[pkgsrc/pkgsrc-2022Q1]: pkgsrc/security/clamav Pullup ticket #6625 - requeste...

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/c3791fc6c678
branches:  pkgsrc-2022Q1
changeset: 378882:c3791fc6c678
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Sun May 08 15:28:34 2022 +0000

description:
Pullup ticket #6625 - requested by taca
security/clamav: security fix

Revisions pulled up:
- security/clamav/Makefile                                      1.84
- security/clamav/Makefile.common                               1.23
- security/clamav/buildlink3.mk                                 1.16
- security/clamav/distinfo                                      1.42

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Thu May  5 00:44:07 UTC 2022

   Modified Files:
        pkgsrc/security/clamav: Makefile Makefile.common buildlink3.mk distinfo

   Log Message:
   security/clamav: update to 0.103.6

   0.103.6 (2022-05-04)

   ClamAV 0.103.6 is a critical patch release with the following fixes:

   - [CVE-2022-20770](CVE-2022-20770): Fixed a possible infinite loop vulner=
   ability
     in the CHM file parser.
     Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 =
   and
     prior versions.
     Thank you to Micha=A9=A9 Dardas for reporting this issue.

   - [CVE-2022-20796](CVE-2022-20796): Fixed a possible NULL-pointer derefer=
   ence
     crash in the scan verdict cache check.
     Issue affects versions 0.103.4, 0.103.5, 0.104.1, and 0.104.2.
     Thank you to Alexander Patrakov and Antoine Gatineau for reporting this=
    issue.

   - [CVE-2022-20771](CVE-2022-20771): Fixed a possible infinite loop vulner=
   ability
     in the TIFF file parser.
     Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 =
   and
     prior versions.
     The issue only occurs if the "--alert-broken-media" ClamScan option is
     enabled. For ClamD, the affected option is "AlertBrokenMedia yes", and =
   for
     libclamav it is the "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option.
     Thank you to Micha=A9=A9 Dardas for reporting this issue.

   - [CVE-2022-20785](CVE-2022-20785): Fixed a possible memory leak in the
     HTML file parser / Javascript normalizer.
     Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 =
   and
     prior versions.
     Thank you to Micha=A9=A9 Dardas for reporting this issue.

   - [CVE-2022-20792](CVE-2022-20792): Fixed a possible multi-byte heap buff=
   er
     overflow write vulnerability in the signature database load module.
     The fix was to update the vendored regex library to the latest version.
     Issue affects versions 0.104.0 through 0.104.2 and LTS version 0.103.5 =
   and
     prior versions.
     Thank you to Micha=A9=A9 Dardas for reporting this issue.

   - ClamOnAcc: Fixed a number of assorted stability issues and added niceti=
   es for
     debugging ClamOnAcc. Patches courtesy of Frank Fegert.

   - Fixed an issue causing byte-compare subsignatures to cause an alert whe=
   n they
     match even if other conditions of the given logical signatures were not=
    met.

   - Fix memleak when using multiple byte-compare subsignatures.
     This fix was backported from 0.104.0.
     Thank you to Andrea De Pasquale for contributing the fix.

   - Assorted bug fixes and improvements.

   Special thanks to the following people for code contributions and bug rep=
   orts:
   - Alexander Patrakov
   - Andrea De Pasquale
   - Antoine Gatineau
   - Frank Fegert
   - Micha=A9=A9 Dardas

diffstat:

 security/clamav/Makefile.common |  4 ++--
 security/clamav/buildlink3.mk   |  4 ++--
 security/clamav/distinfo        |  8 ++++----
 3 files changed, 8 insertions(+), 8 deletions(-)

diffs (49 lines):

diff -r 18dba5d380ad -r c3791fc6c678 security/clamav/Makefile.common
--- a/security/clamav/Makefile.common   Sun May 08 14:58:27 2022 +0000
+++ b/security/clamav/Makefile.common   Sun May 08 15:28:34 2022 +0000
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.22 2022/01/13 15:28:22 taca Exp $
+# $NetBSD: Makefile.common,v 1.22.2.1 2022/05/08 15:28:34 bsiegert Exp $
 #
 # used by security/clamav/Makefile
 # used by security/clamav-doc/Makefile
 
-DISTNAME=      clamav-0.103.5
+DISTNAME=      clamav-0.103.6
 CATEGORIES=    security
 MASTER_SITES=  http://www.clamav.net/downloads/production/
 
diff -r 18dba5d380ad -r c3791fc6c678 security/clamav/buildlink3.mk
--- a/security/clamav/buildlink3.mk     Sun May 08 14:58:27 2022 +0000
+++ b/security/clamav/buildlink3.mk     Sun May 08 15:28:34 2022 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.14 2021/12/08 16:02:33 adam Exp $
+# $NetBSD: buildlink3.mk,v 1.14.4.1 2022/05/08 15:28:34 bsiegert Exp $
 
 BUILDLINK_TREE+=       clamav
 
@@ -6,7 +6,7 @@
 CLAMAV_BUILDLINK3_MK:=
 
 BUILDLINK_API_DEPENDS.clamav+= clamav>=0.95.3nb1
-BUILDLINK_ABI_DEPENDS.clamav+= clamav>=0.103.4
+BUILDLINK_ABI_DEPENDS.clamav+= clamav>=0.103.6
 BUILDLINK_PKGSRCDIR.clamav?=   ../../security/clamav
 
 .include "../../archivers/bzip2/buildlink3.mk"
diff -r 18dba5d380ad -r c3791fc6c678 security/clamav/distinfo
--- a/security/clamav/distinfo  Sun May 08 14:58:27 2022 +0000
+++ b/security/clamav/distinfo  Sun May 08 15:28:34 2022 +0000
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.41 2022/01/13 15:28:22 taca Exp $
+$NetBSD: distinfo,v 1.41.2.1 2022/05/08 15:28:34 bsiegert Exp $
 
-BLAKE2s (clamav-0.103.5.tar.gz) = 045c523bcbd02439cc05095cc19d102eee7af6db5cda340e19ed47fb885a3ae9
-SHA512 (clamav-0.103.5.tar.gz) = 242423b507eacbbd31dbae6dd0325dff87da25bb8072f2cee7a5e7cab4b8eb5ee6196c759570c1d75986a2777f0f79f92cfbd6250a30ae5b53390c75b238c29a
-Size (clamav-0.103.5.tar.gz) = 16434316 bytes
+BLAKE2s (clamav-0.103.6.tar.gz) = 402df52b9e6ad382f0d63abe2b2cfd97472dd0873e956d96a37e83b17f715988
+SHA512 (clamav-0.103.6.tar.gz) = d39e1964678b8251bde3a9f3db30fe3d3d76cc566a86834297f4dd8489086dc9cc4c6541ca128089159f4c071d2d85b530455bd942987d3929ea0082b8ab272b
+Size (clamav-0.103.6.tar.gz) = 16491761 bytes
 SHA1 (patch-Makefile.in) = 51e0f42323f07b7ae0cb35a640469dce4e1a2041
 SHA1 (patch-aa) = c07a7b6e883f384ce278964645f0658c0d986ab5
 SHA1 (patch-ab) = 78793f0267ce8c820b51937186dc17dabb4a1ccf