Browse code
Update bytecode api functionality levels and add news from recent patch versions
Micah Snyder authored on 2024/02/02 07:30:25Showing 2 changed files
| ... | ... |
@@ -97,6 +97,40 @@ Special thanks to the following people for code contributions and bug reports: |
| 97 | 97 |
- RainRat |
| 98 | 98 |
- teoberi |
| 99 | 99 |
|
| 100 |
+## 1.2.2 |
|
| 101 |
+ |
|
| 102 |
+ClamAV 1.2.2 is a critical patch release with the following fix: |
|
| 103 |
+ |
|
| 104 |
+- [CVE-2024-20290](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20290): |
|
| 105 |
+ Fixed a possible heap overflow read bug in the OLE2 file parser that could |
|
| 106 |
+ cause a denial-of-service (DoS) condition. |
|
| 107 |
+ |
|
| 108 |
+ Affected versions: |
|
| 109 |
+ - 1.0.0 through 1.0.4 (LTS) |
|
| 110 |
+ - 1.1 (all patch versions) |
|
| 111 |
+ - 1.2.0 and 1.2.1 |
|
| 112 |
+ |
|
| 113 |
+ Thank you to OSS-Fuzz for identifying this issue. |
|
| 114 |
+ |
|
| 115 |
+- [CVE-2024-20328](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20328): |
|
| 116 |
+ Fixed a possible command injection vulnerability in the `VirusEvent` feature |
|
| 117 |
+ of ClamAV's ClamD service. |
|
| 118 |
+ |
|
| 119 |
+ To fix this issue, we disabled the '%f' format string parameter. |
|
| 120 |
+ ClamD administrators may continue to use the `CLAM_VIRUSEVENT_FILENAME` |
|
| 121 |
+ environment variable, instead of '%f'. But you should do so only from within |
|
| 122 |
+ an executable, such as a Python script, and not directly in the `clamd.conf` |
|
| 123 |
+ `VirusEvent` command. |
|
| 124 |
+ |
|
| 125 |
+ Affected versions: |
|
| 126 |
+ - 0.104 (all patch versions) |
|
| 127 |
+ - 0.105 (all patch versions) |
|
| 128 |
+ - 1.0.0 through 1.0.4 (LTS) |
|
| 129 |
+ - 1.1 (all patch versions) |
|
| 130 |
+ - 1.2.0 and 1.2.1 |
|
| 131 |
+ |
|
| 132 |
+ Thank you to Amit Schendel for identifying this issue. |
|
| 133 |
+ |
|
| 100 | 134 |
## 1.2.1 |
| 101 | 135 |
|
| 102 | 136 |
ClamAV 1.2.1 is a patch release with the following fixes: |
| ... | ... |
@@ -501,6 +535,40 @@ Special thanks to the following people for code contributions and bug reports: |
| 501 | 501 |
- Sebastian Andrzej Siewior |
| 502 | 502 |
- The OSS-Fuzz project |
| 503 | 503 |
|
| 504 |
+## 1.0.5 |
|
| 505 |
+ |
|
| 506 |
+ClamAV 1.0.5 is a critical patch release with the following fixes: |
|
| 507 |
+ |
|
| 508 |
+- [CVE-2024-20290](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20290): |
|
| 509 |
+ Fixed a possible heap overflow read bug in the OLE2 file parser that could |
|
| 510 |
+ cause a denial-of-service (DoS) condition. |
|
| 511 |
+ |
|
| 512 |
+ Affected versions: |
|
| 513 |
+ - 1.0.0 through 1.0.4 (LTS) |
|
| 514 |
+ - 1.1 (all patch versions) |
|
| 515 |
+ - 1.2.0 and 1.2.1 |
|
| 516 |
+ |
|
| 517 |
+ Thank you to OSS-Fuzz for identifying this issue. |
|
| 518 |
+ |
|
| 519 |
+- [CVE-2024-20328](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20328): |
|
| 520 |
+ Fixed a possible command injection vulnerability in the `VirusEvent` feature |
|
| 521 |
+ of ClamAV's ClamD service. |
|
| 522 |
+ |
|
| 523 |
+ To fix this issue, we disabled the '%f' format string parameter. |
|
| 524 |
+ ClamD administrators may continue to use the `CLAM_VIRUSEVENT_FILENAME` |
|
| 525 |
+ environment variable, instead of '%f'. But you should do so only from within |
|
| 526 |
+ an executable, such as a Python script, and not directly in the `clamd.conf` |
|
| 527 |
+ `VirusEvent` command. |
|
| 528 |
+ |
|
| 529 |
+ Affected versions: |
|
| 530 |
+ - 0.104 (all patch versions) |
|
| 531 |
+ - 0.105 (all patch versions) |
|
| 532 |
+ - 1.0.0 through 1.0.4 (LTS) |
|
| 533 |
+ - 1.1 (all patch versions) |
|
| 534 |
+ - 1.2.0 and 1.2.1 |
|
| 535 |
+ |
|
| 536 |
+ Thank you to Amit Schendel for identifying this issue. |
|
| 537 |
+ |
|
| 504 | 538 |
## 1.0.4 |
| 505 | 539 |
|
| 506 | 540 |
ClamAV 1.0.4 is a patch release with the following fixes: |
| ... | ... |
@@ -167,10 +167,19 @@ enum FunctionalityLevels {
|
| 167 | 167 |
|
| 168 | 168 |
FUNC_LEVEL_1_0 = 160, /**< LibClamAV release 1.0.0 */ |
| 169 | 169 |
FUNC_LEVEL_1_0_1 = 161, /**< LibClamAV release 1.0.1 */ |
| 170 |
+ FUNC_LEVEL_1_0_2 = 162, /**< LibClamAV release 1.0.2 */ |
|
| 171 |
+ FUNC_LEVEL_1_0_3 = 163, /**< LibClamAV release 1.0.3 */ |
|
| 172 |
+ FUNC_LEVEL_1_0_4 = 164, /**< LibClamAV release 1.0.4 */ |
|
| 173 |
+ FUNC_LEVEL_1_0_5 = 165, /**< LibClamAV release 1.0.5 */ |
|
| 170 | 174 |
|
| 171 | 175 |
FUNC_LEVEL_1_1 = 180, /**< LibClamAV release 1.1.0 */ |
| 176 |
+ FUNC_LEVEL_1_1_1 = 181, /**< LibClamAV release 1.1.1 */ |
|
| 177 |
+ FUNC_LEVEL_1_1_2 = 182, /**< LibClamAV release 1.1.2 */ |
|
| 178 |
+ FUNC_LEVEL_1_1_3 = 183, /**< LibClamAV release 1.1.3 */ |
|
| 172 | 179 |
|
| 173 | 180 |
FUNC_LEVEL_1_2 = 190, /**< LibClamAV release 1.2.0 */ |
| 181 |
+ FUNC_LEVEL_1_2_1 = 191, /**< LibClamAV release 1.2.1 */ |
|
| 182 |
+ FUNC_LEVEL_1_2_2 = 192, /**< LibClamAV release 1.2.2 */ |
|
| 174 | 183 |
|
| 175 | 184 |
FUNC_LEVEL_1_3 = 200, /**< LibClamAV release 1.3.0 */ |
| 176 | 185 |
}; |