* [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 704a0d7874ec5b2370536948d89ed5c08ecfd44b
@ 2026-07-02 15:02 Michael Tremer
0 siblings, 0 replies; only message in thread
From: Michael Tremer @ 2026-07-02 15:02 UTC (permalink / raw)
To: ipfire-scm
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 704a0d7874ec5b2370536948d89ed5c08ecfd44b (commit)
via 4233d169f725ca6f160af95b12bd190da0da5661 (commit)
from 9e27ea51c08e4f2ff523d737361cdf9894fd1409 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 704a0d7874ec5b2370536948d89ed5c08ecfd44b
Author: Adolf Belka <adolf.belka@ipfire.org>
Date: Thu Jul 2 15:03:15 2026 +0200
clamav: Update to version 1.5.3
- Update from version 1.5.2 to 1.5.3
- Update of rootfile
- 8 CVE fixes, one of which is related to a rust module plus 2 rust security fixes that
do not have an assigned CVE
- Changelog
1.5.3
CVE-2026-20217<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20217>:
Fixed a bug in the PESpin unpacker cleanup path that could free pointers into
the scanned file buffer and crash the scanner.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as
2005. The fix is included in 1.5.3 and 1.4.5.
CVE-2026-20213<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20213>:
Fixed an integer overflow in PE rebuild size calculations that could be
reached through a malformed Aspack-packed PE file and lead to a heap buffer
overflow write.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as
2007. The fix is included in 1.5.3 and 1.4.5.
CVE-2026-20216<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20216>:
Fixed an InstallShield archive extraction limit bypass that could write far
more temporary data than intended and exhaust temporary storage.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as
2009. The fix is included in 1.5.3 and 1.4.5.
CVE-2026-20214<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20214>:
Fixed an FSG unpacker loop underflow that could write past the section array
while scanning a malformed PE file.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions as far back as
2004. The fix is included in 1.5.3 and 1.4.5.
CVE-2026-20243<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20243>:
Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
to panic, abort the scanner, or skip expected scan-limit handling.
This issue affects ClamAV 1.5.0 through 1.5.2 and 1.4.0 through 1.4.4. The
fix is included in 1.5.3 and 1.4.5.
CVE-2026-20215<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20215>:
Fixed a 7z parser substream count overflow that could under-allocate parser
metadata arrays and write past them while reading a malformed archive.
This issue affects ClamAV 1.5.2, 1.4.4, and all prior versions back to 2009.
The fix is included in 1.5.3 and 1.4.5.
CVE-2026-20244<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20244>:
Fixed 32-bit DMG parser size checks that could let a short mish stripe table
pass validation and crash 32-bit scanner builds.
This issue affects 32-bit ClamAV builds from 0.98.1 through 1.5.2, including
1.4.0 through 1.4.4 and 1.5.0 through 1.5.2. It does not affect 64-bit builds.
The fix is included in 1.5.3 and 1.4.5.
Hardened clamscan, clamdscan, and clamonacc quarantine actions against
time-of-check/time-of-use races that could redirect copied, moved, or removed
files under unsafe quarantine directory configurations.
Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
resolve CVE-2026-41676.
Raised the minimum required CMake version to 3.17 to fix Linux builds with
libcurl v8.21.0 when linking static library dependencies.
Metadata preclass scans now run before the final scan verdict.
ClamOnAcc: Fixed errors when recursively excluded paths are children of an
included path.
ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide in
the same bucket.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
commit 4233d169f725ca6f160af95b12bd190da0da5661
Author: Matthias Fischer <matthias.fischer@ipfire.org>
Date: Thu Jul 2 08:45:03 2026 +0200
tmux: Update to 3.7b
Bug fixes - again - for details see:
https://raw.githubusercontent.com/tmux/tmux/3.7b/CHANGES
"CHANGES FROM 3.7a TO 3.7b
* Fix so that the end of a synchronized update again triggers a redraw."
Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
config/rootfiles/packages/clamav | 9 ++++++---
lfs/clamav | 6 +++---
lfs/tmux | 6 +++---
3 files changed, 12 insertions(+), 9 deletions(-)
Difference in files:
diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav
index 0fe438477..f17380c98 100644
--- a/config/rootfiles/packages/clamav
+++ b/config/rootfiles/packages/clamav
@@ -149,6 +149,7 @@ usr/sbin/clamd
#usr/share/doc/ClamAV/html/manual/Signatures/YaraRules.html
#usr/share/doc/ClamAV/html/manual/Usage
#usr/share/doc/ClamAV/html/manual/Usage.html
+#usr/share/doc/ClamAV/html/manual/Usage/ClamdProtocol.html
#usr/share/doc/ClamAV/html/manual/Usage/Configuration.html
#usr/share/doc/ClamAV/html/manual/Usage/ReportABug.html
#usr/share/doc/ClamAV/html/manual/Usage/Scanning.html
@@ -156,14 +157,16 @@ usr/sbin/clamd
#usr/share/doc/ClamAV/html/manual/Usage/SignatureManagement.html
#usr/share/doc/ClamAV/html/manual/cisco-talos.gpg
#usr/share/doc/ClamAV/html/mark-09e88c2c.min.js
+#usr/share/doc/ClamAV/html/mermaid-eefea253.min.js
+#usr/share/doc/ClamAV/html/mermaid-init-ccf746f1.js
#usr/share/doc/ClamAV/html/mode-rust-2c9d5c9a.js
#usr/share/doc/ClamAV/html/print.html
-#usr/share/doc/ClamAV/html/searcher-c2a407aa.js
-#usr/share/doc/ClamAV/html/searchindex-1b5ba28b.js
+#usr/share/doc/ClamAV/html/searcher-09f2665d.js
+#usr/share/doc/ClamAV/html/searchindex-d348bbbb.js
#usr/share/doc/ClamAV/html/sitemap.xml
#usr/share/doc/ClamAV/html/theme-dawn-4493f9c8.js
#usr/share/doc/ClamAV/html/theme-tomorrow_night-9dbe62a9.js
-#usr/share/doc/ClamAV/html/toc-cbaddea7.js
+#usr/share/doc/ClamAV/html/toc-0c194aa2.js
#usr/share/doc/ClamAV/html/toc.html
#usr/share/doc/ClamAV/html/tomorrow-night-4c0ae647.css
#var/ipfire/clamav
diff --git a/lfs/clamav b/lfs/clamav
index 888803c10..5320f6986 100644
--- a/lfs/clamav
+++ b/lfs/clamav
@@ -26,7 +26,7 @@ include Config
SUMMARY = Antivirus Toolkit
-VER = 1.5.2
+VER = 1.5.3
THISAPP = clamav-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = clamav
-PAK_VER = 83
+PAK_VER = 84
DEPS =
@@ -50,7 +50,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = e63131ac19160a68c6acd9413263fd5793a6acf67adfe30873f6c56bca3a29286bf4f872e439b9c4b75ab772d20e9b05a0e0b3ac19399ac81033c52d7c2b6d42
+$(DL_FILE)_BLAKE2 = 1b2d42bc8c4fed29b71e10be9823da17f861a11e6a818654ae51b2b1fbd16619494572f9aa5e8712433bd65443c33f3e250baa99bb1fea031aa47c6bf6b81c21
install : $(TARGET)
diff --git a/lfs/tmux b/lfs/tmux
index 38c872568..066f2f7d6 100644
--- a/lfs/tmux
+++ b/lfs/tmux
@@ -26,7 +26,7 @@ include Config
SUMMARY = Terminal multiplexer
-VER = 3.7a
+VER = 3.7b
THISAPP = tmux-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = tmux
-PAK_VER = 17
+PAK_VER = 18
DEPS =
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 04632a169a33b9c60a84c05c3a6dd66b61d911059c563cb0b6bb967b32ec29e6082e127caf8e110a930dcf08a37e7498278498903806140ff3d87575ced8437a
+$(DL_FILE)_BLAKE2 = 17972a31e1164a19273adf43857f4a731218637dc33c138ff2f4f1bd809580394b4df78cde681ba3bfaeba2430b4ee175eb89a8406cdd8bb5ab474dad97e7657
install : $(TARGET)
hooks/post-receive
--
IPFire 2.x development tree
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-02 15:02 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-02 15:02 [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 704a0d7874ec5b2370536948d89ed5c08ecfd44b Michael Tremer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox