Some vulnerabilities have been reported in ClamAV, which potentially can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

1) An integer overflow error within the PE header parser in the "cli_scanpe()" function in libclamav/pe.c can be exploited to cause a heap-based buffer overflow and execute arbitrary code on a vulnerable system via a specially crafted UPX file.

Successful exploitation requires that the ArchiveMaxFileSize option is disabled.

2) Some format string errors in the logging handling in "shared/output.c" may be exploited to execute arbitrary code.

3) An out-of-bounds memory access error in the "cli_bitset_test()" function in "ibclamav/others.c" may be exploited to cause a crash.

The vulnerabilities have been reported in version 0.88. Prior versions may also be affected.

Solution
Update to version 0.88.1.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) Damian Put
2) Reported by the vendor.
3) David Luyer

Changelog
Further details available to Secunia VIM customers

Original Advisory
Debian:
http://www.us.debian.org/security/2006/dsa-1024

Damian Put:
http://www.overflow.pl/adv/clamavupxinteger.txt

Deep Links
Links available to Secunia VIM customers