Wednesday, August 21, 2019

ClamAV 0.101.4 security patch release has been published

Today we have published the ClamAV 0.101.4 security patch release.


ClamAV 0.101.4 is a security patch release that addresses the following issues.
  •  An out of bounds write was possible within ClamAV's NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.

    Thanks to Martin Simmons for reporting the issue here.
  •  The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.

    The default scan time limit is 2 minutes (120000 milliseconds).

    To customize the time limit:
    - use the clamscan  --max-scantime option
    - use the clamd  MaxScanTime config option

    Libclamav users may customize the time limit using the cl_engine_set_num function. For example:

        cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, time_limit_milliseconds)

    Thanks to David Fifield for reviewing the zip-bomb mitigation in 0.101.3 and reporting the issue.
As usual, ClamAV may be downloaded from, and discussion should take place on the ClamAV-Users list.  Thanks!