pool/clamav
SHA256
3
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
bdee1c074b
clamav/clamav-disable-timestamps.patch

86 lines
2.5 KiB
Diff
Raw Normal View History

Accepting request 728340 from home:AndreasStieger:branches:security - update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (boo#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime` config option (boo#1144504) OBS-URL: https://build.opensuse.org/request/show/728340 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=189
2019-09-09 14:39:48 +02:00
Index: libclamav/tomsfastmath/misc/fp_ident.c
===================================================================
- Update to security release 0.99.4 (bsc#1083915): * CVE-2012-6706 * CVE-2017-6419 * CVE-2017-11423 * CVE-2018-1000085 (bsc#1082858) * CVE-2018-0202 - Obsolete patches: * clamav-CVE-2012-6706.patch * clamav-gcc47.patch OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=159
2018-03-07 14:46:42 +01:00
--- libclamav/tomsfastmath/misc/fp_ident.c.orig
+++ libclamav/tomsfastmath/misc/fp_ident.c
Accepting request 439481 from home:faweiss:branches:security OBS-URL: https://build.opensuse.org/request/show/439481 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=140
2016-11-10 23:34:49 +01:00
@@ -15,7 +15,11 @@ const char *fp_ident(void)
memset(buf, 0, sizeof(buf));
snprintf(buf, sizeof(buf)-1,
-"TomsFastMath (%s)\n"
+#if (ENABLE_TIMESTAMPS == 1)
+ "TomsFastMath (%s)\n"
+#else
+ "TomsFastMath\n"
+#endif
"\n"
"Sizeofs\n"
"\tfp_digit = %llu\n"
@@ -70,7 +74,11 @@ const char *fp_ident(void)
#ifdef TFM_HUGE
" TFM_HUGE "
#endif
+#if (ENABLE_TIMESTAMPS == 1)
"\n", __DATE__, (long long unsigned)sizeof(fp_digit), (long long unsigned)sizeof(fp_word), FP_MAX_SIZE);
+#else
+ "\n", (long long unsigned)sizeof(fp_digit), (long long unsigned)sizeof(fp_word), FP_MAX_SIZE);
+#endif
if (sizeof(fp_digit) == sizeof(fp_word)) {
strncat(buf, "WARNING: sizeof(fp_digit) == sizeof(fp_word), this build is likely to not work properly.\n",
Accepting request 728340 from home:AndreasStieger:branches:security - update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (boo#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime` config option (boo#1144504) OBS-URL: https://build.opensuse.org/request/show/728340 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=189
2019-09-09 14:39:48 +02:00
Index: configure
===================================================================
- Update to security release 0.99.4 (bsc#1083915): * CVE-2012-6706 * CVE-2017-6419 * CVE-2017-11423 * CVE-2018-1000085 (bsc#1082858) * CVE-2018-0202 - Obsolete patches: * clamav-CVE-2012-6706.patch * clamav-gcc47.patch OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=159
2018-03-07 14:46:42 +01:00
--- configure.orig
+++ configure
Accepting request 728340 from home:AndreasStieger:branches:security - update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (boo#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime` config option (boo#1144504) OBS-URL: https://build.opensuse.org/request/show/728340 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=189
2019-09-09 14:39:48 +02:00
@@ -814,6 +814,7 @@ FGREP
Accepting request 750749 from home:adkorte:branches:security - update to 0.102.1 * CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. * Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support. * Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu. * Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library. * Null-dereference fix in email parser when using the --gen-json metadata option. * Fixes for Authenticode parsing and certificate signature (.crb database) bugs. - dropped clamav-fix_building_milter.patch (upstreamed) - update to 0.102.0 * The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects: - On-Access scanning for created and moved files (Extra-Scanning) is fixed. - VirusEvent for On-Access scans is fixed. - With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan. * The freshclam database update utility has undergone a significant update. This includes: - Added support for HTTPS. - Support for database mirrors hosted on ports other than 80. - Removal of the mirror management feature (mirrors.dat). - An all new libfreshclam library API. - created new subpackage libfreshclam2 - dropped clamav-max_patch.patch (upstreamed) - added clamav-fix_building_milter.patch to fix build of milter OBS-URL: https://build.opensuse.org/request/show/750749 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=193
2019-11-26 00:01:55 +01:00
LIBFRESHCLAM_VERSION
LIBCLAMAV_VERSION_NUM
Accepting request 439481 from home:faweiss:branches:security OBS-URL: https://build.opensuse.org/request/show/439481 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=140
2016-11-10 23:34:49 +01:00
LIBCLAMAV_VERSION
+ENABLE_TIMESTAMPS
Accepting request 750749 from home:adkorte:branches:security - update to 0.102.1 * CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. * Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support. * Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu. * Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library. * Null-dereference fix in email parser when using the --gen-json metadata option. * Fixes for Authenticode parsing and certificate signature (.crb database) bugs. - dropped clamav-fix_building_milter.patch (upstreamed) - update to 0.102.0 * The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects: - On-Access scanning for created and moved files (Extra-Scanning) is fixed. - VirusEvent for On-Access scans is fixed. - With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan. * The freshclam database update utility has undergone a significant update. This includes: - Added support for HTTPS. - Support for database mirrors hosted on ports other than 80. - Removal of the mirror management feature (mirrors.dat). - An all new libfreshclam library API. - created new subpackage libfreshclam2 - dropped clamav-max_patch.patch (upstreamed) - added clamav-fix_building_milter.patch to fix build of milter OBS-URL: https://build.opensuse.org/request/show/750749 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=193
2019-11-26 00:01:55 +01:00
PACKAGE_VERSION_NUM
Accepting request 770381 from home:adkorte:branches:security - update to 0.102.2 * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. * Significantly improved the scan speed of PDF files on Windows. * Re-applied a fix to alleviate file access issues when scanning RAR files in downstream projects that use libclamav where the scanning engine is operating in a low-privilege process. This bug was originally fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0. * Fixed an issue where freshclam failed to update if the database version downloaded is one version older than advertised. This situation may occur after a new database version is published. The issue affected users downloading the whole CVD database file. * Changed the default freshclam ReceiveTimeout setting to 0 (infinite). The ReceiveTimeout had caused needless database update failures for users with slower internet connections. * Correctly display the number of kilobytes (KiB) in progress bar and reduced the size of the progress bar to accommodate 80-character width terminals. * Fixed an issue where running freshclam manually causes a daemonized freshclam process to fail when it updates because the manual instance deletes the temporary download directory. The freshclam temporary files will now download to a unique directory created at the time of an update instead of using a hardcoded directory created/destroyed at the program start/exit. * Fix for freshclam's OnOutdatedExecute config option. * Fixes a memory leak in the error condition handling for the email parser. * Improved bound checking and error handling in ARJ archive parser. * Improved error handling in PDF parser. * Fix for memory leak in byte-compare signature handler. OBS-URL: https://build.opensuse.org/request/show/770381 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=201
2020-02-06 16:31:51 +01:00
ac_ct_AR
AR
Accepting request 728340 from home:AndreasStieger:branches:security - update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (boo#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime` config option (boo#1144504) OBS-URL: https://build.opensuse.org/request/show/728340 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=189
2019-09-09 14:39:48 +02:00
@@ -924,6 +925,7 @@ ac_user_opts='
Accepting request 750749 from home:adkorte:branches:security - update to 0.102.1 * CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation. * Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support. * Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu. * Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library. * Null-dereference fix in email parser when using the --gen-json metadata option. * Fixes for Authenticode parsing and certificate signature (.crb database) bugs. - dropped clamav-fix_building_milter.patch (upstreamed) - update to 0.102.0 * The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects: - On-Access scanning for created and moved files (Extra-Scanning) is fixed. - VirusEvent for On-Access scans is fixed. - With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan. * The freshclam database update utility has undergone a significant update. This includes: - Added support for HTTPS. - Support for database mirrors hosted on ports other than 80. - Removal of the mirror management feature (mirrors.dat). - An all new libfreshclam library API. - created new subpackage libfreshclam2 - dropped clamav-max_patch.patch (upstreamed) - added clamav-fix_building_milter.patch to fix build of milter OBS-URL: https://build.opensuse.org/request/show/750749 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=193
2019-11-26 00:01:55 +01:00
enable_mmap_for_cross_compiling
Accepting request 439481 from home:faweiss:branches:security OBS-URL: https://build.opensuse.org/request/show/439481 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=140
2016-11-10 23:34:49 +01:00
enable_dependency_tracking
- Update to version 0.101.1: * more details will be added later - Add missing include for str.h to libclamav/others_common.c (clamav-str-h.patch) OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=180
2019-01-21 18:35:52 +01:00
enable_silent_rules
Accepting request 439481 from home:faweiss:branches:security OBS-URL: https://build.opensuse.org/request/show/439481 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=140
2016-11-10 23:34:49 +01:00
+enable_timestamps
enable_static
enable_shared
with_pic
Accepting request 728340 from home:AndreasStieger:branches:security - update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (boo#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime` config option (boo#1144504) OBS-URL: https://build.opensuse.org/request/show/728340 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=189
2019-09-09 14:39:48 +02:00
@@ -1644,6 +1646,8 @@ Optional Features:
- Update to version 0.101.1: * more details will be added later - Add missing include for str.h to libclamav/others_common.c (clamav-str-h.patch) OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=180
2019-01-21 18:35:52 +01:00
--enable-silent-rules less verbose build output (undo: "make V=1")
--disable-silent-rules verbose build output (undo: "make V=0")
Accepting request 569976 from home:vitezslav_cizek:branches:security - Update to security release 0.99.3 (bsc#1077732) * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability) * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability) * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities) * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability) * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability) * CVE-2017-12380 (ClamAV Null Dereference Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. * CVE-2017-6420 (bsc#1052448) - this vulnerability allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. * CVE-2017-6419 (bsc#1052449) - ClamAV allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. * CVE-2017-11423 (bsc#1049423) - The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. * CVE-2017-6418 (bsc#1052466) - ClamAV 0.99.2 allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. - drop clamav-0.99.2-openssl-1.1.patch (upstream) OBS-URL: https://build.opensuse.org/request/show/569976 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=151
2018-01-26 17:21:11 +01:00
--enable-static[=PKGS] build static libraries [default=no]
Accepting request 439481 from home:faweiss:branches:security OBS-URL: https://build.opensuse.org/request/show/439481 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=140
2016-11-10 23:34:49 +01:00
+ --enable-timestamps Enable embedding timestamp information in build
+ (default is YES)
--enable-shared[=PKGS] build shared libraries [default=yes]
--enable-fast-install[=PKGS]
Accepting request 569976 from home:vitezslav_cizek:branches:security - Update to security release 0.99.3 (bsc#1077732) * CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability) * CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability) * CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition or potentially execute arbitrary code on an affected device. * CVE-2017-12374 (ClamAV use-after-free Vulnerabilities) * CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability) * CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability) * CVE-2017-12380 (ClamAV Null Dereference Vulnerability) - these vulnerabilities could have allowed an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. * CVE-2017-6420 (bsc#1052448) - this vulnerability allowed remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression. * CVE-2017-6419 (bsc#1052449) - ClamAV allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. * CVE-2017-11423 (bsc#1049423) - The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha allowed remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. * CVE-2017-6418 (bsc#1052466) - ClamAV 0.99.2 allowed remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message. - drop clamav-0.99.2-openssl-1.1.patch (upstream) OBS-URL: https://build.opensuse.org/request/show/569976 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=151
2018-01-26 17:21:11 +01:00
optimize for fast installation [default=yes]
Accepting request 728340 from home:AndreasStieger:branches:security - update to 0.101.4: * CVE-2019-12900: An out of bounds write in the NSIS bzip2 (boo#1149458) * CVE-2019-12625: Introduce a configurable time limit to mitigate zip bomb vulnerability completely. Default is 2 minutes, configurable useing the clamscan --max-scantime and for clamd using the MaxScanTime` config option (boo#1144504) OBS-URL: https://build.opensuse.org/request/show/728340 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=189
2019-09-09 14:39:48 +02:00
@@ -5927,6 +5931,26 @@ $as_echo "$ac_cv_safe_to_define___extens
Accepting request 439481 from home:faweiss:branches:security OBS-URL: https://build.opensuse.org/request/show/439481 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=140
2016-11-10 23:34:49 +01:00
Accepting request 770381 from home:adkorte:branches:security - update to 0.102.2 * CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash. * Significantly improved the scan speed of PDF files on Windows. * Re-applied a fix to alleviate file access issues when scanning RAR files in downstream projects that use libclamav where the scanning engine is operating in a low-privilege process. This bug was originally fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0. * Fixed an issue where freshclam failed to update if the database version downloaded is one version older than advertised. This situation may occur after a new database version is published. The issue affected users downloading the whole CVD database file. * Changed the default freshclam ReceiveTimeout setting to 0 (infinite). The ReceiveTimeout had caused needless database update failures for users with slower internet connections. * Correctly display the number of kilobytes (KiB) in progress bar and reduced the size of the progress bar to accommodate 80-character width terminals. * Fixed an issue where running freshclam manually causes a daemonized freshclam process to fail when it updates because the manual instance deletes the temporary download directory. The freshclam temporary files will now download to a unique directory created at the time of an update instead of using a hardcoded directory created/destroyed at the program start/exit. * Fix for freshclam's OnOutdatedExecute config option. * Fixes a memory leak in the error condition handling for the email parser. * Improved bound checking and error handling in ARJ archive parser. * Improved error handling in PDF parser. * Fix for memory leak in byte-compare signature handler. OBS-URL: https://build.opensuse.org/request/show/770381 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=201
2020-02-06 16:31:51 +01:00
$as_echo "#define PACKAGE PACKAGE_NAME" >>confdefs.h
Accepting request 439481 from home:faweiss:branches:security OBS-URL: https://build.opensuse.org/request/show/439481 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=140
2016-11-10 23:34:49 +01:00
+# Check whether --enable-timestamps was given.
+if test "${enable_timestamps+set}" = set; then :
+ enableval=$enable_timestamps;
+else
+ enableval=default
+fi
+
+case "$enableval" in
+ yes) ENABLE_TIMESTAMPS=1
+ ;;
+ no) ENABLE_TIMESTAMPS=0
+ ;;
+ default) ENABLE_TIMESTAMPS=1
+ ;;
+ *) as_fn_error $? "Invalid setting for --enable-timestamps. Use \"yes\" or \"no\"" "$LINENO" 5 ;;
+esac
+
+cat >>confdefs.h <<_ACEOF
+#define ENABLE_TIMESTAMPS $ENABLE_TIMESTAMPS
+_ACEOF
Accepting request 834369 from home:adkorte:branches:security - Update to 0.103.0 * clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort. - Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume two times as much memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no. * Dropped clamav-str-h.patch (no longer needed) * Fix clamav-milter.service (requires clamd.service to run) OBS-URL: https://build.opensuse.org/request/show/834369 OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=209
2020-09-18 16:19:44 +02:00
VERSION="0.103.0"
Reference in New Issue Copy Permalink