CVE-2019-12900

Note

first fix cause a regression see LP: 1834494
clamav has a vendored copy of bzip2 which is used by the
nulsft/nsis scanner. only affects clamav versions < 0.101.4

Package	Release	Status
bzip2 Launchpad, Ubuntu, Debian	bionic	Released (1.0.6-8.1ubuntu0.2)
	cosmic	Released (1.0.6-9ubuntu0.18.10.1)
	disco	Released (1.0.6-9ubuntu0.19.04.1)
	trusty	Released (1.0.6-5ubuntu0.1~esm2) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	upstream	Released (1.0.7)
	xenial	Released (1.0.6-8ubuntu0.2)
	Patches: upstream: https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
clamav Launchpad, Ubuntu, Debian	bionic	Released (0.101.4+dfsg-0ubuntu0.18.04.1)
	disco	Released (0.101.4+dfsg-0ubuntu0.19.04.1)
	trusty	Released (0.101.4+dfsg-0ubuntu0.14.04.1+esm1) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	upstream	Released (0.101.4)
	xenial	Released (0.101.4+dfsg-0ubuntu0.16.04.1)

Parameter	Value
Base score	9.8
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2019-12900

Notes

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading

Author	Note
leosilva	first fix cause a regression see LP: 1834494
alexmurray	clamav has a vendored copy of bzip2 which is used by the nulsft/nsis scanner. only affects clamav versions < 0.101.4