Thema: ClamWin/ClamAV .......

[SiLæncer]

Whats new:>>

This release updates ClamAV scannin engine to the supported version and delivers the following imporvements:

    Virus database updates are working again
    ClamAV engine updated to version 0.103.2

http://www.clamav.net

[SiLæncer]

Whats new:>>

    Fixed Virus database updates
    ClamAV engine updated to version 0.103.2r1

http://www.clamav.net

[SiLæncer]

Changelog

    Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is enabled. This issue did not affect most users, but for those affected, it caused every scanned file to be copied to the temp directory before the scan.
    Fixed ClamDScan crashes when using the --fdpass --multiscan command-line options in combination with the ClamD ExcludePath config file options.
    Fixed an issue where the mirrors.dat file is owned by root when starting as root (or with sudo) and using daemon-mode. File ownership will be set to the DatabaseOwner just before FreshClam switches to run as that user.
    Renamed the mirrors.dat file to freshclam.dat.
    Unfortunately, some users have FreshClam configured to automatically delete mirrors.dat if FreshClam failed. Renaming mirrors.dat to freshclam.dat should make it so those scripts don't delete important FreshClam data.
    We used to recommend deleting mirrors.dat if FreshClam failed to update. This is because mirrors.dat used to keep track of offline mirrors and network interruptions were known to cause FreshClam to think that all mirrors were offline. ClamAV now uses a paid CDN instead of a mirror network, and the new FreshClam DAT file no longer stores that kind of information. The UUID used in ClamAV's HTTP User-Agent is stored in the FreshClam DAT file and we want the UUID to persist between runs, even if there was a failure.
    Disabled the HTTPUserAgent config option if the DatabaseMirror uses clamav.net. This will prevent users from being inadvertently blocked and will ensure that we can keep better metrics on which ClamAV versions are being used.
    This change effectively deprecates the HTTPUserAgent option for most users.
    Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes) option. This type of PNG issue appears to be common enough to be an annoyance, and the CVE is old enough that no one should be vulnerable at this point.
    Fixed ClamSubmit failures after changes to Cloudflare "__cfduid" cookies.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

    New Requirements:

    As of ClamAV 0.104, CMake is required to build ClamAV.
    We have added comprehensive build instructions for using CMake to the new INSTALL.md file. The online documentation will also be updated to include CMake build instructions.
    The Autotools and the Visual Studio build systems have been removed.

    Major changes:

    The built-in LLVM for the bytecode runtime has been removed.
    The bytecode interpreter is the default runtime for bytecode signatures just as it was in ClamAV 0.103.
    We wished to add support for newer versions of LLVM, but ran out of time. If you're building ClamAV from source and you wish to use LLVM instead of the bytecode interpreter, you will need to supply the development libraries for LLVM version 3.6.2. See INSTALL.md to learn more.
    There are now official ClamAV images on Docker Hub.
    Note: Until ClamAV 0.104.0 is released, these images are limited to "unstable" versions, which are updated daily with the latest changes in the default branch on GitHub.
    You can find the images on Docker Hub under clamav.

    Docker Hub ClamAV tags:

    clamav/clamav:<version>: A release preloaded with signature databases.
    Using this container will save the ClamAV project some bandwidth. Use this if you will keep the image around so that you don't download the entire database set every time you start a new container. Updating with FreshClam from the existing databases set does not use much data.
    clamav/clamav:<version>_base: A release with no signature databases.
    Use this container only if you mount a volume in your container under /var/lib/clamav to persist your signature database databases. This method is the best option because it will reduce data costs for ClamAV and for the Docker registry, but it does require advanced familiarity with Linux and Docker.
    Caution: Using this image without mounting an existing database directory will cause FreshClam to download the entire database set each time you start a new container.
    You can use the unstable version (i.e. clamav/clamav:unstable or clamav/clamav:unstable_base) to try the latest from our development branch.
    Please, be kind when using "free" bandwidth for the virus databases and Docker registry. Try not to download the entire database set or the larger ClamAV database images on a regular basis.
    For more details, see the ClamAV Docker documentation.
    Special thanks to Olliver Schinagl for his excellent work creating ClamAV's new Docker files, image database deployment tooling, and user documentation.
    clamd and freshclam are now available as Windows services. To install and run them, use the --install-service option and net start [name] command.
    Special thanks to Gianluigi Tiesi for his original work on this feature.

    Notable changes:

    We added these features in 0.103.1 but wanted to re-post them here, as patch versions do not generally introduce new options:

    Added a new scan option to alert on broken media (graphics) file formats. This feature mitigates the risk of malformed media files intended to exploit vulnerabilities in other software. Currently, media validation exists for JPEG, TIFF, PNG, and GIF files. To enable this feature, set AlertBrokenMedia yes in clamd.conf, or use the --alert-broken-media option when using clamscan. These options are disabled by default in this patch, but may be enabled in a subsequent release. Application developers may enable this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for the heuristic scan option bit field.
    Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF and PNG typing behavior. BMP and JPEG 2000 files will continue to detect as CL_TYPE_GRAPHICS because ClamAV does not have BMP or JPEG 2000 format-checking capabilities.
    Added progress callbacks to libclamav for:
    database load: cl_engine_set_clcb_sigload_progress()
    engine compile: cl_engine_set_clcb_engine_compile_progress()
    engine free: cl_engine_set_clcb_engine_free_progress()
    These new callbacks enable an application to monitor and estimate load, compile and unload progress. See clamav.h for API details.

    Added progress bars to ClamScan for the signature load and engine compile steps before a scan begins. The startup progress bars won't be enabled if ClamScan isn't running in a terminal (i.e. if stdout is not a TTY), or if any of these options are used:

    --debug
    --quiet
    --infected
    --no-summary

    Other improvements:

    Added the %f format string option to the ClamD VirusEvent feature to insert the file path of the scan target when a virus event occurs. This supplements the VirusEvent %v option that prints the signature (virus) name. The ClamD VirusEvent feature also provides two environment variables, $CLAM_VIRUSEVENT_FILENAME and $CLAM_VIRUSEVENT_VIRUSNAME for a similar effect. This fix comes courtesy of Vasile Papp.
    Improvements to the AutoIt extraction module. Patch courtesy of cw2k.
    Added support for extracting images from Excel *.xls (OLE2) documents.
    Trusted SHA256-based Authenticode hashes can now be loaded in from *.cat files. See our Authenticode documentation for more info about using *.cat files with *.crb rules to trust signed Windows executables.

    Bug fixes:

    Fixed a memory leak affecting logical signatures that use the "byte compare" feature. Patch courtesy of Andrea De Pasquale.
    Fixed bytecode match evaluation for PDF bytecode hooks in PDF file scans.
    Other minor bug fixes.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

    What changed since the first release candidate:

    First and foremost, we are listening to your concerns about the build system change from Autotools to CMake, and about changes coming in a future feature release when we add the Rust programming language toolchain into our build requirements. We can't bring back Autotools, but we hope that the following will help.
    We are introducing a Long Term Support (LTS) program that will begin with the 0.103 feature release. Users will be required to stay up to date with the latest patch versions (e.g., 0.103.3) within the 0.103 feature series, but will have the peace-of-mind that the 0.103 feature release will receive critical patch versions with a stable ABI up until End-of-Life in September 2023. Stay tuned for a separate blog post introducing the full details of our LTS program. We will also add a version-support-matrix to our online documentation in tandem with the LTS blog post for easy reference.

    In addition to the above, we've resolved the following issues identified during the first release candidate:

    Increased the functionality level (FLEVEL) for the 0.104 release to make space for additional 0.103 (LTS) patch versions. See the Version & FLEVEL reference.
    Improvements installation instructions in INSTALL.md and in the online documentation.
    Fixed iconv / libiconv detection in the CMake configuration process when -Werror=return-type is enabled, such as in the openSUSE packaging environment. See PR-233.
    Fixed broken CMake build when RAR support is intentionally disabled and test-support is enabled. See PR-237.
    Fixed broken CMake build on systems that do not provide format string macros for standard integer types. See PR-231.
    Improved long file path support on Windows. (Disclaimer: presently requires user to opt-in with a registry key change). See PR-229.
    Fixed a segfault and socket file descriptor leak in ClamOnAcc. See PR-227.
    Fixed an error reported by ClamD when scanning directories on Windows. See PR-230.
    Fixed issue with Freshclam support for Universal Naming Convention (UNC) paths on Windows. See PR-226.
    Added missing environment variable feature documentation to the manpages. See PR-254.
    Fixed an assortment of issues identified by Coverity static analysis. See PR-221.
    Tuned the Valgrind suppression rules for the public test suite to resolve a false positive that caused intermittent ClamD test failures. See PR-238.
    Fixed the mspack library name to deconflict with system installed mspack packages. See PR-234.
    Fixed a false positive in the ClamD tests, reported by Valgrind when compiling with Clang. See PR-236.

[close]

http://www.clamav.net