Skip to content

Commit

Permalink
News: Release notes for 1.2.2
Browse files Browse the repository at this point in the history
  • Loading branch information
micahsnyder committed Feb 1, 2024
1 parent 9ca550b commit ae891c9
Showing 1 changed file with 70 additions and 38 deletions.
108 changes: 70 additions & 38 deletions NEWS.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,37 @@ differ slightly from third-party binary packages.

## 1.2.2

ClamAV 1.2.2 is a critical patch release with the following fixes:
ClamAV 1.2.2 is a critical patch release with the following fix:

Special thanks to the following people for code contributions and bug reports:
- [CVE-2024-20290](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20290):
Fixed a possible heap overflow read bug in the OLE2 file parser that could
cause a denial-of-service (DoS) condition.

Affected versions:
- 1.0.0 through 1.0.4 (LTS)
- 1.1 (all patch versions)
- 1.2.0 and 1.2.1

Thank you to OSS-Fuzz for identifying this issue.

- [CVE-2024-20328](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20328):
Fixed a possible command injection vulnerability in the `VirusEvent` feature
of ClamAV's ClamD service.

To fix this issue, we disabled the '%f' format string parameter.
ClamD administrators may continue to use the `CLAM_VIRUSEVENT_FILENAME`
environment variable, instead of '%f'. But you should do so only from within
an executable, such as a Python script, and not directly in the `clamd.conf`
`VirusEvent` command.

Affected versions:
- 0.104 (all patch versions)
- 0.105 (all patch versions)
- 1.0.0 through 1.0.4 (LTS)
- 1.1 (all patch versions)
- 1.2.0 and 1.2.1

Thank you to Amit Schendel for identifying this issue.

## 1.2.1

Expand Down Expand Up @@ -822,39 +850,40 @@ ClamAV 0.105.0 includes the following improvements and changes.

The CVE's fixes below are also addressed in versions 0.104.3 and 0.103.6.

- [CVE-2022-20803](CVE-2022-20803): Fixed a possible double-free vulnerability
in the OLE2 file parser.
- [CVE-2022-20803](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20803):
Fixed a possible double-free vulnerability in the OLE2 file parser.
Issue affects versions 0.104.0 through 0.104.2.
Issue identified by OSS-Fuzz.

- [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulnerability
in the CHM file parser.
- [CVE-2022-20770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20770):
Fixed a possible infinite loop vulnerability in the CHM file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer dereference
crash in the scan verdict cache check.
Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
- [CVE-2022-20796](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20796):
Fixed a possible NULL-pointer dereference crash in the scan verdict cache
check. Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
Thank you to Alexander Patrakov and Antoine Gatineau for reporting this issue.

- [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulnerability
in the TIFF file parser.
- [CVE-2022-20771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20771):
Fixed a possible infinite loop vulnerability in the TIFF file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
The issue only occurs if the "--alert-broken-media" ClamScan option is
enabled. For ClamD, the affected option is "AlertBrokenMedia yes", and for
libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option.
Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the
HTML file parser / Javascript normalizer.
- [CVE-2022-20785](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20785):
Fixed a possible memory leak in the HTML file parser / Javascript normalizer.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buffer
overflow write vulnerability in the signature database load module.
- [CVE-2022-20792](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20792):
Fixed a possible multi-byte heap buffer overflow write vulnerability in the
signature database load module.
The fix was to update the vendored regex library to the latest version.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Expand Down Expand Up @@ -940,39 +969,41 @@ ClamAV 0.104.4 is a critical patch release with the following fixes:

ClamAV 0.104.3 is a critical patch release with the following fixes:

- [CVE-2022-20803](CVE-2022-20803): Fixed a possible double-free vulnerability
in the OLE2 file parser.
- [CVE-2022-20803](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20803):
Fixed a possible double-free vulnerability in the OLE2 file parser.
Issue affects versions 0.104.0 through 0.104.2.
Issue identified by OSS-Fuzz.

- [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulnerability
in the CHM file parser.
- [CVE-2022-20770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20770):
Fixed a possible infinite loop vulnerability in the CHM file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer dereference
crash in the scan verdict cache check.
- [CVE-2022-20796](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20796):
Fixed a possible NULL-pointer dereference crash in the scan verdict cache
check.
Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
Thank you to Alexander Patrakov and Antoine Gatineau for reporting this issue.

- [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulnerability
in the TIFF file parser.
- [CVE-2022-20771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20771):
Fixed a possible infinite loop vulnerability in the TIFF file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
The issue only occurs if the "--alert-broken-media" ClamScan option is
enabled. For ClamD, the affected option is "AlertBrokenMedia yes", and for
libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option.
Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the
HTML file parser / Javascript normalizer.
- [CVE-2022-20785](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20785):
Fixed a possible memory leak in the HTML file parser / Javascript normalizer.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buffer
overflow write vulnerability in the signature database load module.
- [CVE-2022-20792](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20792):
Fixed a possible multi-byte heap buffer overflow write vulnerability in the
signature database load module.
The fix was to update the vendored regex library to the latest version.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Expand Down Expand Up @@ -1334,34 +1365,35 @@ ClamAV 0.103.7 is a critical patch release with the following fixes:
ClamAV 0.103.6 is a critical patch release with the following fixes:
- [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulnerability
in the CHM file parser.
- [CVE-2022-20770](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20770):
Fixed a possible infinite loop vulnerability in the CHM file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.
- [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer dereference
crash in the scan verdict cache check.
Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
- [CVE-2022-20796](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20796):
Fixed a possible NULL-pointer dereference crash in the scan verdict cache
check. Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
Thank you to Alexander Patrakov and Antoine Gatineau for reporting this issue.
- [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulnerability
in the TIFF file parser.
- [CVE-2022-20771](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20771):
Fixed a possible infinite loop vulnerability in the TIFF file parser.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
The issue only occurs if the "--alert-broken-media" ClamScan option is
enabled. For ClamD, the affected option is "AlertBrokenMedia yes", and for
libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option.
Thank you to Michał Dardas for reporting this issue.
- [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the
HTML file parser / Javascript normalizer.
- [CVE-2022-20785](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20785):
Fixed a possible memory leak in the HTML file parser / Javascript normalizer.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Thank you to Michał Dardas for reporting this issue.
- [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buffer
overflow write vulnerability in the signature database load module.
- [CVE-2022-20792](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-20792):
Fixed a possible multi-byte heap buffer overflow write vulnerability in the
signature database load module.
The fix was to update the vendored regex library to the latest version.
Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
prior versions.
Expand Down

0 comments on commit ae891c9

Please sign in to comment.