clamav: A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV)versions 1.4.0, 1.3.2 and prior versions, all 1...

A vulnerability in the ClamD service module of Clam AntiVirus (ClamAV)versions 1.4.0, 1.3.2 and prior versions, all 1.2.x versions, 1.0.6 andprior versions, all 0.105.x versions, all 0.104.x versions, and 0.103.11and all prior versions could allow an authenticated, local attacker tocorrupt critical system files.The vulnerability is due to allowing the ClamD process to write to its logfile while privileged without checking if the logfile has been replacedwith a symbolic link. An attacker could exploit this vulnerability if theyreplace the ClamD log file with a symlink to a critical system file andthen find a way to restart the ClamD process. An exploit could allow theattacker to corrupt a critical system file by appending ClamD log messagesafter restart.

Where it's fixed