Arch Linux Security Advisory ASA-201411-21 ========================================== Severity: Low Date : 2014-11-20 CVE-ID : CVE-2013-6497 Package : clamav Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package clamav before version 0.98.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.98.5-1. # pacman -Syu "clamav>=0.98.5-1" The problem has been fixed upstream in version 0.98.5. Workaround ========== None. Description =========== It was discovered that clamav crashes on certain files when using 'clamscan -a' or while scanning maliciously crafted files. Impact ====== Certain JavaScript or specially crafted files processed by "clamscan" may lead to a segmentation fault resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2013-6497 https://bugzilla.clamav.net/show_bug.cgi?id=11088 http://seclists.org/oss-sec/2014/q4/673