FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-1389

This CVE name corresponds to:

Entered	Topic
2008-09-12	clamav -- CHM Processing Denial of Service

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-1389 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-1389
Phase	Assigned(20080318)

Description

libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a malformed CHM file, related to an "invalid memory access."

References

Source	Reference
MISC	http://int21.de/cve/CVE-2008-1389-clamav-chd.html
CONFIRM	http://sourceforge.net/project/shownotes.php?group_id=86638&release_id=623661
CONFIRM	http://svn.clamav.net/svn/clamav-devel/trunk/ChangeLog
CONFIRM	https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089
CONFIRM	http://kolab.org/security/kolab-vendor-notice-22.txt
CONFIRM	http://support.apple.com/kb/HT3216
APPLE	APPLE-SA-2008-10-09
FEDORA	FEDORA-2008-9644
FEDORA	FEDORA-2008-9651
GENTOO	GLSA-200809-18
MANDRIVA	MDVSA-2008:189
SUSE	SUSE-SR:2008:018
BID	30994
BID	31681
VUPEN	ADV-2008-2484
VUPEN	ADV-2008-2564
VUPEN	ADV-2008-2780
SECTRACK	1020805
SECUNIA	31725
SECUNIA	32030
SECUNIA	31906
SECUNIA	32222
SECUNIA	32699
SECUNIA	31982