Debian Security Advisory 1616-2 – This update corrects a packaging and build error in the packages released in DSA-1616-1. Those packages, while functional, did not actually apply the fix intended. This update restores the fix to the package build; no other changes are introduced. Damian Put discovered a vulnerability in the ClamAV anti-virus toolkit’s parsing of Petite-packed Win32 executables. The weakness leads to an invalid memory access, and could enable an attacker to crash clamav by supplying a maliciously crafted Petite-compressed binary for scanning. In some configurations, such as when clamav is used in combination with mail servers, this could cause a system to “fail open,” facilitating a follow-on viral attack.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/68544/dsa-1616-2.txt
Source: https://packetstormsecurity.com/files/68544/Debian-Linux-Security-Advisory-1616-2.html