Read this online at: https://blog.clamav.net/2023/07/2023-08-16-releases.html
Today, we are releasing the following critical patch versions for ClamAV:
* 1.1.1
* 1.0.2
* 0.103.9
ClamAV 0.105 and 0.104 have reached end-of-life according to the ClamAV’s End of Life (EOL) policy<https://docs.clamav.net/faq/faq-eol.html> and will not be patched.
The release files are available for download on ClamAV.net<https://www.clamav.net/downloads>, on the Github Release page<https://github.com/Cisco-Talos/clamav/releases>, and through Docker Hub<https://hub.docker.com/r/clamav/clamav/>.
Note: We observed an issue building ClamAV on Windows using the recently released libjson-c version 0.17. If you are building ClamAV for Windows, you should use libjson-c version 0.16 or prior.
1.1.1
ClamAV 1.1.1 is a critical patch release with the following fixes:
* CVE-2023-20197<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197> Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
* Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/997
* Fixed a build issue on Windows when using Rust version 1.70 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/994
* CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/972
* Removed a warning message showing the HTTP response codes during the Freshclam database update process.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/939
Special thanks to the following people for code contributions and bug reports:
* Steve Smith
1.0.2
ClamAV 1.0.2 is a critical patch release with the following fixes:
* CVE-2023-20197<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197> Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
* CVE-2023-20212<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20212> Fixed a possible denial of service vulnerability in the AutoIt file parser. This issue affects versions 1.0.1 and 1.0.0. This issue does not affect version 1.1.0.
* Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/996
* Fixed a build issue on Windows when using Rust version 1.70 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/993
* CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/973
* Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature. The bug would later cause a crash when scanning certain files.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/952
* Fixed an issue so that ClamAV correctly removes temporary files generated by the VBA and XLM extraction modules so that the files are not leaked in patched versions of ClamAV where temporary files are written directly to the temp-directory instead of writing to a unique subdirectory.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/900
* Set Git attributes to prevent Git from altering line endings for bundled Rust libraries. Third-party Rust libraries are bundled in the ClamAV release tarball. We do not commit them to our own Git repository, but community package maintainers may now store the tarball contents in Git. The Rust build system verifies the library manifest, and this change ensures that the hashes are correct. Improvement courtesy of Nicolas R.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/856
* Fixed two bugs that would cause Freshclam to fail update when applying a CDIFF database patch if that patch adds a file to the database archive or removes a file from the database archive. This bug also caused Sigtool to fail to create such a patch.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/901
Special thanks to the following people for code contributions and bug reports:
* Nicolas R.
* Steve Smith
0.103.9
ClamAV 0.103.9 is a critical patch release with the following fixes:
* CVE-2023-20197<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197> Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
* Fixed compiler warnings that may turn into errors in Clang 16. Patch courtesy of Michael Orlitzky.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/747
Special thanks to the following people for code contributions and bug reports:
* Michael Orlitzky
* Steve Smith
Posted by Micah Snyder <https://www.blogger.com/profile/07798916006145826441> at 5:39?PM<https://blog.clamav.net/2023/07/2023-08-16-releases.html> [https://img1.blogblog.com/img/icon18_email.gif] <https://www.blogger.com/email-post.g?blogID=2366689974368239573&postID=6613298127849701948> [https://img2.blogblog.com/img/icon18_edit_allbkg.gif] <https://www.blogger.com/post-edit.g?blogID=2366689974368239573&postID=6613298127849701948&from=pencil>
Email This<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=email>BlogThis!<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=blog>Share to Twitter<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=twitter>Share to Facebook<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=facebook>Share to Pinterest<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=pinterest>
Labels: 0.103.9<https://blog.clamav.net/search/label/0.103.9>, 1.0.2<https://blog.clamav.net/search/label/1.0.2>, 1.1.1<https://blog.clamav.net/search/label/1.1.1>, patch<https://blog.clamav.net/search/label/patch>, patch release<https://blog.clamav.net/search/label/patch%20release>, security updates<https://blog.clamav.net/search/label/security%20updates>
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.
Today, we are releasing the following critical patch versions for ClamAV:
* 1.1.1
* 1.0.2
* 0.103.9
ClamAV 0.105 and 0.104 have reached end-of-life according to the ClamAV’s End of Life (EOL) policy<https://docs.clamav.net/faq/faq-eol.html> and will not be patched.
The release files are available for download on ClamAV.net<https://www.clamav.net/downloads>, on the Github Release page<https://github.com/Cisco-Talos/clamav/releases>, and through Docker Hub<https://hub.docker.com/r/clamav/clamav/>.
Note: We observed an issue building ClamAV on Windows using the recently released libjson-c version 0.17. If you are building ClamAV for Windows, you should use libjson-c version 0.16 or prior.
1.1.1
ClamAV 1.1.1 is a critical patch release with the following fixes:
* CVE-2023-20197<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197> Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
* Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/997
* Fixed a build issue on Windows when using Rust version 1.70 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/994
* CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/972
* Removed a warning message showing the HTTP response codes during the Freshclam database update process.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/939
Special thanks to the following people for code contributions and bug reports:
* Steve Smith
1.0.2
ClamAV 1.0.2 is a critical patch release with the following fixes:
* CVE-2023-20197<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197> Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
* CVE-2023-20212<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20212> Fixed a possible denial of service vulnerability in the AutoIt file parser. This issue affects versions 1.0.1 and 1.0.0. This issue does not affect version 1.1.0.
* Fixed a build issue when using the Rust nightly toolchain, which was affecting the oss-fuzz build environment used for regression tests.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/996
* Fixed a build issue on Windows when using Rust version 1.70 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/993
* CMake build system improvement to support compiling with OpenSSL 3.x on macOS with the Xcode toolchain. The official ClamAV installers and packages are now built with OpenSSL 3.1.1 or newer.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/973
* Fixed an issue where ClamAV does not abort the signature load process after partially loading an invalid signature. The bug would later cause a crash when scanning certain files.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/952
* Fixed an issue so that ClamAV correctly removes temporary files generated by the VBA and XLM extraction modules so that the files are not leaked in patched versions of ClamAV where temporary files are written directly to the temp-directory instead of writing to a unique subdirectory.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/900
* Set Git attributes to prevent Git from altering line endings for bundled Rust libraries. Third-party Rust libraries are bundled in the ClamAV release tarball. We do not commit them to our own Git repository, but community package maintainers may now store the tarball contents in Git. The Rust build system verifies the library manifest, and this change ensures that the hashes are correct. Improvement courtesy of Nicolas R.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/856
* Fixed two bugs that would cause Freshclam to fail update when applying a CDIFF database patch if that patch adds a file to the database archive or removes a file from the database archive. This bug also caused Sigtool to fail to create such a patch.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/901
Special thanks to the following people for code contributions and bug reports:
* Nicolas R.
* Steve Smith
0.103.9
ClamAV 0.103.9 is a critical patch release with the following fixes:
* CVE-2023-20197<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20197> Fixed a possible denial of service vulnerability in the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through 1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8 through 0.103.0. Thank you to Steve Smith for reporting this issue.
* Fixed compiler warnings that may turn into errors in Clang 16. Patch courtesy of Michael Orlitzky.
* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/747
Special thanks to the following people for code contributions and bug reports:
* Michael Orlitzky
* Steve Smith
Posted by Micah Snyder <https://www.blogger.com/profile/07798916006145826441> at 5:39?PM<https://blog.clamav.net/2023/07/2023-08-16-releases.html> [https://img1.blogblog.com/img/icon18_email.gif] <https://www.blogger.com/email-post.g?blogID=2366689974368239573&postID=6613298127849701948> [https://img2.blogblog.com/img/icon18_edit_allbkg.gif] <https://www.blogger.com/post-edit.g?blogID=2366689974368239573&postID=6613298127849701948&from=pencil>
Email This<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=email>BlogThis!<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=blog>Share to Twitter<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=twitter>Share to Facebook<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=facebook>Share to Pinterest<https://www.blogger.com/share-post.g?blogID=2366689974368239573&postID=6613298127849701948&target=pinterest>
Labels: 0.103.9<https://blog.clamav.net/search/label/0.103.9>, 1.0.2<https://blog.clamav.net/search/label/1.0.2>, 1.1.1<https://blog.clamav.net/search/label/1.1.1>, patch<https://blog.clamav.net/search/label/patch>, patch release<https://blog.clamav.net/search/label/patch%20release>, security updates<https://blog.clamav.net/search/label/security%20updates>
Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.