From patchwork Sat Aug 8 10:34:12 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10122 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hHHTN5L86z3wp9 for ; Sat, 08 Aug 2026 10:35:04 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hHHTD26kRz7NG for ; Sat, 08 Aug 2026 10:34:56 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hHHSh60Mzz36Vj for ; Sat, 08 Aug 2026 10:34:28 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hHHSf1hWWz2xPV for ; Sat, 08 Aug 2026 10:34:26 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hHHST2sHlz5gm; Sat, 08 Aug 2026 10:34:17 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786185257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=5gRtsoN82JogRkt7P5+z35mUXIQOMZdmEL0BVN+qdzk=; b=xcIIVstkOEB2Nf1u+aNGfWk2JKQa96c4ouIuBrGZvHu/TeiSslwUU2jasqTwY/XV7PwFBJ WjoWNEzmLvH7T8BQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786185257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=5gRtsoN82JogRkt7P5+z35mUXIQOMZdmEL0BVN+qdzk=; b=IMv162r80MZqy+1kVrugGL9bIh91qDoK4UGicvIbLrQIJjTCuudcGBVVXZeO2ftbi1oGGa fmja7nCaluaHBS6ta8vhnoEeHD2CRdSv1hxrctCabj1OWlqyllAiZ/FrPcUl+KXvtUF3OK ngYuoRRBtCR+ekGaeWR6ttIc8OeSNNJRyMWUzXjvxcqmA85+cd+H2YqnDxQEh3+A6PJA9c cgyL1oChX47XhaAec92c55nBLuvwOZfJYLEonCtuj3qEFCfkCsH9MUBA1W1omBhpx0G5rd i4+j50ML+otWTkaIKNnlldcAj9NLkqM2xYX6SJBYu0V2mTRnBaSRXwt6lpZcDg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] clamav: Update to version 1.5.4 Date: Sat, 8 Aug 2026 12:34:12 +0200 Message-ID: <20260808103415.3443313-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 1.5.3 to 1.5.4 - Update of rootfile - 8 CVE Fixes plus a fix for a rust advisory - Changelog 1.5.4 - [CVE-2026-20337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20337): Fixed ZIP catalogue capacity tracking that could write beyond a heap allocation while indexing local file headers. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. Thank you to Kevin Stubbings of the GitHub Security Lab team for identifying this issue. - [CVE-2026-20345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20345): Fixed an indexing error while converting GPT partition names that could read or write beyond a stack-allocated partition entry. This issue affects ClamAV 0.98.2 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab for identifying this issue. - [CVE-2026-20339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20339): Fixed an integer overflow in the PESpin unpacker that could allocate an undersized buffer and then write beyond it while rebuilding a PE file. This issue affects ClamAV 0.90 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Feng Xue and, independently, Yazdan Soltani for identifying this issue. - [CVE-2026-20338](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20338): Fixed ownership handling while merging ZIP catalogue records that could cause an invalid free while scanning a malformed archive. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. Thank you to Daggolu Rakesh and, independently, Yazdan Soltani for identifying this issue. - [CVE-2026-20346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20346): Fixed an integer underflow in the PDF parser that could cause a crash while reading a malformed hex string. This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Tristan (@TristanInSec) for identifying this issue. - [CVE-2026-20347](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20347): Fixed undefined behavior and integer overflow in the Mach-O parser that could cause a crash while scanning a malformed Mach-O file. This issue affects ClamAV 1.4.5 and earlier, and ClamAV 1.5.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Tristan (@TristanInSec) for identifying this issue. - [CVE-2026-20348](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20348): Fixed XAR parser size handling that could request an excessive allocation or exceed scan limits while decompressing a malformed table of contents. This issue affects ClamAV 0.98.1 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to leduckhuong for identifying this issue. - [CVE-2025-8088](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8088): Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. The fix rejects path separators in NTFS alternate data stream names to prevent extraction outside ClamAV's temporary scan directory on Windows. This issue affects ClamAV 0.101.0 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. Thank you to Yazdan Soltani for identifying that this issue affects ClamAV. - Fixed thread-safety issues in the `clamd` STATS command that could disclose process memory or crash the daemon while scans and STATS requests run concurrently. Also fixed partial socket-write handling used for large STATS responses. This issue affects ClamAV 0.95 through 1.5.3. The fix is included in 1.4.6 and 1.5.4. - FreeBSD: Restored support for safe quarantine move and remove actions while preserving protection against source-path replacement races. This issue affects ClamAV 1.4.5 and 1.5.3. The fix is included in 1.4.6 and 1.5.4. - Fixed an OpenSSL library-context leak in legacy hashing helpers when a requested message digest cannot be fetched, such as when the default provider is unavailable in a FIPS-enabled environment. This issue affects ClamAV 1.5.0 through 1.5.3. The fix is included in 1.5.4. - Upgraded the Rust `crossbeam-epoch` dependency to resolve the RUSTSEC-2026-0204 advisory. Signed-off-by: Adolf Belka --- config/rootfiles/packages/clamav | 2 +- lfs/clamav | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/rootfiles/packages/clamav b/config/rootfiles/packages/clamav index f17380c98..088ab0172 100644 --- a/config/rootfiles/packages/clamav +++ b/config/rootfiles/packages/clamav @@ -162,7 +162,7 @@ usr/sbin/clamd #usr/share/doc/ClamAV/html/mode-rust-2c9d5c9a.js #usr/share/doc/ClamAV/html/print.html #usr/share/doc/ClamAV/html/searcher-09f2665d.js -#usr/share/doc/ClamAV/html/searchindex-d348bbbb.js +#usr/share/doc/ClamAV/html/searchindex-f120d447.js #usr/share/doc/ClamAV/html/sitemap.xml #usr/share/doc/ClamAV/html/theme-dawn-4493f9c8.js #usr/share/doc/ClamAV/html/theme-tomorrow_night-9dbe62a9.js diff --git a/lfs/clamav b/lfs/clamav index 5320f6986..4f12ab4f6 100644 --- a/lfs/clamav +++ b/lfs/clamav @@ -26,7 +26,7 @@ include Config SUMMARY = Antivirus Toolkit -VER = 1.5.3 +VER = 1.5.4 THISAPP = clamav-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = clamav -PAK_VER = 84 +PAK_VER = 85 DEPS = @@ -50,7 +50,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 1b2d42bc8c4fed29b71e10be9823da17f861a11e6a818654ae51b2b1fbd16619494572f9aa5e8712433bd65443c33f3e250baa99bb1fea031aa47c6bf6b81c21 +$(DL_FILE)_BLAKE2 = 9cd52cb4b885aae7b26477ed45efdd8cd12b5adae030a17db31cb0aa4489b004977b592e00c6d3121aae4367db842cf03c83f84eda06031537ed09051321be6e install : $(TARGET)