- update to 0.102.2
* CVE-2020-3123: A denial-of-service (DoS) condition may occur when
using the optional credit card data-loss-prevention (DLP) feature.
Improper bounds checking of an unsigned variable resulted in an
out-of-bounds read, which causes a crash.
* Significantly improved the scan speed of PDF files on Windows.
* Re-applied a fix to alleviate file access issues when scanning RAR
files in downstream projects that use libclamav where the scanning
engine is operating in a low-privilege process. This bug was originally
fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
* Fixed an issue where freshclam failed to update if the database version
downloaded is one version older than advertised. This situation may
occur after a new database version is published. The issue affected
users downloading the whole CVD database file.
* Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
The ReceiveTimeout had caused needless database update failures for
users with slower internet connections.
* Correctly display the number of kilobytes (KiB) in progress bar and
reduced the size of the progress bar to accommodate 80-character width
terminals.
* Fixed an issue where running freshclam manually causes a daemonized
freshclam process to fail when it updates because the manual instance
deletes the temporary download directory. The freshclam temporary files
will now download to a unique directory created at the time of an update
instead of using a hardcoded directory created/destroyed at the program
start/exit.
* Fix for freshclam's OnOutdatedExecute config option.
* Fixes a memory leak in the error condition handling for the email
parser.
* Improved bound checking and error handling in ARJ archive parser.
* Improved error handling in PDF parser.
* Fix for memory leak in byte-compare signature handler.
OBS-URL: https://build.opensuse.org/request/show/770381
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=201
- update to 0.102.1
* CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may
occur when scanning a specially crafted email file as a result
of excessively long scan times. The issue is resolved by
implementing several maximums in parsing MIME messages and by
optimizing use of memory allocation.
* Build system fixes to build clamav-milter, to correctly link
with libxml2 when detected, and to correctly detect fanotify
for on-access scanning feature support.
* Signature load time is significantly reduced by changing to a
more efficient algorithm for loading signature patterns and
allocating the AC trie. Patch courtesy of Alberto Wu.
* Introduced a new configure option to statically link libjson-c
with libclamav. Static linking with libjson is highly
recommended to prevent crashes in applications that use
libclamav alongside another JSON parsing library.
* Null-dereference fix in email parser when using the
--gen-json metadata option.
* Fixes for Authenticode parsing and certificate signature
(.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)
- update to 0.102.0
* The On-Access Scanning feature has been migrated out of clamd
and into a brand new utility named clamonacc. This utility is
similar to clamdscan and clamav-milter in that it acts as a
client to clamd. This separation from clamd means that clamd no
longer needs to run with root privileges while scanning potentially
malicious files. Instead, clamd may drop privileges to run under an
account that does not have super-user. In addition to improving the
security posture of running clamd with On-Access enabled, this
update fixed a few outstanding defects:
- On-Access scanning for created and moved files (Extra-Scanning)
is fixed.
- VirusEvent for On-Access scans is fixed.
- With clamonacc, it is now possible to copy, move, or remove a
file if the scan triggered an alert, just like with clamdscan.
* The freshclam database update utility has undergone a significant
update. This includes:
- Added support for HTTPS.
- Support for database mirrors hosted on ports other than 80.
- Removal of the mirror management feature (mirrors.dat).
- An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter
OBS-URL: https://build.opensuse.org/request/show/750749
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=193
An out-of-bounds heap read condition may occur when scanning malformed
PDF documents as a result of improper bounds-checking.
* CVE-2019-1785:
A path-traversal write condition may occur as a result of improper
input validation when scanning RAR archives.
* CVE-2019-1798:
A use-after-free condition may occur as a result of improper error
handling when scanning nested RAR archives.
* Add missing headers to fix build of packages against libclamav.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=184
- Update to version 0.101.2
* CVE-2019-1787:
An out-of-bounds heap read condition may occur when scanning PDF
documents. The defect is a failure to correctly keep track of the number
of bytes remaining in a buffer when indexing file data.
* CVE-2019-1789:
An out-of-bounds heap read condition may occur when scanning PE files
(i.e. Windows EXE and DLL files) that have been packed using Aspack as a
result of inadequate bound-checking.
* CVE-2019-1788:
An out-of-bounds heap write condition may occur when scanning OLE2 files
such as Microsoft Office 97-2003 documents. The invalid write happens when
an invalid pointer is mistakenly used to initialize a 32bit integer to
zero. This is likely to crash the application.
- added clamav-max_patch.patch to fix build
OBS-URL: https://build.opensuse.org/request/show/689169
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=181
* bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
unpacking feature that could allow an unauthenticated, remote
attacker to cause a denial of service (DoS) condition on an
affected device.
* bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
more fixes for embedded libmspack.
* Make freshclam more robust against lagging signature mirrors.
* On-Access "Extra Scanning", an opt-in minor feature of
OnAccess scanning on Linux systems, has been disabled due to a
known issue with resource cleanup OnAccessExtraScanning will
be re-enabled in a future release when the issue is
resolved. In the mean-time, users who enabled the feature in
clamd.conf will see a warning informing them that the feature
is not active. For details, see:
https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
0.100.0 when the virus database is already up to date
(bsc#1104457, clamav-freshclam-exit.patch).
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=177
- Update to version 0.100.1
* CVE-2017-16932: Vulnerability in libxml2 dependency (affects
ClamAV on Windows only).
* CVE-2018-0360: HWP integer overflow, infinite loop
vulnerability. Reported by Secunia Research at Flexera.
* CVE-2018-0361: ClamAV PDF object length check, unreasonably
long time to parse relatively small file. Reported by aCaB.
* Buffer over-read in unRAR code due to missing max value checks
in table initialization. Reported by Rui Reis.
* Libmspack heap buffer over-read in CHM parser. Reported by
Hanno Böck.
* Buffer length checks when reading integers from non-NULL
terminated strings.
* Buffer length tracking when reading strings from dictionary
objects.
* HTTPS support for clamsubmit.
* Fix for DNS resolution for users on IPv4-only machines where
IPv6 is not available or is link-local only. Patch provided by
Guilherme Benkenstein.
OBS-URL: https://build.opensuse.org/request/show/622505
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=168
the versions we have are too new and the performance gain over
the byte code interpreter are negligable, according to upstream.
- Put libclammspack0 into its own subpackage to follow the letter
of the shlib packaging policy, even though it really makes no
sense here.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=166
collecting ClamAV virus events.
* Support libmspack internal code or as a shared object
library. The internal library is the default and includes
modifications to enable parsing of CAB files that do not
entirely adhere to the CAB file format.
* Link with OpenSSL 1.1.0.
* Deprecate of the AllowSupplementaryGroups parameter
statement in clamd, clamav-milter, and freshclam.
Use of supplementary is now in effect by default.
* Deprecate internal LLVM code support.
* Compute and check PE import table hash (a.k.a. "imphash")
signatures.
* Support file property collection and analysis for MHTML files.
* Raw scanning of PostScript files.
* Fix clamsubmit to use the new virus and false positive
submission web interface.
* Optionally, flag files with the virus
"Heuristic.Limits.Exceeded" when size limitations are exceeded.
* Improved decoders for PDF files.
* Reduced number of compile time warnings.
* Improved support for C++11.
* Improved detection of system installed libraries.
* Fixes to ClamAV's Container system and the introduction of
Intermediates for more descriptive signatures.
* Improvements to clamd's On-Access scanning capabilities
for Linux.
- Use system-wide LLVM instead of the deprecated bundled one.
- Move pkgconfig stuff the main to the devel package.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=162
* FIXME: Add upstream changes here before submitting to Factory.
* Obsoletes clamav-fix_newer_zlib.patch
- Update key ring and add signature file.
- Remove the logic around building the embedded llvm as the
system-wide llvm is now auto-detected and used.
- Move pc files from the main to the devel package.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=161
- Update to security release 0.99.3 (bsc#1077732)
* CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability)
* CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability)
* CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability)
- these vulnerabilities could have allowed an unauthenticated,
remote attacker to cause a denial of service (DoS) condition
or potentially execute arbitrary code on an affected device.
* CVE-2017-12374 (ClamAV use-after-free Vulnerabilities)
* CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability)
* CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability)
* CVE-2017-12380 (ClamAV Null Dereference Vulnerability)
- these vulnerabilities could have allowed an unauthenticated,
remote attacker to cause a denial of service (DoS) condition on an affected device.
* CVE-2017-6420 (bsc#1052448)
- this vulnerability allowed remote attackers to cause a denial of service
(use-after-free) via a crafted PE file with WWPack compression.
* CVE-2017-6419 (bsc#1052449)
- ClamAV allowed remote attackers to cause a denial of service
(heap-based buffer overflow and application crash) or possibly
have unspecified other impact via a crafted CHM file.
* CVE-2017-11423 (bsc#1049423)
- The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha
allowed remote attackers to cause a denial of service
(stack-based buffer over-read and application crash) via a crafted CAB file.
* CVE-2017-6418 (bsc#1052466)
- ClamAV 0.99.2 allowed remote attackers to cause a denial
of service (out-of-bounds read) via a crafted e-mail message.
- drop clamav-0.99.2-openssl-1.1.patch (upstream)
OBS-URL: https://build.opensuse.org/request/show/569976
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=151
