From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4bNNGW3lfQz2xRj for ; Thu, 19 Jun 2025 14:26:59 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R10" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4bNNGW3WSXz2xMP for ; Thu, 19 Jun 2025 14:26:59 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E6" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4bNNGV5DppzN7 for ; Thu, 19 Jun 2025 14:26:58 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1750343218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=tPmYK218M2XLyFtbJ0Qsq0rLl2qAWj7oDjuFWLques4=; b=YJDzZB/hzqeiVgm+mhhbGGMBAQEJQbC1Nu2NXxhkxcHACt0OkQJD7RieCFtC3ZNNj5Jski SOZBofTQodXtzbAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1750343218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=tPmYK218M2XLyFtbJ0Qsq0rLl2qAWj7oDjuFWLques4=; b=YWScN87MXGKPSaoQLJMSgpznWJvMdttOmUvLKuuAzlhf9JCuJPzSVqvwHb6z1gZRCT2eSG 1aOo4VVLIfr1pRh5S35fD3A4/6zx1Tqts9O2MNMujxNJH0dyLthmqyLnMf8IiptQcqWHrN v57Ssb11FxIAUv6qkzLRd8KfNjoy1HbunTO5F+xI+6raDDWMA5/2DqoZ4dHR5Zq555nIc8 sXTSbAdlXkk43hntt8TagFIH4GYblxA9uSub1TAmLXkZk0HKPLPdfh8U53WOQ0iKHcXCBN lFJuj9E8xdl8PjOIctQbFKzvg/5vdUcoPis/L5kqD7/+zL5yZ2EVaexfps1+nw== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4bNNGV3XGwz2xFc; Thu, 19 Jun 2025 14:26:58 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. b241b660d642efa3379865f43d103f600586da13 X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: a1ac4d54dc2e667b88ee5554d713c79f3ed7b001 X-Git-Newrev: b241b660d642efa3379865f43d103f600586da13 Message-Id: <4bNNGV3XGwz2xFc@people01.haj.ipfire.org> Date: Thu, 19 Jun 2025 14:26:58 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via b241b660d642efa3379865f43d103f600586da13 (commit) from a1ac4d54dc2e667b88ee5554d713c79f3ed7b001 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b241b660d642efa3379865f43d103f600586da13 Author: Adolf Belka Date: Thu Jun 19 14:03:29 2025 +0200 clamav: Update to version 1.4.3 - Update from version 1.4.2 to 1.4.3 - Update of rootfile not required - Changelog 1.4.3 - [CVE-2025-20260](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20260): Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution. This issue only affects configurations where both: 1. The max file-size scan limit is set greater than or equal to 1024MB. 2. The max scan-size scan limit is set greater than or equal to 1025MB. The code flaw was present prior to version 1.0.0, but a change in version 1.0.0 that enables larger allocations based on untrusted data made it possible to trigger this bug. This issue affects all currently supported versions. Thank you to Greg Walkup at Sandia National Labs for identifying this issue. - [CVE-2025-20234](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20234): Fixed a possible buffer overflow read bug in the UDF file parser that may write to a temp file and thus disclose information, or it may crash and cause a denial-of-service (DoS) condition. This issue was introduced in version 1.2.0. It will be fixed in 1.4.3. Thank you to volticks (@movx64 on Twitter/X), working with Trend Micro Zero Day Initiative, for identifying this issue. - Fixed a possible use-after-free bug in the Xz decompression module in the bundled lzma-sdk library. This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a copy of the lzma-sdk with some performance changes specific to libclamav, plus select bug fixes like this one in lieu of a full upgrade to newer lzma-sdk. This issue affects all ClamAV versions at least as far back as 0.99.4. Thank you to OSS-Fuzz for identifying this issue. - Windows: Fixed a build install issue when a DLL dependency such as libcrypto has the exact same name as one provided by the Windows operating system. Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: lfs/clamav | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) Difference in files: diff --git a/lfs/clamav b/lfs/clamav index e6bb32355..6a1d3849b 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -26,7 +26,7 @@ include Config SUMMARY = Antivirus Toolkit -VER = 1.4.2 +VER = 1.4.3 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 76 +PAK_VER = 77 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 869f3375ff3da33c0a63607499d06b3312788cf8fdaa0f026553c0b12a23888b7f27a6eda9ffb0888c268faad6b552941cef0c3178ea86197eb92d4ce4f011e5 +$(DL_FILE)_BLAKE2 = 144be77e7104ebf78482c9efc411a4a168bb4ea3ad18abb237e7bcc1f5cf3e2c10d5478a54d9dc0d82b028c923065bc614cd535fd4f67fb1e73f5fe1c6425861 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree