2019-03-27 - Andrey Karepin <firstname.lastname@example.org>
- Update to version 0.101.2 (bsc#1130721)
An out-of-bounds heap read condition may occur when scanning PDF
documents. The defect is a failure to correctly keep track of the number
of bytes remaining in a buffer when indexing file data.
An out-of-bounds heap read condition may occur when scanning PE files
(i.e. Windows EXE and DLL files) that have been packed using Aspack as a
result of inadequate bound-checking.
An out-of-bounds heap write condition may occur when scanning OLE2 files
such as Microsoft Office 97-2003 documents. The invalid write happens when
an invalid pointer is mistakenly used to initialize a 32bit integer to
zero. This is likely to crash the application.
An out-of-bounds heap read condition may occur when scanning malformed
PDF documents as a result of improper bounds-checking.
A path-traversal write condition may occur as a result of improper
input validation when scanning RAR archives.
A use-after-free condition may occur as a result of improper error
handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch
2019-01-21 - Reinhard Max <email@example.com>
- Update to version 0.101.1:
* Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
2018-10-04 - Reinhard Max <firstname.lastname@example.org>
- Update to version 0.100.2:
* bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
unpacking feature that could allow an unauthenticated, remote
attacker to cause a denial of service (DoS) condition on an
* bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
more fixes for embedded libmspack.
* Make freshclam more robust against lagging signature mirrors.
* On-Access "Extra Scanning", an opt-in minor feature of
OnAccess scanning on Linux systems, has been disabled due to a
known issue with resource cleanup OnAccessExtraScanning will
be re-enabled in a future release when the issue is
resolved. In the mean-time, users who enabled the feature in
clamd.conf will see a warning informing them that the feature
is not active. For details, see:
- Restore exit code compatibility of freshclam with versions before
0.100.0 when the virus database is already up to date
2018-07-31 - email@example.com
- bsc#1101654: Disable YARA support for licensing reasons
- Do not ignore errors from useradd et al.
- Unclutter the spec file.
2018-07-25 - firstname.lastname@example.org
- Update dendencies (pcre2, libjson-c and systemd)
- Modernise spec file with spec-cleaner
2018-07-17 - email@example.com
- fix library-without-ldconfig warnings on libclammspack
2018-07-10 - firstname.lastname@example.org
- Update to version 0.100.1
* CVE-2018-0360: HWP integer overflow, infinite loop
* CVE-2018-0361: PDF object length check, unreasonably long time
to parse relatively small file (bsc#1101412)
* Buffer over-read in unRAR code due to missing max value checks
in table initialization
* Libmspack heap buffer over-read in CHM parser
* PDF parser bugs
* Add HTTPS support for clamsubmit
* Fix for DNS resolution for users on IPv4-only machines where
IPv6 is not available or is link-local only