ClamAV® blog: ClamAV 0.103 .0 release candidate
"Joel Esler (jesler)" <[email protected]> Tue, 18 Aug 2020 21:57:23 +0000
| Newsgroups | gmane.comp.security.virus.clamav.announce,gmane.comp.security.virus.clamav.win32,gmane.comp.security.virus.clamav.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============6867180856609135793==
Content-Language: en-US
Content-Type: multipart/signed;
boundary="Apple-Mail=_C478E7B8-CE0A-4E49-AC5C-B9E85E72E66E";
protocol="application/pkcs7-signature";
micalg=sha-256
--Apple-Mail=_C478E7B8-CE0A-4E49-AC5C-B9E85E72E66E
Content-Type: multipart/alternative;
boundary="Apple-Mail=_431BD869-28D5-4DE5-94FD-662E22811A61"
--Apple-Mail=_431BD869-28D5-4DE5-94FD-662E22811A61
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
charset=utf-8
>=20
> https://blog.clamav.net/2020/08/clamav-01030-release-candidate.html =
<https://blog.clamav.net/2020/08/clamav-01030-release-candidate.html>
>=20
> ClamAV 0.103.0 release candidate
>=20
> Today we are pleased to announce the ClamAV 0.103.0 release candidate =
<https://www.clamav.net/downloads>!
>=20
> Please help us validate this release. We need your feedback so let us =
know what you find and join us on the clamav mailing list =
<https://lists.clamav.net/mailman/listinfo/clamav-users>, in #clamav on =
irc.freenode.net, or on our Discord <https://discord.gg/sGaxA5Q>, which =
is bridged with our IRC.
>=20
> Please submit bugs to on our Bugzilla =
<https://bugzilla.clamav.net/enter_bug.cgi?product=3DClamAV>.=20
>=20
> ClamAV 0.103.0 includes the following improvements and changes.
>=20
> Major changes
>=20
> clamd can now reload the signature database without blocking scanning. =
This multi-threaded database reload improvement was made possible thanks =
to a community effort.
> Non-blocking database reloads are now the default behavior. Some =
systems that are more constrained on RAM may need to disable =
non-blocking reloads as it will temporarily consume 2x as much memory. =
For this purpose we have added a new clamd config option =
ConcurrentDatabaseReload which may be set to no.
>=20
> Special thanks to the following for making this feature a reality:
> Alberto Wu
> Alexander Sulfrian
> Arjen de Korte
> David Heidelberg
> Ged Haywood
> Julius Plenz
> Michael Orlitzky
>=20
> Thank you all for your patience waiting for this feature.=20
>=20
> Notable changes
>=20
>=20
> The DLP module has been enhanced with additional credit card ranges =
and a new engine option which allows ClamAV to alert only on credit =
cards (and not, for instance, gift cards) when scannning with the DLP =
module. This feature enhancement was made by John Schember, with input =
from Alexander Sulfrian.
>=20
> Support for Adobe Reader X PDF encryption, an overhaul of PNG scanning =
to detect PNG specific exploits, and a major change to GIF parsing which =
makes it more tolerant to problematic files and adds the ability to scan =
overlays, all thanks to work and patches submitted by Aldo Mazzeo.
>=20
> clamdtop.exe now available for Windows users. Functionality is =
somewhat limited when compared with clamdtop on Linux. PDCurses is =
required to build clamdtop.exe for ClamAV on Windows.
>=20
> The phishing detection module will now print "Suspicious link found!" =
along with the "Real URL" and "Display URL" each time phishing is =
detected. In a future version, we would like to print out alert-related =
metadata like this at the end of a scan, but for now this detail will =
help users understand why a given file is being flagged as phishing.
>=20
> Added new *experimental* CMake build tooling. CMake is not yet =
recommended for production builds. Our team would appreciate any =
assistance improving the CMake build tooling so we can one day deprecate =
Autotools and remove the Visual Studio solutions.
> Please see the new CMake installation instructions found in =
INSTALL.cmake.md for detailed instructions on how to build ClamAV with =
CMake.
>=20
> Added --ping and --wait options to the clamdscan and clamonacc client =
applications.
> The --ping (-p) command will attempt to ping clamd up to a specified =
maximum number of attempts at an optional interval. If the interval =
isn't specified, a default 1-second interval is used. It will exit with =
status code `0` when it receives a PONG from clamd or status code `21` =
if the timeout expires before it receives a response.
> Example:
> clamdscan -p 120 will attempt to ping clamd 120 at a 1 second =
interval.
> The --wait (-w) command will wait up to 30 seconds for clamd to start. =
This option may be used in tandem with the --ping option to customize =
the max # of attempts and the attempt interval. As with --ping, the =
scanning client may exit with status code 21 if the timeout expires =
before a connection is made to clamd.
> Example:
> clamdscan -p 30:2 -w <file> will attempt a scan, waiting up to 60 =
seconds for clamd to start and receive the scan request.
> The ping-and-wait feature is particularly useful for those wishing to =
start clamd and start clamonacc at startup, ensuring that clamd is ready =
before clamonacc starts. It is also useful for those wishing to start =
clamd immediately before initiating scans with clamdscan rather than =
having the clamd service run continuously.
> Added Excel 4.0 (XLM) macro detection and extraction support. =
Significantly improved VBA detection and extraction as well. Work =
courtesy of Jonas Zaddach.
> This support not yet added to sigtool, as the VBA extraction feature =
in sigtool is separate from the one used for scanning and will still =
need to be updated or replaced in the future.
> Improvements to the layout and legibility of temp files created during =
a scan. Improvements to legibility and content of the metadata JSON =
generated during a scan.
> To review the scan temp files and metadata JSON, run:
>=20
> clamscan --tempdir=3D<path> --leave-temps --gen-json <target>
>=20
>=20
> Viewing the scan temp files and metadata.json file provides some =
insight into how ClamAV analyzes a given file and can also be useful to =
analysts for initial triage of potentially malicious files.
> =20
> Other improvements
>=20
>=20
> Added ability for freshclam and clamsubmit to override default use of =
OpenSSL CA bundle with a custom CA bundle. On Linux/Unix platforms =
(excluding macOS), users may specify a custom CA bundle by setting the =
CURL_CA_BUNDLE environment variable. On macOS and Windows, users are =
expected to add CA certificates to their respective system's =
keychain/certificate store. Patch courtesy of Sebastian A. Siewior
> clamscan and clamdscan now print the scan start and end dates in the =
scan summary.
> The clamonacc on-access scanning daemon for Linux now installs to sbin =
instead of bin.
> Improvements to the freshclam progress bar so the width of the text =
does not shift around as information changes and will not spill exceed =
80-characters even on very slow connections. Time is now displayed in Xm =
XXs (or Xh XXm) for values of 60 seconds or more. Bytes display now =
changes units at the proper 1024 B/KiB instead of 2048 B/KiB. Patch =
courtesy of Zachary Murden.
> Improve column alignment and line wrap rendering for clamdtop. Also =
fixed an issue on Windows where clamdtop would occasionally disconnect =
from clamd and fail to reconnect. Patch courtesy of Zachary Murden.
> Improvements to the AutoIT parser.
> Loosened the curl version requirements in order to build and use =
clamonacc. You may now build ClamAV with any version of libcurl. However =
clamonacc's file descriptor-passing (FD-passing) capability will only be =
available with libcurl 7.40 or newer. FD-passing is ordinarily the =
default way to perform scans with clamonacc as it is significantly =
faster than streaming.
> Added LZMA and BZip2 decompression routines to the bytecode signature =
API.
> Disabled embedded type recognition for specific archive and disk image =
file types. This change reduces file type misclassification and improves =
scan time performance by reducing duplicated file scanning.
> =20
> Bug fixes
>=20
>=20
> Fixed issue scanning directories on Windows with clamdscan.exe that =
was introduced when mitigating against symlink quarantine attacks.
> Fixed behavior of freshclam --quiet option. Patch courtesy of Reio =
Remma.
> Fixed behavior of freshclam's OnUpdateExecute, OnErrorExecute, and =
OnOutdatedExecute config options on Windows when in daemon-mode so it =
can handle multiple arguments. Patch courtesy of Zachary Murden.
> Fixed an error in the heuristic alert mechanism that would cause a =
single detection within an archive to alert once for every subsequent =
file scanned, potentially resulting in thousands of alerts for a single =
scan.
> Fixed clamd, clamav-milter, and freshclam to create PID files before =
dropping privileges, to avoid the possibility of an unprivileged user =
from changing the PID file so that a service manager will kill a =
different process. This change does make the services unable to clean up =
the PID file on exit.
> Fixed the false positive (.fp) signature feature. In prior versions, =
the hash in a false positive signature would be checked only against the =
current layer of a file being scanned. In 0.103, every file layer is =
hashed, and the hashes for each in the scan recursion list are checked. =
This ensures that .fp signatures containing a hash for any layer in the =
scan leading up to the alert will negate the alert.
> As an example, a hash for a zip containing the file which alerts would =
not prevent the detection in prior versions. Only the hash of the =
embedded file would work. For some file types where the outermost is =
always an archive, eg. docx files, this made .fp signatures next to =
useless. For certain file types where the scanned content was a =
normalized version of the original content, eg. HTML, the normalized =
version was never hashed and this meant that .fp signatures never =
worked.
> Fixed Trusted & Revoked Windows executable (PE) file signature rules =
(.crb) maximum functionality level (FLEVEL) which had been being treated =
as the minimum FLEVEL. These signatures enable ClamAV to trust =
executables that are digitally signed by trusted publishers, or to alert =
on executables signed with compromised signing-certificates. The minimum =
and maximum FLEVELS enable or disable signatures at load time depending =
on the current ClamAV version.
> Fixed a bug wherein you could not build ClamAV with =
--enable-libclamav-only if curl was not installed on the system.
> Various other bug fixes, improvements, and documentation improvements.
> =20
> New Requirements
>=20
>=20
> Autotools (automake, autoconf, m4, pkg-config, libtool) are now =
required in order to build from a Git clone because the files generated =
by these tools have been removed from the Git repository. To generate =
theses files before you compile ClamAV, run autogen.sh. Users building =
with Autotools from the release tarball should be unaffected.
> Flex and Bison are now required in order to build from a Git clone. =
Flex and Bison are also required to build with CMake. Users building =
with Autotools from the release tarball should be unaffected.
> =20
> Acknowledgements
>=20
> The ClamAV team thanks the following individuals for their code =
submissions:
>=20
> Aldo Mazzeo
> =C3=81ngel
> Antonino Cangialosi
> Clement Lecigne
> Jamie Biggar
> Jan Smutny
> John Schember
> Jonathan Sabbe
> lutianxiong
> Reio Remma
> Sebastian A. Siewior
> Zachary Murden=20
--Apple-Mail=_431BD869-28D5-4DE5-94FD-662E22811A61
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
charset=utf-8
<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; =
charset=3Dutf-8"><base></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><base=
class=3D""><div class=3D"Apple-Mail-URLShareUserContentTopClass"><br =
class=3D""></div><div =
class=3D"Apple-Mail-URLShareWrapperClass"><blockquote type=3D"cite" =
style=3D"border-left-style: none; color: inherit; padding: inherit; =
margin: inherit;" class=3D""><div class=3D""><div =
class=3D"original-url"><br class=3D""><a =
href=3D"https://blog.clamav.net/2020/08/clamav-01030-release-candidate.htm=
l" =
class=3D"">https://blog.clamav.net/2020/08/clamav-01030-release-candidate.=
html</a><br class=3D""><br class=3D""></div><div id=3D"article" =
role=3D"article" style=3D"font-family: Georgia; text-rendering: =
optimizeLegibility; font-size: 1.2em; line-height: 1.5em; margin: 0px; =
padding: 0px;" class=3D"georgia exported">
<!-- This node will contain a number of div.page. -->
<div class=3D"page" style=3D"word-wrap: break-word; max-width: =
100%;"><h1 class=3D"title" style=3D"font-size: 1.95552em; line-height: =
1.2141em; margin-top: 0px; margin-bottom: 0.5em; max-width: =
100%;">ClamAV 0.103.0 release candidate</h1><p style=3D"max-width: =
100%;" class=3D"">Today we are pleased to announce the <a =
href=3D"https://www.clamav.net/downloads" target=3D"_blank" =
style=3D"color: rgb(73, 129, 254); max-width: 100%;" class=3D"">ClamAV =
0.103.0 release candidate</a>!</p><p style=3D"max-width: 100%;" =
class=3D"">Please help us validate this release. We need your feedback =
so let us know what you find and join us on the <a =
href=3D"https://lists.clamav.net/mailman/listinfo/clamav-users" =
target=3D"_blank" style=3D"color: rgb(73, 129, 254); max-width: 100%;" =
class=3D"">clamav mailing list</a>, in <span style=3D"max-width: 100%;" =
class=3D"">#clamav</span> on <a href=3D"http://irc.freenode.net" =
class=3D"">irc.freenode.net</a>, or on <a =
href=3D"https://discord.gg/sGaxA5Q" target=3D"_blank" style=3D"color: =
rgb(73, 129, 254); max-width: 100%;" class=3D"">our Discord</a>, which =
is bridged with our IRC.</p><p style=3D"max-width: 100%;" =
class=3D"">Please submit bugs to on our <a =
href=3D"https://bugzilla.clamav.net/enter_bug.cgi?product=3DClamAV" =
target=3D"_blank" style=3D"color: rgb(73, 129, 254); max-width: 100%;" =
class=3D"">Bugzilla</a>. </p><p style=3D"max-width: 100%;" =
class=3D"">ClamAV 0.103.0 includes the following improvements and =
changes.</p><h3 style=3D"font-size: 1.25em; max-width: 100%;" =
class=3D""> Major changes</h3><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D""><span =
style=3D"max-width: 100%;" class=3D"">clamd</span> can now reload the =
signature database without blocking scanning. This multi-threaded =
database reload improvement was made possible thanks to a community =
effort.</li><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Non-blocking database reloads are =
now the default behavior. Some systems that are more constrained on =
RAM may need to disable non-blocking reloads as it will temporarily =
consume 2x as much memory. For this purpose we have added a =
new <span style=3D"max-width: 100%;" class=3D"">clamd</span> config =
option <span style=3D"max-width: 100%;" =
class=3D"">ConcurrentDatabaseReload</span> which may be set to <span =
style=3D"max-width: 100%;" class=3D"">no</span>.</li></ul></ul><br =
style=3D"max-width: 100%;" class=3D"">Special thanks to the following =
for making this feature a reality:<br style=3D"max-width: 100%;" =
class=3D""><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Alberto Wu</li><li =
style=3D"max-width: 100%;" class=3D"">Alexander Sulfrian</li><li =
style=3D"max-width: 100%;" class=3D"">Arjen de Korte</li><li =
style=3D"max-width: 100%;" class=3D"">David Heidelberg</li><li =
style=3D"max-width: 100%;" class=3D"">Ged Haywood</li><li =
style=3D"max-width: 100%;" class=3D"">Julius Plenz</li><li =
style=3D"max-width: 100%;" class=3D"">Michael Orlitzky</li></ul><br =
style=3D"max-width: 100%;" class=3D""><p style=3D"max-width: 100%;" =
class=3D"">Thank you all for your patience waiting for this =
feature. </p><h3 style=3D"font-size: 1.25em; max-width: 100%;" =
class=3D"">Notable changes</h3><div style=3D"max-width: 100%;" =
class=3D""><br class=3D"webkit-block-placeholder"></div><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">The DLP module has been enhanced with additional credit card =
ranges and a new engine option which allows ClamAV to alert only on =
credit cards (and not, for instance, gift cards) when scannning =
with the DLP module. This feature enhancement was made by John =
Schember, with input from Alexander Sulfrian.</li></ul><br =
style=3D"max-width: 100%;" class=3D""><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Support for Adobe =
Reader X PDF encryption, an overhaul of PNG scanning to detect PNG =
specific exploits, and a major change to GIF parsing which makes it =
more tolerant to problematic files and adds the ability to scan =
overlays, all thanks to work and patches submitted by Aldo =
Mazzeo.</li></ul><br style=3D"max-width: 100%;" class=3D""><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D""><span style=3D"max-width: 100%;" class=3D"">clamdtop.exe</span>=
now available for Windows users. Functionality is somewhat limited when =
compared with <span style=3D"max-width: 100%;" class=3D"">clamdtop</span> =
on Linux. PDCurses is required to build <span style=3D"max-width: =
100%;" class=3D"">clamdtop.exe</span> for ClamAV on =
Windows.</li></ul><br style=3D"max-width: 100%;" class=3D""><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">The phishing detection module will now print "Suspicious link =
found!" along with the "Real URL" and "Display URL" each time =
phishing is detected. In a future version, we would like to print =
out alert-related metadata like this at the end of a scan, but for =
now this detail will help users understand why a given file is =
being flagged as phishing.</li></ul><br style=3D"max-width: 100%;" =
class=3D""><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Added new *<i style=3D"max-width: =
100%;" class=3D"">experimental</i>* CMake build tooling. CMake is not =
yet recommended for production builds. <i style=3D"max-width: 100%;" =
class=3D"">Our team would appreciate any assistance improving =
the CMake build tooling so we can one day deprecate Autotools and =
remove the Visual Studio solutions</i>.</li><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">Please see =
the new CMake installation instructions found in <span style=3D"max-width:=
100%;" class=3D"">INSTALL.cmake.md</span> for detailed instructions on =
how to build ClamAV with CMake.</li></ul></ul><br style=3D"max-width: =
100%;" class=3D""><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Added <span style=3D"max-width: =
100%;" class=3D"">--ping</span> and <span style=3D"max-width: 100%;" =
class=3D"">--wait</span> options to the <span style=3D"max-width: 100%;" =
class=3D"">clamdscan</span> and <span style=3D"max-width: 100%;" =
class=3D"">clamonacc</span> client applications.</li><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">The <span style=3D"max-width: 100%;" class=3D"">--ping</span> =
(<span style=3D"max-width: 100%;" class=3D"">-p</span>) command will =
attempt to ping <span style=3D"max-width: 100%;" class=3D"">clamd</span> =
up to a specified maximum number of attempts at an optional =
interval. If the interval isn't specified, a default 1-second =
interval is used. It will exit with status code `<span =
style=3D"max-width: 100%;" class=3D"">0</span>` when it receives a <span =
style=3D"max-width: 100%;" class=3D"">PONG</span> from <span =
style=3D"max-width: 100%;" class=3D"">clamd</span> or status code `<span =
style=3D"max-width: 100%;" class=3D"">21</span>` if the =
timeout expires before it receives a =
response.</li></ul></ul>Example:<br style=3D"max-width: 100%;" =
class=3D""><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" =
class=3D"">clamdscan -p 120</span> will attempt to ping <span =
style=3D"max-width: 100%;" class=3D"">clamd</span> 120 at a 1 second =
interval.</li><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">The <span style=3D"max-width: =
100%;" class=3D"">--wait</span> (<span style=3D"max-width: 100%;" =
class=3D"">-w</span>) command will wait up to 30 seconds for <span =
style=3D"max-width: 100%;" class=3D"">clamd</span> to start. This =
option may be used in tandem with the <span style=3D"max-width: 100%;" =
class=3D"">--ping</span> option to customize the max # of attempts and =
the attempt interval. As with <span style=3D"max-width: 100%;" =
class=3D"">--ping</span>, the scanning client may exit with status code =
<span style=3D"max-width: 100%;" class=3D"">21</span> if the timeout =
expires before a connection is made to <span style=3D"max-width: 100%;" =
class=3D"">clamd</span>.</li></ul></ul>Example:<br style=3D"max-width: =
100%;" class=3D""><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" =
class=3D"">clamdscan -p 30:2 -w <<i style=3D"max-width: 100%;" =
class=3D"">file</i>></span> will attempt a scan, waiting up to 60 =
seconds for <span style=3D"max-width: 100%;" class=3D"">clamd</span> =
to start and receive the scan request.</li><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">The =
ping-and-wait feature is particularly useful for those wishing to =
start <span style=3D"max-width: 100%;" class=3D"">clamd</span> and =
start <span style=3D"max-width: 100%;" class=3D"">clamonacc</span> at =
startup, ensuring that <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> is ready before <span style=3D"max-width: =
100%;" class=3D"">clamonacc</span> starts. It is also useful for those =
wishing to start <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> immediately before initiating scans with <span =
style=3D"max-width: 100%;" class=3D"">clamdscan</span> rather =
than having the <span style=3D"max-width: 100%;" =
class=3D"">clamd</span> service run continuously.</li></ul></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Added Excel 4.0 (XLM) macro detection and extraction support. =
Significantly improved VBA detection and extraction as well. Work =
courtesy of Jonas Zaddach.</li><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">This support not =
yet added to <span style=3D"max-width: 100%;" class=3D"">sigtool</span>, =
as the VBA extraction feature in <span style=3D"max-width: 100%;" =
class=3D"">sigtool</span> is separate from the one used for scanning and =
will still need to be updated or replaced in the =
future.</li></ul></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Improvements to the layout and =
legibility of temp files created during a scan. Improvements to =
legibility and content of the metadata JSON generated during a =
scan.</li></ul>To review the scan temp files and metadata JSON, run:<br =
style=3D"max-width: 100%;" class=3D""><br style=3D"max-width: 100%;" =
class=3D""> <span style=3D"max-width: 100%;" class=3D"">clamscan =
--tempdir=3D<<i style=3D"max-width: 100%;" class=3D"">path</i>> =
--leave-temps --gen-json <<i style=3D"max-width: 100%;" =
class=3D"">target</i>></span><br style=3D"max-width: 100%;" =
class=3D""><br style=3D"max-width: 100%;" class=3D""><br =
style=3D"max-width: 100%;" class=3D""> Viewing the scan temp files =
and <span style=3D"max-width: 100%;" class=3D"">metadata.json</span> =
file provides some insight into how ClamAV analyzes a given file =
and can also be useful to analysts for initial triage of =
potentially malicious files.<br style=3D"max-width: 100%;" =
class=3D""> <h3 style=3D"font-size: 1.25em; max-width: 100%;" =
class=3D"">Other improvements</h3><div style=3D"max-width: 100%;" =
class=3D""><br class=3D"webkit-block-placeholder"></div><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Added ability for <span style=3D"max-width: 100%;" =
class=3D"">freshclam</span> and <span style=3D"max-width: 100%;" =
class=3D"">clamsubmit</span> to override default use of OpenSSL CA =
bundle with a custom CA bundle. On Linux/Unix platforms (excluding =
macOS), users may specify a custom CA bundle by setting the <span =
style=3D"max-width: 100%;" class=3D"">CURL_CA_BUNDLE</span> =
environment variable. On macOS and Windows, users are expected to =
add CA certificates to their respective system's keychain/certificate =
store. Patch courtesy of Sebastian A. Siewior</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D""><span style=3D"max-width: 100%;" class=3D"">clamscan</span> =
and <span style=3D"max-width: 100%;" class=3D"">clamdscan</span> now =
print the scan start and end dates in the =
scan summary.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">The <span style=3D"max-width: =
100%;" class=3D"">clamonacc</span> on-access scanning daemon for Linux =
now installs to <span style=3D"max-width: 100%;" =
class=3D"">sbin</span> instead of <span style=3D"max-width: 100%;" =
class=3D"">bin</span>.</li></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Improvements to the =
<span style=3D"max-width: 100%;" class=3D"">freshclam</span> progress =
bar so the width of the text does not shift around as information =
changes and will not spill exceed 80-characters even on very slow =
connections. Time is now displayed in <span style=3D"max-width: 100%;" =
class=3D"">Xm XXs</span> (or <span style=3D"max-width: 100%;" =
class=3D"">Xh XXm</span>) for values of 60 seconds or more. Bytes =
display now changes units at the proper 1024 B/KiB instead of 2048 =
B/KiB. Patch courtesy of Zachary Murden.</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Improve column alignment and line wrap rendering for <span =
style=3D"max-width: 100%;" class=3D"">clamdtop</span>. Also =
fixed an issue on Windows where <span style=3D"max-width: 100%;" =
class=3D"">clamdtop</span> would occasionally disconnect from <span =
style=3D"max-width: 100%;" class=3D"">clamd</span> and fail to =
reconnect. Patch courtesy of Zachary Murden.</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Improvements to the AutoIT parser.</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Loosened the curl version requirements in order to build and =
use <span style=3D"max-width: 100%;" class=3D"">clamonacc</span>. You=
may now build ClamAV with any version of libcurl. However <span =
style=3D"max-width: 100%;" class=3D"">clamonacc</span>'s file =
descriptor-passing (FD-passing) capability will only be available =
with libcurl 7.40 or newer. FD-passing is ordinarily the default =
way to perform scans with <span style=3D"max-width: 100%;" =
class=3D"">clamonacc</span> as it is significantly faster than =
streaming.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Added LZMA and BZip2 decompression =
routines to the bytecode signature API.</li></ul><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">Disabled =
embedded type recognition for specific archive and disk image =
file types. This change reduces file type misclassification and =
improves scan time performance by reducing duplicated file =
scanning.</li></ul> <h3 style=3D"font-size: 1.25em; max-width: =
100%;" class=3D"">Bug fixes</h3><div style=3D"max-width: 100%;" =
class=3D""><br class=3D"webkit-block-placeholder"></div><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Fixed issue scanning directories on Windows with <span =
style=3D"max-width: 100%;" class=3D"">clamdscan.exe</span> that =
was introduced when mitigating against symlink quarantine =
attacks.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Fixed behavior of <span =
style=3D"max-width: 100%;" class=3D"">freshclam --quiet</span> option. =
Patch courtesy of Reio Remma.</li></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Fixed behavior of =
<span style=3D"max-width: 100%;" class=3D"">freshclam</span>'s <span =
style=3D"max-width: 100%;" class=3D"">OnUpdateExecute</span>, <span =
style=3D"max-width: 100%;" class=3D"">OnErrorExecute</span>, =
and <span style=3D"max-width: 100%;" =
class=3D"">OnOutdatedExecute</span> config options on Windows when in =
daemon-mode so it can handle multiple arguments. Patch =
courtesy of Zachary Murden.</li></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Fixed an error in =
the heuristic alert mechanism that would cause a single detection =
within an archive to alert once for every subsequent file =
scanned, potentially resulting in thousands of alerts for a single =
scan.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Fixed clamd, clamav-milter, and =
freshclam to create PID files before dropping privileges, to avoid =
the possibility of an unprivileged user from changing the PID file =
so that a service manager will kill a different process. This =
change does make the services unable to clean up the PID file on =
exit.</li></ul><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Fixed the false positive (<span =
style=3D"max-width: 100%;" class=3D"">.fp</span>) signature feature. In =
prior versions, the hash in a false positive signature would be =
checked only against the current layer of a file being scanned. In =
0.103, every file layer is hashed, and the hashes for each in the =
scan recursion list are checked. This ensures that <span =
style=3D"max-width: 100%;" class=3D"">.fp</span> signatures containing a =
hash for any layer in the scan leading up to the alert will negate =
the alert.</li><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">As an example, a hash for a zip =
containing the file which alerts would not prevent the detection in =
prior versions. Only the hash of the embedded file would work. For =
some file types where the outermost is always an archive, eg. docx =
files, this made <span style=3D"max-width: 100%;" class=3D"">.fp</span> =
signatures next to useless. For certain file types where the =
scanned content was a normalized version of the original content, =
eg. HTML, the normalized version was never hashed and this =
meant that <span style=3D"max-width: 100%;" class=3D"">.fp</span> =
signatures never worked.</li></ul></ul><ul style=3D"max-width: 100%;" =
class=3D""><li style=3D"max-width: 100%;" class=3D"">Fixed Trusted & =
Revoked Windows executable (PE) file signature rules (<span =
style=3D"max-width: 100%;" class=3D"">.crb</span>) maximum =
functionality level (FLEVEL) which had been being treated as =
the minimum FLEVEL. These signatures enable ClamAV to trust =
executables that are digitally signed by trusted publishers, or to =
alert on executables signed with compromised signing-certificates. =
The minimum and maximum FLEVELS enable or disable signatures at =
load time depending on the current ClamAV version.</li></ul><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Fixed a bug wherein you could not build ClamAV with <span =
style=3D"max-width: 100%;" class=3D"">--enable-libclamav-only</span> if =
curl was not installed on the system.</li></ul><ul style=3D"max-width: =
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">Various =
other bug fixes, improvements, and documentation =
improvements.</li></ul> <h3 style=3D"font-size: 1.25em; max-width: =
100%;" class=3D"">New Requirements</h3><div style=3D"max-width: 100%;" =
class=3D""><br class=3D"webkit-block-placeholder"></div><ul =
style=3D"max-width: 100%;" class=3D""><li style=3D"max-width: 100%;" =
class=3D"">Autotools (<span style=3D"max-width: 100%;" =
class=3D"">automake</span>, <span style=3D"max-width: 100%;" =
class=3D"">autoconf</span>, <span style=3D"max-width: 100%;" =
class=3D"">m4</span>, <span style=3D"max-width: 100%;" =
class=3D"">pkg-config</span>, <span style=3D"max-width: 100%;" =
class=3D"">libtool</span>) are now required in order to build from =
a Git clone because the files generated by these tools have been =
removed from the Git repository. To generate theses files =
before you compile ClamAV, run <span style=3D"max-width: 100%;" =
class=3D"">autogen.sh</span>. Users building with Autotools from =
the release tarball should be unaffected.</li></ul><ul style=3D"max-width:=
100%;" class=3D""><li style=3D"max-width: 100%;" class=3D"">Flex and =
Bison are now required in order to build from a Git clone. Flex and =
Bison are also required to build with CMake. Users building with =
Autotools from the release tarball should be =
unaffected.</li></ul> <h3 style=3D"font-size: 1.25em; max-width: =
100%;" class=3D"">Acknowledgements</h3><p style=3D"max-width: 100%;" =
class=3D"">The ClamAV team thanks the following individuals for their =
code submissions:</p><ul style=3D"max-width: 100%;" class=3D""><li =
style=3D"max-width: 100%;" class=3D"">Aldo Mazzeo</li><li =
style=3D"max-width: 100%;" class=3D"">=C3=81ngel</li><li =
style=3D"max-width: 100%;" class=3D"">Antonino Cangialosi</li><li =
style=3D"max-width: 100%;" class=3D"">Clement Lecigne</li><li =
style=3D"max-width: 100%;" class=3D"">Jamie Biggar</li><li =
style=3D"max-width: 100%;" class=3D"">Jan Smutny</li><li =
style=3D"max-width: 100%;" class=3D"">John Schember</li><li =
style=3D"max-width: 100%;" class=3D"">Jonathan Sabbe</li><li =
style=3D"max-width: 100%;" class=3D"">lutianxiong</li><li =
style=3D"max-width: 100%;" class=3D"">Reio Remma</li><li =
style=3D"max-width: 100%;" class=3D"">Sebastian A. Siewior</li><li =
style=3D"max-width: 100%;" class=3D"">Zachary =
Murden </li></ul></div></div></div></blockquote></div></body></html>=
--Apple-Mail=_431BD869-28D5-4DE5-94FD-662E22811A61--
--Apple-Mail=_C478E7B8-CE0A-4E49-AC5C-B9E85E72E66E
Content-Disposition: attachment; filename="smime.p7s"
Content-Type: application/pkcs7-signature;
name=smime.p7s
Content-Transfer-Encoding: base64
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCRYw
ggRuMIIDVqADAgECAgphEIBtAAAAAAAOMA0GCSqGSIb3DQEBBQUAMDUxFjAUBgNVBAoTDUNpc2Nv
IFN5c3RlbXMxGzAZBgNVBAMTEkNpc2NvIFJvb3QgQ0EgMjA0ODAeFw0xNDA0MDQyMDI0MThaFw0y
OTA1MTQyMDI1NDJaMCwxDjAMBgNVBAoTBUNpc2NvMRowGAYDVQQDExFDaXNjbyBFbXBsb3llZSBD
QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMrffhZMUxX7I1bNxrllCgSV5d5MRWeM
DMcG4KsfbV83Knvn7aOtgH8RyPOC6+6fUNnJvz2hL7s8EQc177il2VFO2bD3U6CUgCwskmWtEG+h
hmtfQAqZpVBEGpBNz+ZM+0YGjUjjB9fhrWPX1egnABW/bgeyQ7tlBi999lldmxLFLH2960SwUuHC
/B7tnVn3HZOnqzGmQkI5J9OBYsZULCaM2z0U0KiOFeoopBv+vaw8nk3W1UyvjMv/S58FbA9xgTIk
Ye0Zq77qcbRojLvI9OSLP3dTon4VnnML41d0XoPS6JPGzDSRDAKXndcHk3VUtF+DLAIXqLCQZXfZ
UuTuIncCAwEAAaOCAYcwggGDMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBSflTa0jl3VS8MK
wacpk0NRBv2JUTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwEgYDVR0T
AQH/BAgwBgEB/wIBADAfBgNVHSMEGDAWgBQn88gVHm6aAgkWrSugiWBf2nsvqjBDBgNVHR8EPDA6
MDigNqA0hjJodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY3JsL2NyY2EyMDQ4LmNy
bDBQBggrBgEFBQcBAQREMEIwQAYIKwYBBQUHMAKGNGh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3Vy
aXR5L3BraS9jZXJ0cy9jcmNhMjA0OC5jZXIwXAYDVR0gBFUwUzBRBgorBgEEAQkVARUAMEMwQQYI
KwYBBQUHAgEWNWh0dHA6Ly93d3cuY2lzY28uY29tL3NlY3VyaXR5L3BraS9wb2xpY2llcy9pbmRl
eC5odG1sMA0GCSqGSIb3DQEBBQUAA4IBAQA+Tr4jGkYCjV5r24oCNAtjm+UBPCZdjHCyJOtgXuyK
hGQuG1kVo2ca4Rbj/eBNfUSaIyjS7bb3oh/nRM3tbeqGIVQorGxhvPvIZVAEQIoqi/yfbhie9cU+
paKpHACucaYXu0kyS0pYE5NMNun3Lw3ogOs4XVR5yoVSpKTiVnfTDQchTpwkMgzivqXDcS1OiDfU
8C9WaEZHRWtdUIgl9zoppPGIQa1TflcxhirW4GeH2FOrgaN1d77bIcg6R7RpJ9Xu3/f01nGNunrR
cy993c2meJQoZcOJd15C6ugHwhAxeXY6QXYgkY8KQVCCGwkpshEgbwPrC+I/Itb6P7hGq7awMIIE
oDCCA4igAwIBAgIKAYYRaDD7OEqcKzANBgkqhkiG9w0BAQsFADAsMQ4wDAYDVQQKEwVDaXNjbzEa
MBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0EwHhcNMTgxMTIxMDAwMDAwWhcNMjAxMTIwMDAxMDAw
WjCBlTEcMBoGA1UEAxMTSm9lbCBFc2xlciAoamVzbGVyKTEUMBIGA1UECxMLQ2lzY28gVXNlcnMx
EjAQBgNVBAsTCUVtcGxveWVlczETMBEGCgmSJomT8ixkARkTA2NvbTEVMBMGCgmSJomT8ixkARkT
BWNpc2NvMR8wHQYJKoZIhvcNAQkBDBBqZXNsZXJAY2lzY28uY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAjY9Yo3zw0WCxtdtE4oQyXJqoSbeuJULMuLBbZbmalv2w7vNluXG9Qhsh
7zttHIU+z1j0XpG2BnYZMl4AgO23yOyghTAo5u8hBH9Riox9bw0hRkB/pAE89QeZ+1kNOGLuZfN8
B5sTFFmRTztX+TZtIkFONq7q9Wj+h0P5ikvyCgr3tjsbnJRNVSAynEfWGFxIxAGyEYIGMHeSz1ej
SenHps4yI8qTKsX9o3KLRz1nLucUDpm/TCLbQEI87Uv9Phd2v0FptbWUKik9agDjTW4/Q7PjBTPc
OpXem/8w8H9S7TKa248Opt2Nv24oqJZMVAUu6It9oQZWubO0bsYYp8yiDQIDAQABo4IBWDCCAVQw
DgYDVR0PAQH/BAQDAgTwMAwGA1UdEwEB/wQCMAAwegYIKwYBBQUHAQEEbjBsMDwGCCsGAQUFBzAC
hjBodHRwOi8vd3d3LmNpc2NvLmNvbS9zZWN1cml0eS9wa2kvY2VydHMvY2VjYS5jZXIwLAYIKwYB
BQUHMAGGIGh0dHA6Ly9wa2ljdnMuY2lzY28uY29tL3BraS9vY3NwMB8GA1UdIwQYMBaAFJ+VNrSO
XdVLwwrBpymTQ1EG/YlRMDoGA1UdHwQzMDEwL6AtoCuGKWh0dHA6Ly9jaXNjb2NlcnRzLmNpc2Nv
LmNvbS9maWxlL2NlY2EuY3JsMBsGA1UdEQQUMBKBEGplc2xlckBjaXNjby5jb20wHQYDVR0OBBYE
FDTmAUtoBuQRY6GKIvCllZGSohm5MB8GA1UdJQQYMBYGCisGAQQBgjcKAwwGCCsGAQUFBwMEMA0G
CSqGSIb3DQEBCwUAA4IBAQA3p6fJ3fQlcqszfVLrike+NXunUtbNejhKDOPMhVc3bsozBPggAZbo
m62BvhsvgVLj/+IS2qIEflQxhS2ToplJi8nXRpZ9Qtsu4mhCByy0Z0Xtaw0v2f78B1pskPxDdXZm
T47sc84h0iW+wuZ4yADZb2azb+2j7GNd/vdPLnVyDE209ksjrYyYNO7LifZqmSqIipBYOyG3JZ25
BMTQP7ttExfRKbrkRFSHapvISiFoBeakwGRSqiF7aTAnilXm0Kp1Aj6cQH0Ju3xgXSUpxQewDvZm
Q+AYG6sV6V0yy4fwa1UQAOVKH0dadXp1z9K5WcrqC8Wqz0ojBLT/Avhfy3sXMYICajCCAmYCAQEw
OjAsMQ4wDAYDVQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhK
nCswDQYJYIZIAWUDBAIBBQCgggEBMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN
AQkFMQ8XDTIwMDgxODIxNTcyM1owLwYJKoZIhvcNAQkEMSIEIB72upvleW1+J7jUeV6qN+Qzpmcv
eBLMFuT2aWngkOzpMEkGCSsGAQQBgjcQBDE8MDowLDEOMAwGA1UEChMFQ2lzY28xGjAYBgNVBAMT
EUNpc2NvIEVtcGxveWVlIENBAgoBhhFoMPs4SpwrMEsGCyqGSIb3DQEJEAILMTygOjAsMQ4wDAYD
VQQKEwVDaXNjbzEaMBgGA1UEAxMRQ2lzY28gRW1wbG95ZWUgQ0ECCgGGEWgw+zhKnCswDQYJKoZI
hvcNAQEBBQAEggEAQq6IffDRgjZP8FiH3AyyJI9ifzNGgfb4N6i9VAfjoTKRALjv/9aqn8KoCAqN
zHpkqJuffnVg8ohhIt0i+yuR8fR3CPpOmyjd1TnSM6uuiAorRrKaGIclb15Y5XyIhO8Dn/Dm4Ijq
V4FRcCDKXWwNLyq26CUYxZonkFqmB4lhl7hcioH//p/VduGaU/cV3Vb6mikEhraNaZvRDdiahkB0
SBYj9S4GYtNoMzhHmqtvHK0brws8WHDwssICdNsmuwOO8/T/1yj+xscRzZVDc+XxWJioIywUdlWu
4RONmJrwHk0TDkD1z4qcuT4i+XODEMCGF7L5kuPZOiXlyvjc36WIuwAAAAAAAA==
--Apple-Mail=_C478E7B8-CE0A-4E49-AC5C-B9E85E72E66E--
--===============6867180856609135793==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce
http://www.clamav.net/contact.html#ml
--===============6867180856609135793==--