Debian Security Advisory DSA 1616-2 (clamav)

The remote host is missing an update to clamav announced via advisory DSA 1616-2.

This update corrects a packaging and build error in the packages released in DSA-1616-1. Those packages, while functional, did not actually apply the fix intended. This update restores the fix to the package build no other changes are introduced. For reference, the text of the original advisory follows. Damian Put discovered a vulnerability in the ClamAV anti-virus toolkit's parsing of Petite-packed Win32 executables. The weakness leads to an invalid memory access, and could enable an attacker to crash clamav by supplying a maliciously crafted Petite-compressed binary for scanning. In some configurations, such as when clamav is used in combination with mail servers, this could cause a system to fail open, facilitating a follow-on viral attack. The Common Vulnerabilities and Exposures project identifies this weakness as CVE-2008-2713. For the stable distribution (etch), this problem has been fixed in version 0.90.1dfsg-3.1+etch14. For the unstable distribution (sid), the problem has been fixed in version 0.93.1.dfsg-1.1. We recommend that you upgrade your clamav packages.

https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201616-2