From a0027c513de0c78ecc5604998ae25cb40bfa09bf Mon Sep 17 00:00:00 2001 From: wk333 <13474090681@163.com> Date: Mon, 24 Jan 2022 14:22:21 +0800 Subject: [PATCH] Fix CVE-2022-20698 --- CVE-2022-20698.patch | 31 +++++++++++++++++++++++++++++++ clamav.spec | 6 +++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 CVE-2022-20698.patch diff --git a/CVE-2022-20698.patch b/CVE-2022-20698.patch new file mode 100644 index 0000000..8d5bb62 --- /dev/null +++ b/CVE-2022-20698.patch @@ -0,0 +1,31 @@ +From 9a6bb57f89721db637f4ddb5b233c1c4e23d223a Mon Sep 17 00:00:00 2001 +From: Micah Snyder +Date: Wed, 15 Sep 2021 15:51:53 -0700 +Subject: [PATCH] OOXML: Fix invalid pointer dereference + +The OOXML parser in libclamav may try to extract an entry that is +missing a file name. This results in an invalid 0x1 pointer dereference +in the ZIP parser that is likely to crash the scanning application. + +This commit fixes the issue by requiring both the PartName (PN) *and* +the ContentType (CT) variables to be non-NULL or else the entry will be +skipped. + +Thank you Laurent Delosieres for reporting this issue. +--- + libclamav/ooxml.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libclamav/ooxml.c b/libclamav/ooxml.c +index 16c436f1a5..644779432c 100644 +--- a/libclamav/ooxml.c ++++ b/libclamav/ooxml.c +@@ -245,7 +245,7 @@ static cl_error_t ooxml_content_cb(int fd, const char *filepath, cli_ctx *ctx, c + cli_dbgmsg("%s: %s\n", localname, value); + } + +- if (!CT && !PN) continue; ++ if (!CT || !PN) continue; + + if (!xmlStrcmp(CT, (const xmlChar *)"application/vnd.openxmlformats-package.core-properties+xml")) { + /* default: /docProps/core.xml*/ diff --git a/clamav.spec b/clamav.spec index f7f6b00..f9dd38a 100644 --- a/clamav.spec +++ b/clamav.spec @@ -1,7 +1,7 @@ Name: clamav Summary: End-user tools for the Clam Antivirus scanner Version: 0.103.2 -Release: 1 +Release: 2 License: GPLv2 and Public Domain and bzip2-1.0.6 and Zlib and Apache-2.0 URL: https://www.clamav.net/ Source0: https://www.clamav.net/downloads/production/clamav-%{version}.tar.gz @@ -26,6 +26,7 @@ Patch0003: clamav-0.99-private.patch Patch0004: clamav-check.patch Patch0005: clamav-clamonacc-service.patch Patch0006: clamav-freshclam.service.patch +Patch0007: CVE-2022-20698.patch BuildRequires: autoconf automake gettext-devel libtool libtool-ltdl-devel BuildRequires: gcc-c++ zlib-devel bzip2-devel gmp-devel curl-devel json-c-devel @@ -410,6 +411,9 @@ test -e %_var/log/clamav-milter.log || { %changelog +* Mon Jan 24 2022 wangkai - 0.103.2-2 +- Fix CVE-2022-20698 + * Fri Apr 16 2021 wangyue - 0.103.2-1 - Upgrade to 0.103.2 -- Gitee