From 2b82a975e3416d63bdc6d1deefce8d2208641735 Mon Sep 17 00:00:00 2001 From: Micah Snyder Date: Fri, 24 Mar 2023 17:08:42 -0700 Subject: [PATCH 1/7] Set release candidate version suffix and bump SOVERSION Change the version suffix from -devel-{TODAY} to -rc Bump the SO version for libclamav and libfreshclam. Increasing the current version to 12.0.0 and 3.0.0 respectively. The reason is that we reintroduced using the version scripts: - libclamav.map - libfreshclam.map - libclamunrar.map - libclamunrar_iface.map Note that libclamunrar and libclamunrar_iface use the SO version from libclamav. Note that libclammspack does not have a .map file and so is not getting symbol versioning at this time nor are we bumping the SO version for that library. --- CMakeLists.txt | 8 ++++---- libclamav/bytecode_api.h | 5 ++++- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 9a172ab9ea..2371aba16e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -19,7 +19,7 @@ cmake_policy(SET CMP0087 NEW) # support generator expressions in install(CODE) a # For release candidate: set(VERSION_SUFFIX "-rc") # For release: set(VERSION_SUFFIX "") string(TIMESTAMP TODAY "%Y%m%d") -set(VERSION_SUFFIX "-devel-${TODAY}") +set(VERSION_SUFFIX "-rc") project( ClamAV VERSION "1.1.0" @@ -36,7 +36,7 @@ set(PACKAGE_URL "https://www.clamav.net/") HexVersion(PACKAGE_VERSION_NUM ${PROJECT_VERSION_MAJOR} ${PROJECT_VERSION_MINOR} ${PROJECT_VERSION_PATCH}) # libtool library versioning rules: http://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html -set(LIBCLAMAV_CURRENT 11) +set(LIBCLAMAV_CURRENT 12) set(LIBCLAMAV_REVISION 0) set(LIBCLAMAV_AGE 0) @@ -44,8 +44,8 @@ math(EXPR LIBCLAMAV_SOVERSION "${LIBCLAMAV_CURRENT} - ${LIBCLAMAV_AGE}") set(LIBCLAMAV_VERSION "${LIBCLAMAV_SOVERSION}.${LIBCLAMAV_AGE}.${LIBCLAMAV_REVISION}") HexVersion(LIBCLAMAV_VERSION_NUM ${LIBCLAMAV_CURRENT} ${LIBCLAMAV_REVISION} ${LIBCLAMAV_AGE}) -set(LIBFRESHCLAM_CURRENT 2) -set(LIBFRESHCLAM_REVISION 2) +set(LIBFRESHCLAM_CURRENT 3) +set(LIBFRESHCLAM_REVISION 0) set(LIBFRESHCLAM_AGE 0) math(EXPR LIBFRESHCLAM_SOVERSION "${LIBFRESHCLAM_CURRENT} - ${LIBFRESHCLAM_AGE}") diff --git a/libclamav/bytecode_api.h b/libclamav/bytecode_api.h index 69093bccf1..6a4d13ebe7 100644 --- a/libclamav/bytecode_api.h +++ b/libclamav/bytecode_api.h @@ -153,6 +153,7 @@ enum FunctionalityLevels { FUNC_LEVEL_0103_5 = 126, /**< LibClamAV release 0.103.5 */ FUNC_LEVEL_0103_6 = 127, /**< LibClamAV release 0.103.6 */ FUNC_LEVEL_0103_7 = 128, /**< LibClamAV release 0.103.7 */ + FUNC_LEVEL_0103_8 = 129, /**< LibClamAV release 0.103.8 */ FUNC_LEVEL_0104 = 140, /**< LibClamAV release 0.104.0 */ FUNC_LEVEL_0104_1 = 141, /**< LibClamAV release 0.104.1 */ @@ -162,8 +163,10 @@ enum FunctionalityLevels { FUNC_LEVEL_0105 = 150, /**< LibClamAV release 0.105.0 */ FUNC_LEVEL_0105_1 = 151, /**< LibClamAV release 0.105.1 */ + FUNC_LEVEL_0105_2 = 152, /**< LibClamAV release 0.105.2 */ - FUNC_LEVEL_1_0 = 160, /**< LibClamAV release 1.0.0 */ + FUNC_LEVEL_1_0 = 160, /**< LibClamAV release 1.0.0 */ + FUNC_LEVEL_1_0_1 = 161, /**< LibClamAV release 1.0.1 */ FUNC_LEVEL_1_1 = 180, /**< LibClamAV release 1.1.0 */ }; From de385e00cc477ef34448b9c6194afc7830f923f4 Mon Sep 17 00:00:00 2001 From: Micah Snyder Date: Sat, 25 Mar 2023 16:32:03 -0700 Subject: [PATCH 2/7] Add news for recent 1.0.1, 0.105.2, and 0.103.8 patch versions --- NEWS.md | 80 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) diff --git a/NEWS.md b/NEWS.md index 9566502fa9..ec79791fca 100644 --- a/NEWS.md +++ b/NEWS.md @@ -18,6 +18,31 @@ ClamAV 1.1.0 includes the following improvements and changes. Special thanks to the following people for code contributions and bug reports: +## 1.0.1 + +ClamAV 1.0.1 is a critical patch release with the following fixes: + +- [CVE-2023-20032](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032): + Fixed a possible remote code execution vulnerability in the HFS+ file parser. + Issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and + earlier. + Thank you to Simon Scannell for reporting this issue. + +- [CVE-2023-20052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052): + Fixed a possible remote information leak vulnerability in the DMG file parser. + Issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and + earlier. + Thank you to Simon Scannell for reporting this issue. + +- Fix allmatch detection issue with the preclass bytecode hook. + - GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/825 + +- Update vendored libmspack library to version 0.11alpha. + - GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/828 + +Special thanks to the following people for code contributions and bug reports: +- Simon Scannell + ## 1.0.0 ClamAV 1.0.0 includes the following improvements and changes. @@ -252,6 +277,39 @@ Special thanks to the following people for code contributions and bug reports: - teoberi - TerminalFi +## 0.105.2 + +ClamAV 0.105.2 is a critical patch release with the following fixes: + +- [CVE-2023-20032](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032): + Fixed a possible remote code execution vulnerability in the HFS+ file parser. + Issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and + earlier. + Thank you to Simon Scannell for reporting this issue. + +- [CVE-2023-20052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052): + Fixed a possible remote information leak vulnerability in the DMG file parser. + Issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and + earlier. + Thank you to Simon Scannell for reporting this issue. + +- Fixed an issue loading Yara rules containing regex strings with an escaped + forward-slash (`\/`) followed by a colon (`:`). + - GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/695 + +- Moved the ClamAV Docker files for building containers to a new Git repository. + The Docker files are now in https://github.com/Cisco-Talos/clamav-docker. + This change enables us to fix issues with the images and with the supporting + scripts used to publish and update the images without committing changes + directly to files in the ClamAV release branches. + - GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/765 + +- Update vendored libmspack library to version 0.11alpha. + - GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/829 + +Special thanks to the following people for code contributions and bug reports: +- Simon Scannell + ## 0.105.1 ClamAV 0.105.1 is a critical patch release with the following fixes: @@ -906,6 +964,28 @@ The ClamAV team thanks the following individuals for their code submissions: - Vasile Papp - Yasuhiro Kimura +## 0.103.8 + +ClamAV 0.103.8 is a critical patch release with the following fixes: + +- [CVE-2023-20032](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032): + Fixed a possible remote code execution vulnerability in the HFS+ file parser. + Issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and + earlier. + Thank you to Simon Scannell for reporting this issue. + +- [CVE-2023-20052](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052): + Fixed a possible remote information leak vulnerability in the DMG file parser. + Issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and + earlier. + Thank you to Simon Scannell for reporting this issue. + +- Update vendored libmspack library to version 0.11alpha. + - GitHub pull request: https://github.com/Cisco-Talos/clamav/pull/830 + +Special thanks to the following people for code contributions and bug reports: +- Simon Scannell + ## 0.103.7 ClamAV 0.103.7 is a critical patch release with the following fixes: From 896a46d589e424ee43708de63f2789c247cac9aa Mon Sep 17 00:00:00 2001 From: Micah Snyder Date: Sat, 25 Mar 2023 16:32:52 -0700 Subject: [PATCH 3/7] Update news for 1.1.0 release --- NEWS.md | 137 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 134 insertions(+), 3 deletions(-) diff --git a/NEWS.md b/NEWS.md index ec79791fca..a1f96cb54f 100644 --- a/NEWS.md +++ b/NEWS.md @@ -5,18 +5,149 @@ differ slightly from third-party binary packages. ## 1.1.0 -ClamAV 1.1.0 includes the following improvements and changes. +ClamAV 1.1.0 includes the following improvements and changes: ### Major changes -### Other improvements +- Added the ability to extract images embedded in HTML CSS `