Secunia

Two vulnerabilities have been reported in ClamAV, which can be exploited by malicious people to cause a DoS (Denial of Service), or potentially to compromise a vulnerable system.

1) A signedness error in "libclamav/upx.c" can potentially be exploited to cause a heap-based buffer overflow when processing a malformed UPX-compressed executable file with a negative value in the "NumberOfSections" attribute of the PE header.

2) An error in "libclamav/fsg.c" when sorting sections in a FSG (v1.33)-compressed executable file may cause an infinite loop when processing a specially-crafted file containing two sections with the same Relative Virtual Address (RVA).

The vulnerabilities have been reported in version 0.86.2 and prior.

Solution
Update to version 0.87 or later.

Provided and/or discovered by
Discovered by anonymous person and reported via iDEFENSE.

Changelog
Further details available in Customer Area

Original Advisory
iDEFENSE:
http://www.idefense.com/application/poi/display?id=315&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=316&type=vulnerabilities

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area