- Don't daemonize freshclam, but use a systemd timer instead to
trigger updates
+ timer.freshclam
% service.freshclam
% clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
- clamav-disable-timestamps.patch
- Cleanup spec
* use pkgconfig() to resolve BuildRequires where upstream uses it
* rework creating vscan user (new system-user in Tumbleweed)
* remove obsolete configure option --disable-zlib-vcheck
OBS-URL: https://build.opensuse.org/request/show/871162
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=218
- Update to 0.103.1
* Added a new scan option to alert on broken media (graphics) file
formats. This feature mitigates the risk of malformed media files
intended to exploit vulnerabilities in other software. At present
media validation exists for JPEG, TIFF, PNG, and GIF files. To
enable this feature, set AlertBrokenMedia yes in clamd.conf, or
use the --alert-broken-media option when using clamscan. These
options are disabled by default in this patch release, but may be
enabled in a subsequent release. Application developers may enable
this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
the heuristic scan option bit field.
* Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
behavior. BMP and JPEG 2000 files will continue to detect as
CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
2000 format checking capabilities.
* Fixed PNG parser logic bugs that caused an excess of parsing
errors and fixed a stack exhaustion issue affecting some systems
when scanning PNG files. PNG file type detection was disabled via
signature database update for ClamAV version 0.103.0 to mitigate
the effects from these bugs.
* Fixed an issue where PNG and GIF files no longer work with
Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
than as CL_TYPE_GRAPHICS. Target types now support up to 10
possible file types to make way for additional graphics types in
future releases.
* Fixed clamonacc's --fdpass option.
- Interprocess file descriptor passing for clamonacc was broken
since version 0.102.0 due to a bug introduced by the switch to
curl for communicating with clamd. On Linux, passing file
descriptors from one process to another is handled by the
kernel, so we reverted clamonacc to use standard system calls
for socket communication when fd passing is enabled.
* Fixed a clamonacc stack corruption issue on some systems when
using an older version of libcurl.
* Allow clamscan and clamdscan scans to proceed even if the
realpath lookup failed. This alleviates an issue on Windows
scanning files hosted on file- systems that do not support the
GetMappedFileNameW() API such as on ImDisk RAM-disks.
* Fixed freshclam --on-update-execute=EXIT_1 temporary directory
cleanup issue.
* clamd's log output and VirusEvent now provide the scan target's
file path instead of a file descriptor. The clamd socket API for
submitting a scan by FD-passing doesn't include a file path, this
feature works by looking up the file path by file descriptor.
This feature works on Mac and Linux but is not yet implemented
for other UNIX operating systems. FD-passing is not available for
Windows.
* Fixed an issue where freshclam database validation didn't work
correctly when run in daemon mode on Linux/Unix.
OBS-URL: https://build.opensuse.org/request/show/869944
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=216
- Keep OBS from installing an existing clamav instance to scan the
sources, because this makes "make check" use the old library
instead of the just built one. This is only a workaround until
we found a way to keep libtool from adding libdir to rpath and
LD_LIBRARY_PATH of the binaries in the testsuite.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=211
- Update to 0.103.0
* clamd can now reload the signature database without blocking
scanning. This multi-threaded database reload improvement was made
possible thanks to a community effort.
- Non-blocking database reloads are now the default behavior. Some
systems that are more constrained on RAM may need to disable
non-blocking reloads as it will temporarily consume two times as
much memory. We added a new clamd config option
ConcurrentDatabaseReload, which may be set to no.
* Dropped clamav-str-h.patch (no longer needed)
* Fix clamav-milter.service (requires clamd.service to run)
OBS-URL: https://build.opensuse.org/request/show/834369
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=209
- Update to 0.102.4
* CVE-2020-3350: Fix a vulnerability wherein a malicious user could
replace a scan target's directory with a symlink to another path
to trick clamscan, clamdscan, or clamonacc into removing or moving
a different file (eg. a critical system file). The issue would
affect users that use the --move or --remove options for clamscan,
clamdscan, and clamonacc.
* CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
module in ClamAV 0.102.3 that could cause a Denial-of-Service
(DoS) condition. Improper bounds checking results in an
out-of-bounds read which could cause a crash. The previous fix for
this CVE in 0.102.3 was incomplete. This fix correctly resolves
the issue.
* CVE-2020-3481: Fix a vulnerability in the EGG archive module in
ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
condition. Improper error handling may result in a crash due to a
NULL pointer dereference. This vulnerability is mitigated for
those using the official ClamAV signature databases because the
file type signatures in daily.cvd will not enable the EGG archive
parser in versions affected by the vulnerability.
OBS-URL: https://build.opensuse.org/request/show/821356
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=207
- Update to 0.102.3
* CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
condition. Improper bounds checking of an unsigned variable results
in an out-of-bounds read which causes a crash.
* CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
condition. Improper size checking of a buffer used to initialize AES
decryption routines results in an out-of-bounds read which may cause
a crash.
* Fix "Attempt to allocate 0 bytes" error when parsing some PDF
documents.
* Fix a couple of minor memory leaks.
* Updated libclamunrar to UnRAR 5.9.2.
OBS-URL: https://build.opensuse.org/request/show/803374
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=205
- update to 0.102.2
* CVE-2020-3123: A denial-of-service (DoS) condition may occur when
using the optional credit card data-loss-prevention (DLP) feature.
Improper bounds checking of an unsigned variable resulted in an
out-of-bounds read, which causes a crash.
* Significantly improved the scan speed of PDF files on Windows.
* Re-applied a fix to alleviate file access issues when scanning RAR
files in downstream projects that use libclamav where the scanning
engine is operating in a low-privilege process. This bug was originally
fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
* Fixed an issue where freshclam failed to update if the database version
downloaded is one version older than advertised. This situation may
occur after a new database version is published. The issue affected
users downloading the whole CVD database file.
* Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
The ReceiveTimeout had caused needless database update failures for
users with slower internet connections.
* Correctly display the number of kilobytes (KiB) in progress bar and
reduced the size of the progress bar to accommodate 80-character width
terminals.
* Fixed an issue where running freshclam manually causes a daemonized
freshclam process to fail when it updates because the manual instance
deletes the temporary download directory. The freshclam temporary files
will now download to a unique directory created at the time of an update
instead of using a hardcoded directory created/destroyed at the program
start/exit.
* Fix for freshclam's OnOutdatedExecute config option.
* Fixes a memory leak in the error condition handling for the email
parser.
* Improved bound checking and error handling in ARJ archive parser.
* Improved error handling in PDF parser.
* Fix for memory leak in byte-compare signature handler.
OBS-URL: https://build.opensuse.org/request/show/770381
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=201
- update to 0.102.1
* CVE-2019-15961: A Denial-of-Service (DoS) vulnerability may
occur when scanning a specially crafted email file as a result
of excessively long scan times. The issue is resolved by
implementing several maximums in parsing MIME messages and by
optimizing use of memory allocation.
* Build system fixes to build clamav-milter, to correctly link
with libxml2 when detected, and to correctly detect fanotify
for on-access scanning feature support.
* Signature load time is significantly reduced by changing to a
more efficient algorithm for loading signature patterns and
allocating the AC trie. Patch courtesy of Alberto Wu.
* Introduced a new configure option to statically link libjson-c
with libclamav. Static linking with libjson is highly
recommended to prevent crashes in applications that use
libclamav alongside another JSON parsing library.
* Null-dereference fix in email parser when using the
--gen-json metadata option.
* Fixes for Authenticode parsing and certificate signature
(.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)
- update to 0.102.0
* The On-Access Scanning feature has been migrated out of clamd
and into a brand new utility named clamonacc. This utility is
similar to clamdscan and clamav-milter in that it acts as a
client to clamd. This separation from clamd means that clamd no
longer needs to run with root privileges while scanning potentially
malicious files. Instead, clamd may drop privileges to run under an
account that does not have super-user. In addition to improving the
security posture of running clamd with On-Access enabled, this
update fixed a few outstanding defects:
- On-Access scanning for created and moved files (Extra-Scanning)
is fixed.
- VirusEvent for On-Access scans is fixed.
- With clamonacc, it is now possible to copy, move, or remove a
file if the scan triggered an alert, just like with clamdscan.
* The freshclam database update utility has undergone a significant
update. This includes:
- Added support for HTTPS.
- Support for database mirrors hosted on ports other than 80.
- Removal of the mirror management feature (mirrors.dat).
- An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter
OBS-URL: https://build.opensuse.org/request/show/750749
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=193
An out-of-bounds heap read condition may occur when scanning malformed
PDF documents as a result of improper bounds-checking.
* CVE-2019-1785:
A path-traversal write condition may occur as a result of improper
input validation when scanning RAR archives.
* CVE-2019-1798:
A use-after-free condition may occur as a result of improper error
handling when scanning nested RAR archives.
* Add missing headers to fix build of packages against libclamav.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=184
- Update to version 0.101.2
* CVE-2019-1787:
An out-of-bounds heap read condition may occur when scanning PDF
documents. The defect is a failure to correctly keep track of the number
of bytes remaining in a buffer when indexing file data.
* CVE-2019-1789:
An out-of-bounds heap read condition may occur when scanning PE files
(i.e. Windows EXE and DLL files) that have been packed using Aspack as a
result of inadequate bound-checking.
* CVE-2019-1788:
An out-of-bounds heap write condition may occur when scanning OLE2 files
such as Microsoft Office 97-2003 documents. The invalid write happens when
an invalid pointer is mistakenly used to initialize a 32bit integer to
zero. This is likely to crash the application.
- added clamav-max_patch.patch to fix build
OBS-URL: https://build.opensuse.org/request/show/689169
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=181
* bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
unpacking feature that could allow an unauthenticated, remote
attacker to cause a denial of service (DoS) condition on an
affected device.
* bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
more fixes for embedded libmspack.
* Make freshclam more robust against lagging signature mirrors.
* On-Access "Extra Scanning", an opt-in minor feature of
OnAccess scanning on Linux systems, has been disabled due to a
known issue with resource cleanup OnAccessExtraScanning will
be re-enabled in a future release when the issue is
resolved. In the mean-time, users who enabled the feature in
clamd.conf will see a warning informing them that the feature
is not active. For details, see:
https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
0.100.0 when the virus database is already up to date
(bsc#1104457, clamav-freshclam-exit.patch).
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=177
- Update to version 0.100.1
* CVE-2017-16932: Vulnerability in libxml2 dependency (affects
ClamAV on Windows only).
* CVE-2018-0360: HWP integer overflow, infinite loop
vulnerability. Reported by Secunia Research at Flexera.
* CVE-2018-0361: ClamAV PDF object length check, unreasonably
long time to parse relatively small file. Reported by aCaB.
* Buffer over-read in unRAR code due to missing max value checks
in table initialization. Reported by Rui Reis.
* Libmspack heap buffer over-read in CHM parser. Reported by
Hanno Böck.
* Buffer length checks when reading integers from non-NULL
terminated strings.
* Buffer length tracking when reading strings from dictionary
objects.
* HTTPS support for clamsubmit.
* Fix for DNS resolution for users on IPv4-only machines where
IPv6 is not available or is link-local only. Patch provided by
Guilherme Benkenstein.
OBS-URL: https://build.opensuse.org/request/show/622505
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=168
the versions we have are too new and the performance gain over
the byte code interpreter are negligable, according to upstream.
- Put libclammspack0 into its own subpackage to follow the letter
of the shlib packaging policy, even though it really makes no
sense here.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=166
collecting ClamAV virus events.
* Support libmspack internal code or as a shared object
library. The internal library is the default and includes
modifications to enable parsing of CAB files that do not
entirely adhere to the CAB file format.
* Link with OpenSSL 1.1.0.
* Deprecate of the AllowSupplementaryGroups parameter
statement in clamd, clamav-milter, and freshclam.
Use of supplementary is now in effect by default.
* Deprecate internal LLVM code support.
* Compute and check PE import table hash (a.k.a. "imphash")
signatures.
* Support file property collection and analysis for MHTML files.
* Raw scanning of PostScript files.
* Fix clamsubmit to use the new virus and false positive
submission web interface.
* Optionally, flag files with the virus
"Heuristic.Limits.Exceeded" when size limitations are exceeded.
* Improved decoders for PDF files.
* Reduced number of compile time warnings.
* Improved support for C++11.
* Improved detection of system installed libraries.
* Fixes to ClamAV's Container system and the introduction of
Intermediates for more descriptive signatures.
* Improvements to clamd's On-Access scanning capabilities
for Linux.
- Use system-wide LLVM instead of the deprecated bundled one.
- Move pkgconfig stuff the main to the devel package.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=162
* FIXME: Add upstream changes here before submitting to Factory.
* Obsoletes clamav-fix_newer_zlib.patch
- Update key ring and add signature file.
- Remove the logic around building the embedded llvm as the
system-wide llvm is now auto-detected and used.
- Move pc files from the main to the devel package.
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=161
- Update to security release 0.99.3 (bsc#1077732)
* CVE-2017-12376 (ClamAV Buffer Overflow in handle_pdfname Vulnerability)
* CVE-2017-12377 (ClamAV Mew Packet Heap Overflow Vulnerability)
* CVE-2017-12379 (ClamAV Buffer Overflow in messageAddArgument Vulnerability)
- these vulnerabilities could have allowed an unauthenticated,
remote attacker to cause a denial of service (DoS) condition
or potentially execute arbitrary code on an affected device.
* CVE-2017-12374 (ClamAV use-after-free Vulnerabilities)
* CVE-2017-12375 (ClamAV Buffer Overflow Vulnerability)
* CVE-2017-12378 (ClamAV Buffer Over Read Vulnerability)
* CVE-2017-12380 (ClamAV Null Dereference Vulnerability)
- these vulnerabilities could have allowed an unauthenticated,
remote attacker to cause a denial of service (DoS) condition on an affected device.
* CVE-2017-6420 (bsc#1052448)
- this vulnerability allowed remote attackers to cause a denial of service
(use-after-free) via a crafted PE file with WWPack compression.
* CVE-2017-6419 (bsc#1052449)
- ClamAV allowed remote attackers to cause a denial of service
(heap-based buffer overflow and application crash) or possibly
have unspecified other impact via a crafted CHM file.
* CVE-2017-11423 (bsc#1049423)
- The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha
allowed remote attackers to cause a denial of service
(stack-based buffer over-read and application crash) via a crafted CAB file.
* CVE-2017-6418 (bsc#1052466)
- ClamAV 0.99.2 allowed remote attackers to cause a denial
of service (out-of-bounds read) via a crafted e-mail message.
- drop clamav-0.99.2-openssl-1.1.patch (upstream)
OBS-URL: https://build.opensuse.org/request/show/569976
OBS-URL: https://build.opensuse.org/package/show/security/clamav?expand=0&rev=151
