==========================================================================
Ubuntu Security Notice USN-4435-1
July 27, 2020

clamav vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 20.04 LTS
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in ClamAV.

Software Description:
– clamav: Anti-virus utility for Unix

Details:

It was discovered that ClamAV incorrectly handled parsing ARJ archives. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2020-3327)

It was discovered that ClamAV incorrectly handled scanning malicious files.
A local attacker could possibly use this issue to delete arbitrary files.
(CVE-2020-3350)

It was discovered that ClamAV incorrectly handled parsing EGG archives. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2020-3481)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
clamav 0.102.4+dfsg-0ubuntu0.20.04.1

Ubuntu 18.04 LTS:
clamav 0.102.4+dfsg-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
clamav 0.102.4+dfsg-0ubuntu0.16.04.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.

References:
https://usn.ubuntu.com/4435-1
CVE-2020-3327, CVE-2020-3350, CVE-2020-3481

Package Information:
https://launchpad.net/ubuntu/+source/clamav/0.102.4+dfsg-0ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/clamav/0.102.4+dfsg-0ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/clamav/0.102.4+dfsg-0ubuntu0.16.04.1

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl8e9yIACgkQZWnYVadE
vpOWFQ//ZCMP7UMhjcq3lyL4sxhn4II4hjPghfnbbVhD8QkkGP4rzJG1U5fJ+3SF
+dbCmrlIHe1XDIjnfrxDssAfley5Etq5NIoJb2jeroAZ0jISMZYxFduaha0MVsZk
SKixmejQWRhrZUFCBByjwWhsmPu43v6XJ0zoCPQo874w9IKEHQJA3imtvClAvRLg
c6fTMwaAJpKfNXo+fGZ8XIpQgXG3SGCIGhqhXJh0bEFIvqrbExExZ5+LHzGuq/OJ
6sFKdxe3U2/9j/tF1XvRA92Hhi1AFXcUSIV0KDW8HX34JpqN1pTZ1YphdbgCja4p
F8J0U2jrTpRxjvyXSHftwtnwf9s07LGxmJ7n+yi14lG4biXHtW7sAjoHzXw9ZWJ7
RC2gdj70nsFX2RxUBpGPMM7ZyHmo8MADAd+TZ1adUpUp5WmcG03gSmhF1HiepV85
fG2FIogdUQXGtgaQnEKw48ZMp4PEGhqWRGtEE6lr0Nn5IiA8v1TXdoXYg8hh5P5W
gFzxIJ0j8o4GmtsWkmD+7eKeF0JEw9HagLux4SOA0qTd7Ao36LstvcrpzElwTZ8A
HzEWw2RJWx11bxRQw39H53viQbEHzz7bIKdSqXeYx1+xgtUsqDBU1ntBxsOr0iC9
oFJ0zyZo648wGo5OueWx7QGedrrylYr2KjPdEMJUER7tIolRmyI=
=272i
—–END PGP SIGNATURE—–
—