clamav: Crash with crafted chm, CVE-2008-1389
A fuzzing test showed weakness in the chm parser of clamav, which can possibly
The clamav team has disabled the chm module in older versions though freshclam
updates and has released 0.94 with a fixed parser.
The clamav team has not mentioned this issue in the release notes of 0.94,
which is very bad security behaviour.
2008-07-09: clamav bug opened
unknown date: clamav disables chm-parser through freshclam
2008-09-02 Vendor releases 0.94
2008-09-04 Released this advisory
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2008-1389 to this issue. This is a candidate for inclusion in the CVE
list (http://cve.mitre.org/), which standardizes names for security problems.
Credits and copyright
This vulnerability was discovered by Hanno Boeck of schokokeks.org webhosting.
It's licensed under the creative commons attribution license.
Hanno Boeck, 2008-09-04, http://www.hboeck.de
Hanno B=C3=B6ck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: email@example.com
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
-----END PGP SIGNATURE-----