Re: Question about the status of libclamunrar9/libclamunrar and CVE-2023-40477 in debian buster aka oldoldstable

[Emilio Pozuelo Monfort <pochu@debian.org>]

On 13/11/2023 21:29, Markus Koschany wrote:
> Hi,
>
> > > Ist there any chance that the patched version (0.103.10) will be back-
> > > ported from bullseye?
>
> Thanks for the heads-up. We will update clamav in Buster to 0.103.10 as well to
> include the patches for libclamunrar.

clamav is unaffected in Debian as libclamunrar code is removed and split into 
src:libclamunrar (non-free).

I'll update the package in dla-needed to reflect this.

Cheers,
Emilio