1. clamav-devel
  2. Commit 30561caff531dd7d0c16aba214399baf3fceab40
Browse code

0.105 release prep: Update NEWS.md release notes

Also add release notes from 0.103 and 0.104 patch versions published
during the development of 0.105.

Also Update llvm support details in the INSTALL.md file.

Micah Snyder authored on 2022/03/01 11:24:48
Showing 2 changed files
INSTALL.md
History View file @ 30561ca
... ... 
@@ -50,6 +50,9 @@ configuration options.
50 50 
     - [`libcurl`](#libcurl)
51 51 
     - [`ncurses` or `pdcurses`, for `clamdtop`](#ncurses-or-pdcurses-for-clamdtop)
52 52 
     - [Bytecode Runtime](#bytecode-runtime)
53 
+      - [Interpreter Bytecode Runtime](#interpreter-bytecode-runtime)
54 
+      - [LLVM JIT Bytecode Runtime](#llvm-jit-bytecode-runtime)
55 
+      - [Disabling the Bytecode Runtime](#disabling-the-bytecode-runtime)
53 56 
   - [Compiling For Multiple Architectures (Cross-Compiling)](#compiling-for-multiple-architectures-cross-compiling)
54 57 
   - [Un-install](#un-install)
55 58
... ... 
@@ -618,9 +621,16 @@ need to specify the following:
618 618
619 619 
 ### `llvm` (optional, _see "Bytecode Runtime" section_)
620 620
621 
+Set:
621 622 
 ```sh
622 623 
   -D BYTECODE_RUNTIME="llvm"
623 
-  -D LLVM_ROOT_DIR="_path to llvm install root_" -D LLVM_FIND_VERSION="3.6.0"
624 
+```
625 
+
626 
+Options for a custom LLVM install path, or to select a specific version if you
627 
+have multiple LLVM installations:
628 
+```sh
629 
+  -D LLVM_ROOT_DIR="_path to llvm install root_"
630 
+  -D LLVM_FIND_VERSION="3.6.0"
624 631 
 ```
625 632
626 633 
 ### `libcurl`
... ... 
@@ -669,6 +679,8 @@ ClamAV has two bytecode runtimes:
669 669 
    We ran out of time in 0.104 development to update to support newer versions
670 670 
    of LLVM. LLVM 3.6.2 is the newest version supported in ClamAV 0.104.
671 671
672 
+#### Interpreter Bytecode Runtime
673 
+
672 674 
 At the moment, the *interpreter* is the default runtime, while we work out
673 675 
 compatibility issues with newer versions of libLLVM. This default equates to:
674 676
... ... 
@@ -676,15 +688,54 @@ compatibility issues with newer versions of libLLVM. This default equates to:
676 676 
 cmake .. -D BYTECODE_RUNTIME="interpreter"
677 677 
 ```
678 678
679 
-If you wish to build using LLVM instead of the intereter, you will need to
680 
-obtain v3.6 of the LLVM development libraries. Then build using these options:
679 
+#### LLVM JIT Bytecode Runtime
680 
+
681 
+If you wish to build using LLVM JIT for the bytecode runtime instead of the
682 
+bytecode interpreter, you will need to install the LLVM development libraries.
683 
+ClamAV currently supports LLVM versions 8.0 through 12.0.
681 684
685 
+To build with LLVM for the bytecode runtime, build with this option:
682 686 
 ```sh
683 687 
 cmake .. \
684 
-  -D BYTECODE_RUNTIME="llvm"       \
685 
-  -D LLVM_ROOT_DIR="/opt/llvm/3.6" \
686 
-  -D LLVM_FIND_VERSION="3.6.0"
688 
+  -D BYTECODE_RUNTIME="llvm"
689 
+```
690 
+
691 
+If you have multiple LLVM installations, or have a custom path for the LLVM
692 
+installation, you may also set `LLVM_ROOT_DIR` and `LLVM_FIND_VERSION` options
693 
+to help CMake find the right LLVm installation. For example:
694 
+```sh
695 
+  -D LLVM_ROOT_DIR="/opt/llvm/8.0"
696 
+  -D LLVM_FIND_VERSION="8.0.1"
697 
+```
698 
+
699 
+If the build fails to detect LLVM or linking with LLVM fails using the above
700 
+options, you may try adding this CMake parameter to enable
701 
+[CMake's package-config feature](https://cmake.org/cmake/help/latest/variable/CMAKE_FIND_PACKAGE_PREFER_CONFIG.html):
702 
+```
703 
+  -D CMAKE_FIND_PACKAGE_PREFER_CONFIG=TRUE
687 704 
 ```
705 
+Normally, ClamAV would use the `FindLLVM.cmake` module in our `<src>/cmake`
706 
+directory to find LLVM. With this option enabled, it will instead try to use
707 
+`<LLVM_ROOT_DIR>/lib/cmake/llvm/LLVMConfig.cmake` to determine the LLVM package
708 
+configuration.
709 
+
710 
+> _Known Issues_: Known issues building with LLVM:
711 
+> - Enabling `CMAKE_FIND_PACKAGE_PREFER_CONFIG` may fail to build with some LLVM
712 
+>   packages that are missing the `libPolly.a` library. This includes some LLVM
713 
+>   packages distributed by Debian, Ubuntu, and OpenSUSE.
714 
+> - Not enabling `CMAKE_FIND_PACKAGE_PREFER_CONFIG` may fail to build with some
715 
+>   LLVM packages using `gcc` when RTTI was disabled for the LLVM build, but is
716 
+>   enabled for the ClamAV build. Using `clang` instead of `gcc` may have better
717 
+>   results.
718 
+> - Building ClamAV in Debug-mode with a Release-LLVM build may fail, and
719 
+>   building ClamAV in Release-mode with a Debug-LLVM build may fail.
720 
+> - The unit tests may fail in Debug-mode builds on the `libclamav` "bytecode"
721 
+>   test due to an assertion/abort.
722 
+> - Windows-only: CMake fails to collect library dependencies when building with
723 
+>   LLVM. That is, the tests will fail because it can't load libssl.dll and
724 
+>   other DLL dependencies. This issue only applies when not using VCPkg.
725 
+
726 
+#### Disabling the Bytecode Runtime
688 727
689 728 
 To disable bytecode signature support entirely, you may build with this option:
690 729
NEWS.md
History View file @ 30561ca
... ... 
@@ -9,10 +9,101 @@ ClamAV 0.105.0 includes the following improvements and changes.
9 9
10 10 
 ### New Requirements
11 11
12 
+- Starting with ClamAV v0.105, the Rust toolchain is required to compile ClamAV.
13 
+
14 
+  You can install the Rust toolchain for your development environment by
15 
+  following the instructions on the [`rustup`](https://rustup.rs/) website.
16 
+  Some binary package distributions do provide relatively up-to-date packages of
17 
+  the Rust toolchain, but many do not. Using `rustup` ensures that you have the
18 
+  most up-to-date Rust compiler at the time of installation. Keep your toolchain
19 
+  updated for new features and bug/security fixes by periodically executing:
20 
+  ```sh
21 
+  rustup update
22 
+  ```
23 
+
24 
+  Building ClamAV requires, at a minimum, Rust compiler version 1.56, as it
25 
+  relies on features introduced in the Rust 2021 Edition.
26 
+
27 
+  ClamAV's third-party Rust library dependencies are vendored into the release
28 
+  tarball (`clamav-<version>.tar.gz`) file that we publish on
29 
+  [clamav.net/downloads](https://www.clamav.net/downloads).
30 
+  But, if you build from a Git clone or from an unofficial tarball taken from
31 
+  GitHub.com, you will need the internet to download the Rust libraries during
32 
+  the build.
33 
+
12 34 
 ### Major changes
13 35
36 
+- Increased the default limits for file-size and scan-size:
37 
+  - MaxScanSize:        100M -> 400M
38 
+  - MaxFileSize:        25M  -> 100M
39 
+  - StreamMaxLength:    25M  -> 100M
40 
+  - PCREMaxFileSize:    25M  -> 100M
41 
+  - MaxEmbeddedPE:      10M  -> 40M
42 
+  - MaxHTMLNormalize:   10M  -> 40M
43 
+  - MaxScriptNormalize: 5M   -> 20M
44 
+  - MaxHTMLNoTags:      2M   -> 8M
45 
+
46 
+- Added image fuzzy hash subsignatures for logical signatures.
47 
+
48 
+  Image fuzzy hash subsignatures are a new feature for detecting images known to
49 
+  be used in phishing campaigns or otherwise used when distributing malware.
50 
+
51 
+  Image fuzzy hash subsignatures follow this format:
52 
+  ```
53 
+  fuzzy_img#<hash>
54 
+  ```
55 
+  For example:
56 
+  ```
57 
+  logo.png;Engine:150-255,Target:0;0;fuzzy_img#af2ad01ed42993c7
58 
+  logo.png-2;Engine:150-255,Target:0;0&1;49484452;fuzzy_img#af2ad01ed42993c7
59 
+  ```
60 
+
61 
+  This initial implementation does not support matching with a hamming distance.
62 
+  Support for matching with a hamming distance may be added in a future release.
63 
+
64 
+  ClamAV's image fuzzy hash is very close to, but not 100% identical to, the
65 
+  fuzzy hash generated by the Python `imagehash` package's `phash()` function.
66 
+  Note that these are only clean-room approximations of the pHash™️ algorithm.
67 
+  ClamAV's image fuzzy hashes are not expected to match the fuzzy hashes
68 
+  generated using other tools. Some images may match, while others do not.
69 
+
70 
+  To generate the image fuzzy hash you can run this command:
71 
+  ```
72 
+  clamscan --gen-json --debug /path/to/file
73 
+  ```
74 
+  The hash will appear in the JSON above the "SCAN SUMMARY" under the object
75 
+  named "ImageFuzzyHash".
76 
+
77 
+- ClamScan & ClamDScan (Windows-only):
78 
+  - Added a process memory scanning feature from ClamWin's ClamScan.
79 
+
80 
+    This adds three new options to ClamScan and ClamDScan on Windows:
81 
+    * `--memory`
82 
+    * `--kill`
83 
+    * `--unload`
84 
+
85 
+    Special thanks to:
86 
+    - Gianluigi Tiesi for allowing us to integrate the Windows process memory
87 
+      scanning feature from ClamWin into the ClamAV.
88 
+    - Grace Kang for integrating the ClamScan feature, and for extending it to
89 
+      work with ClamDScan in addition.
90 
+
14 91 
 ### Notable changes
15 92
93 
+- Updated the LLVM bytecode runtime support so that it can use LLVM versions
94 
+  8 through 12 and removed support for earlier LLVM versions.
95 
+  Using LLVM JIT for the bytecode runtime may improve scan performance over the
96 
+  built-in bytecode interpreter runtime, which is the default.
97 
+  If you wish to build using LLVM, you must obtain a complete build of
98 
+  the LLVM libraries including the devopment headers and static libraries.
99 
+
100 
+  There are some known issues both compiling and running the test suite with
101 
+  some LLVM installations. We are working to further stabilize LLVM bytecode
102 
+  runtime support, and document specific edge cases. Your feedback is welcome.
103 
+
104 
+  For details about building ClamAV with the LLVM bytecode runtime, see the
105 
+  [install reference documentation](INSTALL.md#bytecode-runtime).
106 
+
16 107 
 - Added a `GenerateMetadataJson` option to ClamD.
17 108 
   The functionality is equivalent to the `clamscan --gen-json` option.
18 109 
   Scan metadata is useful for file analysis and for debugging scan behavior.
... ... 
@@ -21,13 +112,217 @@ ClamAV 0.105.0 includes the following improvements and changes.
21 21 
   in the scan-temp directory. You can customize the scan-temp directory path
22 22 
   using the `TemporaryDirectory` option.
23 23
24 
+- The `libclamunrar.so` library's SO version now matches that of `libclamav.so`.
25 
+  The upstream UnRAR library does not have an SO version that we should match.
26 
+  This change is to prevent a possible collision when multiple ClamAV versions
27 
+  are installed.
28 
+
29 
+- CMake: Added support for using an external TomsFastMath library (libtfm).
30 
+
31 
+  To use an external TomsFastMath library, configure the build with the new
32 
+  option `-D ENABLE_EXTERNAL_TOMSFASTMATH=ON`. The following CMake variables may
33 
+  also be set as needed:
34 
+  - `-D TomsFastMath_INCLUDE_DIR=<path>` - The directory containing `tfm.h`.
35 
+  - `-D TomsFastMath_LIBRARY=<path>` - The path to the TomsFastMath library.
36 
+
37 
+  Also updated the vendored TomsFastMath code to version 0.13.1.
38 
+
24 39 
 ### Other improvements
25 40
41 
+- Freshclam:
42 
+  - Improve `ReceiveTimeout` behavior so that will abort a download attempt if
43 
+    the download is not making significant progress. Previously this limit was
44 
+    an absolute time limit for the download and could abort prematurely for
45 
+    those on a slower connection.
46 
+    Special thanks to Simon Arlott for this improvement.
47 
+
48 
+- Rewrote the ClamAV database archive incremental-update feature (CDIFF) from
49 
+  scratch in Rust. The new implementation was our first module to be rewritten
50 
+  in Rust. It is significantly faster at applying updates that remove large
51 
+  numbers of signatures from a database, such as when migrating signatures from
52 
+  `daily.cvd` to `main.cvd`.
53 
+
54 
+- Freshclam & ClamD:
55 
+  - Increased the maximum line-length for `freshclam.conf` and `clamd.conf` from
56 
+    512-characters to 1024-characters. This change was by request to accommodate
57 
+    very long `DatabaseMirror` options when using access tokens in the URI.
58 
+
59 
+- Removed the Heuristics.PNG.CVE-2010-1205 detection. This alert had been placed
60 
+  behind the `--alert-broken-media` (`SCAN_HEURISTIC_BROKEN_MEDIA`) option in
61 
+  0.103.3 and 0.104 because of excessive alerts on slightly malformed but non-
62 
+  malicious files. Now it is completely removed.
63 
+
64 
+- Added support for building ClamDTop using ncursesw if ncurses can not be
65 
+  found. Patch courtesy of Carlos Velasco.
66 
+
26 67 
 ### Bug fixes
27 68
69 
+- ClamOnAcc: Fixed a number of assorted stability issues and added niceties for
70 
+  debugging ClamOnAcc. Patches courtesy of Frank Fegert.
71 
+
72 
+- Fixed an issue causing byte-compare subsignatures to cause an alert when they
73 
+  match even if other conditions of the given logical signatures were not met.
74 
+
75 
+- Fixed an issue causing XLM macro false positives when scanning XLS documents
76 
+  containing images if the `--alert-macros` (`AlertOLE2Macros`) option was
77 
+  enabled.
78 
+
79 
+- Fixed an issue preventing multiple matches when scanning in all-match mode.
80 
+
81 
+- Docker:
82 
+  - Fixed an issue exposing the health check port. Patch courtesy of Sammy Chu.
83 
+  - Fixed an issue with health check failure false positives during container
84 
+    startup. Patch courtesy of Olliver Schinagl.
85 
+  - Set the default time zone to `Etc/UTC`. The `--env` parameter can be used to
86 
+    customize the time zone by setting `TZ` environment variable.
87 
+    Patch courtesy of Olliver Schinagl.
88 
+
89 
+- Added support for detecting the curses library dependency even when the
90 
+  associated pkg-config file is not present. This resolves a build issue on some
91 
+  BSD distributions. Patch courtesy of Stuart Henderson.
92 
+
93 
+- Assorted bug fixes and improvements.
94 
+
28 95 
 ### Acknowledgements
29 96
30 97 
 The ClamAV team thanks the following individuals for their code submissions:
98 
+- Ahmon Dancy
99 
+- Alexander Sulfrian
100 
+- Carlos Velasco
101 
+- Bernd Kuhls
102 
+- David Korczynski
103 
+- Fabrice Fontaine
104 
+- Frank Fegert
105 
+- Gianluigi Tiesi
106 
+- Giovanni Bechis
107 
+- Grace Kang
108 
+- John Humlick
109 
+- Jordan Ernst
110 
+- JunWei Song
111 
+- mko-x
112 
+- Olliver Schinagl
113 
+- Sammy Chu
114 
+- Sergey Valentey
115 
+- Simon Arlott
116 
+- Stuart Henderson
117 
+- Yann E. Morin
118 
+
119 
+## 0.104.2
120 
+
121 
+ClamAV 0.104.2 is a critical patch release with the following fixes:
122 
+
123 
+- [CVE-2022-20698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20698):
124 
+  Fix for invalid pointer read that may cause a crash.
125 
+  Affects 0.104.1, 0.103.4 and prior when ClamAV is compiled with libjson-c and
126 
+  the `CL_SCAN_GENERAL_COLLECT_METADATA` scan option (the `clamscan --gen-json`
127 
+  option) is enabled.
128 
+
129 
+  Cisco would like to thank Laurent Delosieres of ManoMano for reporting this
130 
+  vulnerability.
131 
+
132 
+- Fixed ability to disable the file size limit with libclamav C API, like this:
133 
+  ```c
134 
+    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
135 
+  ```
136 
+  This issue didn't impact ClamD or ClamScan which also can disable the limit by
137 
+  setting it to zero using `MaxFileSize 0` in `clamd.conf` for ClamD, or
138 
+  `clamscan --max-filesize=0` for ClamScan.
139 
+
140 
+  Note: Internally, the max file size is still set to 2 GiB. Disabling the limit
141 
+  for a scan will fall back on the internal 2 GiB limitation.
142 
+
143 
+- Increased the maximum line length for ClamAV config files from 512 bytes to
144 
+  1024 bytes to allow for longer config option strings.
145 
+
146 
+Special thanks to the following for code contributions and bug reports:
147 
+- Laurent Delosieres
148 
+
149 
+## 0.104.1
150 
+
151 
+ClamAV 0.104.1 is a critical patch release with the following fixes:
152 
+
153 
+- FreshClam:
154 
+  - Add a 24-hour cool-down for FreshClam clients that have received an HTTP
155 
+    403 (Forbidden) response from the CDN.
156 
+    This is to reduce the volume of 403-response data served to blocked
157 
+    FreshClam clients that are configured with a tight update-loop.
158 
+  - Fixed a bug where FreshClam treats an empty CDIFF as an incremental update
159 
+    failure instead of as an intentional request to download the whole CVD.
160 
+
161 
+- ClamDScan: Fix a scan error when broken symlinks are encountered on macOS with
162 
+  "FollowDirectorySymlinks" and "FollowFileSymlinks" options disabled.
163 
+
164 
+- Overhauled the scan recursion / nested archive extraction logic and added new
165 
+  limits on embedded file-type recognition performed during the "raw" scan of
166 
+  each file. This limits embedded file-type misidentification and prevents
167 
+  detecting embedded file content that is found/extracted and scanned at other
168 
+  layers in the scanning process.
169 
+
170 
+- Fix an issue with the FMap module that failed to read from some nested files.
171 
+
172 
+- Fixed an issue where failing to load some rules from a Yara file containing
173 
+  multiple rules may cause a crash.
174 
+
175 
+- Fixed assorted compiler warnings.
176 
+
177 
+- Fixed assorted Coverity static code analysis issues.
178 
+
179 
+- Scan limits:
180 
+  - Added virus-name suffixes to the alerts that trigger when a scan limit has
181 
+    been exceeded. Rather than simply `Heuristics.Limits.Exceeded`, you may now
182 
+    see limit-specific virus-names, to include:
183 
+    - `Heuristics.Limits.Exceeded.MaxFileSize`
184 
+    - `Heuristics.Limits.Exceeded.MaxScanSize`
185 
+    - `Heuristics.Limits.Exceeded.MaxFiles`
186 
+    - `Heuristics.Limits.Exceeded.MaxRecursion`
187 
+    - `Heuristics.Limits.Exceeded.MaxScanTime`
188 
+  - Renamed the `Heuristics.Email.ExceedsMax.*` alerts to align with the other
189 
+    limit alerts names. These alerts include:
190 
+    - `Heuristics.Limits.Exceeded.EmailLineFoldcnt`
191 
+    - `Heuristics.Limits.Exceeded.EmailHeaderBytes`
192 
+    - `Heuristics.Limits.Exceeded.EmailHeaders`
193 
+    - `Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage`
194 
+    - `Heuristics.Limits.Exceeded.EmailMIMEArguments`
195 
+  - Fixed an issue where the Email-related scan limits would alert even when the
196 
+    "AlertExceedsMax" (`--alert-exceeds-max`) scan option is not enabled.
197 
+  - Fixes an issue in the Zip parser where exceeding the "MaxFiles" limit or
198 
+    the "MaxFileSize" limit would abort the scan but would fail to alert.
199 
+    The Zip scan limit issues were independently identified and reported by
200 
+    Aaron Leliaert and Max Allan.
201 
+
202 
+- Fixed a leak in the Email parser when using the `--gen-json` scan option.
203 
+
204 
+- Fixed an issue where a failure to record metadata in the Email parser when
205 
+  using the `--gen-json` scan option could cause the Email parser to abort the
206 
+  scan early and fail to extract and scan additional content.
207 
+
208 
+- Fixed a file name memory leak in the Zip parser.
209 
+
210 
+- Fixed an issue where certain signature patterns may cause a crash or cause
211 
+  unintended matches on some systems when converting characters to uppercase if
212 
+  a UTF-8 unicode single-byte grapheme becomes a multi-byte grapheme.
213 
+  Patch courtesy of Andrea De Pasquale.
214 
+
215 
+- CMake:
216 
+  - Fix a packaging issue with the Windows `*.msi` installer so that it will
217 
+    include all of the required files.
218 
+  - Add support for developer code-signing on macOS during the build.
219 
+  - Fix an issue finding and linking with the `tinfo` library on systems where
220 
+    `tinfo` is separate from `ncurses`. Patch courtesy of Luca Barbato.
221 
+
222 
+- Tests: Improved the Freshclam incremental update tests to verify correct
223 
+  behavior when a zero-byte CDIFF is downloaded and the CVD served to FreshClam
224 
+  is older than advertised.
225 
+
226 
+- Docker: Remove the `freshclam.dat` file when building the Docker image with
227 
+  the databases-included so FreshClam agents running in the container will have
228 
+  a unique ID in the HTTP User-Agent.
229 
+
230 
+Special thanks to the following for code contributions and bug reports:
231 
+- Aaron Leliaert
232 
+- Andrea De Pasquale
233 
+- Luca Barbato
234 
+- Max Allan
31 235
32 236 
 ## 0.104.0
33 237
... ... 
@@ -194,6 +489,192 @@ The ClamAV team thanks the following individuals for their code submissions:
194 194 
 - Vasile Papp
195 195 
 - Yasuhiro Kimura
196 196
197 
+## 0.103.5
198 
+
199 
+ClamAV 0.103.5 is a critical patch release with the following fixes:
200 
+
201 
+- [CVE-2022-20698](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20698):
202 
+  Fix for invalid pointer read that may cause a crash.
203 
+  Affects 0.104.1, 0.103.4 and prior when ClamAV is compiled with libjson-c and
204 
+  the `CL_SCAN_GENERAL_COLLECT_METADATA` scan option (the `clamscan --gen-json`
205 
+  option) is enabled.
206 
+
207 
+  Cisco would like to thank Laurent Delosieres of ManoMano for reporting this
208 
+  vulnerability.
209 
+
210 
+- Fixed ability to disable the file size limit with libclamav C API, like this:
211 
+  ```c
212 
+    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
213 
+  ```
214 
+  This issue didn't impact ClamD or ClamScan which also can disable the limit by
215 
+  setting it to zero using `MaxFileSize 0` in `clamd.conf` for ClamD, or
216 
+  `clamscan --max-filesize=0` for ClamScan.
217 
+
218 
+  Note: Internally, the max file size is still set to 2 GiB. Disabling the limit
219 
+  for a scan will fall back on the internal 2 GiB limitation.
220 
+
221 
+- Increased the maximum line length for ClamAV config files from 512 bytes to
222 
+  1024 bytes to allow for longer config option strings.
223 
+
224 
+- SigTool: Fix insufficient buffer size for `--list-sigs` that caused a failure
225 
+  when listing a database containing one or more very long signatures.
226 
+  This fix was backported from 0.104.
227 
+
228 
+Special thanks to the following for code contributions and bug reports:
229 
+- Laurent Delosieres
230 
+
231 
+## 0.103.4
232 
+
233 
+ClamAV 0.103.4 is a critical patch release with the following fixes:
234 
+
235 
+- FreshClam:
236 
+  - Add a 24-hour cool-down for FreshClam clients that have received an HTTP
237 
+    403 (Forbidden) response from the CDN.
238 
+    This is to reduce the volume of 403-response data served to blocked
239 
+    FreshClam clients that are configured with a tight update-loop.
240 
+  - Fixed a bug where FreshClam treats an empty CDIFF as an incremental update
241 
+    failure instead of as an intentional request to download the whole CVD.
242 
+
243 
+- ClamDScan: Fix a scan error when broken symlinks are encountered on macOS with
244 
+  "FollowDirectorySymlinks" and "FollowFileSymlinks" options disabled.
245 
+
246 
+- Overhauled the scan recursion / nested archive extraction logic and added new
247 
+  limits on embedded file-type recognition performed during the "raw" scan of
248 
+  each file. This limits embedded file-type misidentification and prevents
249 
+  detecting embedded file content that is found/extracted and scanned at other
250 
+  layers in the scanning process.
251 
+
252 
+- Fix an issue with the FMap module that failed to read from some nested files.
253 
+
254 
+- Fixed an issue where failing to load some rules from a Yara file containing
255 
+  multiple rules may cause a crash.
256 
+
257 
+- Fixed assorted compiler warnings.
258 
+
259 
+- Fixed assorted Coverity static code analysis issues.
260 
+
261 
+- Scan limits:
262 
+  - Added virus-name suffixes to the alerts that trigger when a scan limit has
263 
+    been exceeded. Rather than simply `Heuristics.Limits.Exceeded`, you may now
264 
+    see limit-specific virus-names, to include:
265 
+    - `Heuristics.Limits.Exceeded.MaxFileSize`
266 
+    - `Heuristics.Limits.Exceeded.MaxScanSize`
267 
+    - `Heuristics.Limits.Exceeded.MaxFiles`
268 
+    - `Heuristics.Limits.Exceeded.MaxRecursion`
269 
+    - `Heuristics.Limits.Exceeded.MaxScanTime`
270 
+  - Renamed the `Heuristics.Email.ExceedsMax.*` alerts to align with the other
271 
+    limit alerts names. These alerts include:
272 
+    - `Heuristics.Limits.Exceeded.EmailLineFoldcnt`
273 
+    - `Heuristics.Limits.Exceeded.EmailHeaderBytes`
274 
+    - `Heuristics.Limits.Exceeded.EmailHeaders`
275 
+    - `Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage`
276 
+    - `Heuristics.Limits.Exceeded.EmailMIMEArguments`
277 
+  - Fixed an issue where the Email-related scan limits would alert even when the
278 
+    "AlertExceedsMax" (`--alert-exceeds-max`) scan option is not enabled.
279 
+  - Fixes an issue in the Zip parser where exceeding the "MaxFiles" limit or
280 
+    the "MaxFileSize" limit would abort the scan but would fail to alert.
281 
+    The Zip scan limit issues were independently identified and reported by
282 
+    Aaron Leliaert and Max Allan.
283 
+
284 
+- Fixed a leak in the Email parser when using the `--gen-json` scan option.
285 
+
286 
+- Fixed an issue where a failure to record metadata in the Email parser when
287 
+  using the `--gen-json` scan option could cause the Email parser to abort the
288 
+  scan early and fail to extract and scan additional content.
289 
+
290 
+- Fixed a file name memory leak in the Zip parser.
291 
+
292 
+- Fixed an issue where certain signature patterns may cause a crash or cause
293 
+  unintended matches on some systems when converting characters to uppercase if
294 
+  a UTF-8 unicode single-byte grapheme becomes a multi-byte grapheme.
295 
+  Patch courtesy of Andrea De Pasquale.
296 
+
297 
+Other fixes backported from 0.104.0:
298 
+
299 
+- Fixed a crash in programs that use libclamav when the programs don't set a
300 
+  callback for the "virus found" event.
301 
+  Patch courtesy of Markus Strehle.
302 
+
303 
+- Added checks to the the SIS archive parser to prevent an SIS file entry from
304 
+  pointing to the archive, which would result in a loop. This was not an actual
305 
+  infinite loop, as ClamAV's scan recursion limit limits the depth of nested
306 
+  archive extraction.
307 
+
308 
+- ClamOnAcc: Fixed a socket file descriptor leak that could result in a crash
309 
+  when all available file descriptors are exhausted.
310 
+
311 
+- FreshClam: Fixed an issue where FreshClam would download a CVD repeatedly if a
312 
+  zero-byte CDIFF is downloaded or if the incremental update failed and if the
313 
+  CVD downloaded after that is older than advertised.
314 
+  Patch courtesy of Andrew Williams.
315 
+
316 
+- ClamDScan:
317 
+  - Fixed a memory leak of the scan target filename when using the
318 
+    `--fdpass` or `--stream` options.
319 
+  - Fixed an issue where ClamDScan would fail to scan any file after excluding
320 
+    a file with the "ExcludePath" option when using when using the `--multiscan`
321 
+    (`-m`) option along with either `--fdpass` or `--stream`.
322 
+    Also fixed a memory leak of the accidentally-excluded paths in this case.
323 
+  - Fixed a single file path memory leak when using `--fdpass`.
324 
+  - Fixed an issue where the "ExcludePath" regex may fail to exclude absolute
325 
+    paths when the scan is invoked with a relative path.
326 
+
327 
+Special thanks to the following for code contributions and bug reports:
328 
+- Aaron Leliaert
329 
+- Andrea De Pasquale
330 
+- Andrew Williams
331 
+- Markus Strehle
332 
+- Max Allan
333 
+
334 
+## 0.103.3
335 
+
336 
+ClamAV 0.103.3 is a patch release with the following fixes:
337 
+
338 
+- Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is enabled.
339 
+  This issue did not impacted most users but for those affected it caused every
340 
+  scanned file to be copied to the temp directory before the scan.
341 
+
342 
+- Fix ClamDScan crashes when using the `--fdpass --multiscan` command-line
343 
+  options in combination with the ClamD `ExcludePath` config file options.
344 
+
345 
+- Fixed an issue where the `mirrors.dat` file is owned by root when starting as
346 
+  root (or with sudo) and using daemon-mode. File ownership will be set to the
347 
+  `DatabaseOwner` just before FreshClam switches to run as that user.
348 
+
349 
+- Renamed the `mirrors.dat` file to `freshclam.dat`.
350 
+
351 
+  We used to recommend deleting `mirrors.dat` if FreshClam failed to update.
352 
+  This is because `mirrors.dat` used to keep track of offline mirrors and
353 
+  network interruptions were known to cause FreshClam to think that all mirrors
354 
+  were offline. ClamAV now uses a paid CDN instead of a mirror network, and the
355 
+  new FreshClam DAT file no longer stores that kind of information.
356 
+  The UUID used in ClamAV's HTTP User-Agent is stored in the FreshClam DAT file
357 
+  and we want the UUID to persist between runs, even if there was a failure.
358 
+
359 
+  Unfortunately, some users have FreshClam configured to automatically delete
360 
+  `mirrors.dat` if FreshClam failed. Renaming `mirrors.dat` to `freshclam.dat`
361 
+  should make it so those scripts don't delete important FreshClam data.
362 
+
363 
+- Disabled the `HTTPUserAgent` config option if the `DatabaseMirror` uses
364 
+  clamav.net. This will prevent users from being inadvertently blocked and
365 
+  will ensure that we can keep better metrics on which ClamAV versions are
366 
+  being used.
367 
+
368 
+  This change effectively deprecates the `HTTPUserAgent` option for most users.
369 
+
370 
+- Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
371 
+  ClamScan `--alert-broken-media` option (ClamD `AlertBrokenMedia yes`) option.
372 
+  This type of PNG issue appears to be common enough to be an annoyance, and
373 
+  the CVE is old enough that no one should be vulnerable at this point.
374 
+
375 
+- Fix ClamSubmit failures after changes to Cloudflare "__cfduid" cookies.
376 
+  See: https://blog.cloudflare.com/deprecating-cfduid-cookie/
377 
+
378 
+Special thanks to the following for code contributions and bug reports:
379 
+
380 
+- Stephen Agate
381 
+- Tom Briden
382 
+
197 383 
 ## 0.103.2
198 384
199 385 
 ClamAV 0.103.2 is a security patch release with the following fixes:
... ... 
@@ -3309,7 +3790,7 @@ the highest possible level.
3309 3309
3310 3310 
 New mirroring mechanisms. Luca Gibelli (ClamAV) and mirror administrators
3311 3311 
 (22 sites) are converting mirrors to new "push mirroring"
3312 
-method. It uses advanced techniques to ensure all the mirrors are up to date.
3312 
+method. It uses advanced techniques to ensure all the mirrors are up-to-date.
3313 3313
3314 3314 
 We would like to thank our donors:
3315 3315
... ... 
@@ -3656,7 +4137,7 @@ MacOSX and NetBSD (support for them was broken in 0.51).
3656 3656
3657 3657 
 ## 0.51
3658 3658
3659 
-OAV database is up to date ! There was a problem with signature parsing,
3659 
+OAV database is up-to-date ! There was a problem with signature parsing,
3660 3660 
 because some hex strings were upper case. Anyway, I still recommend you
3661 3661 
 freshclam for a database updating.
3662 3662