in libclamav in ClamAV before 0.90.3 and 0.91 before 0.91rc1 allows remote attackers to cause a denial of service (core dump) via a crafted RAR file with a modified vm_codesize value, which triggers a heap-based buffer overflow.

References

Source	Reference
MLIST	[Clamav-announce] 20070530 announcing ClamAV 0.90.3
CONFIRM	http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog
CONFIRM	https://wwws.clamav.net/bugzilla/show_bug.cgi?id=521
CONFIRM	http://kolab.org/security/kolab-vendor-notice-15.txt
DEBIAN	DSA-1320
GENTOO	GLSA-200706-05
SUSE	SUSE-SA:2007:033
BID	24289
OSVDB	35522
SECUNIA	25523
SECUNIA	25525
SECUNIA	25688
SECUNIA	25796
XF	clamav-rar-dos(34778)