Thema: ClamWin/ClamAV .......

[SiLæncer]

Changelog

ClamAV 0.100.2 is a patch release to address a set of vulnerabilities.

- Fixes for the following ClamAV vulnerabilities:
  - [CVE-2018-15378](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15378):
    Vulnerability in ClamAV's MEW unpacking feature that could allow an
    unauthenticated, remote attacker to cause a denial of service (DoS)
    condition on an affected device.
    Reported by Secunia Research at Flexera.
  - Fix for a 2-byte buffer over-read bug in ClamAV's PDF parsing code.
    Reported by Alex Gaynor.
- Fixes for the following vulnerabilities in bundled third-party libraries:
  - [CVE-2018-14680](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14680):
    An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It
    does not reject blank CHM filenames.
  - [CVE-2018-14681](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14681):
    An issue was discovered in kwajd_read_headers in mspack/kwajd.c in
    libmspack before 0.7alpha. Bad KWAJ file header extensions could cause
    a one or two byte overwrite.
  - [CVE-2018-14682](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14682):
    An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha.
    There is an off-by-one error in the TOLOWER() macro for CHM decompression.
  - Additionally, 0.100.2 reverted 0.100.1's patch for CVE-2018-14679, and applied
    libmspack's version of the fix in its place.
- Other changes:
  - Some users have reported freshclam signature update failures as a result of
    a delay between the time the new signature database content is announced and
    the time that the content-delivery-network has the content available for
    download. To mitigate these errors, this patch release includes some
    modifications to freshclam to make it more lenient, and to reduce the time
    that freshclam will ignore a mirror when it detects an issue.
  - On-Access "Extra Scanning", an opt-in minor feature of OnAccess scanning on
    Linux systems, has been disabled due to a known issue with resource cleanup.
    OnAccessExtraScanning will be re-enabled in a future release when the issue
    is resolved. In the mean-time, users who enabled the feature in clamd.conf
    will see a warning informing them that the feature is not active.
    For details, see: https://bugzilla.clamav.net/show_bug.cgi?id=12048

Thank you to the following ClamAV community members for your code submissions
and bug reports!

- Alex Gaynor
- Hiroya Ito
- Laurent Delosieres, Secunia Research at Flexera

[close]

http://www.clamav.net

[SiLæncer]

Release Notes

ClamAV 0.101.0 is a feature release with an assortment of improvements that
we've cooked up over the past 6 months.

### Some of the more obvious changes

- Our user manual has been converted from latex/pdf/html into **Markdown**!
  Markdown is easier to read & edit than latex, and is easier to contribute
  to as it eliminates the need to generate documents (the PDF, HTML).
  Find the user manual under docs/UserManual[.md].
  [Check it out!](https://github.com/Cisco-Talos/clamav-devel/blob/dev/0.101/docs/UserManual.md)
- Support for RAR v5 archive extraction! We replaced the legacy C-based unrar
  implementation with RarLabs UnRAR 5.6.5 library. Licensing is the same as
  before, although our `libclamunrar_iface` supporting library has changed from
  LGPL to the BSD 3-Clause license.
- Libclamav API changes:
  - The following scanning functions now require a filename argument.
    This will enable ClamAV to report more details warning and error
    information in the future, and will also allow for more sensible temp
    file names. The filename argument may be `NULL` if a filename is not
    available.
    - `cl_scandesc`
    - `cl_scandesc_callback`
    - `cl_scanmap_callback`
  - Scanning options have been converted from a single flag bit-field into
    a structure of multiple categorized flag bit-fields. This change enabled
    us to add new scanning options requested by the community. In addition,
    the name of each scan option has changed a little.
    As a result, the API changes will require libclamav users to modify
    how they initialize and pass scan options into calls such as `cl_scandesc()`.
    For details:
    - [example code](https://github.com/Cisco-Talos/clamav-devel/blob/dev/0.101/examples/ex1.c#L89)
    - [documentation](https://github.com/Cisco-Talos/clamav-devel/blob/dev/0.101/docs/UserManual/libclamav.md#data-scan-functions)
  - With our move to openssl versions >1.0.1, the `cl_cleanup_crypto()` function
    has been deprecated. This is because cleanup of open-ssl init functions is
    now handled by an auto-deinit procedure within the openssl library, meaning
    the call to `EVP_cleanup()` may cause problems to processes external to Clam.
  - `CL_SCAN_HEURISTIC_ENCRYPTED` scan option was replaced by 2 new scan options:
    - `CL_SCAN_HEURISTIC_ENCRYPTED_ARCHIVE`
    - `CL_SCAN_HEURISTIC_ENCRYPTED_DOC`
- `clamd.conf` and command line interface (CLI) changes:
  - As in 0.100.2, the clamd.conf `OnAccessExtraScanning` has been temporarily
    disabled in order to prevent resource cleanup issues from impacting clamd
    stability. As noted below, `OnAccessExtraScanning` is an opt-in minor
    feature of on-access scanning on Linux systems and its loss does not
    significantly impact the effectiveness of on-access scanning.
    The option still exists, but the feature will not be enabled and a warning
    will show if `LogVerbose` is enabled.
    For details, see: https://bugzilla.clamav.net/show_bug.cgi?id=12048
  - "Heuristic Alerts" (aka "Algorithmic Detection") options have been changed
    to make the names more consistent. The original options are deprecated in
    0.101, and will be removed in a future feature release.
  - In addition, _two new scan options_ were added to alert specifically on
    encrypted archives or encrypted docs. Previous functionality did both, even
    though it claimed to be specific to archives:
  - Scan option details:

    | Old `clamd.conf` option          | *New* `clamd.conf` option    |
    | -------------------------------- | ---------------------------- |
    | `AlgorithmicDetection`           | `HeuristicAlerts`            |
    | `DetectBrokenExecutables`        | `AlertBrokenExecutables`     |
    | `PhishingAlwaysBlockCloak`       | `AlertPhishingCloak`         |
    | `PhishingAlwaysBlockSSLMismatch` | `AlertPhishingSSLMismatch`   |
    | `PartitionIntersection`          | `AlertPartitionIntersection` |
    | `BlockMax`                       | `AlertExceedsMax`            |
    | `OLE2BlockMacros`                | `AlertOLE2Macros`            |
    | `ArchiveBlockEncrypted`          | `AlertEncrypted`             |
    |                                  | `AlertEncryptedArchive`      |
    |                                  | `AlertEncryptedDoc`          |

    | Old `clamscan` option        | *New* `clamscan` option          |
    | ---------------------------- | -------------------------------- |
    | `--algorithmic-detection`    | `--heuristic-alerts`             |
    | `--detect-broken`            | `--alert-broken`                 |
    | `--phishing-cloak`           | `--alert-phishing-cloak`         |
    | `--phishing-ssl`             | `--alert-phishing-ssl`           |
    | `--partition-intersection`   | `--alert-partition-intersection` |
    | `--block-max`                | `--alert-exceeds-max`            |
    | `--block-macros`             | `--alert-macros`                 |
    | `--block-encrypted`          | `--alert-encrypted`              |
    |                              | `--alert-encrypted-archive`      |
    |                              | `--alert-encrypted-doc`          |

### Some more subtle improvements

- Logical signatures have been extended with a new subsignature type which
  allows for numerical byte sequence comparison. For those familiar with
  Snort, this byte comparison feature works similarly to the byte_extract
  and byte_test feature, in that it allows signature writers to extract and
  compare a specified number of bytes (offset from a match) against another
  numeric value. You can read more about this feature, see how it works, and
  look over examples in [our documentation](docs/UserManual/Signatures.md).
- Backwards compatibility improvements for detecting the OpenSSL dependency.
- Freshclam updated to match exit codes defined in the freshclam.1 man page.
- Upgrade from libmspack 0.5alpha to libmspack 0.7.1alpha. As a reminder, we
  support system-installed versions of libmspack. _However_, at this time the
  ClamAV-provided version of libmspack provides additional abilities to parse
  broken or non-standard CAB files beyond what the stock libmspack 0.7.1alpha
  provides. We are working with the upstream project to incorporate our
  modifications, and hopefully these changes will appear in a future release
  of libmspack.
- Updated the bundled 3rd party library libxml2 included for Windows builds to
  version 2.9.8.
- Updated the bundled 3rd party library pcre included for Windows builds to
  pcre2 version 10.31.
- Upgraded Aspack PE unpacking capability with support up to version 2.42.
- Improvements to PDF parsing capability.
- Replaced the Windows installer with a new installer built using InnoSetup 5.
- Improved `curl-config` detection logic.
  GitHub pull-request by Thomas Petazzoni.
- Added file type `CL_TYPE_LNK` to more easily identify Windows Shortcut files
  when writing signatures.
- Improved parsing of Windows executable (PE) Authenticode signatures. Pull-
  request by Andrew Williams.
  - Added support for Authenticode signature properties commonly used by
    Windows system files. These files are now much more likely to be
    whitelisted correctly.
  - Signature parsing now works correctly on big endian systems.

- Some simplification to freshclam mirror management code, including changes
  to reduce timeout on ignoring mirrors after errors, and to make freshclam
  more tolerant when there is a delay between the time the new signature
  database content is announced and the time that the content-delivery-network
  has the content available for download.
- Email MIME Header parsing changes to accept argument values with unbalanced
  quotes. Improvement should improve detection of attachments on malformed
  emails.
  GitHub pull-request by monnerat.
- Included the config filename when reporting errors parsing ClamAV configs.
  GitHub pull-request by Josh Soref.
- Improvement to build scripts for clamav-milter.
  GitHub pull-request by Renato Botelho.

### Other changes

- Removed option handler for `AllowSupplementaryGroups` from libfreshclam.
  This option was previously deprecated from freshclam in ClamAV 0.100.0 but
  remained in libfreshclam by mistake.
- In older versions of pcre2 and in pcre, a higher `PCRERecMatchLimit` may
  cause `clamd` to crash on select files. We have lowered the default
  `PCRERecMatchLimit` to 2000 to reduce the likelihood of a crash and have
  added warnings to recommend using pcre2 v10.30 or higher to eliminate
  the issue.

[close]

http://www.clamav.net

[SiLæncer]

Release Notes

ClamAV 0.101.1 is an urgent patch release to address an issue in 0.101.0 specifically for developers that depend on libclamav. The issue in 0.101.0 is that clamav.h required supporting headers that were not provided on make install. To address this issue, the internal cltypes.h header has been replaced by a clamav-types.h that is generated on ./configure and will be installed alongside clamav.h.

Other changes

Increased the default CommandReadTimeout to reduce the chance of mail loss if using clamav-milter with the TCP socket. Contribution by Scott Kitterman. Fixes for --with-libjson and --with-libcurl to correctly accept library install path arguments.

Acknowledgements

 The ClamAV team thanks the following individuals for their code submissions: Scott Kitterman

Known Issues

Some users have observed crashes the first time running freshclam after upgrading from 0.100 to 0.101. We haven't yet tracked down the source of the issue, but have found that the issue resolves itself and that subsequent calls to freshclam work as expected.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

- Fixes for the following vulnerabilities affecting 0.101.1 and prior:

- CVE-2019-1787:

An out-of-bounds heap read condition may occur when scanning PDF
documents. The defect is a failure to correctly keep track of the number
of bytes remaining in a buffer when indexing file data.

- CVE-2019-1789:

An out-of-bounds heap read condition may occur when scanning PE files
(i.e. Windows EXE and DLL files) that have been packed using Aspack as a
result of inadequate bound-checking.

- CVE-2019-1788:

An out-of-bounds heap write condition may occur when scanning OLE2 files
such as Microsoft Office 97-2003 documents. The invalid write happens when
an invalid pointer is mistakenly used to initialize a 32bit integer to
zero. This is likely to crash the application.

- Fixes for the following vulnerabilities affecting 0.101.1 and 0.101.0 only:

- CVE-2019-1786:

An out-of-bounds heap read condition may occur when scanning malformed PDF
documents as a result of improper bounds-checking.

- CVE-2019-1785:

A path-traversal write condition may occur as a result of improper input
validation when scanning RAR archives. Issue reported by aCaB.

- CVE-2019-1798:

A use-after-free condition may occur as a result of improper error
handling when scanning nested RAR archives. Issue reported by David L.

- Fixes for the following assorted bugs:

- Added checks to prevent shifts from causing undefined behavior in HTML
normalizer, UPX unpacker, ARJ extractor, CPIO extractor, OLE2 parser,
LZW decompressor used in the PDF parser, Xz decompressor, and UTF-16 to
ASCII transcoder.
- Added checks to prevent integer overflow in UPX unpacker.
- Fix for minor memory leak in OLE2 parser.
- Fix to speed up PDF parser when handling truncated (or malformed) PDFs.
- Fix for memory leak in ARJ decoder failure condition.
- Fix for potential memory and file descriptor leak in HTML normalization code.
- Removed use of problematic feature that converted file descriptors to
file paths. The feature was intended to improve performance when scanning
file types, notably RAR archives, for which the API requires a file path.
This feature caused issues in environments where the ClamAV engine is run
in a low-permissions or sandboxed process. RAR archives are still supported
with this change, but performance may suffer slightly if the file path is not
provided in calls to `cl_scandesc_callback()`.
- Added filename and tempfile names to scandesc calls in clamd.
- Added general scan option `CL_SCAN_GENERAL_UNPRIVILEGED` to treat the scan
engine as unprivileged, meaning that the scan engine will not have read
access to the file. Provided file paths are for logging purposes only.
- Added ability to create a temp file when scanning RAR archives when the
process does not have read access to the file path provided (i.e.
unprivileged is set, or an access check fails).

[close]

http://www.clamav.net

[SiLæncer]

Changelog

ClamAV 0.101.3 is a patch release to address a vulnerability to non-recursive
zip bombs.

A Denial-of-Service (DoS) vulnerability may occur when scanning a zip bomb as a
result of excessively long scan times. The issue is resolved by detecting the
overlapping local file headers which characterize the non-recursive zip bomb
described by David Fifield,
[here](https://www.bamsoftware.com/hacks/zipbomb/).

Thank you to Hanno Böck for reporting the issue as it relates to ClamAV,
[here](https://bugzilla.clamav.net/show_bug.cgi?id=12356).

Also included in 0.101.3:

- Update of bundled the libmspack library from 0.8alpha to 0.10alpha, to
  address a buffer overflow vulnerability in libmspack < 0.9.1α.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

    Major changes:

    The On-Access Scanning feature has been migrated out of clamd and into a brand new utility named clamonacc. This utility is similar to clamdscan and clamav-milter in that it acts as a client to clamd. This separation from clamd means that clamd no longer needs to run with root privileges while scanning potentially malicious files. Instead, clamd may drop privileges to run under an account that does not have super-user. In addition to improving the security posture of running clamd with On-Access enabled, this update fixed a few outstanding defects:

    On-Access scanning for created and moved files (Extra-Scanning) is fixed.
    VirusEvent for On-Access scans is fixed.
    With clamonacc, it is now possible to copy, move, or remove a file if the scan triggered an alert, just like with clamdscan.
    For details on how to use the new clamonacc On-Access scanner, please refer to the user manual on ClamAV.net, and please read our blog post entitled "Understanding and transitioning to ClamAV's new On-Access scanner."

    The freshclam database update utility has undergone a significant update. This includes:

    Added support for HTTPS.
    Support for database mirrors hosted on ports other than 80.
    Removal of the mirror management feature (mirrors.dat).
    An all new libfreshclam library API.

    Notable changes:

    Added support for extracting ESTsoft .egg archives. This feature is new code developed from scratch using ESTsoft's Egg-archive specification and without referencing the UnEgg library provided by ESTsoft. This was necessary because the UnEgg library's license includes restrictions limiting the commercial use of the UnEgg library.
    The documentation has moved!
    Users should navigate to ClamAV.net to view the documentation online.
    The documentation will continue to be provided in HTML format with each release for offline viewing in the docs/html directory.
    The new home for the documentation markdown is in our ClamAV FAQ Github repository.
    To remediate future denial of service conditions caused by excessive scan times, we introduced a scan time limit. The default value is 2 minutes (120000 milliseconds).

    To customize the time limit:

    use the clamscan --max-scantime option
    use the clamd MaxScanTime config option

    Libclamav users may customize the time limit using the cl_engine_set_num function. For example:

    cl_engine_set_num(engine, CL_ENGINE_MAX_SCANTIME, time_limit_milliseconds)

    Other improvements:

    Improved Windows executable Authenticode handling, enabling both whitelisting and blacklisting of files based on code-signing certificates. Additional improvements to Windows executable (PE file) parsing. Work courtesy of Andrew Williams.
    Added support for creating bytecode signatures for Mach-O and ELF executable unpacking. Work courtesy of Jonas Zaddach.
    Re-formatted the entire ClamAV code-base using clang-format in conjunction with our new ClamAV code style specification. See the clamav.net blog post for details.
    Integrated ClamAV with Google's OSS-Fuzz automated fuzzing service with the help of Alex Gaynor. This work has already proven beneficial, enabling us to identify and fix subtle bugs in both legacy code and newly developed code.
    The clamsubmit tool is now available on Windows.
    The clamscan metadata feature (--gen-json) is now available on Windows.
    Significantly reduced number of warnings generated when compiling ClamAV with "-Wall" and "-Wextra" compiler flags and made many subtle improvements to the consistency of variable types throughout the code.
    Updated the majority of third-party dependencies for ClamAV on Windows. The source code for each has been removed from the clamav-devel repository. This means that these dependencies have to be compiled independently of ClamAV. The added build process complexity is offset by significantly reducing the difficulty of releasing ClamAV with newer versions of those dependencies.
    During the 0.102 development period, we've also improved our Continuous Integration (CI) processes. Most recently, we added a CI pipeline definition to the ClamAV Git repository. This chains together our build and quality assurance test suites and enables automatic testing of all proposed changes to ClamAV, with customizable parameters to suit the testing needs of any given code change.
    Added a new clamav-version.h generated header to provide version number macros in text and numerical format for ClamAV, libclamav, and libfreshclam.
    Improved cross-platform buildability of libxml2. Work courtesy of Eneas U de Queiroz with supporting ideas pulled from the work of Jim Klimov.

    Bug fixes:

    Fix to prevent a possible crash when loading LDB type signature databases and PCRE is not available. Patch courtesy of Tomasz Kojm.
    Fixes to the PDF parser that will improve PDF malware detection efficacy. Patch courtesy of Clement Lecigne.
    Fix for regular expression phishing signatures (PDB R-type signatures).
    Various other bug fixes.

    New Requirements:

    Libcurl has become a hard-dependency. Libcurl enables HTTPS support for freshclam and clamsubmit as well as communication between clamonacc and clamd.

    Libcurl version >= 7.45 is required when building ClamAV from source with the new On-Access Scanning application (clamonacc). Users on Linux operating systems that package older versions of libcurl (e.g. all versions of CentOS and Debian versions <= 8) have a number of options:

    Wait for your package maintainer to provide a newer version of libcurl.
    Install a newer version of libcurl from source.
    Disable installation of clamonacc and On-Access Scanning capabilities with the ./configure flag --disable-clamonacc.
    Non-Linux users will need to take no actions as they are unaffected by this new requirement.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

Fix for the following vulnerability affecting 0.102.0 and 0.101.4 and prior:

CVE-2019-15961:

A Denial-of-Service (DoS) vulnerability may occur when scanning a specially crafted email file as a result of excessively long scan times. The issue is resolved by implementing several maximums in parsing MIME messages and by optimizing use of memory allocation.
Build system fixes to build clamav-milter, to correctly link with libxml2 when detected, and to correctly detect fanotify for on-access scanning feature support.
Signature load time is significantly reduced by changing to a more efficient algorithm for loading signature patterns and allocating the AC trie. Patch courtesy of Alberto Wu.
Introduced a new configure option to statically link libjson-c with libclamav. Static linking with libjson is highly recommended to prevent crashes in applications that use libclamav alongside another JSON parsing library.
Null-dereference fix in email parser when using the --gen-json metadata option.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

    ClamAV 0.102.2 is a security patch release to address the following issues:

    CVE-2020-3123: A denial-of-service (DoS) condition may occur when using the optional credit card data-loss-prevention (DLP) feature. Improper bounds checking of an unsigned variable resulted in an out-of-bounds read, which causes a crash.
    Significantly improved the scan speed of PDF files on Windows.
    Re-applied a fix to alleviate file access issues when scanning RAR files in downstream projects that use libclamav where the scanning engine is operating in a low-privilege process. This bug was originally fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
    Fixed an issue where freshclam failed to update if the database version downloaded is one version older than advertised. This situation may occur after a new database version is published. The issue affected users downloading the whole CVD database file.
    Changed the default freshclam ReceiveTimeout setting to 0 (infinite). The ReceiveTimeout had caused needless database update failures for users with slower internet connections.
    Correctly display the number of kilobytes (KiB) in progress bar and reduced the size of the progress bar to accommodate 80-character width terminals.
    Fixed an issue where running freshclam manually causes a daemonized freshclam process to fail when it updates because the manual instance deletes the temporary download directory. The freshclam temporary files will now download to a unique directory created at the time of an update instead of using a hardcoded directory created/destroyed at the program start/exit.
    Fix for freshclam's OnOutdatedExecute config option.
    Fixes a memory leak in the error condition handling for the email parser.
    Improved bound checking and error handling in ARJ archive parser.
    Improved error handling in PDF parser.
    Fix for memory leak in byte-compare signature handler.
    Updates to the unit test suite to support libcheck 0.13.
    Updates to support autoconf 2.69 and automake 1.15.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

ClamAV 0.102.3 is a bug patch release to address the following issues.

- [CVE-2020-3327](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3327):
  Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.2 that
  could cause a Denial-of-Service (DoS) condition. Improper bounds checking of
  an unsigned variable results in an out-of-bounds read which causes a crash.

  Special thanks to Daehui Chang and Fady Othman for helping identify the ARJ
  parsing vulnerability.

- [CVE-2020-3341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3341):
  Fix a vulnerability in the PDF parsing module in ClamAV 0.101 - 0.102.2 that
  could cause a Denial-of-Service (DoS) condition. Improper size checking of
  a buffer used to initialize AES decryption routines results in an out-of-
  bounds read which may cause a crash. Bug found by OSS-Fuzz.

- Fix "Attempt to allocate 0 bytes" error when parsing some PDF documents.

- Fix a couple of minor memory leaks.

- Updated libclamunrar to UnRAR 5.9.2.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

ClamAV 0.102.4 is a bug patch release to address the following issues.

- [CVE-2020-3350](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3350):
  Fix a vulnerability wherein a malicious user could replace a scan target's
  directory with a symlink to another path to trick clamscan, clamdscan, or
  clamonacc into removing or moving a different file (eg. a critical system
  file). The issue would affect users that use the --move or --remove options
  for clamscan, clamdscan, and clamonacc.

  For more information about AV quarantine attacks using links, see the
  [RACK911 Lab's report](https://www.rack911labs.com/research/exploiting-almost-every-antivirus-software).

- [CVE-2020-3327](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3327):
  Fix a vulnerability in the ARJ archive parsing module in ClamAV 0.102.3 that
  could cause a Denial-of-Service (DoS) condition. Improper bounds checking
  results in an out-of-bounds read which could cause a crash.
  The previous fix for this CVE in 0.102.3 was incomplete. This fix correctly
  resolves the issue.

- [CVE-2020-3481](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3481):
  Fix a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3
  could cause a Denial-of-Service (DoS) condition. Improper error handling
  may result in a crash due to a NULL pointer dereference.
  This vulnerability is mitigated for those using the official ClamAV
  signature databases because the file type signatures in daily.cvd
  will not enable the EGG archive parser in versions affected by the
  vulnerability.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

    Major changes:

    clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort.
    Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads as it will temporarily consume 2x as much memory. For this purpose we have added a new clamd config option ConcurrentDatabaseReload which may be set to no.

    Notable changes:

    The DLP module has been enhanced with additional credit card ranges and a new engine option which allows ClamAV to alert only on credit cards (and not, for instance, gift cards) when scannning with the DLP module. This feature enhancement was made by John Schember, with input from Alexander Sulfrian.
    Support for Adobe Reader X PDF encryption, an overhaul of PNG scanning to detect PNG specific exploits, and a major change to GIF parsing which makes it more tolerant to problematic files and adds the ability to scan overlays, all thanks to work and patches submitted by Aldo Mazzeo.
    clamdtop.exe now available for Windows users. Functionality is somewhat limited when compared with clamdtop on Linux. PDCurses is required to build clamdtop.exe for ClamAV on Windows.
    The phishing detection module will now print "Suspicious link found!" along with the "Real URL" and "Display URL" each time phishing is detected. In a future version, we would like to print out alert-related metadata like this at the end of a scan, but for now this detail will help users understand why a given file is being flagged as phishing.
    Added new *experimental* CMake build tooling. CMake is not yet recommended for production builds. Our team would appreciate any assistance improving the CMake build tooling so we can one day deprecate Autotools and remove the Visual Studio solutions.
    Please see the new CMake installation instructions found in INSTALL.cmake.md for detailed instructions on how to build ClamAV with CMake.
    Added --ping and --wait options to the clamdscan and clamonacc client applications.
    The --ping (-p) command will attempt to ping clamd up to a specified maximum number of attempts at an optional interval. If the interval isn't specified, a default 1-second interval is used. It will exit with status code `0` when it receives a PONG from clamd or status code `21` if the timeout expires before it receives a response.
    Other improvements
    Added ability for freshclam and clamsubmit to override default use of OpenSSL CA bundle with a custom CA bundle. On Linux/Unix platforms (excluding macOS), users may specify a custom CA bundle by setting the CURL_CA_BUNDLE environment variable. On macOS and Windows, users are expected to add CA certificates to their respective system's keychain/certificate store. Patch courtesy of Sebastian A. Siewior
    clamscan and clamdscan now print the scan start and end dates in the scan summary.
    The clamonacc on-access scanning daemon for Linux now installs to sbin instead of bin.
    Improvements to the freshclam progress bar so the width of the text does not shift around as information changes and will not spill exceed 80-characters even on very slow connections. Time is now displayed in Xm XXs (or Xh XXm) for values of 60 seconds or more. Bytes display now changes units at the proper 1024 B/KiB instead of 2048 B/KiB. Patch courtesy of Zachary Murden.
    Improve column alignment and line wrap rendering for clamdtop. Also fixed an issue on Windows where clamdtop would occasionally disconnect from clamd and fail to reconnect. Patch courtesy of Zachary Murden.
    Improvements to the AutoIT parser.
    Loosened the curl version requirements in order to build and use clamonacc. You may now build ClamAV with any version of libcurl. However clamonacc's file descriptor-passing (FD-passing) capability will only be available with libcurl 7.40 or newer. FD-passing is ordinarily the default way to perform scans with clamonacc as it is significantly faster than streaming.
    Added LZMA and BZip2 decompression routines to the bytecode signature API.
    Disabled embedded type recognition for specific archive and disk image file types. This change reduces file type misclassification and improves scan time performance by reducing duplicated file scanning.

    Bug fixes:

    Fixed issue scanning directories on Windows with clamdscan.exe that was introduced when mitigating against symlink quarantine attacks.
    Fixed behavior of freshclam --quiet option. Patch courtesy of Reio Remma.
    Fixed behavior of freshclam's OnUpdateExecute, OnErrorExecute, and OnOutdatedExecute config options on Windows when in daemon-mode so it can handle multiple arguments. Patch courtesy of Zachary Murden.
    Fixed an error in the heuristic alert mechanism that would cause a single detection within an archive to alert once for every subsequent file scanned, potentially resulting in thousands of alerts for a single scan.
    Fixed clamd, clamav-milter, and freshclam to create PID files before dropping privileges, to avoid the possibility of an unprivileged user from changing the PID file so that a service manager will kill a different process. This change does make the services unable to clean up the PID file on exit.
    Fixed the false positive (.fp) signature feature. In prior versions, the hash in a false positive signature would be checked only against the current layer of a file being scanned. In 0.103, every file layer is hashed, and the hashes for each in the scan recursion list are checked. This ensures that .fp signatures containing a hash for any layer in the scan leading up to the alert will negate the alert.
    As an example, a hash for a zip containing the file which alerts would not prevent the detection in prior versions. Only the hash of the embedded file would work. For some file types where the outermost is always an archive, eg. docx files, this made .fp signatures next to useless. For certain file types where the scanned content was a normalized version of the original content, eg. HTML, the normalized version was never hashed and this meant that .fp signatures never worked.
    Fixed Trusted & Revoked Windows executable (PE) file signature rules (.crb) maximum functionality level (FLEVEL) which had been being treated as the minimum FLEVEL. These signatures enable ClamAV to trust executables that are digitally signed by trusted publishers, or to alert on executables signed with compromised signing-certificates. The minimum and maximum FLEVELS enable or disable signatures at load time depending on the current ClamAV version.
    Fixed a bug wherein you could not build ClamAV with --enable-libclamav-only if curl was not installed on the system.
    Various other bug fixes, improvements, and documentation improvements.

    New Requirements:

    Autotools (automake, autoconf, m4, pkg-config, libtool) are now required in order to build from a Git clone because the files generated by these tools have been removed from the Git repository. To generate theses files before you compile ClamAV, run autogen.sh. Users building with Autotools from the release tarball should be unaffected.
    Flex and Bison are now required in order to build from a Git clone. Flex and Bison are also required to build with CMake. Users building with Autotools from the release tarball should be unaffected.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

    Fixed clamd and clamav-milter service/daemon start issue when starting as root and switching users. This issue discussed in the mailing list and reported on bugzilla.
    Fixed a build issue when libcheck is not installed. This issue reported on bugzilla.
    Fixed a Windows issue using the clamscan.exe & clamdscan.exe's --remove option. This issue reported on bugzilla.
    Added pkg-config support for finding pcre2 and ncurses when using the Autotools build system. pcre2 pkg-config support contributed by Michael Orlitzky via GitHub.com.
    Reverted the change require Bison & Flex when building from a Git clone. Bison & Flex generated sources will remain in our Git repository. When building with CMake, they can be re-generated by enabling "maintainer mode".
    Fixed bugs in the ARJ and XAR archive parsers.

[close]

http://www.clamav.net

[SiLæncer]

Changelog

    With your feedback on the previous candidates, we've fixed these additional issues:

    The freshclam PID file was not readable by other users in previous release candidates but is now readable by all.
    An issue with how freshclam was linked with the autotools build system caused SysLog settings to be ignored.
    The real-path checks introduced to clamscan and clamdscan in 0.102.4 broke scanning of some files with Unicode filenames and files on network shares for Windows users.
    Thanks to the users for your help in fixing these bugs.

    Major changes:

    clamd can now reload the signature database without blocking scanning. This multi-threaded database reload improvement was made possible thanks to a community effort.
    Non-blocking database reloads are now the default behavior. Some systems that are more constrained on RAM may need to disable non-blocking reloads, as it will temporarily consume double the amount of memory. We added a new clamd config option ConcurrentDatabaseReload, which may be set to no.

    Notable changes:

    The DLP module has been enhanced with additional credit card ranges and a new engine option that allows ClamAV to alert only on credit cards (and not, for instance, gift cards) when scanning with the DLP module. John Schember developed this feature, with input from Alexander Sulfrian.
    We added support for Adobe Reader X PDF encryption and overhauled the PNG-scanning tool to detect PNG-specific exploits. We also made a major change to GIF parsing that now makes it more tolerant of problematic files and adds the ability to scan overlays, all thanks to work and patches submitted by Aldo Mazzeo.
    clamdtop.exe is now available for Windows users. The functionality is somewhat limited when compared to clamdtop on Linux. PDCurses is required to build clamdtop.exe for ClamAV on Windows.
    The phishing detection module will now print "Suspicious link found!" along with the "Real URL" and "Display URL" each time ClamAV detects phishing. In a future version, we would like to print out alert-related metadata like this at the end of a scan, but for now, this detail will help users understand why a given file is being flagged as phishing.
    Added new *experimental* CMake build tooling. CMake is not yet recommended for production builds. Our team would appreciate any assistance improving the CMake build tooling so we can one day deprecate autotools and remove the Visual Studio solutions.
    Please see the new CMake installation instructions found in INSTALL.cmake.md for detailed instructions on how to build ClamAV with CMake.
    Added --ping and --wait options to the clamdscan and clamonacc client applications.
    The --ping (-p) command will attempt to ping clamd up to a specified maximum number of attempts at an optional interval. If the interval isn't specified, a default one-second interval is used. It will exit with status code `0` when it receives a PONG from clamd or status code `21` if the timeout expires before it receives a response.
    Added Excel 4.0 (XLM) macro detection and extraction support. Significantly improved VBA detection and extraction as well. Work courtesy of Jonas Zaddach.
    This support not yet added to sigtool, as the VBA extraction feature in sigtool is separate from the one used for scanning and will still need to be updated or replaced in the future.
    Improvements to the layout and legibility of temp files created during a scan. Improvements to legibility and content of the metadata JSON generated during a scan.

    To review the scan temp files and metadata JSON, run:

    clamscan --tempdir=<path> --leave-temps --gen-json <target>

    Viewing the scan temp files and metadata.json file provides some insight into how ClamAV analyzes a given file and can also be useful to analysts for the initial triage of potentially malicious files.

    Other improvements:

    Added ability for freshclam and clamsubmit to override default use of OpenSSL CA bundle with a custom CA bundle. On Linux/Unix platforms (excluding macOS), users may specify a custom CA bundle by setting the CURL_CA_BUNDLE environment variable. On macOS and Windows, users are expected to add CA certificates to their respective system's keychain/certificate store. Patch courtesy of Sebastian A. Siewior.
    clamscan and clamdscan now print the scan start and end dates in the scan summary.
    The clamonacc on-access scanning daemon for Linux now installs to sbin instead of bin.
    Improvements to the freshclam progress bar to ensure the text does not shift around as information changes. The bar will not exceed 80 characters, even on very slow connections. Time is now displayed in Xm XXs (or Xh XXm) for values of 60 seconds or longer. The bytes display now changes units at the proper 1024 B/KiB instead of 2048 B/KiB. Patch courtesy of Zachary Murden.
    Improve column alignment and line wrap rendering for clamdtop. Also fixed an issue on Windows where clamdtop would occasionally disconnect from clamd and fail to reconnect. Patch courtesy of Zachary Murden.
    Improvements to the AutoIT parser.
    Loosened the curl version requirements in order to build and use clamonacc. You may now build ClamAV with any version of libcurl. However, clamonacc's file descriptor-passing (FD-passing) capability will only be available with libcurl 7.40 or newer. FD-passing is ordinarily the default way to perform scans with clamonacc, as it is significantly faster than streaming.
    Added LZMA and BZip2 decompression routines to the bytecode signature API.
    Disabled embedded type recognition for specific archive and disk image file types. This change reduces file type misclassification and improves scan time performance by reducing duplicated file scanning.
    Use pkg-config to detect libpcre2-8 before resorting to pcre2-config or pcre-config.
    Patch courtesy of Michael Orlitzky.

    Bug fixes:

    Fixed issue scanning directories on Windows with clamdscan.exe that was introduced when mitigating against symlink quarantine attacks.
    Fixed behavior of freshclam --quiet option. Patch courtesy of Reio Remma.
    Fixed behavior of freshclam's OnUpdateExecute, OnErrorExecute, and OnOutdatedExecute config options on Windows when in daemon-mode so it can handle multiple arguments. Patch courtesy of Zachary Murden.
    Fixed an error in the heuristic alert mechanism that would cause a single detection within an archive to alert once for every subsequent file scanned, potentially resulting in thousands of alerts for a single scan.
    Fixed clamd, clamav-milter, and freshclam to create PID files before dropping privileges, to avoid the possibility of an unprivileged user from changing the PID file so that a service manager will kill a different process. This change does make the services unable to clean up the PID file on exit.
    Fixed the false positive (.fp) signature feature. In prior versions, the hash in a false positive signature would be checked only against the current layer of a file being scanned. In 0.103, every file layer is hashed, and the hashes for each in the scan recursion list are checked. This ensures that .fp signatures containing a hash for any layer in the scan leading up to the alert will negate the alert.
    As an example, a hash for a zip containing the file which alerts would not prevent the detection in prior versions. Only the hash of the embedded file would work. For some file types where the outermost is always an archive, eg. docx files, this made .fp signatures next to useless. For certain file types where the scanned content was a normalized version of the original content, eg. HTML, the normalized version was never hashed and this meant that .fp signatures never worked.
    Fixed Trusted & Revoked Windows executable (PE) file signature rules (.crb) maximum functionality level (FLEVEL) which had been being treated as the minimum FLEVEL. These signatures enable ClamAV to trust executables that are digitally signed by trusted publishers or to alert on executables signed with compromised signing-certificates. The minimum and maximum FLEVELS enable or disable signatures at load time depending on the current ClamAV version.
    Fixed a bug wherein you could not build ClamAV with --enable-libclamav-only if curl was not installed on the system.
    Various other bug fixes, improvements and documentation improvements.

    New Requirements:

    Autotools (automake, autoconf, m4, pkg-config, libtool) are now required to build from a Git clone because the files generated by these tools have been removed from the Git repository. To generate these files before you compile ClamAV, run autogen.sh. Users building with autotools from the release tarball should be unaffected.

[close]

http://www.clamav.net

[SiLæncer]

A flexible antivirus solution based on ClamAV's virus database, offering a good level of detection for possible threats within a minimalistic UI.

Freeware

https://www.aulap.my.id/softwares

[SiLæncer]

Changelog

    This is a security patch release with the following fixes:

    CVE-2021-1386: Fix for UnRAR DLL load privilege escalation. Affects 0.103.1 and prior on Windows only.
    CVE-2021-1252: Fix for Excel XLM parser infinite loop. Affects 0.103.0 and 0.103.1 only.
    CVE-2021-1404: Fix for PDF parser buffer over-read; possible crash. Affects 0.103.0 and 0.103.1 only.
    CVE-2021-1405: Fix for mail parser NULL-dereference crash. Affects 0.103.1 and prior.
    Fix possible memory leak in PNG parser.
    Fix ClamOnAcc scan on file-creation race condition so files are scanned after their contents are written.
    FreshClam: Deprecate the SafeBrowsing config option. The SafeBrowsing option will no longer do anything. For more details, see our blog post from last year about the future of the ClamAV Safe Browsing database.
    DatabaseCustomURL option in freshclam.conf to download it.
    FreshClam: Improved HTTP 304, 403 and 429 handling.
    FreshClam: Added the mirrors.dat file back to the database directory.

    This new mirrors.dat file will store:

    A randomly generated UUID for the FreshClam User-Agent.
    A retry-after timestamp that so FreshClam won't try to update after having received an HTTP 429 response until the Retry-After timeout has expired.
    FreshClam will now exit with a failure in daemon mode if an HTTP 403 (Forbidden) was received because the outcome won't change if it tries again later. The FreshClam user will have to take appropriate action to get unblocked.
    Fix the FreshClam mirror-sync issue where a downloaded database is "older than the version advertised."

[close]

http://www.clamav.net