-------------------------------------------------------------------------------- Fedora EPEL Update Notification FEDORA-EPEL-2021-a847c261f5 2021-03-23 01:52:36.297425 --------------------------------------------------------------------------------

Name : clamav Product : Fedora EPEL 8 Version : 0.103.1 Release : 3.el8 URL : https://www.clamav.net/ Summary : End-user tools for the Clam Antivirus scanner Description : Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs are based on a shared library distributed with the Clam AntiVirus package, which you can use with your own software. The virus database is based on the virus database from OpenAntiVirus, but contains additional signatures (including signatures for popular polymorphic viruses, too) and is KEPT UP TO DATE.

-------------------------------------------------------------------------------- Update Information:

- clamav-freshclam.service: Standard output type syslog is obsolete (#1933977) - Quiet proxy on stdout (#1814698) ---- ClamAV 0.103.1 patch release https://blog.clamav.net/2021/02/clamav-01031-patch-release.html Notable changes Added a new scan option to alert on broken media (graphics) file formats. This feature mitigates the risk of malformed media files intended to exploit vulnerabilities in other software. At present, media validation exists for JPEG, TIFF, PNG and GIF files. To enable this feature, set AlertBrokenMedia yes in clamd.conf for use with ClamD, or use the --alert-broken-media option when using ClamScan. These options are disabled by default in this patch release but may be enabled in a subsequent release. Application developers may enable this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for the heuristic scan option bit field. Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF and PNG typing behavior. BMP and JPEG 2000 files will continue to detect as CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG 2000 format- checking capabilities. Bug fixes Fixed PNG parser logic bugs that caused an excess of parsing errors and fixed a stack exhaustion issue affecting some systems when scanning PNG files. PNG file type detection was disabled via signature database update for ClamAV version 0.103.0 to mitigate the effects from these bugs. Fixed an issue where PNG and GIF files no longer work with Target:5 graphics signatures if detected as CL_TYPE_PNG or CL_TYPE_GIF rather than as CL_TYPE_GRAPHICS. Target types now support up to 10 possible file types to make way for additional graphics types in future releases. Fixed ClamOnAcc's --fdpass option. File descriptor passing (or "FD-passing") is a mechanism by which ClamOnAcc and ClamDScan may transfer an open file to ClamD to scan, even if ClamD is running as a non-privileged user and wouldn't otherwise have read-access to the file. This enables ClamD to scan all files without having to run ClamD as root. If possible, ClamD should never be run as root to mitigate the risk in case ClamD is somehow compromised while scanning malware. Interprocess file descriptor passing for ClamOnAcc was broken since version 0.102.0 due to a bug introduced by the switch to cURL for communicating with ClamD. On Linux, passing file descriptors from one process to another is handled by the kernel, so we reverted ClamOnAcc to use standard system calls for socket communication when FD-passing is enabled. Fixed a ClamOnAcc stack corruption issue on some systems when using an older version of libcurl. Patch courtesy of Emilio Pozuelo Monfort. Allow ClamScan and ClamDScan scans to proceed even if the realpath lookup failed. This alleviates an issue on Windows scanning files hosted on file-systems that do not support the GetMappedFileNameW() API, such as on ImDisk RAM-disks. Fixed FreshClam's --on-update-execute=EXIT_1 temporary directory cleanup issue. ClamD's log output and VirusEvent feature now provide the scan target's file path instead of a file descriptor. The ClamD socket API for submitting a scan by FD-passing doesn't include a file path. This feature works by looking up the file path by the file descriptor. This feature works on Mac and Linux but is not yet implemented for other UNIX operating systems. FD-passing is not available for Windows. Fixed an issue where FreshClam database validation didn't work correctly when run in daemon mode on Linux/Unix. Fixed scan speed performance issues accidentally introduced in ClamAV 0.103.0 caused by hashing file maps more than once when parsing a file as a new type, and caused by frequent scanning of non-HTML text data with the HTML parser. Other improvements Scanning JPEG, TIFF, PNG and GIF files will no longer return "parse" errors when file format validation fails. Instead, the scan will alert with the "Heuristics.Broken.Media" signature prefix and a descriptive suffix to indicate the issue, provided that the "alert broken media" feature is enabled. GIF format validation will no longer fail if the GIF image is missing the trailer byte, as this appears to be a relatively common issue in otherwise functional GIFs. Added a TIFF dynamic configuration (DCONF) option that was missing. This will allow us to disable TIFF format validation via signature database update in the event that it proves to be problematic. This feature already exists for many other file types. -------------------------------------------------------------------------------- ChangeLog:

* Sun Mar 7 2021 S��rgio Basto sergio@serjux.com - 0.103.1-3 - clamav-freshclam.service: Standard output type syslog is obsolete (#1933977) - Quiet proxy on stdout (#1814698) * Tue Mar 2 2021 Zbigniew J��drzejewski-Szmek zbyszek@in.waw.pl - 0.103.1-2 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. * Wed Feb 17 2021 S��rgio Basto sergio@serjux.com - 0.103.1-1 - Update to 0.103.1 * Wed Jan 27 2021 S��rgio Basto sergio@serjux.com - 0.103.0-3 - Add upstream patch clamonacc: Fix stack buffer overflow with old curl * Tue Jan 26 2021 Fedora Release Engineering releng@fedoraproject.org - 0.103.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild -------------------------------------------------------------------------------- References:

[ 1 ] Bug #1814698 - freshclam --quiet returns proxy on stdout https://bugzilla.redhat.com/show_bug.cgi?id=1814698 [ 2 ] Bug #1909184 - clamdscan in 0.103.0 version seems to consume too much memory https://bugzilla.redhat.com/show_bug.cgi?id=1909184 [ 3 ] Bug #1933977 - clamav-freshclam.service "Standard output type syslog is obsolete" https://bugzilla.redhat.com/show_bug.cgi?id=1933977 --------------------------------------------------------------------------------

This update can be installed with the "yum" update programs. Use su -c 'yum update clamav' at the command line. For more information, refer to "YUM", available at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7%5C /html/System_Administrators_Guide/ch-yum.html

All packages are signed with the Fedora EPEL GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------