From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4dyPst4jSBz30Kj for ; Fri, 23 Jan 2026 17:23:46 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4dyPsp6lGnz2xLt for ; Fri, 23 Jan 2026 17:23:42 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4dyPsp0CFBz7R; Fri, 23 Jan 2026 17:23:41 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1769189022; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aVWjm1YZwTZXTpnXbNUt2h1fUbkwAMW3a6Qryip5x9Q=; b=ORlY/mKCgVdc5ZtvfiIWn3W6Ec+iOJfun7AIHMXHbQ5jxPc1+kDCGNQcN/YIIy807A048M mnbcyUFDhwwdhXCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1769189022; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aVWjm1YZwTZXTpnXbNUt2h1fUbkwAMW3a6Qryip5x9Q=; b=gMx+bDus3GiHYSAFA8zygd4y1J9+vcManKKpq3ku1zUvGdIS+QinJReVd3OJekf/bFFEb/ AsHIGBxADhMki+yLCU3BTVdyjVSPBhUxiBsn62PlDSGckKwfzcxvOUMFkagTTDtcCwcrwI ERHgfVPzkMuuvySx5IB0IXcEljX4sMuhAlIvY394SxsfD4ogu67vrZqtsMGxBpiMJeb/Zs T1ZGHqTTFqu4C4XU6W7q1R3iW0xBRj364qfaDQTPyZ5pMd/Dg9BXAiWs9elVV09bUUD9XA JEF+U5PF4UoXrxeGwIsKcpzSbEa12B5CnVHodWp+Wqs22BTsTGZV3i6153T1YA== Content-Type: text/plain; charset=us-ascii Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: [PATCH] clamav: Update to version 1.5.1 From: Michael Tremer In-Reply-To: Date: Fri, 23 Jan 2026 17:23:41 +0000 Cc: development@lists.ipfire.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20260123135908.90964-1-adolf.belka@ipfire.org> <2D90702A-0A8A-443F-9101-5351E14063C8@ipfire.org> To: Adolf Belka Hello Adolf, It was me in this commit: = https://git.ipfire.org/?p=3Dipfire-2.x.git;a=3Dcommitdiff;h=3D934a30f84f8b= 3e2b659f5c6d76ca6177186da6e3 I wanted to avoid pushing too many times today because the builders = would takes ages to build multiple builds and I was hoping to be able to = verify the Rust/Suricata changes as soon as possible. -Michael > On 23 Jan 2026, at 17:06, Adolf Belka wrote: >=20 > Hi Michael, >=20 > On 23/01/2026 15:57, Michael Tremer wrote: >> Hello Adolf, >> Thank you very much for the patch. >> It did however not apply cleanly because I increased the release = number earlier in next when Stefan submitted a new version of Rust. So = you might not see this one as accepted on Patchwork. >> I pushed another commit to increase the release once again, although = nobody should have seen version 81 anywhere. >=20 > I had seen that the clamav version had been bumped and wondered why. >=20 > I did my build of clamav 3 or 4 days ago and have been testing it = since then to try and make sure that I minimise the chances of having = another clamav update problem as we had with CU199. Of course it would = have helped if somebody had tested out clamav during the Testing phase. >=20 > Hopefully some actual user will test it out in CU200 Testing. >=20 > Regards, >=20 > Adolf. >=20 >> All the best, >> -Michael >>> On 23 Jan 2026, at 13:59, Adolf Belka = wrote: >>>=20 >>> - Update from version 1.4.3 to 1.5.1 >>> - Update of rootfile >>> - =46rom version 1.5.0 clamav added signing/verification of the = signature file downloads >>> with external .sign files. -D = CVD_CERTS_DIRECTORY=3D/etc/clamav/certs has been added >>> as a build option to create the certs directory and to install the = clamav.crt file >>> - Tested out the execution of this version on a vm testbed. The = .sign files were >>> correctly downloaded and the databases approved. This was also the = case with a >>> reboot. This was where users had a problem with the version = relaesed in CU199 after >>> they had manually created a directory. >>> - Changelog >>> 1.5.1 >>> ClamAV 1.5.1 is a patch release with the following fixes: >>>=20 >>> * >>> Fixed a significant performance issue when scanning some PE files >>> * >>> Fixed an issue recording file entries from a ZIP archive central = directory which resulted in "Heuristics.Limits.Exceeded.MaxFiles" alerts = when using the ClamScan --alert-exceeds-max command line option or ClamD = AlertExceedsMax config file option >>> * >>> Improved performance when scanning TNEF email attachments >>> * >>> Fixed an issue with recording metadata for OOXML office documents >>> * >>> Fixed an issue with signature matches for VBA in OLE2 office = documents >>> * >>> Loosened overly restrictive rules for embedded file identification = and increased the limit for finding PE files embedded in other PE files >>> * >>> Fixed an issue with extracting some RAR archives embedded in other = files >>> * >>> Fixed an issue with calculating fuzzy hashes affecting some images = by updating the version for several Rust library dependencies >>> * This release does not require a newer version of the Rust = compiler toolchain than what was required for ClamAV 1.5.0 >>>=20 >>> GitHub pull request >>>=20 >>> 1.5.0 >>> Major changes >>>=20 >>> * >>> Added checks to determine if an OLE2-based Microsoft Office document = is encrypted. >>> GitHub pull request >>> * >>> Added the ability to record URIs found in HTML if the = generate-JSON-metadata feature is enabled. Also adds an option to = disable this in case you want the JSON metadata feature but do not want = to record HTML URIs. The ClamScan command-line option is = --json-store-html-uris=3Dno. The clamd.conf config option is = JsonStoreHTMLURIs no. The libclamav general scan option is = CL_SCAN_GENERAL_STORE_HTML_URIS >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> GitHub pull request = #3 >>> * >>> Added the ability to record URIs found in PDFs if the = generate-JSON-metadata feature is enabled. Also adds an option to = disable this in case you want the JSON metadata feature but do not want = to record PDF URIs. The ClamScan command-line option is = --json-store-pdf-uris=3Dno. The clamd.conf config option is = JsonStorePDFURIs no. The libclamav general scan option is = CL_SCAN_GENERAL_STORE_PDF_URIS >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> GitHub pull request = #3 >>> GitHub pull request = #4 >>> * >>> Added regex support for the clamd.conf OnAccessExcludePath config = option. This change courtesy of GitHub user b1tg. >>> GitHub pull request >>> * >>> Added CVD signing/verification with external .sign files. >>> Freshclam will now attempt to download external signature files to = accompany existing .cvd databases and .cdiff patch files. Sigtool now = has commands to sign and verify using the external signatures. >>> ClamAV now installs a 'certs' directory in the app config directory = (e.g., /etc/certs). The install path is configurable. The CMake = option to configure the CVD certs directory is -D = CVD_CERTS_DIRECTORY=3DPATH >>> New options to set an alternative CVD certs directory: >>> Added two new APIs to the public clamav.h header: >>>=20 >>> cl_error_t cl_cvdverify_ex( >>> const char *file, >>> const char *certs_directory, >>> uint32_t dboptions); >>>=20 >>> cl_error_t cl_cvdunpack_ex( >>> const char *file, >>> const char *dir, >>> const char *certs_directory, >>> uint32_t dboptions); >>>=20 >>> The original cl_cvdverify and cl_cvdunpack are deprecated. >>> Added a cl_engine_field enum option CL_ENGINE_CVDCERTSDIR. You may = set this option with cl_engine_set_str and get it with = cl_engine_get_str, to override the compiled in default CVD certs = directory. >>> Thank you to Mark Carey at SAP for inspiring work on this feature = with an initial proof of concept for external-signature FIPS compliant = CVD signing. >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> GitHub pull request = #3 >>> GitHub pull request = #4 >>> * The command-line option for Freshclam, ClamD, ClamScan, and = Sigtool is --cvdcertsdir PATH >>> * The environment variable for Freshclam, ClamD, ClamScan, and = Sigtool is CVD_CERTS_DIR >>> * The config option for Freshclam and ClamD is = CVDCertsDirectory PATH >>> * >>> Freshclam, ClamD, ClamScan, and Sigtool: Added an option to enable = FIPS-like limits disabling MD5 and SHA1 from being used for verifying = digital signatures or for being used to trust a file when checking for = false positives (FPs). >>> For freshclam.conf and clamd.conf set this config option: >>>=20 >>> FIPSCryptoHashLimits yes >>>=20 >>> For clamscan and sigtool use this command-line option: >>>=20 >>> --fips-limits >>>=20 >>> For libclamav: Enable FIPS-limits for a ClamAV engine like this: >>>=20 >>> cl_engine_set_num(engine, CL_ENGINE_FIPS_LIMITS, 1); >>>=20 >>> ClamAV will also attempt to detect if FIPS-mode is enabled. If so, = it will automatically enable the FIPS-limits feature. >>> This change mitigates safety concerns over the use of MD5 and SHA1 = algorithms to trust files and is required to enable ClamAV to operate = legitimately in FIPS-mode enabled environments. >>> Note: ClamAV may still calculate MD5 or SHA1 hashes as needed for = detection purposes or for informational purposes in FIPS-enabled = environments and when the FIPS-limits option is enabled. >>> GitHub pull request >>> * >>> Upgraded the clean-file scan cache to use SHA2-256 (prior versions = use MD5). The clean-file cache algorithm is not configurable. >>> This change resolves safety concerns over the use of MD5 to trust = files and is required to enable ClamAV to operate legitimately in = FIPS-mode enabled environments. >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> * >>> ClamD: Added an option to disable select administrative commands = including SHUTDOWN, RELOAD, STATS and VERSION. >>> The new clamd.conf options are: >>>=20 >>> EnableShutdownCommand yes >>> EnableReloadCommand yes >>> EnableStatsCommand yes >>> EnableVersionCommand yes >>>=20 >>> This change courtesy of GitHub user ChaoticByte. >>> GitHub pull request >>> * >>> libclamav: Added extended hashing functions with a "flags" parameter = that allows the caller to choose if they want to bypass FIPS hash = algorithm limits: >>>=20 >>> cl_error_t cl_hash_data_ex( >>> const char *alg, >>> const uint8_t *data, >>> size_t data_len, >>> uint8_t **hash, >>> size_t *hash_len, >>> uint32_t flags); >>>=20 >>> cl_error_t cl_hash_init_ex( >>> const char *alg, >>> uint32_t flags, >>> cl_hash_ctx_t **ctx_out); >>>=20 >>> cl_error_t cl_update_hash_ex( >>> cl_hash_ctx_t *ctx, >>> const uint8_t *data, >>> size_t length); >>>=20 >>> cl_error_t cl_finish_hash_ex( >>> cl_hash_ctx_t *ctx, >>> uint8_t **hash, >>> size_t *hash_len, >>> uint32_t flags); >>>=20 >>> void cl_hash_destroy(void *ctx); >>>=20 >>> cl_error_t cl_hash_file_fd_ex( >>> const char *alg, >>> int fd, >>> size_t offset, >>> size_t length, >>> uint8_t **hash, >>> size_t *hash_len, >>> uint32_t flags); >>>=20 >>> GitHub pull request >>> * >>> ClamScan: Improved the precision of the bytes-scanned and bytes-read = counters. The ClamScan scan summary will now report exact counts in = "GiB", "MiB", "KiB", or "B" as appropriate. Previously, it always = reported "MB". >>> GitHub pull request >>> * >>> ClamScan: Add hash & file-type in/out CLI options: >>> We will not be adding this for ClamDScan, as we do not have a = mechanism in the ClamD socket API to receive scan options or a way for = ClamD to include scan metadata in the response. >>> GitHub pull request >>> * --hash-hint: The file hash so that libclamav does not need = to calculate it. The type of hash must match the --hash-alg. >>> * --log-hash: Print the file hash after each file scanned. The = type of hash printed will match the --hash-alg. >>> * --hash-alg: The hashing algorithm used for either = --hash-hint or --log-hash. Supported algorithms are "md5", "sha1", = "sha2-256". If not specified, the default is "sha2-256". >>> * --file-type-hint: The file type hint so that libclamav can = optimize scanning (e.g., "pe", "elf", "zip", etc.). You may also use = ClamAV type names such as "CL_TYPE_PE". ClamAV will ignore the hint if = it is not familiar with the specified type. See also: = https://docs.clamav.net/appendix/FileTypes.html#file-types >>> * --log-file-type: Print the file type after each file = scanned. >>> * >>> libclamav: Added new scan functions that provide additional = functionality: >>>=20 >>> cl_error_t cl_scanfile_ex( >>> const char *filename, >>> cl_verdict_t *verdict_out, >>> const char **last_alert_out, >>> uint64_t *scanned_out, >>> const struct cl_engine *engine, >>> struct cl_scan_options *scanoptions, >>> void *context, >>> const char *hash_hint, >>> char **hash_out, >>> const char *hash_alg, >>> const char *file_type_hint, >>> char **file_type_out); >>>=20 >>> cl_error_t cl_scandesc_ex( >>> int desc, >>> const char *filename, >>> cl_verdict_t *verdict_out, >>> const char **last_alert_out, >>> uint64_t *scanned_out, >>> const struct cl_engine *engine, >>> struct cl_scan_options *scanoptions, >>> void *context, >>> const char *hash_hint, >>> char **hash_out, >>> const char *hash_alg, >>> const char *file_type_hint, >>> char **file_type_out); >>>=20 >>> cl_error_t cl_scanmap_ex( >>> cl_fmap_t *map, >>> const char *filename, >>> cl_verdict_t *verdict_out, >>> const char **last_alert_out, >>> uint64_t *scanned_out, >>> const struct cl_engine *engine, >>> struct cl_scan_options *scanoptions, >>> void *context, >>> const char *hash_hint, >>> char **hash_out, >>> const char *hash_alg, >>> const char *file_type_hint, >>> char **file_type_out); >>>=20 >>> The older cl_scan*() functions are now deprecated and may be removed = in a future release. See clamav.h for more details. >>> GitHub pull request >>> * >>> libclamav: Added a new engine option to toggle temp directory = recursion. >>> Temp directory recursion is the idea that each object scanned in = ClamAV's recursive extract/scan process will get a new temp = subdirectory, mimicking the nesting structure of the file. >>> Temp directory recursion was introduced in ClamAV 0.103 and is = enabled whenever --leave-temps / LeaveTemporaryFiles is enabled. >>> In ClamAV 1.5, an application linking to libclamav can separately = enable temp directory recursion if they wish. For ClamScan and ClamD, it = will remain tied to --leave-temps / LeaveTemporaryFiles options. >>> The new temp directory recursion option can be enabled with: >>>=20 >>> cl_engine_set_num(engine, CL_ENGINE_TMPDIR_RECURSION, 1); >>>=20 >>> GitHub pull request >>> * >>> libclamav: Added a class of scan callback functions that can be = added with the following API function: >>>=20 >>> void cl_engine_set_scan_callback(struct cl_engine *engine, clcb_scan = callback, cl_scan_callback_t location); >>>=20 >>> The scan callback location may be configured using the following = five values: >>> Each callback may alter scan behavior using the following return = codes: >>> Each callback is given a pointer to the current scan layer from = which they can get previous layers, can get the layer's fmap, and then = various attributes of the layer and of the fmap. To make this possible, = there are new APIs to query scan-layer details and fmap details: >>>=20 >>> cl_error_t cl_fmap_set_name(cl_fmap_t *map, const char *name); >>> cl_error_t cl_fmap_get_name(cl_fmap_t *map, const char **name_out); >>> cl_error_t cl_fmap_set_path(cl_fmap_t *map, const char *path); >>> cl_error_t cl_fmap_get_path(cl_fmap_t *map, const char **path_out, = size_t *offset_out, size_t *len_out); >>> cl_error_t cl_fmap_get_fd(const cl_fmap_t *map, int *fd_out, size_t = *offset_out, size_t *len_out); >>> cl_error_t cl_fmap_get_size(const cl_fmap_t *map, size_t = *size_out); >>> cl_error_t cl_fmap_set_hash(const cl_fmap_t *map, const char = *hash_alg, char hash); >>> cl_error_t cl_fmap_have_hash(const cl_fmap_t *map, const char = *hash_alg, bool *have_hash_out); >>> cl_error_t cl_fmap_will_need_hash_later(const cl_fmap_t *map, const = char *hash_alg); >>> cl_error_t cl_fmap_get_hash(const cl_fmap_t *map, const char = *hash_alg, char **hash_out); >>> cl_error_t cl_fmap_get_data(const cl_fmap_t *map, size_t offset, = size_t len, const uint8_t **data_out, size_t *data_len_out); >>> cl_error_t cl_scan_layer_get_fmap(cl_scan_layer_t *layer, cl_fmap_t = **fmap_out); >>> cl_error_t cl_scan_layer_get_parent_layer(cl_scan_layer_t *layer, = cl_scan_layer_t **parent_layer_out); >>> cl_error_t cl_scan_layer_get_type(cl_scan_layer_t *layer, const = char **type_out); >>> cl_error_t cl_scan_layer_get_recursion_level(cl_scan_layer_t = *layer, uint32_t *recursion_level_out); >>> cl_error_t cl_scan_layer_get_object_id(cl_scan_layer_t *layer, = uint64_t *object_id_out); >>> cl_error_t cl_scan_layer_get_last_alert(cl_scan_layer_t *layer, = const char **alert_name_out); >>> cl_error_t cl_scan_layer_get_attributes(cl_scan_layer_t *layer, = uint32_t *attributes_out); >>>=20 >>> This deprecates, but does not immediately remove, the existing scan = callbacks: >>>=20 >>> void cl_engine_set_clcb_pre_cache(struct cl_engine *engine, = clcb_pre_cache callback); >>> void cl_engine_set_clcb_file_inspection(struct cl_engine *engine, = clcb_file_inspection callback); >>> void cl_engine_set_clcb_pre_scan(struct cl_engine *engine, = clcb_pre_scan callback); >>> void cl_engine_set_clcb_post_scan(struct cl_engine *engine, = clcb_post_scan callback); >>> void cl_engine_set_clcb_virus_found(struct cl_engine *engine, = clcb_virus_found callback); >>> void cl_engine_set_clcb_hash(struct cl_engine *engine, clcb_hash = callback); >>>=20 >>> There is an interactive test program to demonstrate the new = callbacks. See: examples/ex_scan_callbacks.c >>> GitHub pull request >>> * CL_SCAN_CALLBACK_PRE_HASH: Occurs just after basic file-type = detection and before any hashes have been calculated either for the = cache or the gen-json metadata. >>> * CL_SCAN_CALLBACK_PRE_SCAN: Occurs before parser modules run = and before pattern matching. >>> * CL_SCAN_CALLBACK_POST_SCAN: Occurs after pattern matching = and after running parser modules. A.k.a. the scan is complete for this = layer. >>> * CL_SCAN_CALLBACK_ALERT: Occurs each time an alert = (detection) would be triggered during a scan. >>> * CL_SCAN_CALLBACK_FILE_TYPE: Occurs each time the file type = determination is refined. This may happen more than once per layer. >>> * >>> CL_BREAK: Scan aborted by callback. The rest of the scan is skipped. = This does not mark the file as clean or infected, it just skips the rest = of the scan. >>> * >>> CL_SUCCESS / CL_CLEAN: File scan will continue. >>> For CL_SCAN_CALLBACK_ALERT: This means you want to ignore this = specific alert and keep scanning. >>> This is different than CL_VERIFIED because it does not affect prior = or future alerts. Return CL_VERIFIED instead if you want to remove prior = alerts for this layer and skip the rest of the scan for this layer. >>> * >>> CL_VIRUS: This means you do not trust the file. A new alert will be = added. >>> For CL_SCAN_CALLBACK_ALERT: This means you agree with the alert and = no extra alert is needed. >>> * >>> CL_VERIFIED: Layer explicitly trusted by the callback and previous = alerts removed for THIS layer. You might want to do this if you trust = the hash or verified a digital signature. The rest of the scan will be = skipped for THIS layer. For contained files, this does NOT mean that the = parent or adjacent layers are trusted. >>> * >>> Signature names that start with "Weak." will no longer alert. = Instead, they will be tracked internally and can be found in scan = metadata JSON. This is a step towards enabling alerting signatures to = depend on prior Weak indicator matches in the current layer or in child = layers. >>> GitHub pull request >>> * >>> For the "Generate Metadata JSON" feature: >>> GitHub pull request >>> * >>> The "Viruses" array of alert names has been replaced by two new = arrays that include additional details beyond just signature name: >>> * "Indicators" records three types of indicators: >>> * Strong indicators are for traditional alerting = signature matches and will halt the scan, except in all-match mode. >>> * Potentially Unwanted indicators will only cause an = alert at the end of the scan unless a Strong indicator is found. They = are treated the same as Strong indicators in all-match mode. >>> * Weak indicators do not alert and will be leveraged in = a future version as a condition for logical signature matches. >>> * "Alerts" records only alerting indicators. Events that = trust a file, such as false positive signatures, will remove affected = indicators, and mark them as "Ignored" in the "Indicators" array. >>> * >>> Add new option to calculate and record additional hash types when = the "generate metadata JSON" feature is enabled: >>> * libclamav option: CL_SCAN_GENERAL_STORE_EXTRA_HASHES >>> * ClamScan option: --json-store-extra-hashes (default off) >>> * clamd.conf option: JsonStoreExtraHashes (default 'no') >>> * >>> The file hash is now stored as "sha2-256" instead of "FileMD5". If = you enable the "extra hashes" option, then it will also record "md5" and = "sha1". >>> * >>> Each object scanned now has a unique "Object ID". >>> * >>> Sigtool: Renamed the sigtool option --sha256 to --sha2-256. The = original option is still functional but is deprecated. >>> GitHub pull request >>>=20 >>> Other improvements >>>=20 >>> * >>> Set a limit on the max-recursion config option. Users will no longer = be able to set max-recursion higher than 100. This change prevents = errors on start up or crashes if encountering a file with that many = layers of recursion. >>> GitHub pull request >>> * >>> Build system: CMake improvements to support compiling for the AIX = platform. This change is courtesy of GitHub user KamathForAIX. >>> GitHub pull request >>> * >>> Improve support for extracting malformed zip archives. This change = is courtesy of Frederick Sell. >>> GitHub pull request >>> * >>> Windows: Code quality improvement for the ClamScan and ClamDScan = --move and --remove options. This change is courtesy of Maxim Suhanov. >>> GitHub pull request >>> * >>> Added file type recognition for an initial set of AI model file = types. >>> The file type is accessible to applications using libclamav via the = scan callback functions and as an optional output parameter to the scan = functions: cl_scanfile_ex(), cl_scanmap_ex(), and cl_scandesc_ex(). >>> When scanning these files, type will now show "CL_TYPE_AI_MODEL" = instead of "CL_TYPE_BINARY_DATA". >>> GitHub pull request >>> * >>> Added support for inline comments in ClamAV configuration files. = This change is courtesy of GitHub user userwiths. >>> GitHub pull request >>> * >>> Disabled the MyDoom hardcoded/heuristic detection because of false = positives. >>> GitHub pull request >>> * >>> Sigtool: Added support for creating .cdiff and .script patch files = for CVDs that have underscores in the CVD name. Also improved support = for relative paths with the --diff command. >>> GitHub pull request >>> * >>> Windows: Improved support for file names with UTF-8 characters not = found in the ANSI or OEM code pages when printing scan results or = showing activity in the ClamDTOP monitoring utility. Fixed a bug with = opening files with such names with the Sigtool utility. >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> * >>> Improved the code quality of the ZIP module. Added inline = documentation. >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> * >>> Always run scan callbacks for embedded files. Embedded files are = found within other files through signature matches instead of by = parsing. They will now be processed the same way and then they can = trigger application callbacks (e.g., "pre-scan", "post-scan", etc.). >>> A consequence of this change is that each embedded file will be = pattern- matched just like any other extracted file. To minimize = excessive pattern matching, file header validation checks were added for = ZIP, ARJ, and CAB. Also fixed a bug with embedded PE file scanning to = reduce unnecessary matching. >>> This change will impact scans with both the "leave-temps" feature = and the "force-to-disk" feature enabled, resulting in additional = temporary files. >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> * >>> Added DevContainer templates to the ClamAV Git repository in order = to make it easier to set up AlmaLinux or Debian development = environments. >>> GitHub pull request >>> * >>> Removed the "Heuristics.XZ.DicSizeLimit" alert because of potential = unintended alerts based on system state. >>> GitHub pull request >>> * >>> Improved support for compiling on Solaris. >>> This fix courtesy of Andrew Watkins. >>> GitHub pull request >>> * >>> Improved support for compiling on GNU/Hurd. >>> This fix courtesy of Pino Toscano. >>> GitHub pull request >>> * >>> Improved support for linking with the NCurses library dependency = when libtinfo is built as a separate library. >>> GitHub pull request >>>=20 >>> Bug fixes >>>=20 >>> * >>> Reduced email multipart message parser complexity. >>> GitHub pull request >>> * >>> Fixed possible undefined behavior in inflate64 module. The inflate64 = module is a modified version of the zlib library, taken from version = 1.2.3 with some customization and with some cherry-picked fixes. This = adds one additional fix from zlib 1.2.9. Thank you to TITAN Team for = reporting this issue. >>> GitHub pull request >>> * >>> Fixed a bug in ClamD that broke reporting of memory usage on Linux. = The STATS command can be used to monitor ClamD directly or through = ClamDTOP. The memory stats feature does not work on all platforms (e.g., = Windows). >>> GitHub pull request >>> * >>> Windows: Fixed a build issue when the same library dependency is = found in two different locations. >>> GitHub pull request >>> * >>> Fixed an infinite loop when scanning some email files in debug-mode. = This fix is courtesy of Yoann Lecuyer. >>> GitHub pull request >>> * >>> Fixed a stack buffer overflow bug in the phishing signature load = process. This fix is courtesy of GitHub user Shivam7-1. >>> GitHub pull request >>> * >>> Fixed a race condition in the Freshclam feature tests. This fix is = courtesy of GitHub user rma-x. >>> GitHub pull request >>> * >>> Windows: Fixed a 5-byte heap buffer overread in the Windows unit = tests. This fix is courtesy of GitHub user Sophie0x2E. >>> GitHub pull request >>> * >>> Fix double-extraction of OOXML-based office documents. >>> GitHub pull request >>> * >>> ClamBC: Fixed crashes on startup. >>> GitHub pull request >>> * >>> Fixed an assortment of issues found with Coverity static analysis. >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> * >>> Fixed libclamav unit test, ClamD, and ClamDScan Valgrind test = failures affecting some platforms. >>> GitHub pull request = #1 >>> GitHub pull request = #2 >>> * >>> Fixed crash in the Sigtool program when using the --html-normalize = option. >>> GitHub pull request >>> * >>> Fixed some potential NULL-pointer dereference issues if memory = allocations fail. >>> Fix courtesy of GitHub user JiangJias. >>> GitHub pull request >>>=20 >>> Tested-by: Adolf Belka >>> Signed-off-by: Adolf Belka >>> --- >>> config/rootfiles/packages/clamav | 15 ++++++------ >>> lfs/clamav | 39 = ++++++++++++++++---------------- >>> 2 files changed, 28 insertions(+), 26 deletions(-) >>>=20 >>> diff --git a/config/rootfiles/packages/clamav = b/config/rootfiles/packages/clamav >>> index d5495e4b7..43c5585d9 100644 >>> --- a/config/rootfiles/packages/clamav >>> +++ b/config/rootfiles/packages/clamav >>> @@ -1,3 +1,6 @@ >>> +etc/clamav >>> +etc/clamav/certs >>> +etc/clamav/certs/clamav.crt >>> etc/rc.d/init.d/clamav >>> usr/bin/clamav-config >>> usr/bin/clambc >>> @@ -14,20 +17,20 @@ usr/bin/sigtool >>> #usr/include/libfreshclam.h >>> usr/lib/libclamav.so >>> usr/lib/libclamav.so.12 >>> -usr/lib/libclamav.so.12.0.3 >>> +usr/lib/libclamav.so.12.1.0 >>> #usr/lib/libclamav_rust.a >>> usr/lib/libclammspack.so >>> usr/lib/libclammspack.so.0 >>> usr/lib/libclammspack.so.0.8.0 >>> usr/lib/libclamunrar.so >>> usr/lib/libclamunrar.so.12 >>> -usr/lib/libclamunrar.so.12.0.3 >>> +usr/lib/libclamunrar.so.12.1.0 >>> usr/lib/libclamunrar_iface.so >>> usr/lib/libclamunrar_iface.so.12 >>> -usr/lib/libclamunrar_iface.so.12.0.3 >>> +usr/lib/libclamunrar_iface.so.12.1.0 >>> usr/lib/libfreshclam.so >>> -usr/lib/libfreshclam.so.3 >>> -usr/lib/libfreshclam.so.3.0.2 >>> +usr/lib/libfreshclam.so.4 >>> +usr/lib/libfreshclam.so.4.0.0 >>> #usr/lib/pkgconfig/libclamav.pc >>> usr/sbin/clamd >>> #usr/share/doc/ClamAV >>> @@ -133,7 +136,6 @@ usr/sbin/clamd >>> #usr/share/doc/ClamAV/html/manual/Installing/Add-clamav-user.html >>> #usr/share/doc/ClamAV/html/manual/Installing/Community-projects.html >>> #usr/share/doc/ClamAV/html/manual/Installing/Docker.html >>> = -#usr/share/doc/ClamAV/html/manual/Installing/Installing-from-source-Unix-= old.html >>> = #usr/share/doc/ClamAV/html/manual/Installing/Installing-from-source-Unix.h= tml >>> = #usr/share/doc/ClamAV/html/manual/Installing/Installing-from-source-Window= s.html >>> #usr/share/doc/ClamAV/html/manual/Installing/Packages.html >>> @@ -168,7 +170,6 @@ usr/sbin/clamd >>> #usr/share/doc/ClamAV/html/print.html >>> #usr/share/doc/ClamAV/html/searcher.js >>> #usr/share/doc/ClamAV/html/searchindex.js >>> -#usr/share/doc/ClamAV/html/searchindex.json >>> #usr/share/doc/ClamAV/html/sitemap.xml >>> #usr/share/doc/ClamAV/html/theme-dawn.js >>> #usr/share/doc/ClamAV/html/theme-tomorrow_night.js >>> diff --git a/lfs/clamav b/lfs/clamav >>> index 254da1281..1d4d0ba8b 100644 >>> --- a/lfs/clamav >>> +++ b/lfs/clamav >>> @@ -1,7 +1,7 @@ >>> = ##########################################################################= ##### >>> # = # >>> # IPFire.org - A linux based firewall = # >>> -# Copyright (C) 2007-2025 IPFire Team = # >>> +# Copyright (C) 2007-2026 IPFire Team = # >>> # = # >>> # This program is free software: you can redistribute it and/or = modify # >>> # it under the terms of the GNU General Public License as published = by # >>> @@ -26,7 +26,7 @@ include Config >>>=20 >>> SUMMARY =3D Antivirus Toolkit >>>=20 >>> -VER =3D 1.4.3 >>> +VER =3D 1.5.1 >>>=20 >>> THISAPP =3D clamav-$(VER) >>> DL_FILE =3D $(THISAPP).tar.gz >>> @@ -34,7 +34,7 @@ DL_FROM =3D $(URL_IPFIRE) >>> DIR_APP =3D $(DIR_SRC)/$(THISAPP) >>> TARGET =3D $(DIR_INFO)/$(THISAPP) >>> PROG =3D clamav >>> -PAK_VER =3D 80 >>> +PAK_VER =3D 81 >>>=20 >>> DEPS =3D >>>=20 >>> @@ -50,7 +50,7 @@ objects =3D $(DL_FILE) >>>=20 >>> $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) >>>=20 >>> -$(DL_FILE)_BLAKE2 =3D = 144be77e7104ebf78482c9efc411a4a168bb4ea3ad18abb237e7bcc1f5cf3e2c10d5478a54= d9dc0d82b028c923065bc614cd535fd4f67fb1e73f5fe1c6425861 >>> +$(DL_FILE)_BLAKE2 =3D = d6fd0885ea2864b0fecf040d6b0a088b8d9ad05a555697eab6c999b4a8b3d14bc2ee0968ef= 4dcb3f3b56d8361faecb98afa5ff4ffbb843cf1bf221a4e27a4496 >>>=20 >>>=20 >>> install : $(TARGET) >>> @@ -87,21 +87,22 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) >>>=20 >>> cd $(DIR_APP) && mkdir -pv build >>> cd $(DIR_APP)/build && cmake .. -G Ninja \ >>> - -DCMAKE_BUILD_TYPE=3DRelease \ >>> - -DCMAKE_INSTALL_PREFIX=3D/usr \ >>> - -DCMAKE_INSTALL_LIBDIR=3D/usr/lib \ >>> - -DOPTIMIZE=3DON \ >>> - -DBYTECODE_RUNTIME=3D"interpreter" \ >>> - -DENABLE_TESTS=3DOFF \ >>> - -DENABLE_CLAMONACC=3DOFF \ >>> - -DENABLE_MILTER=3DOFF \ >>> - -DENABLE_MAN_PAGES=3DOFF \ >>> - -DENABLE_EXTERNAL_MSPACK=3DOFF \ >>> - -DENABLE_FRESHCLAM_DNS_FIX=3DON \ >>> - -DENABLE_SYSTEMD=3DOFF \ >>> - -DAPP_CONFIG_DIRECTORY=3D/var/ipfire/clamav \ >>> - -DCURSES_LIBRARY=3D/usr/lib/libncurses.so \ >>> - -DDATABASE_DIRECTORY=3D$(DATABASE_DIR) >>> + -D CMAKE_BUILD_TYPE=3DRelease \ >>> + -D CMAKE_INSTALL_PREFIX=3D/usr \ >>> + -D CMAKE_INSTALL_LIBDIR=3D/usr/lib \ >>> + -D CVD_CERTS_DIRECTORY=3D/etc/clamav/certs \ >>> + -D OPTIMIZE=3DON \ >>> + -D BYTECODE_RUNTIME=3D"interpreter" \ >>> + -D ENABLE_TESTS=3DOFF \ >>> + -D ENABLE_CLAMONACC=3DOFF \ >>> + -D ENABLE_MILTER=3DOFF \ >>> + -D ENABLE_MAN_PAGES=3DOFF \ >>> + -D ENABLE_EXTERNAL_MSPACK=3DOFF \ >>> + -D ENABLE_FRESHCLAM_DNS_FIX=3DON \ >>> + -D ENABLE_SYSTEMD=3DOFF \ >>> + -D APP_CONFIG_DIRECTORY=3D/var/ipfire/clamav \ >>> + -D CURSES_LIBRARY=3D/usr/lib/libncurses.so \ >>> + -D DATABASE_DIRECTORY=3D$(DATABASE_DIR) >>> cd $(DIR_APP)/build && ninja $(MAKETUNING) && ninja install >>>=20 >>> mkdir -pv $(DATABASE_DIR) >>> --=20 >>> 2.52.0 >>>=20 >>>=20 >=20