0.101.4
ClamAV 0.101.4 is a security patch release that addresses the following issues.
- An out of bounds write was possible within ClamAV's NSIS bzip2 library when attempting decompression in cases where the number of selectors exceeded the max limit set by the library (CVE-2019-12900). The issue has been resolved by respecting that limit.
Thanks to Martin Simmons for reporting the issue here. - The zip bomb vulnerability mitigated in 0.101.3 has been assigned the CVE identifier CVE-2019-12625. Unfortunately, a workaround for the zip-bomb mitigation was immediately identified. To remediate the zip-bomb scan time issue, a scan time limit has been introduced in 0.101.4. This limit now resolves ClamAV's vulnerability to CVE-2019-12625.
The default scan time limit is 2 minutes (120000 milliseconds).
To customize the time limit:
- use the clamscan --max-scantime option
- use the clamd MaxScanTime config option
Libclamav users may customize the time limit using the cl_engine_set_num function. For example:
C
cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, time_limit_milliseconds)
Thanks to David Fifield for reviewing the zip-bomb mitigation in 0.101.3 and reporting the issue.
As usual, ClamAV may be downloaded from https://www.clamav.net/downloads, and discussion should take place on the ClamAV-Users list. Thanks!
