http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1389
http://int21.de/cve/CVE-2008-1389-clamav-chd.html
http://www.int21.de/cve/cve-2008-1389-samples.tar.bz2
https://wwws.clamav.net/bugzilla/show_bug.cgi?id=1089
A fuzzing test showed weakness in the chm parser of clamav, which can
possibly be exploited.
The clamav team has disabled the chm module in older versions though
freshclam updates and has released 0.94 with a fixed parser.
The clamav team has not mentioned this issue in the release notes of 0.94, which is very bad security behaviour.
2008-07-09: clamav bug opened
unknown date: clamav disables chm-parser through freshclam
2008-09-02 Vendor releases 0.94
2008-09-04 Released this advisory
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-1389 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems.
This vulnerability was discovered by Hanno Boeck of schokokeks.org webhosting. It's licensed under the creative commons attribution license.
Hanno Boeck, 2008-09-04, http://www.hboeck.de