Received: by mail.netbsd.org (Postfix, from userid 605) id B142984F45; Thu, 5 May 2022 00:44:09 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id EB0CC84EFC for ; Thu, 5 May 2022 00:44:08 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id Skc4JfLYD9tF for ; Thu, 5 May 2022 00:44:08 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 256B484ED0 for ; Thu, 5 May 2022 00:44:08 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 17FB3FB1A; Thu, 5 May 2022 00:44:08 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1651711448174290" MIME-Version: 1.0 Date: Thu, 5 May 2022 00:44:08 +0000 From: "Takahiro Kambe" Subject: CVS commit: pkgsrc/security/clamav To: pkgsrc-changes@NetBSD.org Reply-To: taca@netbsd.org X-Mailer: log_accum Message-Id: <20220505004408.17FB3FB1A@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1651711448174290 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" Module Name: pkgsrc Committed By: taca Date: Thu May 5 00:44:07 UTC 2022 Modified Files: pkgsrc/security/clamav: Makefile Makefile.common buildlink3.mk distinfo Log Message: security/clamav: update to 0.103.6 0.103.6 (2022-05-04) ClamAV 0.103.6 is a critical patch release with the following fixes: - [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulnerability in the CHM file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. Thank you to Michał Dardas for reporting this issue. - [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer dereference crash in the scan verdict cache check. Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2. Thank you to Alexander Patrakov and Antoine Gatineau for reporting this issue. - [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulnerability in the TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. The issue only occurs if the "--alert-broken-media" ClamScan option is enabled. For ClamD, the affected option is "AlertBrokenMedia yes", and for libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. Thank you to Michał Dardas for reporting this issue. - [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the HTML file parser / Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. Thank you to Michał Dardas for reporting this issue. - [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buffer overflow write vulnerability in the signature database load module. The fix was to update the vendored regex library to the latest version. Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions. Thank you to Michał Dardas for reporting this issue. - ClamOnAcc: Fixed a number of assorted stability issues and added niceties for debugging ClamOnAcc. Patches courtesy of Frank Fegert. - Fixed an issue causing byte-compare subsignatures to cause an alert when they match even if other conditions of the given logical signatures were not met. - Fix memleak when using multiple byte-compare subsignatures. This fix was backported from 0.104.0. Thank you to Andrea De Pasquale for contributing the fix. - Assorted bug fixes and improvements. Special thanks to the following people for code contributions and bug reports: - Alexander Patrakov - Andrea De Pasquale - Antoine Gatineau - Frank Fegert - Michał Dardas To generate a diff of this commit: cvs rdiff -u -r1.83 -r1.84 pkgsrc/security/clamav/Makefile cvs rdiff -u -r1.22 -r1.23 pkgsrc/security/clamav/Makefile.common cvs rdiff -u -r1.15 -r1.16 pkgsrc/security/clamav/buildlink3.mk cvs rdiff -u -r1.41 -r1.42 pkgsrc/security/clamav/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1651711448174290 Content-Disposition: inline Content-Length: 3079 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/security/clamav/Makefile diff -u pkgsrc/security/clamav/Makefile:1.83 pkgsrc/security/clamav/Makefile:1.84 --- pkgsrc/security/clamav/Makefile:1.83 Mon Apr 18 19:10:04 2022 +++ pkgsrc/security/clamav/Makefile Thu May 5 00:44:07 2022 @@ -1,6 +1,5 @@ -# $NetBSD: Makefile,v 1.83 2022/04/18 19:10:04 adam Exp $ +# $NetBSD: Makefile,v 1.84 2022/05/05 00:44:07 taca Exp $ -PKGREVISION= 1 .include "Makefile.common" COMMENT= Anti-virus toolkit Index: pkgsrc/security/clamav/Makefile.common diff -u pkgsrc/security/clamav/Makefile.common:1.22 pkgsrc/security/clamav/Makefile.common:1.23 --- pkgsrc/security/clamav/Makefile.common:1.22 Thu Jan 13 15:28:22 2022 +++ pkgsrc/security/clamav/Makefile.common Thu May 5 00:44:07 2022 @@ -1,9 +1,9 @@ -# $NetBSD: Makefile.common,v 1.22 2022/01/13 15:28:22 taca Exp $ +# $NetBSD: Makefile.common,v 1.23 2022/05/05 00:44:07 taca Exp $ # # used by security/clamav/Makefile # used by security/clamav-doc/Makefile -DISTNAME= clamav-0.103.5 +DISTNAME= clamav-0.103.6 CATEGORIES= security MASTER_SITES= http://www.clamav.net/downloads/production/ Index: pkgsrc/security/clamav/buildlink3.mk diff -u pkgsrc/security/clamav/buildlink3.mk:1.15 pkgsrc/security/clamav/buildlink3.mk:1.16 --- pkgsrc/security/clamav/buildlink3.mk:1.15 Mon Apr 18 19:10:04 2022 +++ pkgsrc/security/clamav/buildlink3.mk Thu May 5 00:44:07 2022 @@ -1,4 +1,4 @@ -# $NetBSD: buildlink3.mk,v 1.15 2022/04/18 19:10:04 adam Exp $ +# $NetBSD: buildlink3.mk,v 1.16 2022/05/05 00:44:07 taca Exp $ BUILDLINK_TREE+= clamav @@ -6,7 +6,7 @@ BUILDLINK_TREE+= clamav CLAMAV_BUILDLINK3_MK:= BUILDLINK_API_DEPENDS.clamav+= clamav>=0.95.3nb1 -BUILDLINK_ABI_DEPENDS.clamav+= clamav>=0.103.5nb1 +BUILDLINK_ABI_DEPENDS.clamav+= clamav>=0.103.6 BUILDLINK_PKGSRCDIR.clamav?= ../../security/clamav .include "../../archivers/bzip2/buildlink3.mk" Index: pkgsrc/security/clamav/distinfo diff -u pkgsrc/security/clamav/distinfo:1.41 pkgsrc/security/clamav/distinfo:1.42 --- pkgsrc/security/clamav/distinfo:1.41 Thu Jan 13 15:28:22 2022 +++ pkgsrc/security/clamav/distinfo Thu May 5 00:44:07 2022 @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.41 2022/01/13 15:28:22 taca Exp $ +$NetBSD: distinfo,v 1.42 2022/05/05 00:44:07 taca Exp $ -BLAKE2s (clamav-0.103.5.tar.gz) = 045c523bcbd02439cc05095cc19d102eee7af6db5cda340e19ed47fb885a3ae9 -SHA512 (clamav-0.103.5.tar.gz) = 242423b507eacbbd31dbae6dd0325dff87da25bb8072f2cee7a5e7cab4b8eb5ee6196c759570c1d75986a2777f0f79f92cfbd6250a30ae5b53390c75b238c29a -Size (clamav-0.103.5.tar.gz) = 16434316 bytes +BLAKE2s (clamav-0.103.6.tar.gz) = 402df52b9e6ad382f0d63abe2b2cfd97472dd0873e956d96a37e83b17f715988 +SHA512 (clamav-0.103.6.tar.gz) = d39e1964678b8251bde3a9f3db30fe3d3d76cc566a86834297f4dd8489086dc9cc4c6541ca128089159f4c071d2d85b530455bd942987d3929ea0082b8ab272b +Size (clamav-0.103.6.tar.gz) = 16491761 bytes SHA1 (patch-Makefile.in) = 51e0f42323f07b7ae0cb35a640469dce4e1a2041 SHA1 (patch-aa) = c07a7b6e883f384ce278964645f0658c0d986ab5 SHA1 (patch-ab) = 78793f0267ce8c820b51937186dc17dabb4a1ccf --_----------=_1651711448174290--