[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090409125038.GA2951@suse.de>
Date: Thu, 9 Apr 2009 14:50:39 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: clamav clamd and clamscan DoS and bypass by malformated archive
On Thu, Apr 09, 2009 at 02:41:31PM +0200, Hanno Böck wrote:
> Am Donnerstag 09 April 2009 schrieb Tomas Hoger:
> > Upstream 0.95.1 seems to fix at least 2 other issues that may be of
> > interest:
> >
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1552
> > https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1553
> >
> > svn diff -c 5032 http://svn.clamav.net/svn/clamav-devel/
>
> Stupid question but is it common clamav policy to not mention security
> releases? Anyone any info about that?
>
> This is a bit frightening for a "security" product (they have a menu
> point "security" on their website but it seems they don't tend to fill it
> with information...)
I think our clamav package maintainer tried to inject some clues
into their processes, but so far it does not seem to have helped. :/
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
