2023-12-07 18:51:49 by Greg Troxel | Files touched by this commit (1) |
Log message:
security/clamav: Drop MESSAGE
as redundant with upstream documentation.
|
2023-11-08 14:21:43 by Thomas Klausner | Files touched by this commit (2377) |
Log message:
*: recursive bump for icu 74.1
|
2023-10-25 00:11:51 by Thomas Klausner | Files touched by this commit (2298) |
Log message:
*: bump for openssl 3
|
2023-08-29 16:43:01 by Takahiro Kambe | Files touched by this commit (4) | |
Log message:
security/clamav: update to 0.103.10
pkgsrc change:
* Do not always include mail/libmilter/buildlink3.mk in Makefile.
* Use clamav-unit-test PKG_OPTIONS instead of deprecated unit-test.
* pkglint clenn up.
0.103.10
ClamAV 0.103.10 is a critical patch release with the following fixes:
- Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
- GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/1009
|
2023-04-19 10:12:01 by Adam Ciarcinski | Files touched by this commit (2359) | |
Log message:
revbump after textproc/icu update
|
2023-02-20 14:41:19 by Takahiro Kambe | Files touched by this commit (4) | |
Log message:
security/clamav: update to 0.103.8
pkgsrc change: avoid use empty in options.mk.
Security release.
0.103.8 (2023-02-15)
* \
CVE-2023-20032<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032>:
Fixed a possible remote code execution vulnerability in the HFS+ file
parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and
earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for
reporting this issue.
* \
CVE-2023-20052<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052>:
Fixed a possible remote information leak vulnerability in the DMG file
parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and
earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for
reporting this issue.
* Update the vendored libmspack library to version 0.11alpha.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/830
|
2022-11-23 17:21:30 by Adam Ciarcinski | Files touched by this commit (1878) | |
Log message:
massive revision bump after textproc/icu update
|
2022-10-26 12:32:08 by Thomas Klausner | Files touched by this commit (687) |
Log message:
*: bump PKGREVISION for libunistring shlib major bump
|
2022-08-10 15:38:00 by Takahiro Kambe | Files touched by this commit (3) | |
Log message:
security/clamav: update to 0.103.7
0.103.7 (2022-07-26)
ClamAV 0.103.7 is a critical patch release with the following fixes:
* Upgrade the vendored UnRAR library to version 6.1.7.
* Fix logical signature "Intermediates" feature.
* Relax constraints on slightly malformed zip archives that contain
overlapping file entries.
|
2022-05-05 02:44:07 by Takahiro Kambe | Files touched by this commit (4) | |
Log message:
security/clamav: update to 0.103.6
0.103.6 (2022-05-04)
ClamAV 0.103.6 is a critical patch release with the following fixes:
- [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulnerability
in the CHM file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.
- [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer dereference
crash in the scan verdict cache check.
Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
Thank you to Alexander Patrakov and Antoine Gatineau for reporting this issue.
- [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulnerability
in the TIFF file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
The issue only occurs if the "--alert-broken-media" ClamScan option is
enabled. For ClamD, the affected option is "AlertBrokenMedia yes", \
and for
libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option.
Thank you to Michał Dardas for reporting this issue.
- [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the
HTML file parser / Javascript normalizer.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.
- [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buffer
overflow write vulnerability in the signature database load module.
The fix was to update the vendored regex library to the latest version.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.
- ClamOnAcc: Fixed a number of assorted stability issues and added niceties for
debugging ClamOnAcc. Patches courtesy of Frank Fegert.
- Fixed an issue causing byte-compare subsignatures to cause an alert when they
match even if other conditions of the given logical signatures were not met.
- Fix memleak when using multiple byte-compare subsignatures.
This fix was backported from 0.104.0.
Thank you to Andrea De Pasquale for contributing the fix.
- Assorted bug fixes and improvements.
Special thanks to the following people for code contributions and bug reports:
- Alexander Patrakov
- Andrea De Pasquale
- Antoine Gatineau
- Frank Fegert
- Michał Dardas
|