Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20479-1

Опубликовано: 20 апр. 2026
Источник: suse-cvrf

Описание

Security update for clamav

This update for clamav fixes the following issues:

Update to clamav 1.5.2:

Security issue:

  • CVE-2026-20031: improper error handling in the HTML CSS module when splitting UTF-8 strings can lead to denial of service conditions via a crafted HTML file (bsc#1259207).

Non security issue:

  • Support transactional updates (jsc#PED-14819).

Changelog:

  • Fixed a possible infinite loop when scanning some JPEG files by upgrading affected ClamAV dependency, a Rust image library.
  • The CVD verification process will now ignore certificate files in the CVD certs directory when the user lacks read permissions.
  • Freshclam: Fix CLD verification bug with PrivateMirror option.
  • Upgraded the Rust bytes dependency to a newer version to resolve RUSTSEC-2026-0007 advisory.
  • Fixed a possible crash caused by invalid pointer alignment on some platforms.

Список пакетов

openSUSE Leap 16.0
clamav-1.5.2-160000.1.1
clamav-devel-1.5.2-160000.1.1
clamav-docs-html-1.5.2-160000.1.1
clamav-milter-1.5.2-160000.1.1
libclamav12-1.5.2-160000.1.1
libclammspack0-1.5.2-160000.1.1
libfreshclam4-1.5.2-160000.1.1

Ссылки

Описание

A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

Затронутые продукты
openSUSE Leap 16.0:clamav-1.5.2-160000.1.1
openSUSE Leap 16.0:clamav-devel-1.5.2-160000.1.1
openSUSE Leap 16.0:clamav-docs-html-1.5.2-160000.1.1
openSUSE Leap 16.0:clamav-milter-1.5.2-160000.1.1
Ссылки