ClamAV 1.4.1, 1.3.2, 1.0.7, and 0.103.12 security patch versions published
"Micah Snyder \(micasnyd\) via clamav-announce" <[email protected]> Wed, 4 Sep 2024 19:19:15 +0000
| Newsgroups | gmane.comp.security.virus.clamav.win32,gmane.comp.security.virus.clamav.announce |
|---|---|
| Message-ID | <CH3PR11MB8750E7798F128FF0E06A5DA2C69C2__2017.38407356373$1725477814$gmane$org@CH3PR11MB8750.namprd11.prod.outlook.com> |
--===============4406331576889465069==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_CH3PR11MB8750E7798F128FF0E06A5DA2C69C2CH3PR11MB8750namp_"
--_000_CH3PR11MB8750E7798F128FF0E06A5DA2C69C2CH3PR11MB8750namp_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Read this online at https://blog.clamav.net/2024/09/clamav-141-132-107-and-=
010312-security.html
Today, we are publishing the 1.4.1, 1.3.2, 1.0.7, and 0.103.12 security pat=
ch versions.
The release files for the patch versions are available for download on the =
ClamAV downloads page<https://www.clamav.net/downloads>, on the GitHub Rele=
ase page<https://github.com/Cisco-Talos/clamav/releases>, and (with excepti=
on to 0.103.12) through Docker Hub<https://hub.docker.com/r/clamav/clamav/>=
.
The images on Docker Hub may not be immediately available on release day.
Continue reading to learn what changed in each version.
1.4.1
ClamAV 1.4.1 is a critical patch release with the following fixes:
*
CVE-2024-20506<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
506>: Changed the logging module to disable following symlinks on Linux and=
Unix systems so as to prevent an attacker with existing access to the 'cla=
md' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
Thank you to Detlef for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
CVE-2024-20505<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
505>: Fixed a possible out-of-bounds read bug in the PDF file parser that c=
ould cause a denial-of-service (DoS) condition.
This issue affects all currently supported versions. It will be fixed in:
Thank you to OSS-Fuzz for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
Removed unused Python modules from freshclam tests including deprecated 'cg=
i' module that is expected to cause test failures in Python 3.13.
1.3.2
ClamAV 1.3.2 is a patch release with the following fixes:
*
CVE-2024-20506<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
506>: Changed the logging module to disable following symlinks on Linux and=
Unix systems so as to prevent an attacker with existing access to the 'cla=
md' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
Thank you to Detlef for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
CVE-2024-20505<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
505>: Fixed a possible out-of-bounds read bug in the PDF file parser that c=
ould cause a denial-of-service condition.
This issue affects all currently supported versions. It will be fixed in:
Thank you to OSS-Fuzz for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
Removed unused Python modules from freshclam tests including deprecated 'cg=
i' module that is expected to cause test failures in Python 3.13.
*
Fix unit test caused by expiring signing certificate.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1305>
*
Fixed a build issue on Windows with newer versions of Rust. Also upgraded G=
itHub Actions imports to fix CI failures. Fixes courtesy of liushuyu.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1307>
*
Fixed an unaligned pointer dereference issue on select architectures. Fix c=
ourtesy of Sebastian Andrzej Siewior.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1293>
*
Fixes to Jenkins CI pipeline.
For details, see GitHub pull request<https://github.com/Cisco-Talos/clamav/=
pull/1330>
1.0.7
ClamAV 1.0.7 is a patch release with the following fixes:
*
CVE-2024-20506<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
506>: Changed the logging module to disable following symlinks on Linux and=
Unix systems so as to prevent an attacker with existing access to the 'cla=
md' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
Thank you to Detlef for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
CVE-2024-20505<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
505>: Fixed a possible out-of-bounds read bug in the PDF file parser that c=
ould cause a denial-of-service (DoS) condition.
This issue affects all currently supported versions. It will be fixed in:
Thank you to OSS-Fuzz for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
Removed unused Python modules from freshclam tests including deprecated 'cg=
i' module that is expected to cause test failures in Python 3.13.
*
Fix unit test caused by expiring signing certificate.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1305>
*
Fixed a build issue on Windows with newer versions of Rust. Also upgraded G=
itHub Actions imports to fix CI failures. Fixes courtesy of liushuyu.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1307>
*
Fixed an unaligned pointer dereference issue on select architectures. Fix c=
ourtesy of Sebastian Andrzej Siewior.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1293>
*
Fixes to Jenkins CI pipeline.
For details, see GitHub pull request<https://github.com/Cisco-Talos/clamav/=
pull/1331>
0.103.12
ClamAV 0.103.12 is a patch release with the following fixes:
*
CVE-2024-20506<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
506>: Changed the logging module to disable following symlinks on Linux and=
Unix systems so as to prevent an attacker with existing access to the 'cla=
md' or 'freshclam' services from using a symlink to corrupt system files.
This issue affects all currently supported versions. It will be fixed in:
Thank you to Detlef for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
CVE-2024-20505<https://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2024-20=
505>: Fixed a possible out-of-bounds read bug in the PDF file parser that c=
ould cause a denial-of-service condition.
This issue affects all currently supported versions. It will be fixed in:
Thank you to OSS-Fuzz for identifying this issue.
* 1.4.1
* 1.3.2
* 1.0.7
* 0.103.12
*
ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.
* GitHub pull request<https://github.com/Cisco-Talos/clamav/pull/119=
8>
*
Fixed a bug causing CVDs downloaded by the DatabaseCustomURL Freshclam conf=
ig option to be pruned and then re-downloaded with every update. Also added=
the new 'valhalla' database name to the list of optional databases in prep=
aration for future work.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1233>
*
Fixed an unaligned pointer dereference issue on select architectures. Fix c=
ourtesy of Sebastian Andrzej Siewior.
* Backport of GitHub pull request<https://github.com/Cisco-Talos/cla=
mav/pull/1293>
Micah Snyder (they/them)
ClamAV Development
Talos
Cisco Systems, Inc.
--_000_CH3PR11MB8750E7798F128FF0E06A5DA2C69C2CH3PR11MB8750namp_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 9pt; co=
lor: rgb(0, 0, 0);">
<i>Read this online at <a href=3D"https://blog.clamav.net/2024/09/clamav-14=
1-132-107-and-010312-security.html" id=3D"LPlnk620642">
https://blog.clamav.net/2024/09/clamav-141-132-107-and-010312-security.html=
</a></i></div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"text-align: left; line-height: 1.4; font-family: Aptos, Aptos=
_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=
ze: 12pt; color: rgb(0, 0, 0);">
Today, we are publishing the 1.4.1, 1.3.2, 1.0.7, and 0.103.12 security pat=
ch versions.</div>
<div style=3D"text-align: left; line-height: 1.4; font-family: Aptos, Aptos=
_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=
ze: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"text-align: left; line-height: 1.4; =
font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helve=
tica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The release files for the patch versions are available for download on the =
<span style=3D"color: rgb(239, 62, 66);">
<a href=3D"https://www.clamav.net/downloads" target=3D"_blank" id=3D"OWA321=
b2168-13c1-1e25-d6af-b0d177a47d0d" class=3D"Hyperlink SCXW156866380 BCX0 OW=
AAutoLink" rel=3D"noreferrer noopener" style=3D"color: rgb(239, 62, 66); ma=
rgin: 0px;">ClamAV downloads page</a></span>,
on the <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://github.=
com/Cisco-Talos/clamav/releases" target=3D"_blank" id=3D"OWA1fb35849-63e1-4=
cd3-9f7b-81c78799fa6e" class=3D"Hyperlink SCXW156866380 BCX0 OWAAutoLink" r=
el=3D"noreferrer noopener" style=3D"color: rgb(239, 62, 66); margin: 0px;">=
GitHub Release
page</a></span>, and (with exception to 0.103.12) through <span style=3D"c=
olor: rgb(239, 62, 66);">
<a href=3D"https://hub.docker.com/r/clamav/clamav/" target=3D"_blank" id=3D=
"OWA90633ad7-626d-4ec6-0c6f-9ecad6136bc5" class=3D"Hyperlink SCXW156866380 =
BCX0 OWAAutoLink" rel=3D"noreferrer noopener" style=3D"color: rgb(239, 62, =
66); margin: 0px;">Docker Hub</a></span>.</div>
<div style=3D"text-align: left; line-height: 1.4; font-family: Aptos, Aptos=
_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=
ze: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"text-align: left; line-height: 1.4; font-family: Aptos, Aptos=
_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-si=
ze: 12pt; color: rgb(0, 0, 0);">
The images on Docker Hub may not be immediately available on release day.</=
div>
<div style=3D"text-align: left; line-height: 1.4; margin: 0px; font-family:=
Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=
erif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"text-align: left; line-height: 1.4; margin: 0px; font-family:=
Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-s=
erif; font-size: 12pt; color: rgb(0, 0, 0);">
Continue reading to learn what changed in each version.</div>
<div style=3D"line-height: 1.4; margin: 0px; font-family: Aptos, Aptos_Embe=
ddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 1=
2pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"text-align: left; line-height: 1.25; margin: 24px 0px 16px; p=
adding-bottom: 0.3em; border-bottom: 1px solid rgba(0, 0, 0, 0.18); font-fa=
mily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, s=
ans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>1.4.1</b></div>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
ClamAV 1.4.1 is a critical patch release with the following fixes:</div>
<ul data-line=3D"9" style=3D"direction: ltr; margin: 0px 0px 0.7em; padding=
-right: 2.5em; padding-left: 2.5em; list-style-position: initial; list-styl=
e-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20506" id=3D"OWA49195fc6-ee75-4337-75e6-=
aa8b3734f531" class=3D"OWAAutoLink" title=3D"https://cve.mitre.org/cgi-bin/=
cvename.cgi?name=3DCVE-2024-20506" data-href=3D"https://cve.mitre.org/cgi-b=
in/cvename.cgi?name=3DCVE-2024-20506" style=3D"color: rgb(239, 62, 66);">CV=
E-2024-20506</a></span>:
Changed the logging module to disable following symlinks on Linux and Unix=
systems so as to prevent an attacker with existing access to the 'clamd' o=
r 'freshclam' services from using a symlink to corrupt system files.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to Detlef for identifying this issue.</div>
</li><ul data-line=3D"15" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20505" id=3D"OWAe5cf203c-df55-4f0d-fcfc-=
a1e280c55c8d" class=3D"OWAAutoLink" title=3D"https://cve.mitre.org/cgi-bin/=
cvename.cgi?name=3DCVE-2024-20505" data-href=3D"https://cve.mitre.org/cgi-b=
in/cvename.cgi?name=3DCVE-2024-20505" style=3D"color: rgb(239, 62, 66);">CV=
E-2024-20505</a></span>:
Fixed a possible out-of-bounds read bug in the PDF file parser that could =
cause a denial-of-service (DoS) condition.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to OSS-Fuzz for identifying this issue.</div>
</li><ul data-line=3D"27" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Removed unused Python modules from freshclam tests including deprecated 'cg=
i' module that is expected to cause test failures in Python 3.13.</div>
</li></ul>
<div style=3D"line-height: 1.4; margin-right: 0px; margin-left: 0px; font-f=
amily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, =
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"text-align: left; line-height: 1.25; margin: 24px 0px 16px; p=
adding-bottom: 0.3em; border-bottom: 1px solid rgba(0, 0, 0, 0.18); font-fa=
mily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, s=
ans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>1.3.2</b></div>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
ClamAV 1.3.2 is a patch release with the following fixes:</div>
<ul data-line=3D"9" style=3D"direction: ltr; margin: 0px 0px 0.7em; padding=
-right: 2.5em; padding-left: 2.5em; list-style-position: initial; list-styl=
e-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20506" id=3D"OWAebf2bbac-4792-a74b-d051-=
02a2aeb9af69" class=3D"OWAAutoLink" data-href=3D"https://cve.mitre.org/cgi-=
bin/cvename.cgi?name=3DCVE-2024-20506" style=3D"color: rgb(239, 62, 66);">C=
VE-2024-20506</a></span>:
Changed the logging module to disable following symlinks on Linux and Unix=
systems so as to prevent an attacker with existing access to the 'clamd' o=
r 'freshclam' services from using a symlink to corrupt system files.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to Detlef for identifying this issue.</div>
</li><ul data-line=3D"15" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20505" id=3D"OWA3cbd80bb-762a-03ce-f116-=
17fed2a39952" class=3D"OWAAutoLink" data-href=3D"https://cve.mitre.org/cgi-=
bin/cvename.cgi?name=3DCVE-2024-20505" style=3D"color: rgb(239, 62, 66);">C=
VE-2024-20505</a></span>:
Fixed a possible out-of-bounds read bug in the PDF file parser that could =
cause a denial-of-service condition.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to OSS-Fuzz for identifying this issue.</div>
</li><ul data-line=3D"27" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Removed unused Python modules from freshclam tests including deprecated 'cg=
i' module that is expected to cause test failures in Python 3.13.</div>
</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi=
ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); d=
irection: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fix unit test caused by expiring signing certificate.</div>
</li><ul data-line=3D"38" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1305" id=3D"OWA4be01f79-cc79-6702-bc94-c7c9=
9bab4b54" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1305" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixed a build issue on Windows with newer versions of Rust. Also upgraded G=
itHub Actions imports to fix CI failures. Fixes courtesy of liushuyu.</div>
</li><ul data-line=3D"43" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1307" id=3D"OWAc1c77601-d432-32b3-d7c2-61d2=
28041f33" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1307" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixed an unaligned pointer dereference issue on select architectures. Fix c=
ourtesy of Sebastian Andrzej Siewior.</div>
</li><ul data-line=3D"47" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1293" id=3D"OWA19384253-c050-8081-4576-18cc=
c61c7748" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1293" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixes to Jenkins CI pipeline.</div>
</li></ul>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt;">
<span style=3D"color: rgb(0, 0, 0);">For details, see </span><span style=3D=
"color: rgb(239, 62, 66);"><a href=3D"https://github.com/Cisco-Talos/clamav=
/pull/1330" id=3D"OWAb5ab0847-08ed-4296-7797-b902f2972811" class=3D"OWAAuto=
Link" data-href=3D"https://github.com/Cisco-Talos/clamav/pull/1330" style=
=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></div>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"text-align: left; line-height: 1.25; margin: 24px 0px 16px; p=
adding-bottom: 0.3em; border-bottom: 1px solid rgba(0, 0, 0, 0.18); font-fa=
mily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, s=
ans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>1.0.7</b></div>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
ClamAV 1.0.7 is a patch release with the following fixes:</div>
<ul data-line=3D"9" style=3D"direction: ltr; margin: 0px 0px 0.7em; padding=
-right: 2.5em; padding-left: 2.5em; list-style-position: initial; list-styl=
e-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20506" id=3D"OWAd463b21a-1919-da8e-f725-=
1de7e2e45742" class=3D"OWAAutoLink" data-href=3D"https://cve.mitre.org/cgi-=
bin/cvename.cgi?name=3DCVE-2024-20506" style=3D"color: rgb(239, 62, 66);">C=
VE-2024-20506</a></span>:
Changed the logging module to disable following symlinks on Linux and Unix=
systems so as to prevent an attacker with existing access to the 'clamd' o=
r 'freshclam' services from using a symlink to corrupt system files.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to Detlef for identifying this issue.</div>
</li><ul data-line=3D"15" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20505" id=3D"OWA120d3cc9-4a8f-dc67-f20f-=
0af8bdcaf711" class=3D"OWAAutoLink" data-href=3D"https://cve.mitre.org/cgi-=
bin/cvename.cgi?name=3DCVE-2024-20505" style=3D"color: rgb(239, 62, 66);">C=
VE-2024-20505</a></span>:
Fixed a possible out-of-bounds read bug in the PDF file parser that could =
cause a denial-of-service (DoS) condition.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to OSS-Fuzz for identifying this issue.</div>
</li><ul data-line=3D"27" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Removed unused Python modules from freshclam tests including deprecated 'cg=
i' module that is expected to cause test failures in Python 3.13.</div>
</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontServi=
ce, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); d=
irection: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fix unit test caused by expiring signing certificate.</div>
</li><ul data-line=3D"38" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1305" id=3D"OWAef51ad0d-f1e8-15a2-fe95-65ba=
9375dd51" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1305" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixed a build issue on Windows with newer versions of Rust. Also upgraded G=
itHub Actions imports to fix CI failures. Fixes courtesy of liushuyu.</div>
</li><ul data-line=3D"43" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1307" id=3D"OWA1b3776ad-ce87-9a14-cd63-187f=
86076ad7" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1307" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixed an unaligned pointer dereference issue on select architectures. Fix c=
ourtesy of Sebastian Andrzej Siewior.</div>
</li><ul data-line=3D"47" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1293" id=3D"OWAf54c5a4c-5090-7711-6e2b-b470=
5cd1e1f1" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1293" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixes to Jenkins CI pipeline.</div>
</li></ul>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt;">
<span style=3D"color: rgb(0, 0, 0);">For details, see </span><span style=3D=
"color: rgb(239, 62, 66);"><a href=3D"https://github.com/Cisco-Talos/clamav=
/pull/1331" id=3D"OWAb5815c0d-ea3e-ffcc-eb24-005e3db6a2c5" class=3D"OWAAuto=
Link" data-href=3D"https://github.com/Cisco-Talos/clamav/pull/1331" style=
=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></div>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"text-align: left; line-height: 1.25; margin: 24px 0px 16px; p=
adding-bottom: 0.3em; border-bottom: 1px solid rgba(0, 0, 0, 0.18); font-fa=
mily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, s=
ans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>0.103.12</b></div>
<div style=3D"direction: ltr; line-height: 1.4; margin: 0px 0px 16px; font-=
family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica,=
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
ClamAV 0.103.12 is a patch release with the following fixes:</div>
<ul data-line=3D"9" style=3D"direction: ltr; margin: 0px 0px 0.7em; padding=
-right: 2.5em; padding-left: 2.5em; list-style-position: initial; list-styl=
e-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20506" id=3D"OWAfc6224ce-c3fb-2da7-9a90-=
c3335942bb3f" class=3D"OWAAutoLink" data-href=3D"https://cve.mitre.org/cgi-=
bin/cvename.cgi?name=3DCVE-2024-20506" style=3D"color: rgb(239, 62, 66);">C=
VE-2024-20506</a></span>:
Changed the logging module to disable following symlinks on Linux and Unix=
systems so as to prevent an attacker with existing access to the 'clamd' o=
r 'freshclam' services from using a symlink to corrupt system files.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to Detlef for identifying this issue.</div>
</li><ul data-line=3D"15" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://cve.mitre.org/c=
gi-bin/cvename.cgi?name=3DCVE-2024-20505" id=3D"OWA3b476145-412a-5ef0-0d7e-=
ae24d6a064ab" class=3D"OWAAutoLink" data-href=3D"https://cve.mitre.org/cgi-=
bin/cvename.cgi?name=3DCVE-2024-20505" style=3D"color: rgb(239, 62, 66);">C=
VE-2024-20505</a></span>:
Fixed a possible out-of-bounds read bug in the PDF file parser that could =
cause a denial-of-service condition.</div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
This issue affects all currently supported versions. It will be fixed in:</=
div>
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Thank you to OSS-Fuzz for identifying this issue.</div>
</li><ul data-line=3D"27" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
1.4.1</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.3.2</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
1.0.7</li><li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=
Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =
0); direction: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.2=
5em;">
0.103.12</li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
ClamOnAcc: Fixed an infinite loop when a watched directory does not exist.<=
/div>
</li><ul data-line=3D"35" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
<span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://github.com/Cisc=
o-Talos/clamav/pull/1198" id=3D"OWA48e2bb03-98e4-9302-8f3d-f63cbf31d046" cl=
ass=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos/clamav/pull=
/1198" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixed a bug causing CVDs downloaded by the <code>DatabaseCustomURL</code>&n=
bsp;Freshclam config option to be pruned and then re-downloaded with every =
update. Also added the new 'valhalla' database name to the list of optional=
databases in preparation for future
work.</div>
</li><ul data-line=3D"41" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1233" id=3D"OWAd1370c6b-2457-f808-2a8f-27da=
a1f2e5f8" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1233" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; margin: 0px 0px 0.25em;">
<div style=3D"direction: ltr; line-height: 1.4; margin-top: 0px; margin-bot=
tom: 0.7em;">
Fixed an unaligned pointer dereference issue on select architectures. Fix c=
ourtesy of Sebastian Andrzej Siewior.</div>
</li><ul data-line=3D"45" style=3D"direction: ltr; margin: 0px 0px 0.7em; p=
adding-right: 2.5em; padding-left: 2.5em; list-style-position: initial; lis=
t-style-type: disc;">
<li style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, C=
alibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); direct=
ion: ltr; text-indent: 0px; line-height: 1.4; margin: 0px 0px 0.25em;">
Backport of <span style=3D"color: rgb(239, 62, 66);"><a href=3D"https://git=
hub.com/Cisco-Talos/clamav/pull/1293" id=3D"OWA72aec5ab-7093-39ad-de3b-65c4=
2e77479c" class=3D"OWAAutoLink" data-href=3D"https://github.com/Cisco-Talos=
/clamav/pull/1293" style=3D"color: rgb(239, 62, 66);">GitHub
pull request</a></span></li></ul>
</ul>
<div style=3D"line-height: 1.4; margin-right: 0px; margin-left: 0px; font-f=
amily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, =
sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"margin: 1.5em 0px 0px;"></div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div id=3D"Signature">
<div style=3D"font-family: Calibri, Arial, Helvetica, sans-serif; font-size=
: 12pt; color: rgb(0, 0, 0);">
<br>
<span style=3D"font-family: Helvetica; font-size: 12px;">Micah Snyder (they=
/them)</span><br>
<span style=3D"font-family: Helvetica; font-size: 12px;">ClamAV Development=
</span><br>
<span style=3D"font-family: Helvetica; font-size: 12px;">Talos</span><br>
<span style=3D"font-family: Helvetica; font-size: 12px;">Cisco Systems, Inc=
.</span><br>
</div>
</div>
</body>
</html>
--_000_CH3PR11MB8750E7798F128FF0E06A5DA2C69C2CH3PR11MB8750namp_--
--===============4406331576889465069==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
clamav-announce mailing list
[email protected]
https://lists.clamav.net/mailman/listinfo/clamav-announce
http://www.clamav.net/contact.html#ml
--===============4406331576889465069==--