>The release notes for 0.86.2 say: > >"Changes in this release include fixes for three possible integer >overflows in libclamav" Simply assuming that a single-line changelog entry is sufficient acknowledgement of a published vulnerability is dangerous. Such assumptions are frequently wrong. (However, in this case, Alex Wheeler is credited in the more detailed changelog in the release notes). However... The original advisory said: "At least 4 of its file format processors contain remote security bugs." But then the advisory only lists 3 formats. So, was this just a typo by the researchers? Or are there really 4 bugs, and the latest release still has one bug that hasn't been fixed yet? This demonstrates one of the Four I's of security advisory problems, namely Inconsistency. The other three are Inaccurate, Incomplete, or Incomprehensible. - Steve
