Bug #304017 “Recursive stack overflow in jpeg parsing code” : Bugs : clamav package : Ubuntu

Revision history for this message

Scott Kitterman (kitterman) wrote on 2008-12-01:

#1

There is no CVE. Launchpad is being difficult and won't let me link the upstream bug without doing additional paperwork, so here it is:

https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1266

Changed in clamav:
assignee:	nobody → kitterman
importance:	Undecided → High
status:	New → In Progress
assignee:	nobody → kitterman
importance:	Undecided → High
status:	New → Fix Released

Revision history for this message

Scott Kitterman (kitterman) wrote on 2008-12-01:

#2

Package tested. Waiting for Ubuntu security to upload it.

Revision history for this message

Kees Cook (kees) wrote on 2008-12-01:

#3

Building in security queue now.

Changed in clamav:
status:	In Progress → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2008-12-02:

#4

This bug was fixed in the package clamav - 0.94.dfsg.2-1ubuntu0.1

---------------
clamav (0.94.dfsg.2-1ubuntu0.1) intrepid-security; urgency=low

  * SECURITY UPDATE: (LP: #304017)
    - Fix recursive stack overflow in jpeg parsing code
  * Other changes:
    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6 for
      clamav-daemon and clamav-freshclam
    - add debian/usr.bin.freshclam and debian/usr.sbin.clamd
    - debian/clamav-(daemon|freshclam).dirs: add etc/apparmor.d/force-complain
    - debian/clamav-(daemon|freshclam).install: install profiles
    - debian/clamav-(daemon|freshclam).preinst: create symlink for
      force-complain/ on pre-feisty upgrades, upgrades where apparmor-profiles
      profile is unchanged (ie non-enforcing) and upgrades where the profile
      doesn't exist.
    - debian/clamav-(daemon|freshclam).postrm: remove symlink in
      force-complain/ on purge.
    - debian/clamav-(daemon|freshclam).postinst.in: reload apparmor
    - update README.Debian with note on Apparmor
    - Enable upstream test suite in debian/rules

-- Scott Kitterman <email address hidden> Mon, 01 Dec 2008 13:11:52 -0500

Changed in clamav:
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2008-12-04:

#5

This bug was fixed in the package clamav - 0.92.1~dfsg2-1.1ubuntu0.4

---------------
clamav (0.92.1~dfsg2-1.1ubuntu0.4) hardy-security; urgency=low

  * SECURITY UPDATE: denial of service via out-of-memory null dereferences,
    memory leaks, and file descriptor leaks:
    - 29_CVE-2008-3912.dpatch: backported upstream fixes.
    - 30_CVE-2008-3913.dpatch: backported upstream fixes.
    - 31_CVE-2008-3914.dpatch: backported upstream fixes.
    - LP: #271546
  * SECURITY UPDATE: denial of service via crafted JPEG file
    - 32_cli_check_jpeg_exploit.dpatch: backported upstream fixes.
    - CVE-2008-5314, LP: #304017

-- Leonel Nunez <email address hidden> Thu, 04 Dec 2008 10:47:40 -0700

Changed in clamav:
status:	New → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-02-28:

#6

Download full text (8.3 KiB)

This bug was fixed in the package clamav - 0.94.dfsg.2-1ubuntu0.1~dapper1

---------------
clamav (0.94.dfsg.2-1ubuntu0.1~dapper1) dapper-backports; urgency=low

  * Source backport for Dapper (LP: #335724)
    - Drop lsb status functions
      - Revert status_of_proc changes from maintainer scripts
      - Drop versioned depends of lsb-base
    - Switch back to old style dpkg-dev Source-Version
    - Drop maintainer change
    - Build with GCC 4.1
    - Remove leading comments from translation templates due to tool
      shortfalls on Dapper

clamav (0.94.dfsg.2-1ubuntu0.1) intrepid-security; urgency=low

  * SECURITY UPDATE: (LP: #304017)
    - Fix recursive stack overflow in jpeg parsing code
  * Other changes:
    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6 for
      clamav-daemon and clamav-freshclam
    - add debian/usr.bin.freshclam and debian/usr.sbin.clamd
    - debian/clamav-(daemon|freshclam).dirs: add etc/apparmor.d/force-complain
    - debian/clamav-(daemon|freshclam).install: install profiles
    - debian/clamav-(daemon|freshclam).preinst: create symlink for
      force-complain/ on pre-feisty upgrades, upgrades where apparmor-profiles
      profile is unchanged (ie non-enforcing) and upgrades where the profile
      doesn't exist.
    - debian/clamav-(daemon|freshclam).postrm: remove symlink in
      force-complain/ on purge.
    - debian/clamav-(daemon|freshclam).postinst.in: reload apparmor
    - update README.Debian with note on Apparmor
    - Enable upstream test suite in debian/rules

clamav (0.94.dfsg.2-1) unstable; urgency=low

[ Stephen Gran ]
* New upstream version

[ Michael Meskes ]
* Removed unused debconf templates and unfuzzied all translations.

  [ Michael Tautschnig ]
  * Removed --unzip from clampipe script (closes: #506055)
  * Moved clamav-milter specific stuff from its specific README.Debian to
    clamav-global one.
  * Sync start of clamav-milter with clamav-daemon when clamav-daemon is being
    upgraded (closes: #309067)
  * The TemporaryDirectory option has been added long ago, no need for hacks
    via clamav-daemon.default anymore (closes: #253080)

clamav (0.94.dfsg.1-1ubuntu0.1) intrepid-security; urgency=low

  * SECURITY UPDATE: (LP: #296704)
    - Fix off-by-one heap overflow
  * Other changes:
    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6 for
      clamav-daemon and clamav-freshclam
    - add debian/usr.bin.freshclam and debian/usr.sbin.clamd
    - debian/clamav-(daemon|freshclam).dirs: add etc/apparmor.d/force-complain
    - debian/clamav-(daemon|freshclam).install: install profiles
    - debian/clamav-(daemon|freshclam).preinst: create symlink for
      force-complain/ on pre-feisty upgrades, upgrades where apparmor-profiles
      profile is unchanged (ie non-enforcing) and upgrades where the profile
      doesn't exist.
    - debian/clamav-(daemon|freshclam).postrm: remove symlink in
      force-complain/ on purge.
    - debian/clamav-(daemon|freshclam).postinst.in: reload apparmor
    - update README.Debian with note on Apparmor
  * Update apparmor profile for clamd to work with TCP sockets (LP: #288942)

clamav (0.94.dfsg.1-1) unstable; urgency=low

...

This bug was fixed in the package clamav - 0.94.dfsg.2-1ubuntu0.1~dapper1

---------------
clamav (0.94.dfsg.2-1ubuntu0.1~dapper1) dapper-backports; urgency=low

* Source backport for Dapper (LP: #335724)
    - Drop lsb status functions
      - Revert status_of_proc changes from maintainer scripts
      - Drop versioned depends of lsb-base
    - Switch back to old style dpkg-dev Source-Version
    - Drop maintainer change
    - Build with GCC 4.1
    - Remove leading comments from translation templates due to tool
      shortfalls on Dapper

clamav (0.94.dfsg.2-1ubuntu0.1) intrepid-security; urgency=low

* SECURITY UPDATE: (LP: #304017)
    - Fix recursive stack overflow in jpeg parsing code
  * Other changes:
    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6 for
      clamav-daemon and clamav-freshclam
    - add debian/usr.bin.freshclam and debian/usr.sbin.clamd
    - debian/clamav-(daemon|freshclam).dirs: add etc/apparmor.d/force-complain
    - debian/clamav-(daemon|freshclam).install: install profiles
    - debian/clamav-(daemon|freshclam).preinst: create symlink for
      force-complain/ on pre-feisty upgrades, upgrades where apparmor-profiles
      profile is unchanged (ie non-enforcing) and upgrades where the profile
      doesn't exist.
    - debian/clamav-(daemon|freshclam).postrm: remove symlink in
      force-complain/ on purge.
    - debian/clamav-(daemon|freshclam).postinst.in: reload apparmor
    - update README.Debian with note on Apparmor
    - Enable upstream test suite in debian/rules

clamav (0.94.dfsg.2-1) unstable; urgency=low

[ Stephen Gran ]
  * New upstream version

[ Michael Meskes ]
  * Removed unused debconf templates and unfuzzied all translations.

[ Michael Tautschnig ]
  * Removed --unzip from clampipe script (closes: #506055)
  * Moved clamav-milter specific stuff from its specific README.Debian to
    clamav-global one.
  * Sync start of clamav-milter with clamav-daemon when clamav-daemon is being
    upgraded (closes: #309067)
  * The TemporaryDirectory option has been added long ago, no need for hacks
    via clamav-daemon.default anymore (closes: #253080)

clamav (0.94.dfsg.1-1ubuntu0.1) intrepid-security; urgency=low

* SECURITY UPDATE: (LP: #296704)
    - Fix off-by-one heap overflow
  * Other changes:
    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6 for
      clamav-daemon and clamav-freshclam
    - add debian/usr.bin.freshclam and debian/usr.sbin.clamd
    - debian/clamav-(daemon|freshclam).dirs: add etc/apparmor.d/force-complain
    - debian/clamav-(daemon|freshclam).install: install profiles
    - debian/clamav-(daemon|freshclam).preinst: create symlink for
      force-complain/ on pre-feisty upgrades, upgrades where apparmor-profiles
      profile is unchanged (ie non-enforcing) and upgrades where the profile
      doesn't exist.
    - debian/clamav-(daemon|freshclam).postrm: remove symlink in
      force-complain/ on purge.
    - debian/clamav-(daemon|freshclam).postinst.in: reload apparmor
    - update README.Debian with note on Apparmor
  * Update apparmor profile for clamd to work with TCP sockets (LP: #288942)

clamav (0.94.dfsg.1-1) unstable; urgency=low

[ Stephen Gran ]
  * New upstream version (closes: #505134, #502165, #501298)
  * Handle new option SubmitDetectionStats in freshclam.conf
  * Remove RAR from the description, since we really don't handle it anymore
  * Skip 'sleep until -e socket' logic if socket is of type inet (LP #296086)

[ Michael Meskes ]
  * Added myself as uploader.
  * Changed watch file to account for dfsg extension.
  * Do not configure temporary directory in clamd.conf anymore unless it is
    already configured there.
  * Added Basque debconf translation (closes: #500007)

[ Michael Tautschnig ]
  * Use lsb's status_of_proc function to determine the status of the process
    and return with according exit codes (closes: #486076)
  * Updated Dutch debconf translation (thanks Paul Gevers <paul@climbing.nl>)
    (closes: #501627)
  * Changed versioned dependency of clamav-daemon to clamav-base to equals
    (closes: #500416)
  * Handle new option DetectionStatsCountry in freshclam.conf
  * Don't trust the multilib guessing stuff, always use libdir=$prefix/lib
  * Removed nowadays unused lintian overrides
  * Create md5sums control file for clamav-dbg as well (thanks, lintian)

clamav (0.94.dfsg.1~rc1-0ubuntu2) intrepid; urgency=low

* update clamd profile for use with exim (LP: #288110)

clamav (0.94.dfsg.1~rc1-0ubuntu1) intrepid; urgency=low

* New upstream RC release (LP:#286176)
    - Odd version numbering is to get a higher version than 0.94.dfsg without
      an epoch and was coordinated with Debian
    - Packaging based on current Ubuntu (0.94.dfsg-1ubuntu2) and does not use
      unreleased packaging improvements in the Debian pkg-claamv Git repo to
      minimize risk for Intrepid
    - Handle new freshclam option SubmitDetectionStats (cherry picked from
      Debian pkg-clamav Git repo)

clamav (0.94.dfsg-1ubuntu2) intrepid; urgency=low

* Update apparmor profile based on test feedback (LP: #276865)
    -Thanks to Ante Karamatić for the change

clamav (0.94.dfsg-1ubuntu1) intrepid; urgency=low

* Follow ApparmorProfileMigration and force apparmor complain mode on some
    upgrades (LP: #264817)
    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6 for
      clamav-daemon and clamav-freshclam
    - add debian/usr.bin.freshclam and debian/usr.sbin.clamd
    - debian/clamav-(daemon|freshclam).dirs: add etc/apparmor.d/force-complain
    - debian/clamav-(daemon|freshclam).install: install profiles
    - debian/clamav-(daemon|freshclam).preinst: create symlink for
      force-complain/ on pre-feisty upgrades, upgrades where apparmor-profiles
      profile is unchanged (ie non-enforcing) and upgrades where the profile
      doesn't exist.
    - debian/clamav-(daemon|freshclam).postrm: remove symlink in
      force-complain/ on purge.
    - debian/clamav-(daemon|freshclam).postinst.in: reload apparmor
    - update README.Debian with note on Apparmor

clamav (0.94.dfsg-1) unstable; urgency=low

* New upstream version (closes: #497662, #497773)
    - lots of new options for clamd.conf
    - fixes CVEs CVE-2008-3912, CVE-2008-3913, CVE-2008-3914, and
      CVE-2008-1389
  * No longer supports --unzip option, so typo is gone (closes: #496276)
  * Translations:
    - sv (thanks Martin Bagge <brother@bsnet.se>) (closes: #491760)

clamav (0.93.3.dfsg-1) unstable; urgency=low

* New upstream version (closes: #489890, #492838, #491720)
  * Fix AUTHORS symlink (closes: #490207)
  * Fix freshclam's logcheck regex (closes: #486385)

clamav (0.93.1.dfsg-1.1) unstable; urgency=high

* Non-maintainer upload by the Security Team.
  * This update addresses the following security issue:
    - CVE-2008-2713: A crafted petite file can trigger an out-of-bound
      read operation in petite.c resulting in a denial of sevice
      (Closes: #490925).

clamav (0.93.1.dfsg-1) unstable; urgency=low

* New upstream version
  * Move conflicts to freshclam

clamav (0.93~dfsg-4) unstable; urgency=low

* Dammit.  The -f flag is there for a reason (closes: #484262)

clamav (0.93~dfsg-3) unstable; urgency=low

* Make dash happy with use of return (closes: #484170)

clamav (0.93~dfsg-2) unstable; urgency=low

* Remove dpatch dependency - we keep the code in a patch system.
  * Wrap evaluations of [ $variable = true ] in calls to to_lower()
  * Add is_true function to catch the 7 bajillion variants of something being
    true (closes: #483874)
  * Clean up old incompatible database formats.  Users of 3rd party software
    that also loads those old databases are now out of luck. (closes: #481864)
  * Fix logcheck lines for clamav-daemon (closes: #477818)
  * New translation:
    - sv (thanks Martin Bagge <martin.bagge@bthstudent.se>)(closes: #483765)

clamav (0.93~dfsg-1) unstable; urgency=low

* New upstream release (closes: #476450, #477278)
    - Fixes failure to lock database directory
      (closes: #467298, #471643, #426503)
  * Fix logrotation when supervised (closes: #469196)
  * Run adduser on every new install - this should work around the
    xen-create-image thing of adding users but not groups (closes: #458015)
  * Make clamav-milter be a little more self-documenting (closes: #477178)

-- Scott Kitterman <scott@kitterman.com>   Fri, 27 Feb 2009 23:36:24 -0500

Changed in clamav:
status:	New → Fix Released

Revision history for this message

Sergio Zanchetta (primes2h) wrote on 2009-05-07:

#7

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.

Changed in clamav (Ubuntu Gutsy):
status:	New → Won't Fix

Ubuntu
clamav package

Recursive stack overflow in jpeg parsing code

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
clamav (Ubuntu)	Fix Released	High	Scott Kitterman
Dapper	Fix Released	Undecided	Unassigned
Gutsy	Won't Fix	Undecided	Unassigned
Hardy	Fix Released	Undecided	Unassigned
Intrepid	Fix Released	High	Scott Kitterman
Jaunty	Fix Released	High	Scott Kitterman

Ubuntuclamav package

Recursive stack overflow in jpeg parsing code

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
clamav package