From patchwork Tue May 12 19:29:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthias Fischer X-Patchwork-Id: 3077 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 49M7D72KPcz3xWQ for ; Tue, 12 May 2020 19:29:43 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 49M7D53DWyzTj; Tue, 12 May 2020 19:29:41 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 49M7D51cYBz2yCC; Tue, 12 May 2020 19:29:41 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 49M7D30Nq6z2xfm for ; Tue, 12 May 2020 19:29:39 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 49M7D20XPDzTj for ; Tue, 12 May 2020 19:29:38 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1589311778; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=8f1pxk/yVKo4vufAw8QEXKWTSTvSE36kifdk/qOriY4=; b=W/1FgayyQHc0jDJmZbV9LS0NmZ5e7gG9ZW69o74KUpLv8JCnJzEsD0xAlL1SvdSFc404An 5lqcB5Jsj5rjoXDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1589311778; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=8f1pxk/yVKo4vufAw8QEXKWTSTvSE36kifdk/qOriY4=; b=HDkwaq4tcBtYNHe+wqrPOVWWnJAlQbnLCpl0KZMBgePA+DpEhDiRQc/rPV2YL7XGxpbDC1 SVJ4ZDCz1CNGNdwrj4KYfQLzvn4k8seef9s0O9Hp1acj+9st3P0FdVqHDg76HJP2+v1DYH b56Vm1VgeAZZUT11tNmleeFwt3kI3xfQnnhIK02xb7Qz5Iy4amMlAqQYKA6U4HW7+RePRV JrugjjAEWYLjKXXNecF7iMS1T/9jWHbFzV2ccc3D4aHQgHHEvzs31lQCSpWtOy5vAANB9i 7jyW6N1XHoQug1epewXLr4Qp9lKZ/wJRDRiOFIQq6oWVnRhqtyGf2MlCbqTENg== From: Matthias Fischer To: development@lists.ipfire.org Subject: [PATCH] clamav: Update to 0.102.3 Date: Tue, 12 May 2020 21:29:32 +0200 Message-Id: <20200512192932.30993-1-matthias.fischer@ipfire.org> Authentication-Results: mail01.ipfire.org; auth=pass smtp.mailfrom=matthias.fischer@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" For details see: https://blog.clamav.net/2020/05/clamav-01023-security-patch-released.html "ClamAV 0.102.3 is a bug patch release to address the following issues. - CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper bounds checking of an unsigned variable results in an out-of-bounds read which causes a crash. - CVE-2020-3341: Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS) condition. Improper size checking of a buffer used to initialize AES decryption routines results in an out-of-bounds read which may cause a crash. Bug found by OSS-Fuzz. - Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents. - Fix a couple of minor memory leaks. - Updated libclamunrar to UnRAR 5.9.2." Signed-off-by: Matthias Fischer --- lfs/clamav | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/clamav b/lfs/clamav index 4688f0fb8..d1dce39ab 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -24,7 +24,7 @@ include Config -VER = 0.102.2 +VER = 0.102.3 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 50 +PAK_VER = 51 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = ecf5dd2c5c43aeed1c4b458b2e689847 +$(DL_FILE)_MD5 = 1577144c66f558fbd8ece3075ea2ac79 install : $(TARGET)