Re: Recent patch release questions

Hi Zak,

The beta is affected by the two CVE's and the lzma-sdk bug.

We don't generally recommend running betas or event release candidates in production and provide them for community testing purposes.
We're working towards providing a 1.5 stable release which will include those bug fixes.

Best,
Val


Val Snyder (she/they)
ClamAV Development
Talos
Cisco Systems, Inc.
________________________________
From: clamav-users <[email protected]> on behalf of Zakaria via clamav-users <[email protected]>
Sent: Friday, June 20, 2025 5:51 PM
To: [email protected] <[email protected]>
Cc: Zakaria <[email protected]>
Subject: [clamav-users] Recent patch release questions

[https://api.zakaria.website/users/[email protected]/[email protected]/32e142c13fa30dd6fc4a06.png]
Hi All,

I just have two questions, but first I want thank ClamAV team and contributors for all their efforts while I can sense the difficutlies in particular the dev team go through to publish a release, and its very much appreciated. Once more thanks so much for all your work 😭🤭😅🥰.

My question is about ClamAV 1.5 Beta and I wonder if it is affected by the following CVEs:-

CVE-2025-20260
CVE-2025-20234

I just felt a little disheartened having to downgrade from 1.5 Beta to 1.4.3, and I hope isn't affected so I dont have to downgrade.

I looked at the source code and it seems like its affected and if this conclusion is true, does anyone have any idea when 1.5 Beta will be patched?

Looking forward for any answers, with thanks.

Zak.

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat