ClamAV® blog: ClamAV 0.10 3.4 and 0.104.1 patch releases
"Joel Esler (jesler)" <[email protected]> Wed, 3 Nov 2021 20:38:03 +0000
| Newsgroups | gmane.comp.security.virus.clamav.announce,gmane.comp.security.virus.clamav.win32,gmane.comp.security.virus.clamav.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============1328718962372993416==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_BB1AFC9982544C94B2E973056E4AB919ciscocom_"
--_000_BB1AFC9982544C94B2E973056E4AB919ciscocom_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
https://blog.clamav.net/2021/11/clamav-01034-and-01041-patch-releases.html
ClamAV 0.103.4 and 0.104.1 patch releases
ClamAV 0.103.4 LTS and 0.104.1 patch versions are out now. Both of these ca=
n be found on clamav.net/downloads<http://clamav.net/downloads>, with 0.104=
.1 as the main release and 0.103.4 under "Previous Stable Releases."
0.103.4
ClamAV 0.103.4 is a critical patch release with the following fixes:
* FreshClam:
* Add a 24-hour cool-down for FreshClam clients that have received a=
n HTTP 403 (Forbidden) response from the CDN. This is to reduce the volume =
of 403-response data served to blocked FreshClam clients that are configure=
d with a tight update-loop.
* Fixed a bug where FreshClam treats an empty CDIFF as an incrementa=
l update failure instead of as an intentional request to download the whole=
CVD.
* ClamDScan: Fix a scan error when broken symlinks are encountered on m=
acOS with "FollowDirectorySymlinks" and "FollowFileSymlinks" options disabl=
ed.
* Overhauled the scan recursion / nested archive extraction logic and a=
dded new limits on embedded file-type recognition performed during the "raw=
" scan of each file. This limits embedded file-type misidentification and p=
revents detecting embedded file content that is found/extracted and scanned=
at other layers in the scanning process.
* Fix an issue with the FMap module that failed to read from some neste=
d files.
* Fixed an issue where failing to load some rules from a Yara file cont=
aining multiple rules may cause a crash.
* Fixed assorted compiler warnings.
* Fixed assorted Coverity static code analysis issues.
* Scan limits:
* Added virus-name suffixes to the alerts that trigger when a scan l=
imit has been exceeded. Rather than simply Heuristics.Limits.Exceeded, you =
may now see limit-specific virus-names, to include:
* Heuristics.Limits.Exceeded.MaxFileSize
* Heuristics.Limits.Exceeded.MaxScanSize
* Heuristics.Limits.Exceeded.MaxFiles
* Heuristics.Limits.Exceeded.MaxRecursion
* Heuristics.Limits.Exceeded.MaxScanTime
* Renamed the Heuristics.Email.ExceedsMax.* alerts to align with the=
other limit alerts names. These alerts include:
* Heuristics.Limits.Exceeded.EmailLineFoldcnt
* Heuristics.Limits.Exceeded.EmailHeaderBytes
* Heuristics.Limits.Exceeded.EmailHeaders
* Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
* Heuristics.Limits.Exceeded.EmailMIMEArguments
* Fixed an issue where the Email-related scan limits would alert eve=
n when the "AlertExceedsMax" (--alert-exceeds-max) scan option is not enabl=
ed.
* Fixes an issue in the Zip parser where exceeding the "MaxFiles" li=
mit or the "MaxFileSize" limit would abort the scan but would fail to alert=
. The Zip scan limit issues were independently identified and reported by A=
aron Leliaert and Max Allan.
* Fixed a leak in the Email parser when using the --gen-json scan optio=
n.
* Fixed an issue where a failure to record metadata in the Email parser=
when using the --gen-json scan option could cause the Email parser to abor=
t the scan early and fail to extract and scan additional content.
* Fixed a file name memory leak in the Zip parser.
* Fixed an issue where certain signature patterns may cause a crash or =
cause unintended matches on some systems when converting characters to uppe=
rcase if a UTF-8 unicode single-byte grapheme becomes a multi-byte grapheme=
. Patch courtesy of Andrea De Pasquale.
Other fixes backported from 0.104.0:
* Fixed a crash in programs that use libclamav when the programs don't =
set a callback for the "virus found" event. Patch courtesy of Markus Strehl=
e.
* Added checks to the the SIS archive parser to prevent an SIS file ent=
ry from pointing to the archive, which would result in a loop. This was not=
an actual infinite loop, as ClamAV's scan recursion limit limits the depth=
of nested archive extraction.
* ClamOnAcc: Fixed a socket file descriptor leak that could result in a=
crash when all available file descriptors are exhausted.
* FreshClam: Fixed an issue where FreshClam would download a CVD repeat=
edly if a zero-byte CDIFF is downloaded or if the incremental update failed=
and if the CVD downloaded after that is older than advertised. Patch court=
esy of Andrew Williams.
* ClamDScan:
* Fixed a memory leak of the scan target filename when using the --f=
dpass or --stream options.
* Fixed an issue where ClamDScan would fail to scan any file after e=
xcluding a file with the "ExcludePath" option when using when using the --m=
ultiscan (-m) option along with either --fdpass or --stream. Also fixed a m=
emory leak of the accidentally-excluded paths in this case.
* Fixed a single file path memory leak when using --fdpass.
* Fixed an issue where the "ExcludePath" regex may fail to exclude a=
bsolute paths when the scan is invoked with a relative path.
Special thanks to the following for code contributions and bug reports:
* Aaron Leliaert
* Andrea De Pasquale
* Andrew Williams
* Markus Strehle
* Max Allan
0.104.1
ClamAV 0.104.1 is a critical patch release with the following fixes:
* FreshClam:
* Add a 24-hour cool-down for FreshClam clients that have received a=
n HTTP 403 (Forbidden) response from the CDN. This is to reduce the volume =
of 403-response data served to blocked FreshClam clients that are configure=
d with a tight update-loop.
* Fixed a bug where FreshClam treats an empty CDIFF as an incrementa=
l update failure instead of as an intentional request to download the whole=
CVD.
* ClamDScan: Fix a scan error when broken symlinks are encountered on m=
acOS with "FollowDirectorySymlinks" and "FollowFileSymlinks" options disabl=
ed.
* Overhauled the scan recursion / nested archive extraction logic and a=
dded new limits on embedded file-type recognition performed during the "raw=
" scan of each file. This limits embedded file-type misidentification and p=
revents detecting embedded file content that is found/extracted and scanned=
at other layers in the scanning process.
* Fix an issue with the FMap module that failed to read from some neste=
d files.
* Fixed an issue where failing to load some rules from a Yara file cont=
aining multiple rules may cause a crash.
* Fixed assorted compiler warnings.
* Fixed assorted Coverity static code analysis issues.
* Scan limits:
* Added virus-name suffixes to the alerts that trigger when a scan l=
imit has been exceeded. Rather than simply Heuristics.Limits.Exceeded, you =
may now see limit-specific virus-names, to include:
* Heuristics.Limits.Exceeded.MaxFileSize
* Heuristics.Limits.Exceeded.MaxScanSize
* Heuristics.Limits.Exceeded.MaxFiles
* Heuristics.Limits.Exceeded.MaxRecursion
* Heuristics.Limits.Exceeded.MaxScanTime
* Renamed the Heuristics.Email.ExceedsMax.* alerts to align with the=
other limit alerts names. These alerts include:
* Heuristics.Limits.Exceeded.EmailLineFoldcnt
* Heuristics.Limits.Exceeded.EmailHeaderBytes
* Heuristics.Limits.Exceeded.EmailHeaders
* Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
* Heuristics.Limits.Exceeded.EmailMIMEArguments
* Fixed an issue where the Email-related scan limits would alert eve=
n when the "AlertExceedsMax" (--alert-exceeds-max) scan option is not enabl=
ed.
* Fixes an issue in the Zip parser where exceeding the "MaxFiles" li=
mit or the "MaxFileSize" limit would abort the scan but would fail to alert=
. The Zip scan limit issues were independently identified and reported by A=
aron Leliaert and Max Allan.
* Fixed a leak in the Email parser when using the --gen-json scan optio=
n.
* Fixed an issue where a failure to record metadata in the Email parser=
when using the --gen-json scan option could cause the Email parser to abor=
t the scan early and fail to extract and scan additional content.
* Fixed a file name memory leak in the Zip parser.
* Fixed an issue where certain signature patterns may cause a crash or =
cause unintended matches on some systems when converting characters to uppe=
rcase if a UTF-8 unicode single-byte grapheme becomes a multi-byte grapheme=
. Patch courtesy of Andrea De Pasquale.
* CMake:
* Fix a packaging issue with the Windows *.msi installer so that it =
will include all of the required files.
* Add support for developer code-signing on macOS during the build.
* Fix an issue finding and linking with the tinfo library on systems=
where tinfo is separate from ncurses. Patch courtesy of Luca Barbato.
* Tests: Improved the Freshclam incremental update tests to verify corr=
ect behavior when a zero-byte CDIFF is downloaded and the CVD served to Fre=
shClam is older than advertised.
* Docker: Remove the freshclam.dat file when building the Docker image =
with the databases-included so FreshClam agents running in the container wi=
ll have a unique ID in the HTTP User-Agent.
Special thanks to the following for code contributions and bug reports:
* Aaron Leliaert
* Andrea De Pasquale
* Luca Barbato
* Max Allan
--_000_BB1AFC9982544C94B2E973056E4AB919ciscocom_
Content-Type: text/html; charset="iso-8859-1"
Content-ID: <[email protected]>
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<base href=3D"about:blank">
</head>
<body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; line-break:=
after-white-space;" class=3D"">
<base href=3D"about:blank" class=3D"">
<div class=3D"Apple-Mail-URLShareUserContentTopClass"><br class=3D"">
</div>
<div class=3D"Apple-Mail-URLShareWrapperClass">
<blockquote type=3D"cite" style=3D"border-left-style: none; color: inherit;=
padding: inherit; margin: inherit;" class=3D"">
<div class=3D"">
<div class=3D"original-url"><br class=3D"">
<a href=3D"https://blog.clamav.net/2021/11/clamav-01034-and-01041-patch-rel=
eases.html" class=3D"">https://blog.clamav.net/2021/11/clamav-01034-and-010=
41-patch-releases.html</a><br class=3D"">
<br class=3D"">
</div>
<div id=3D"article" role=3D"article" style=3D"-webkit-locale: "en"=
;; text-rendering: optimizeLegibility; font-family: -apple-system-font; fon=
t-size: 1.2em; line-height: 1.5em; margin: 0px; padding: 0px;" class=3D"sys=
tem exported">
<!-- This node will contain a number of div.page. -->
<div class=3D"page" style=3D"word-wrap: break-word; max-width: 100%;">
<h1 class=3D"title" style=3D"font-size: 1.95552em; line-height: 1.2141em; m=
argin-top: 0px; margin-bottom: 0.5em; max-width: 100%;">
ClamAV 0.103.4 and 0.104.1 patch releases</h1>
<p style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" c=
lass=3D"">ClamAV 0.103.4 LTS and 0.104.1 patch versions are out now.
<span style=3D"max-width: 100%;" class=3D"">Both of these can be found on <=
/span></span><span style=3D"max-width: 100%;" class=3D""><span style=3D"max=
-width: 100%;" class=3D""><span style=3D"max-width: 100%;" class=3D""><a hr=
ef=3D"http://clamav.net/downloads" target=3D"_blank" style=3D"color: rgb(73=
, 129, 254); max-width: 100%;" class=3D"">clamav.net/downloads</a></span></=
span>,
with 0.104.1 as the main release and 0.103.4 under "Previous Stable R=
eleases."</span></p>
<p style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" c=
lass=3D""><br style=3D"max-width: 100%;" class=3D"">
</span></p>
<h3 data-line=3D"5" style=3D"font-size: 1.25em; max-width: 100%;" class=3D"=
"><span style=3D"max-width: 100%;" class=3D"">0.103.4</span></h3>
<p data-line=3D"7" style=3D"max-width: 100%;" class=3D""><span style=3D"max=
-width: 100%;" class=3D"">ClamAV 0.103.4 is a critical patch release with t=
he following fixes:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"9" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"9" style=3D"max-width: 100%;" class=3D""><span style=3D"max=
-width: 100%;" class=3D"">FreshClam:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"10" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Add a 24-hour cool-down for FreshClam clients t=
hat have received an HTTP 403 (Forbidden) response from the CDN. This is to=
reduce the volume of 403-response data served
to blocked FreshClam clients that are configured with a tight update-loop.=
</span></li><li data-line=3D"14" style=3D"max-width: 100%;" class=3D""><spa=
n style=3D"max-width: 100%;" class=3D"">Fixed a bug where FreshClam treats =
an empty CDIFF as an incremental update failure instead of as an intentiona=
l request to download the whole CVD.</span></li></ul>
</li><li data-line=3D"17" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"17" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">ClamDScan: Fix a scan error when broken symlinks=
are encountered on macOS with "FollowDirectorySymlinks" and &quo=
t;FollowFileSymlinks" options disabled.</span></p>
</li><li data-line=3D"20" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"20" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Overhauled the scan recursion / nested archive e=
xtraction logic and added new limits on embedded file-type recognition perf=
ormed during the "raw" scan of each file.
This limits embedded file-type misidentification and prevents detecting em=
bedded file content that is found/extracted and scanned at other layers in =
the scanning process.</span></p>
</li><li data-line=3D"26" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"26" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fix an issue with the FMap module that failed to=
read from some nested files.</span></p>
</li><li data-line=3D"28" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"28" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed an issue where failing to load some rules =
from a Yara file containing multiple rules may cause a crash.</span></p>
</li><li data-line=3D"31" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"31" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed assorted compiler warnings.</span></p>
</li><li data-line=3D"33" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"33" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed assorted Coverity static code analysis iss=
ues.</span></p>
</li><li data-line=3D"35" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"35" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Scan limits:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"36" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Added virus-name suffixes to the alerts that tr=
igger when a scan limit has been exceeded. Rather than simply<span style=3D=
"max-width: 100%;" class=3D""> </span><code style=3D"max-width: 100%;"=
class=3D"">Heuristics.Limits.Exceeded</code>,
you may now see limit-specific virus-names, to include:</span>
<ul class=3D"code-block" style=3D"max-width: 100%;">
<li data-line=3D"39" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D""><code style=3D"max-width: 100%;" class=3D"">Heu=
ristics.Limits.Exceeded.MaxFileSize</code></span></li><li data-line=3D"40" =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" clas=
s=3D""><code style=3D"max-width: 100%;" class=3D"">Heuristics.Limits.Exceed=
ed.MaxScanSize</code></span></li><li data-line=3D"41" style=3D"max-width: 1=
00%;" class=3D""><span style=3D"max-width: 100%;" class=3D""><code style=3D=
"max-width: 100%;" class=3D"">Heuristics.Limits.Exceeded.MaxFiles</code></s=
pan></li><li data-line=3D"42" style=3D"max-width: 100%;" class=3D""><span s=
tyle=3D"max-width: 100%;" class=3D""><code style=3D"max-width: 100%;" class=
=3D"">Heuristics.Limits.Exceeded.MaxRecursion</code></span></li><li data-li=
ne=3D"43" style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 1=
00%;" class=3D""><code style=3D"max-width: 100%;" class=3D"">Heuristics.Lim=
its.Exceeded.MaxScanTime</code></span></li></ul>
</li><li data-line=3D"44" style=3D"max-width: 100%;" class=3D""><span style=
=3D"max-width: 100%;" class=3D"">Renamed the<span style=3D"max-width: 100%;=
" class=3D""> </span><code style=3D"max-width: 100%;" class=3D"">Heuri=
stics.Email.ExceedsMax.*</code> alerts to align with the other
limit alerts names. These alerts include:</span>
<ul class=3D"code-block" style=3D"max-width: 100%;">
<li data-line=3D"46" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D""><code style=3D"max-width: 100%;" class=3D"">Heu=
ristics.Limits.Exceeded.EmailLineFoldcnt</code></span></li><li data-line=3D=
"47" style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;"=
class=3D""><code style=3D"max-width: 100%;" class=3D"">Heuristics.Limits.E=
xceeded.EmailHeaderBytes</code></span></li><li data-line=3D"48" style=3D"ma=
x-width: 100%;" class=3D""><span style=3D"max-width: 100%;" class=3D""><cod=
e style=3D"max-width: 100%;" class=3D"">Heuristics.Limits.Exceeded.EmailHea=
ders</code></span></li><li data-line=3D"49" style=3D"max-width: 100%;" clas=
s=3D""><span style=3D"max-width: 100%;" class=3D""><code style=3D"max-width=
: 100%;" class=3D"">Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage</co=
de></span></li><li data-line=3D"50" style=3D"max-width: 100%;" class=3D""><=
span style=3D"max-width: 100%;" class=3D""><code style=3D"max-width: 100%;"=
class=3D"">Heuristics.Limits.Exceeded.EmailMIMEArguments</code></span></li=
></ul>
</li><li data-line=3D"51" style=3D"max-width: 100%;" class=3D""><span style=
=3D"max-width: 100%;" class=3D"">Fixed an issue where the Email-related sca=
n limits would alert even when the "AlertExceedsMax" (<code style=
=3D"max-width: 100%;" class=3D"">--alert-exceeds-max</code>)
scan option is not enabled.</span></li><li data-line=3D"53" style=3D"max-w=
idth: 100%;" class=3D""><span style=3D"max-width: 100%;" class=3D"">Fixes a=
n issue in the Zip parser where exceeding the "MaxFiles" limit or=
the "MaxFileSize" limit would abort the scan but would fail to a=
lert. The Zip scan limit issues
were independently identified and reported by Aaron Leliaert and Max Allan=
.</span></li></ul>
</li><li data-line=3D"58" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"58" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed a leak in the Email parser when using the<=
span style=3D"max-width: 100%;" class=3D""> </span><code style=3D"max-=
width: 100%;" class=3D"">--gen-json</code> scan option.</span></p>
</li><li data-line=3D"60" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"60" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed an issue where a failure to record metadat=
a in the Email parser when using the<span style=3D"max-width: 100%;" class=
=3D""> </span><code style=3D"max-width: 100%;" class=3D"">--gen-json</=
code> scan
option could cause the Email parser to abort the scan early and fail to ex=
tract and scan additional content.</span></p>
</li><li data-line=3D"64" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"64" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed a file name memory leak in the Zip parser.=
</span></p>
</li><li data-line=3D"66" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"66" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed an issue where certain signature patterns =
may cause a crash or cause unintended matches on some systems when converti=
ng characters to uppercase if a UTF-8 unicode
single-byte grapheme becomes a multi-byte grapheme. Patch courtesy of Andr=
ea De Pasquale.</span></p>
</li></ul>
<p data-line=3D"71" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Other fixes backported from 0.104.0:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"73" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"73" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed a crash in programs that use libclamav whe=
n the programs don't set a callback for the "virus found" event. =
Patch courtesy of Markus Strehle.</span></p>
</li><li data-line=3D"77" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"77" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Added checks to the the SIS archive parser to pr=
event an SIS file entry from pointing to the archive, which would result in=
a loop. This was not an actual infinite loop,
as ClamAV's scan recursion limit limits the depth of nested archive extrac=
tion.</span></p>
</li><li data-line=3D"82" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"82" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">ClamOnAcc: Fixed a socket file descriptor leak t=
hat could result in a crash when all available file descriptors are exhaust=
ed.</span></p>
</li><li data-line=3D"85" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"85" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">FreshClam: Fixed an issue where FreshClam would =
download a CVD repeatedly if a zero-byte CDIFF is downloaded or if the incr=
emental update failed and if the CVD downloaded
after that is older than advertised. Patch courtesy of Andrew Williams.</s=
pan></p>
</li><li data-line=3D"90" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"90" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">ClamDScan:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"91" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Fixed a memory leak of the scan target filename=
when using the<span style=3D"max-width: 100%;" class=3D""> </span><co=
de style=3D"max-width: 100%;" class=3D"">--fdpass</code><span style=3D"max-=
width: 100%;" class=3D""> </span>or<span style=3D"max-width: 100%;" cl=
ass=3D""> </span><code style=3D"max-width: 100%;" class=3D"">--stream<=
/code><span style=3D"max-width: 100%;" class=3D""> </span>options.</sp=
an></li><li data-line=3D"93" style=3D"max-width: 100%;" class=3D""><span st=
yle=3D"max-width: 100%;" class=3D"">Fixed an issue where ClamDScan would fa=
il to scan any file after excluding a file with the "ExcludePath"=
option when using when using the<span style=3D"max-width: 100%;" class=3D"=
"> </span><code style=3D"max-width: 100%;" class=3D"">--multiscan</cod=
e><span style=3D"max-width: 100%;" class=3D""> </span>(<code style=3D"=
max-width: 100%;" class=3D"">-m</code>)
option along with either<span style=3D"max-width: 100%;" class=3D""> =
</span><code style=3D"max-width: 100%;" class=3D"">--fdpass</code><span sty=
le=3D"max-width: 100%;" class=3D""> </span>or<span style=3D"max-width:=
100%;" class=3D""> </span><code style=3D"max-width: 100%;" class=3D""=
>--stream</code>.
Also fixed a memory leak of the accidentally-excluded paths in this case.<=
/span></li><li data-line=3D"97" style=3D"max-width: 100%;" class=3D""><span=
style=3D"max-width: 100%;" class=3D"">Fixed a single file path memory leak=
when using<span style=3D"max-width: 100%;" class=3D""> </span><code s=
tyle=3D"max-width: 100%;" class=3D"">--fdpass</code>.</span></li><li data-l=
ine=3D"98" style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: =
100%;" class=3D"">Fixed an issue where the "ExcludePath" regex ma=
y fail to exclude absolute paths when the scan is invoked with a relative p=
ath.</span></li></ul>
</li></ul>
<p data-line=3D"101" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Special thanks to the following for code contri=
butions and bug reports:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"102" style=3D"max-width: 100%;" class=3D""><span style=3D"=
max-width: 100%;" class=3D"">Aaron Leliaert</span></li><li data-line=3D"103=
" style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" cl=
ass=3D"">Andrea De Pasquale</span></li><li data-line=3D"104" style=3D"max-w=
idth: 100%;" class=3D""><span style=3D"max-width: 100%;" class=3D"">Andrew =
Williams</span></li><li data-line=3D"105" style=3D"max-width: 100%;" class=
=3D""><span style=3D"max-width: 100%;" class=3D"">Markus Strehle</span></li=
><li data-line=3D"106" style=3D"max-width: 100%;" class=3D""><span style=3D=
"max-width: 100%;" class=3D"">Max Allan</span></li></ul>
<div style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;"=
class=3D""> </span><br class=3D"webkit-block-placeholder">
</div>
<h3 data-line=3D"5" style=3D"font-size: 1.25em; max-width: 100%;" class=3D"=
"><span style=3D"max-width: 100%;" class=3D"">0.104.1</span></h3>
<p data-line=3D"7" style=3D"max-width: 100%;" class=3D""><span style=3D"max=
-width: 100%;" class=3D"">ClamAV 0.104.1 is a critical patch release with t=
he following fixes:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"9" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"9" style=3D"max-width: 100%;" class=3D""><span style=3D"max=
-width: 100%;" class=3D"">FreshClam:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"10" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Add a 24-hour cool-down for FreshClam clients t=
hat have received an HTTP 403 (Forbidden) response from the CDN. This is to=
reduce the volume of 403-response data served
to blocked FreshClam clients that are configured with a tight update-loop.=
</span></li><li data-line=3D"14" style=3D"max-width: 100%;" class=3D""><spa=
n style=3D"max-width: 100%;" class=3D"">Fixed a bug where FreshClam treats =
an empty CDIFF as an incremental update failure instead of as an intentiona=
l request to download the whole CVD.</span></li></ul>
</li><li data-line=3D"17" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"17" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">ClamDScan: Fix a scan error when broken symlinks=
are encountered on macOS with "FollowDirectorySymlinks" and &quo=
t;FollowFileSymlinks" options disabled.</span></p>
</li><li data-line=3D"20" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"20" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Overhauled the scan recursion / nested archive e=
xtraction logic and added new limits on embedded file-type recognition perf=
ormed during the "raw" scan of each file.
This limits embedded file-type misidentification and prevents detecting em=
bedded file content that is found/extracted and scanned at other layers in =
the scanning process.</span></p>
</li><li data-line=3D"26" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"26" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fix an issue with the FMap module that failed to=
read from some nested files.</span></p>
</li><li data-line=3D"28" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"28" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed an issue where failing to load some rules =
from a Yara file containing multiple rules may cause a crash.</span></p>
</li><li data-line=3D"31" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"31" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed assorted compiler warnings.</span></p>
</li><li data-line=3D"33" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"33" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed assorted Coverity static code analysis iss=
ues.</span></p>
</li><li data-line=3D"35" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"35" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Scan limits:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"36" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Added virus-name suffixes to the alerts that tr=
igger when a scan limit has been exceeded. Rather than simply<span style=3D=
"max-width: 100%;" class=3D""> </span><code style=3D"max-width: 100%;"=
class=3D"">Heuristics.Limits.Exceeded</code>,
you may now see limit-specific virus-names, to include:</span>
<ul class=3D"code-block" style=3D"max-width: 100%;">
<li data-line=3D"39" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D""><code style=3D"max-width: 100%;" class=3D"">Heu=
ristics.Limits.Exceeded.MaxFileSize</code></span></li><li data-line=3D"40" =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" clas=
s=3D""><code style=3D"max-width: 100%;" class=3D"">Heuristics.Limits.Exceed=
ed.MaxScanSize</code></span></li><li data-line=3D"41" style=3D"max-width: 1=
00%;" class=3D""><span style=3D"max-width: 100%;" class=3D""><code style=3D=
"max-width: 100%;" class=3D"">Heuristics.Limits.Exceeded.MaxFiles</code></s=
pan></li><li data-line=3D"42" style=3D"max-width: 100%;" class=3D""><span s=
tyle=3D"max-width: 100%;" class=3D""><code style=3D"max-width: 100%;" class=
=3D"">Heuristics.Limits.Exceeded.MaxRecursion</code></span></li><li data-li=
ne=3D"43" style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 1=
00%;" class=3D""><code style=3D"max-width: 100%;" class=3D"">Heuristics.Lim=
its.Exceeded.MaxScanTime</code></span></li></ul>
</li><li data-line=3D"44" style=3D"max-width: 100%;" class=3D""><span style=
=3D"max-width: 100%;" class=3D"">Renamed the<span style=3D"max-width: 100%;=
" class=3D""> </span><code style=3D"max-width: 100%;" class=3D"">Heuri=
stics.Email.ExceedsMax.*</code><span style=3D"max-width: 100%;" class=3D"">=
</span>alerts
to align with the other limit alerts names. These alerts include:</span>
<ul class=3D"code-block" style=3D"max-width: 100%;">
<li data-line=3D"46" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D""><code style=3D"max-width: 100%;" class=3D"">Heu=
ristics.Limits.Exceeded.EmailLineFoldcnt</code></span></li><li data-line=3D=
"47" style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;"=
class=3D""><code style=3D"max-width: 100%;" class=3D"">Heuristics.Limits.E=
xceeded.EmailHeaderBytes</code></span></li><li data-line=3D"48" style=3D"ma=
x-width: 100%;" class=3D""><span style=3D"max-width: 100%;" class=3D""><cod=
e style=3D"max-width: 100%;" class=3D"">Heuristics.Limits.Exceeded.EmailHea=
ders</code></span></li><li data-line=3D"49" style=3D"max-width: 100%;" clas=
s=3D""><span style=3D"max-width: 100%;" class=3D""><code style=3D"max-width=
: 100%;" class=3D"">Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage</co=
de></span></li><li data-line=3D"50" style=3D"max-width: 100%;" class=3D""><=
span style=3D"max-width: 100%;" class=3D""><code style=3D"max-width: 100%;"=
class=3D"">Heuristics.Limits.Exceeded.EmailMIMEArguments</code></span></li=
></ul>
</li><li data-line=3D"51" style=3D"max-width: 100%;" class=3D""><span style=
=3D"max-width: 100%;" class=3D"">Fixed an issue where the Email-related sca=
n limits would alert even when the "AlertExceedsMax" (<code style=
=3D"max-width: 100%;" class=3D"">--alert-exceeds-max</code>)
scan option is not enabled.</span></li><li data-line=3D"53" style=3D"max-w=
idth: 100%;" class=3D""><span style=3D"max-width: 100%;" class=3D"">Fixes a=
n issue in the Zip parser where exceeding the "MaxFiles" limit or=
the "MaxFileSize" limit would abort the scan but would fail to a=
lert. The Zip scan limit issues
were independently identified and reported by Aaron Leliaert and Max Allan=
.</span></li></ul>
</li><li data-line=3D"58" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"58" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed a leak in the Email parser when using the<=
span style=3D"max-width: 100%;" class=3D""> </span><code style=3D"max-=
width: 100%;" class=3D"">--gen-json</code><span style=3D"max-width: 100%;" =
class=3D""> </span>scan
option.</span></p>
</li><li data-line=3D"60" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"60" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed an issue where a failure to record metadat=
a in the Email parser when using the<span style=3D"max-width: 100%;" class=
=3D""> </span><code style=3D"max-width: 100%;" class=3D"">--gen-json</=
code><span style=3D"max-width: 100%;" class=3D""> </span>scan
option could cause the Email parser to abort the scan early and fail to ex=
tract and scan additional content.</span></p>
</li><li data-line=3D"64" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"64" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed a file name memory leak in the Zip parser.=
</span></p>
</li><li data-line=3D"66" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"66" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Fixed an issue where certain signature patterns =
may cause a crash or cause unintended matches on some systems when converti=
ng characters to uppercase if a UTF-8 unicode
single-byte grapheme becomes a multi-byte grapheme. Patch courtesy of Andr=
ea De Pasquale.</span></p>
</li><li data-line=3D"71" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"71" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">CMake:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"72" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Fix a packaging issue with the Windows<span sty=
le=3D"max-width: 100%;" class=3D""> </span><code style=3D"max-width: 1=
00%;" class=3D"">*.msi</code><span style=3D"max-width: 100%;" class=3D"">&n=
bsp;</span>installer
so that it will include all of the required files.</span></li><li data-lin=
e=3D"74" style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 10=
0%;" class=3D"">Add support for developer code-signing on macOS during the =
build.</span></li><li data-line=3D"75" style=3D"max-width: 100%;" class=3D"=
"><span style=3D"max-width: 100%;" class=3D"">Fix an issue finding and link=
ing with the<span style=3D"max-width: 100%;" class=3D""> </span><code =
style=3D"max-width: 100%;" class=3D"">tinfo</code><span style=3D"max-width:=
100%;" class=3D""> </span>library
on systems where<span style=3D"max-width: 100%;" class=3D""> </span><=
code style=3D"max-width: 100%;" class=3D"">tinfo</code><span style=3D"max-w=
idth: 100%;" class=3D""> </span>is separate from<span style=3D"max-wid=
th: 100%;" class=3D""> </span><code style=3D"max-width: 100%;" class=
=3D"">ncurses</code>.
Patch courtesy of Luca Barbato.</span></li></ul>
</li><li data-line=3D"78" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"78" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Tests: Improved the Freshclam incremental update=
tests to verify correct behavior when a zero-byte CDIFF is downloaded and =
the CVD served to FreshClam is older than
advertised.</span></p>
</li><li data-line=3D"82" style=3D"max-width: 100%;" class=3D"">
<p data-line=3D"82" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Docker: Remove the<span style=3D"max-width: 100%=
;" class=3D""> </span><code style=3D"max-width: 100%;" class=3D"">fres=
hclam.dat</code><span style=3D"max-width: 100%;" class=3D""> </span>fi=
le
when building the Docker image with the databases-included so FreshClam ag=
ents running in the container will have a unique ID in the HTTP User-Agent.=
</span></p>
</li></ul>
<p data-line=3D"86" style=3D"max-width: 100%;" class=3D""><span style=3D"ma=
x-width: 100%;" class=3D"">Special thanks to the following for code contrib=
utions and bug reports:</span></p>
<ul style=3D"max-width: 100%;" class=3D"">
<li data-line=3D"87" style=3D"max-width: 100%;" class=3D""><span style=3D"m=
ax-width: 100%;" class=3D"">Aaron Leliaert</span></li><li data-line=3D"88" =
style=3D"max-width: 100%;" class=3D""><span style=3D"max-width: 100%;" clas=
s=3D"">Andrea De Pasquale</span></li><li data-line=3D"89" style=3D"max-widt=
h: 100%;" class=3D""><span style=3D"max-width: 100%;" class=3D"">Luca Barba=
to</span></li><li data-line=3D"90" style=3D"max-width: 100%;" class=3D""><s=
pan style=3D"max-width: 100%;" class=3D"">Max Allan</span></li></ul>
</div>
</div>
</div>
</blockquote>
</div>
</body>
</html>
--_000_BB1AFC9982544C94B2E973056E4AB919ciscocom_--
--===============1328718962372993416==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce
http://www.clamav.net/contact.html#ml
--===============1328718962372993416==--