Re: [SECURITY] [DSA 1680-1] New clamav packages fix potential code execution

2008-12-05 Thread Michael Tautschnig
[...] > > This looks like quite a serious bug (remote arbitrary code execution). > Are there any plans for an update to volatile? > The fixed version has been uploaded to volatile already and got accepted [1], but probably is still being built!? Best, Michael [1] http://lists.alioth.debian.or

Re: [SECURITY] [DSA 1680-1] New clamav packages fix potential code execution

2008-12-05 Thread Török Edwin
On 2008-12-05 20:15, Dominic Hargreaves wrote: > On Thu, Dec 04, 2008 at 09:26:17AM +0100, Florian Weimer wrote: > > >> Moritz Jodeit discovered that ClamAV, an anti-virus solution, suffers >> from an off-by-one-error in its VBA project file processing, leading to >> a heap-based buffer overflow

Re: [SECURITY] [DSA 1680-1] New clamav packages fix potential code execution

2008-12-05 Thread Dominic Hargreaves
On Thu, Dec 04, 2008 at 09:26:17AM +0100, Florian Weimer wrote: > Moritz Jodeit discovered that ClamAV, an anti-virus solution, suffers > from an off-by-one-error in its VBA project file processing, leading to > a heap-based buffer overflow and potentially arbitrary code execution > (CVE-2008-5050