[pkgsrc/trunk]: pkgsrc/security/clamav security/clamav: update to 0.103.6

[taca <taca%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/efb86a1ffca5
branches:  trunk
changeset: 378610:efb86a1ffca5
user:      taca <taca%pkgsrc.org@localhost>
date:      Thu May 05 00:44:07 2022 +0000

description:
security/clamav: update to 0.103.6

0.103.6 (2022-05-04)

ClamAV 0.103.6 is a critical patch release with the following fixes:

- [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulnerability
  in the CHM file parser.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer dereference
  crash in the scan verdict cache check.
  Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
  Thank you to Alexander Patrakov and Antoine Gatineau for reporting this issue.

- [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulnerability
  in the TIFF file parser.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  The issue only occurs if the "--alert-broken-media" ClamScan option is
  enabled. For ClamD, the affected option is "AlertBrokenMedia yes", and for
  libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option.
  Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the
  HTML file parser / Javascript normalizer.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  Thank you to Michał Dardas for reporting this issue.

- [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buffer
  overflow write vulnerability in the signature database load module.
  The fix was to update the vendored regex library to the latest version.
  Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and
  prior versions.
  Thank you to Michał Dardas for reporting this issue.

- ClamOnAcc: Fixed a number of assorted stability issues and added niceties for
  debugging ClamOnAcc. Patches courtesy of Frank Fegert.

- Fixed an issue causing byte-compare subsignatures to cause an alert when they
  match even if other conditions of the given logical signatures were not met.

- Fix memleak when using multiple byte-compare subsignatures.
  This fix was backported from 0.104.0.
  Thank you to Andrea De Pasquale for contributing the fix.

- Assorted bug fixes and improvements.

Special thanks to the following people for code contributions and bug reports:
- Alexander Patrakov
- Andrea De Pasquale
- Antoine Gatineau
- Frank Fegert
- Michał Dardas

diffstat:

 security/clamav/Makefile        |  3 +--
 security/clamav/Makefile.common |  4 ++--
 security/clamav/buildlink3.mk   |  4 ++--
 security/clamav/distinfo        |  8 ++++----
 4 files changed, 9 insertions(+), 10 deletions(-)

diffs (60 lines):

diff -r 1c5cc75f44c3 -r efb86a1ffca5 security/clamav/Makefile
--- a/security/clamav/Makefile  Wed May 04 23:07:00 2022 +0000
+++ b/security/clamav/Makefile  Thu May 05 00:44:07 2022 +0000
@@ -1,6 +1,5 @@
-# $NetBSD: Makefile,v 1.83 2022/04/18 19:10:04 adam Exp $
+# $NetBSD: Makefile,v 1.84 2022/05/05 00:44:07 taca Exp $
 
-PKGREVISION= 1
 .include "Makefile.common"
 
 COMMENT=       Anti-virus toolkit
diff -r 1c5cc75f44c3 -r efb86a1ffca5 security/clamav/Makefile.common
--- a/security/clamav/Makefile.common   Wed May 04 23:07:00 2022 +0000
+++ b/security/clamav/Makefile.common   Thu May 05 00:44:07 2022 +0000
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.22 2022/01/13 15:28:22 taca Exp $
+# $NetBSD: Makefile.common,v 1.23 2022/05/05 00:44:07 taca Exp $
 #
 # used by security/clamav/Makefile
 # used by security/clamav-doc/Makefile
 
-DISTNAME=      clamav-0.103.5
+DISTNAME=      clamav-0.103.6
 CATEGORIES=    security
 MASTER_SITES=  http://www.clamav.net/downloads/production/
 
diff -r 1c5cc75f44c3 -r efb86a1ffca5 security/clamav/buildlink3.mk
--- a/security/clamav/buildlink3.mk     Wed May 04 23:07:00 2022 +0000
+++ b/security/clamav/buildlink3.mk     Thu May 05 00:44:07 2022 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.15 2022/04/18 19:10:04 adam Exp $
+# $NetBSD: buildlink3.mk,v 1.16 2022/05/05 00:44:07 taca Exp $
 
 BUILDLINK_TREE+=       clamav
 
@@ -6,7 +6,7 @@
 CLAMAV_BUILDLINK3_MK:=
 
 BUILDLINK_API_DEPENDS.clamav+= clamav>=0.95.3nb1
-BUILDLINK_ABI_DEPENDS.clamav+= clamav>=0.103.5nb1
+BUILDLINK_ABI_DEPENDS.clamav+= clamav>=0.103.6
 BUILDLINK_PKGSRCDIR.clamav?=   ../../security/clamav
 
 .include "../../archivers/bzip2/buildlink3.mk"
diff -r 1c5cc75f44c3 -r efb86a1ffca5 security/clamav/distinfo
--- a/security/clamav/distinfo  Wed May 04 23:07:00 2022 +0000
+++ b/security/clamav/distinfo  Thu May 05 00:44:07 2022 +0000
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.41 2022/01/13 15:28:22 taca Exp $
+$NetBSD: distinfo,v 1.42 2022/05/05 00:44:07 taca Exp $
 
-BLAKE2s (clamav-0.103.5.tar.gz) = 045c523bcbd02439cc05095cc19d102eee7af6db5cda340e19ed47fb885a3ae9
-SHA512 (clamav-0.103.5.tar.gz) = 242423b507eacbbd31dbae6dd0325dff87da25bb8072f2cee7a5e7cab4b8eb5ee6196c759570c1d75986a2777f0f79f92cfbd6250a30ae5b53390c75b238c29a
-Size (clamav-0.103.5.tar.gz) = 16434316 bytes
+BLAKE2s (clamav-0.103.6.tar.gz) = 402df52b9e6ad382f0d63abe2b2cfd97472dd0873e956d96a37e83b17f715988
+SHA512 (clamav-0.103.6.tar.gz) = d39e1964678b8251bde3a9f3db30fe3d3d76cc566a86834297f4dd8489086dc9cc4c6541ca128089159f4c071d2d85b530455bd942987d3929ea0082b8ab272b
+Size (clamav-0.103.6.tar.gz) = 16491761 bytes
 SHA1 (patch-Makefile.in) = 51e0f42323f07b7ae0cb35a640469dce4e1a2041
 SHA1 (patch-aa) = c07a7b6e883f384ce278964645f0658c0d986ab5
 SHA1 (patch-ab) = 78793f0267ce8c820b51937186dc17dabb4a1ccf