Next | Query returned 109 messages, browsing 1 to 10 | Previous

History of commit frequency

CVS Commit History:


   2023-12-07 18:51:49 by Greg Troxel | Files touched by this commit (1)
Log message:
security/clamav: Drop MESSAGE

as redundant with upstream documentation.
   2023-11-08 14:21:43 by Thomas Klausner | Files touched by this commit (2377)
Log message:
*: recursive bump for icu 74.1
   2023-10-25 00:11:51 by Thomas Klausner | Files touched by this commit (2298)
Log message:
*: bump for openssl 3
   2023-08-29 16:43:01 by Takahiro Kambe | Files touched by this commit (4) | Package updated
Log message:
security/clamav: update to 0.103.10

pkgsrc change:

* Do not always include mail/libmilter/buildlink3.mk in Makefile.
* Use clamav-unit-test PKG_OPTIONS instead of deprecated unit-test.
* pkglint clenn up.

0.103.10

ClamAV 0.103.10 is a critical patch release with the following fixes:

- Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
  - GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/1009
   2023-04-19 10:12:01 by Adam Ciarcinski | Files touched by this commit (2359) | Package updated
Log message:
revbump after textproc/icu update
   2023-02-20 14:41:19 by Takahiro Kambe | Files touched by this commit (4) | Package updated
Log message:
security/clamav: update to 0.103.8

pkgsrc change: avoid use empty in options.mk.

Security release.

0.103.8 (2023-02-15)

* \ 
CVE-2023-20032<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032>:
  Fixed a possible remote code execution vulnerability in the HFS+ file
  parser.  The issue affects versions 1.0.0 and earlier, 0.105.1 and
  earlier, and 0.103.7 and earlier.  Thank you to Simon Scannell for
  reporting this issue.

* \ 
CVE-2023-20052<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052>:
  Fixed a possible remote information leak vulnerability in the DMG file
  parser.  The issue affects versions 1.0.0 and earlier, 0.105.1 and
  earlier, and 0.103.7 and earlier.  Thank you to Simon Scannell for
  reporting this issue.

* Update the vendored libmspack library to version 0.11alpha.

* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/830
   2022-11-23 17:21:30 by Adam Ciarcinski | Files touched by this commit (1878) | Package updated
Log message:
massive revision bump after textproc/icu update
   2022-10-26 12:32:08 by Thomas Klausner | Files touched by this commit (687)
Log message:
*: bump PKGREVISION for libunistring shlib major bump
   2022-08-10 15:38:00 by Takahiro Kambe | Files touched by this commit (3) | Package updated
Log message:
security/clamav: update to 0.103.7

0.103.7 (2022-07-26)

ClamAV 0.103.7 is a critical patch release with the following fixes:

* Upgrade the vendored UnRAR library to version 6.1.7.

* Fix logical signature "Intermediates" feature.

* Relax constraints on slightly malformed zip archives that contain
  overlapping file entries.
   2022-05-05 02:44:07 by Takahiro Kambe | Files touched by this commit (4) | Package updated
Log message:
security/clamav: update to 0.103.6

0.103.6 (2022-05-04)

ClamAV 0.103.6 is a critical patch release with the following fixes:

- [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulnerability
  in the CHM file parser.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer dereference
  crash in the scan verdict cache check.
  Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
  Thank you to Alexander Patrakov and Antoine Gatineau for reporting this issue.

- [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulnerability
  in the TIFF file parser.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  The issue only occurs if the "--alert-broken-media" ClamScan option is
  enabled. For ClamD, the affected option is "AlertBrokenMedia yes", \ 
and for
  libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option.
  Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the
  HTML file parser / Javascript normalizer.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buffer
  overflow write vulnerability in the signature database load module.
  The fix was to update the vendored regex library to the latest version.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  Thank you to Michał Dardas for reporting this issue.

- ClamOnAcc: Fixed a number of assorted stability issues and added niceties for
  debugging ClamOnAcc. Patches courtesy of Frank Fegert.

- Fixed an issue causing byte-compare subsignatures to cause an alert when they
  match even if other conditions of the given logical signatures were not met.

- Fix memleak when using multiple byte-compare subsignatures.
  This fix was backported from 0.104.0.
  Thank you to Andrea De Pasquale for contributing the fix.

- Assorted bug fixes and improvements.

Special thanks to the following people for code contributions and bug reports:
- Alexander Patrakov
- Andrea De Pasquale
- Antoine Gatineau
- Frank Fegert
- Michał Dardas

Next | Query returned 109 messages, browsing 1 to 10 | Previous