Secunia

A vulnerability has been reported in ClamAV, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a boundary error in libclamav/petite.c. This can be exploited to trigger an out-of-bounds read via a specially crafted Petite packed executable.

The vulnerability is confirmed in versions 0.93 and 0.93.1. Prior versions may also be affected.

Solution
Update to version 0.93.3.

Provided and/or discovered by
The vendor credits Damian Put.

Information about additional attack vector not patched in the original fix was provided by Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1000

http://sourceforge.net/project/shownotes.php?release_id=605577&group_id=86638
http://sourceforge.net/project/shownotes.php?release_id=611890&group_id=86638

Deep Links
Links available in Customer Area