From: Adolf Belka <adolf.belka@ipfire.org>
To: development@lists.ipfire.org
Cc: Adolf Belka <adolf.belka@ipfire.org>
Subject: [PATCH] clamav: Update to version 1.4.3
Date: Thu, 19 Jun 2025 14:03:29 +0200 [thread overview]
Message-ID: <20250619120329.3299500-1-adolf.belka@ipfire.org> (raw)
- Update from version 1.4.2 to 1.4.3
- Update of rootfile not required
- Changelog
1.4.3
- [CVE-2025-20260](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20260):
Fixed a possible buffer overflow write bug in the PDF file parser that could
cause a denial-of-service (DoS) condition or enable remote code execution.
This issue only affects configurations where both:
1. The max file-size scan limit is set greater than or equal to 1024MB.
2. The max scan-size scan limit is set greater than or equal to 1025MB.
The code flaw was present prior to version 1.0.0, but a change in version
1.0.0 that enables larger allocations based on untrusted data made it
possible to trigger this bug.
This issue affects all currently supported versions.
Thank you to Greg Walkup at Sandia National Labs for identifying this issue.
- [CVE-2025-20234](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20234):
Fixed a possible buffer overflow read bug in the UDF file parser that may
write to a temp file and thus disclose information, or it may crash and
cause a denial-of-service (DoS) condition.
This issue was introduced in version 1.2.0. It will be fixed in 1.4.3.
Thank you to volticks (@movx64 on Twitter/X), working with Trend Micro Zero
Day Initiative, for identifying this issue.
- Fixed a possible use-after-free bug in the Xz decompression module in the
bundled lzma-sdk library.
This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy
of the lzma-sdk with some performance changes specific to libclamav, plus
select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk.
This issue affects all ClamAV versions at least as far back as 0.99.4.
Thank you to OSS-Fuzz for identifying this issue.
- Windows: Fixed a build install issue when a DLL dependency such as libcrypto
has the exact same name as one provided by the Windows operating system.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/clamav | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lfs/clamav b/lfs/clamav
index e6bb32355..6a1d3849b 100644
--- a/lfs/clamav
+++ b/lfs/clamav
@@ -26,7 +26,7 @@ include Config
SUMMARY = Antivirus Toolkit
-VER = 1.4.2
+VER = 1.4.3
THISAPP = clamav-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = clamav
-PAK_VER = 76
+PAK_VER = 77
DEPS =
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 869f3375ff3da33c0a63607499d06b3312788cf8fdaa0f026553c0b12a23888b7f27a6eda9ffb0888c268faad6b552941cef0c3178ea86197eb92d4ce4f011e5
+$(DL_FILE)_BLAKE2 = 144be77e7104ebf78482c9efc411a4a168bb4ea3ad18abb237e7bcc1f5cf3e2c10d5478a54d9dc0d82b028c923065bc614cd535fd4f67fb1e73f5fe1c6425861
install : $(TARGET)
--
2.49.0
reply other threads:[~2025-06-19 12:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250619120329.3299500-1-adolf.belka@ipfire.org \
--to=adolf.belka@ipfire.org \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox