Mailing List Archive: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published

ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published

Feb 15, 2023, 11:56 AM

Post #1 of 14 (569 views)

Read this online at https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html

-----------------

Today, we are releasing the following critical patch versions for ClamAV:

* 0.103.8
* 0.105.2
* 1.0.1

ClamAV 0.104 has reached end-of-life according to the ClamAV End of Life (EOL) policy<https://docs.clamav.net/faq/faq-eol.html> and will not be patched. Anyone using ClamAV 0.104 must switch to a supported version. All users should update as soon as possible to patch for two remote code execution vulnerabilities that we recently discovered and patched.

The release files are available for download on ClamAV.net<https://www.clamav.net/downloads>, on the Github Release page<https://github.com/Cisco-Talos/clamav/releases>, and through Docker Hub<https://hub.docker.com/r/clamav/clamav/>.

1.0.1

ClamAV 1.0.1 is a critical patch release with the following fixes:

* CVE-2023-20032<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032>: Fixed a possible remote code execution vulnerability in the HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

* CVE-2023-20052<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052>: Fixed a possible remote information leak vulnerability in the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

* Fix an allmatch detection issue with the preclass bytecode hook.

* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/825

* Update the vendored libmspack library to version 0.11alpha.

* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/828

0.105.2

ClamAV 0.105.2 is a critical patch release with the following fixes:

* CVE-2023-20032<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032>: Fixed a possible remote code execution vulnerability in the HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

* CVE-2023-20052<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052>: Fixed a possible remote information leak vulnerability in the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

* Fixed an issue loading Yara rules containing regex strings with an escaped forward-slash (\/) followed by a colon (:).

* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/695

* Moved the ClamAV Docker files for building containers to a new Git repository. The Docker files are now in https://github.com/Cisco-Talos/clamav-docker. This change enables us to fix issues with the images and with the supporting scripts used to publish and update the images without committing changes directly to files in the ClamAV release branches.

* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/765

* Update the vendored libmspack library to version 0.11alpha.

* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/829

0.103.8

ClamAV 0.103.8 is a critical patch release with the following fixes:

* CVE-2023-20032<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032>: Fixed a possible remote code execution vulnerability in the HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

* CVE-2023-20052<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052>: Fixed a possible remote information leak vulnerability in the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

* Update the vendored libmspack library to version 0.11alpha.

* GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/830

Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 15, 2023, 12:11 PM

Post #2 of 14 (569 views)

Permalink

Unfortunately Ubuntu (22.04.1) has not released 0.103.7 since today... We
are on 0.103.6 and get always warnings from feshclam that we use an
outdated version ????.... Don't know, when Ubuntu will push this fixed
version. I will really update, but when we don't get the new packages...

Am 15. Februar 2023 20:58:18 schrieb "Micah Snyder \(micasnyd\) via
clamav-users" <clamav-users@lists.clamav.net>:
> Read this online at
> https://blog.clamav.net/2023/02/clamav-01038-01052-and-101-patch.html
>
>
> -----------------
>
>
>
> Today, we are releasing the following critical patch versions for ClamAV:
> 0.103.8
> 0.105.2
> 1.0.1
> ClamAV 0.104 has reached end-of-life according to the
>
> ClamAV End of Life (EOL) policy and will not be patched. Anyone using
> ClamAV 0.104 must switch to a supported version. All users should update as
> soon as possible to patch for two remote code execution vulnerabilities
> that we recently discovered and patched.
> The release files are available for download on
> ClamAV.net, on the
>
> Github Release page, and through Docker Hub.
> 1.0.1
> ClamAV 1.0.1 is a critical patch release with the following fixes:
> CVE-2023-20032: Fixed a possible remote code execution vulnerability in the
> HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and
> earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting
> this issue.
> CVE-2023-20052: Fixed a possible remote information leak vulnerability in
> the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1
> and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for
> reporting this issue.
> Fix an allmatch detection issue with the preclass bytecode hook.
> GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/825
> Update the vendored libmspack library to version 0.11alpha.
> GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/828
> 0.105.2
> ClamAV 0.105.2 is a critical patch release with the following fixes:
> CVE-2023-20032: Fixed a possible remote code execution vulnerability in the
> HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and
> earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting
> this issue.
> CVE-2023-20052: Fixed a possible remote information leak vulnerability in
> the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1
> and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for
> reporting this issue.
> Fixed an issue loading Yara rules containing regex strings with an escaped
> forward-slash (\/) followed by a colon (:).
> GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/695
> Moved the ClamAV Docker files for building containers to a new Git
> repository. The Docker files are now in
> https://github.com/Cisco-Talos/clamav-docker. This change enables us to fix
> issues with the images and with the supporting scripts used to publish and
> update the images without committing changes directly to files in the
> ClamAV release branches.
> GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/765
> Update the vendored libmspack library to version 0.11alpha.
> GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/829
> 0.103.8
> ClamAV 0.103.8 is a critical patch release with the following fixes:
> CVE-2023-20032: Fixed a possible remote code execution vulnerability in the
> HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and
> earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting
> this issue.
> CVE-2023-20052: Fixed a possible remote information leak vulnerability in
> the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1
> and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for
> reporting this issue.
> Update the vendored libmspack library to version 0.11alpha.
> GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/830
>
>
>
>
> Micah Snyder
> ClamAV Development
> Talos
> Cisco Systems, Inc.
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat

ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 18, 2023, 10:35 AM

Post #3 of 14 (567 views)

Permalink

Hello,

I would like to ask whether these two new vulnerabilities affect the
version 0.100.3.

Thank you

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 18, 2023, 10:53 AM

Post #4 of 14 (567 views)

Permalink

?100.3 hasn’t been supported in years. There’s lots of our abilities that affect the version.

> On Feb 18, 2023, at 13:36, George.G via clamav-users <clamav-users@lists.clamav.net> wrote:
>
> ?
> Hello,
>
> I would like to ask whether these two new vulnerabilities affect the version 0.100.3.
>
> Thank you
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 18, 2023, 11:13 AM

Post #5 of 14 (567 views)

Permalink

Vulnerabilities*

—
Sent from my iPhone

> On Feb 18, 2023, at 13:54, Joel Esler <joel.esler@me.com> wrote:
>
> ?100.3 hasn’t been supported in years. There’s lots of our abilities that affect the version.
>
>> On Feb 18, 2023, at 13:36, George.G via clamav-users <clamav-users@lists.clamav.net> wrote:
>>
>> ?
>> Hello,
>>
>> I would like to ask whether these two new vulnerabilities affect the version 0.100.3.
>>
>> Thank you
>> _______________________________________________
>>
>> Manage your clamav-users mailing list subscription / unsubscribe:
>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/Cisco-Talos/clamav-documentation
>>
>> https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 20, 2023, 4:11 AM

Post #6 of 14 (567 views)

Permalink

Good day Guys

Anyone on Debian Buster and Bullseye?

How serious is this?
Does anyone have any suggestions. Cause there is no packages available.

If anyone can share their thoughts / experiences.

Regards
Brent

On 2023/02/18 21:13, unison.subject_0t--- via clamav-users wrote:
> Vulnerabilities*
>
> —
> Sent from my iPhone
>
>> On Feb 18, 2023, at 13:54, Joel Esler <joel.esler@me.com> wrote:
>>
>> ?100.3 hasn’t been supported in years. There’s lots of our abilities that affect the version.
>>
>>> On Feb 18, 2023, at 13:36, George.G via clamav-users <clamav-users@lists.clamav.net> wrote:
>>>
>>> ?
>>> Hello,
>>>
>>> I would like to ask whether these two new vulnerabilities affect the version 0.100.3.
>>>
>>> Thank you
>>> _______________________________________________
>>>
>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>
>>>
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/Cisco-Talos/clamav-documentation
>>>
>>> https://docs.clamav.net/#mailing-lists-and-chat
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 20, 2023, 4:41 AM

Post #7 of 14 (567 views)

Permalink

Packages for Bullseye are available in bullseye -proposed-updates. Buster is now supported by the Debian LTS team and I don't know their plans.

Scott K

On February 20, 2023 12:11:10 PM UTC, Brent Clark via clamav-users <clamav-users@lists.clamav.net> wrote:
>Good day Guys
>
>Anyone on Debian Buster and Bullseye?
>
>How serious is this?
>Does anyone have any suggestions. Cause there is no packages available.
>
>If anyone can share their thoughts / experiences.
>
>Regards
>Brent
>
>On 2023/02/18 21:13, unison.subject_0t--- via clamav-users wrote:
>> Vulnerabilities*
>>
>> —
>> Sent from my iPhone
>>
>>> On Feb 18, 2023, at 13:54, Joel Esler <joel.esler@me.com> wrote:
>>>
>>> ?100.3 hasn’t been supported in years. There’s lots of our abilities that affect the version.
>>>
>>>> On Feb 18, 2023, at 13:36, George.G via clamav-users <clamav-users@lists.clamav.net> wrote:
>>>>
>>>> ?
>>>> Hello,
>>>>
>>>> I would like to ask whether these two new vulnerabilities affect the version 0.100.3.
>>>>
>>>> Thank you
>>>> _______________________________________________
>>>>
>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>>
>>>>
>>>> Help us build a comprehensive ClamAV guide:
>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>
>>>> https://docs.clamav.net/#mailing-lists-and-chat
>> _______________________________________________
>>
>> Manage your clamav-users mailing list subscription / unsubscribe:
>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/Cisco-Talos/clamav-documentation
>>
>> https://docs.clamav.net/#mailing-lists-and-chat
>_______________________________________________
>
>Manage your clamav-users mailing list subscription / unsubscribe:
>https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
>Help us build a comprehensive ClamAV guide:
>https://github.com/Cisco-Talos/clamav-documentation
>
>https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

webmaster at securiteinfo

Feb 20, 2023, 4:44 AM

Post #8 of 14 (567 views)

Permalink

Hi,

Le 20/02/2023 à 13:11, Brent Clark via clamav-users a écrit :
> Good day Guys
>
> Anyone on Debian Buster and Bullseye?
>
> How serious is this?
> Does anyone have any suggestions. Cause there is no packages available.

Package is available (0.103.8) in Bulleye proposed update :
https://tracker.debian.org/pkg/clamav

--
Cordialement / Best regards,

Arnaud Jacques
Gérant de SecuriteInfo.com

Téléphone : +33-(0)3.60.47.09.81
E-mail : aj@securiteinfo.com
Site web : https://www.securiteinfo.com
Facebook : https://www.facebook.com/pages/SecuriteInfocom/132872523492286
Twitter : @SecuriteInfoCom
Writing signatures for ClamAV antivirus since 2006
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 20, 2023, 10:43 AM

Post #9 of 14 (567 views)

Permalink

LTS team uploaded it today, so it should be available for Buster shortly, if
it isn't already.

Scott K

On Monday, February 20, 2023 7:41:16 AM EST Scott Kitterman via clamav-users
wrote:
> Packages for Bullseye are available in bullseye -proposed-updates. Buster
> is now supported by the Debian LTS team and I don't know their plans.
>
> Scott K
>
> On February 20, 2023 12:11:10 PM UTC, Brent Clark via clamav-users <clamav-
users@lists.clamav.net> wrote:
> >Good day Guys
> >
> >Anyone on Debian Buster and Bullseye?
> >
> >How serious is this?
> >Does anyone have any suggestions. Cause there is no packages available.
> >
> >If anyone can share their thoughts / experiences.
> >
> >Regards
> >Brent
> >
> >On 2023/02/18 21:13, unison.subject_0t--- via clamav-users wrote:
> >> Vulnerabilities*
> >>
> >> —
> >> Sent from my iPhone
> >>
> >>> On Feb 18, 2023, at 13:54, Joel Esler <joel.esler@me.com> wrote:
> >>>
> >>> ?100.3 hasn’t been supported in years. There’s lots of our abilities
> >>> that affect the version.>>>
> >>>> On Feb 18, 2023, at 13:36, George.G via clamav-users
> >>>> <clamav-users@lists.clamav.net> wrote:
> >>>>
> >>>> ?
> >>>> Hello,
> >>>>
> >>>> I would like to ask whether these two new vulnerabilities affect the
> >>>> version 0.100.3.
> >>>>
> >>>> Thank you
> >>>> _______________________________________________
> >>>>
> >>>> Manage your clamav-users mailing list subscription / unsubscribe:
> >>>> https://lists.clamav.net/mailman/listinfo/clamav-users
> >>>>
> >>>>
> >>>> Help us build a comprehensive ClamAV guide:
> >>>> https://github.com/Cisco-Talos/clamav-documentation
> >>>>
> >>>> https://docs.clamav.net/#mailing-lists-and-chat
> >>
> >> _______________________________________________
> >>
> >> Manage your clamav-users mailing list subscription / unsubscribe:
> >> https://lists.clamav.net/mailman/listinfo/clamav-users
> >>
> >>
> >> Help us build a comprehensive ClamAV guide:
> >> https://github.com/Cisco-Talos/clamav-documentation
> >>
> >> https://docs.clamav.net/#mailing-lists-and-chat
> >
> >_______________________________________________
> >
> >Manage your clamav-users mailing list subscription / unsubscribe:
> >https://lists.clamav.net/mailman/listinfo/clamav-users
> >
> >
> >Help us build a comprehensive ClamAV guide:
> >https://github.com/Cisco-Talos/clamav-documentation
> >
> >https://docs.clamav.net/#mailing-lists-and-chat
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 20, 2023, 10:57 AM

Post #10 of 14 (567 views)

Permalink

Does this mean, it affects the Ubuntu LTS too? This would be really great!

Am 20. Februar 2023 19:44:51 schrieb Scott Kitterman via clamav-users
<clamav-users@lists.clamav.net>:

> LTS team uploaded it today, so it should be available for Buster shortly, if
> it isn't already.
>
> Scott K
>
> On Monday, February 20, 2023 7:41:16 AM EST Scott Kitterman via clamav-users
> wrote:
>> Packages for Bullseye are available in bullseye -proposed-updates. Buster
>> is now supported by the Debian LTS team and I don't know their plans.
>>
>> Scott K
>>
>> On February 20, 2023 12:11:10 PM UTC, Brent Clark via clamav-users <clamav-
> users@lists.clamav.net> wrote:
>>> Good day Guys
>>>
>>> Anyone on Debian Buster and Bullseye?
>>>
>>> How serious is this?
>>> Does anyone have any suggestions. Cause there is no packages available.
>>>
>>> If anyone can share their thoughts / experiences.
>>>
>>> Regards
>>> Brent
>>>
>>> On 2023/02/18 21:13, unison.subject_0t--- via clamav-users wrote:
>>>> Vulnerabilities*
>>>>
>>>> —
>>>> Sent from my iPhone
>>>>
>>>>> On Feb 18, 2023, at 13:54, Joel Esler <joel.esler@me.com> wrote:
>>>>>
>>>>> 100.3 hasn’t been supported in years. There’s lots of our abilities
>>>>> that affect the version.>>>
>>>>>> On Feb 18, 2023, at 13:36, George.G via clamav-users
>>>>>> <clamav-users@lists.clamav.net> wrote:
>>>>>>
>>>>>>
>>>>>> Hello,
>>>>>>
>>>>>> I would like to ask whether these two new vulnerabilities affect the
>>>>>> version 0.100.3.
>>>>>>
>>>>>> Thank you
>>>>>> _______________________________________________
>>>>>>
>>>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>>>>
>>>>>>
>>>>>> Help us build a comprehensive ClamAV guide:
>>>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>>>
>>>>>> https://docs.clamav.net/#mailing-lists-and-chat
>>>>
>>>> _______________________________________________
>>>>
>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>>
>>>>
>>>> Help us build a comprehensive ClamAV guide:
>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>
>>>> https://docs.clamav.net/#mailing-lists-and-chat
>>>
>>> _______________________________________________
>>>
>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>
>>>
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/Cisco-Talos/clamav-documentation
>>>
>>> https://docs.clamav.net/#mailing-lists-and-chat
>>
>> _______________________________________________
>>
>> Manage your clamav-users mailing list subscription / unsubscribe:
>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>
>>
>> Help us build a comprehensive ClamAV guide:
>> https://github.com/Cisco-Talos/clamav-documentation
>>
>> https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 20, 2023, 11:18 AM

Post #11 of 14 (567 views)

Permalink

No. Ubuntu package maintenance is separate from Debian's.

Scott K

On February 20, 2023 6:57:46 PM UTC, Newcomer01 via clamav-users <clamav-users@lists.clamav.net> wrote:
>Does this mean, it affects the Ubuntu LTS too? This would be really great!
>
>Am 20. Februar 2023 19:44:51 schrieb Scott Kitterman via clamav-users <clamav-users@lists.clamav.net>:
>
>> LTS team uploaded it today, so it should be available for Buster shortly, if
>> it isn't already.
>>
>> Scott K
>>
>> On Monday, February 20, 2023 7:41:16 AM EST Scott Kitterman via clamav-users
>> wrote:
>>> Packages for Bullseye are available in bullseye -proposed-updates. Buster
>>> is now supported by the Debian LTS team and I don't know their plans.
>>>
>>> Scott K
>>>
>>> On February 20, 2023 12:11:10 PM UTC, Brent Clark via clamav-users <clamav-
>> users@lists.clamav.net> wrote:
>>>> Good day Guys
>>>>
>>>> Anyone on Debian Buster and Bullseye?
>>>>
>>>> How serious is this?
>>>> Does anyone have any suggestions. Cause there is no packages available.
>>>>
>>>> If anyone can share their thoughts / experiences.
>>>>
>>>> Regards
>>>> Brent
>>>>
>>>> On 2023/02/18 21:13, unison.subject_0t--- via clamav-users wrote:
>>>>> Vulnerabilities*
>>>>>
>>>>> —
>>>>> Sent from my iPhone
>>>>>
>>>>>> On Feb 18, 2023, at 13:54, Joel Esler <joel.esler@me.com> wrote:
>>>>>>
>>>>>> 100.3 hasn’t been supported in years. There’s lots of our abilities
>>>>>> that affect the version.>>>
>>>>>>> On Feb 18, 2023, at 13:36, George.G via clamav-users
>>>>>>> <clamav-users@lists.clamav.net> wrote:
>>>>>>>
>>>>>>>
>>>>>>> Hello,
>>>>>>>
>>>>>>> I would like to ask whether these two new vulnerabilities affect the
>>>>>>> version 0.100.3.
>>>>>>>
>>>>>>> Thank you
>>>>>>> _______________________________________________
>>>>>>>
>>>>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>>>>>
>>>>>>>
>>>>>>> Help us build a comprehensive ClamAV guide:
>>>>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>>>>
>>>>>>> https://docs.clamav.net/#mailing-lists-and-chat
>>>>>
>>>>> _______________________________________________
>>>>>
>>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>>>
>>>>>
>>>>> Help us build a comprehensive ClamAV guide:
>>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>>
>>>>> https://docs.clamav.net/#mailing-lists-and-chat
>>>>
>>>> _______________________________________________
>>>>
>>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>>
>>>>
>>>> Help us build a comprehensive ClamAV guide:
>>>> https://github.com/Cisco-Talos/clamav-documentation
>>>>
>>>> https://docs.clamav.net/#mailing-lists-and-chat
>>>
>>> _______________________________________________
>>>
>>> Manage your clamav-users mailing list subscription / unsubscribe:
>>> https://lists.clamav.net/mailman/listinfo/clamav-users
>>>
>>>
>>> Help us build a comprehensive ClamAV guide:
>>> https://github.com/Cisco-Talos/clamav-documentation
>>>
>>> https://docs.clamav.net/#mailing-lists-and-chat
>
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 20, 2023, 8:18 PM

Post #12 of 14 (566 views)

Permalink

I am using ClamAV 0.103.6 on Buster, but I have always built it from source (since way before Cisco and even SourceFire), hence I'm a bit obsolete.

I did this -- and still do it -- because ClamAV has always been a bit experimental. Thus I install each version under "/opt/clamav.d/version" so I can easily revert if there is a problem. (And I have similarly disabled the systemd linkage for more control).

On Mon, 20 Feb 2023 14:11:10 +0200
Brent Clark via clamav-users <clamav-users@lists.clamav.net> wrote:

> Good day Guys
>
> Anyone on Debian Buster and Bullseye?
>
> How serious is this?
> Does anyone have any suggestions. Cause there is no packages available.
>
> If anyone can share their thoughts / experiences.
>
> Regards
> Brent
>
> On 2023/02/18 21:13, unison.subject_0t--- via clamav-users wrote:
> > Vulnerabilities*
> >
> > —
> > Sent from my iPhone
> >
> >> On Feb 18, 2023, at 13:54, Joel Esler <joel.esler@me.com> wrote:
> >>
> >> ?100.3 hasn’t been supported in years. There’s lots of our abilities that affect the version.
> >>
> >>> On Feb 18, 2023, at 13:36, George.G via clamav-users <clamav-users@lists.clamav.net> wrote:
> >>>
> >>> ?
> >>> Hello,
> >>>
> >>> I would like to ask whether these two new vulnerabilities affect the version 0.100.3.
> >>>
> >>> Thank you
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

uhlar at fantomas

Feb 21, 2023, 6:19 AM

Post #13 of 14 (566 views)

Permalink

>On Mon, 20 Feb 2023 14:11:10 +0200
>Brent Clark via clamav-users <clamav-users@lists.clamav.net> wrote:
>> Anyone on Debian Buster and Bullseye?
>>
>> How serious is this?
>> Does anyone have any suggestions. Cause there is no packages available.
>>
>> If anyone can share their thoughts / experiences.

the packages for clamav 0.103.8 are now available on debian buster and
bullseye:

https://tracker.debian.org/pkg/clamav

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Silvester Stallone: Father of the RISC concept.
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Re: ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published [ In reply to ]

clamav-users at lists

Feb 21, 2023, 9:58 AM

Post #14 of 14 (565 views)

Permalink

> -----Original Message-----
> From: clamav-users <clamav-users-bounces@lists.clamav.net> On Behalf Of Scott Kitterman via clamav-users
> Sent: Monday, February 20, 2023 2:18 PM
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Cc: Scott Kitterman <debian@kitterman.com>
> Subject: Re: [clamav-users] ClamAV 0.103.8, 0.105.2 and 1.0.1 patch versions published
>
> No. Ubuntu package maintenance is separate from Debian's.
>
> Scott K

For those interested, David Gonzales just released the patches to security-proposed on Ubuntu:
https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/2007456

Sincerely,

Eric Tykwinski
TrueNet, Inc.
P: 610-429-8300

_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat

Mailing List Archive

Mailing List Archive

Attached Files: