CVE-2012-1458

Publication date 21 March 2012

Last updated 24 July 2024

Ubuntu priority

The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
clamav	12.04 LTS precise	Fixed 0.97.5+dfsg-1ubuntu0.12.04.1
	11.10 oneiric	Fixed 0.97.5+dfsg-1ubuntu0.11.10.1
	11.04 natty	Fixed 0.97.5+dfsg-1ubuntu0.11.04.1
	10.10 maverick	Ignored end of life
	10.04 LTS lucid	Fixed 0.96.5+dfsg-1ubuntu1.10.04.4
	8.04 LTS hardy	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
clamav	Upstream: http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=a58b68f8adf2466b761ce05f74a4580c1f74fbe6 Upstream: http://git.clamav.net/gitweb?p=clamav-devel.git;a=commit;h=9d6be7c56091f012e90074122db4ec12d3516011

References

Related Ubuntu Security Notices (USN)

USN-1482-1
ClamAV vulnerabilities
19 June 2012

CVE-2012-1458

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references