Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package clamav for openSUSE:Factory checked in at 2026-08-24 15:45:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/clamav (Old) and /work/SRC/openSUSE:Factory/.clamav.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "clamav" Mon Aug 24 15:45:04 2026 rev:142 rq:1373377 version:1.5.4 Changes: -------- --- /work/SRC/openSUSE:Factory/clamav/clamav.changes 2026-07-03 16:06:46.193122860 +0200 +++ /work/SRC/openSUSE:Factory/.clamav.new.1258/clamav.changes 2026-08-24 15:48:31.039180374 +0200 @@ -1,0 +2,50 @@ +Sun Aug 16 20:44:26 UTC 2026 - Arjen de Korte <[email protected]> + +- update to 1.5.4 + ClamAV 1.5.4 is a patch release with the following fixes: + * CVE-2026-20337, bsc#1274597: + Fixed ZIP catalogue capacity tracking that could write beyond a heap + allocation while indexing local file headers. + * CVE-2026-20345, bsc#1274600: + Fixed an indexing error while converting GPT partition names that could + read or write beyond a stack-allocated partition entry. + * CVE-2026-20339, bsc#1274599: + Fixed an integer overflow in the PESpin unpacker that could allocate an + undersized buffer and then write beyond it while rebuilding a PE file. + * CVE-2026-20338, bsc#1274598: + Fixed ownership handling while merging ZIP catalogue records that could + cause an invalid free while scanning a malformed archive. + * CVE-2026-20346, bsc#1274601: + Fixed an integer underflow in the PDF parser that could cause a crash while + reading a malformed hex string. + * CVE-2026-20347, bsc#1274602: + Fixed undefined behavior and integer overflow in the Mach-O parser that + could cause a crash while scanning a malformed Mach-O file. + * CVE-2026-20348, bsc#1274603: + Fixed XAR parser size handling that could request an excessive allocation + or exceed scan limits while decompressing a malformed table of contents. + * CVE-2025-8088: + Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library. + The fix rejects path separators in NTFS alternate data stream names to + prevent extraction outside ClamAV's temporary scan directory on Windows. + * Fixed thread-safety issues in the clamd STATS command that could disclose + process memory or crash the daemon while scans and STATS requests run + concurrently. Also fixed partial socket-write handling used for large STATS + responses. + * FreeBSD: Restored support for safe quarantine move and remove actions while + preserving protection against source-path replacement races. + * Fixed an OpenSSL library-context leak in legacy hashing helpers when a + requested message digest cannot be fetched, such as when the default + provider is unavailable in a FIPS-enabled environment. + * Upgraded the Rust crossbeam-epoch dependency to resolve the + RUSTSEC-2026-0204 advisory. + +------------------------------------------------------------------- +Fri Jul 24 14:09:10 UTC 2026 - Reinhard Max <[email protected]> + +- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to + fix path traversal vulnerability in OneNote parser. +- Add clamav-vendor-cve-2026-46671.tar.gz to provide the + sanitise-file-name Rust crate required by the security fix. + +------------------------------------------------------------------- Old: ---- clamav-1.5.3.tar.gz clamav-1.5.3.tar.gz.sig New: ---- clamav-1.5.4.tar.gz clamav-1.5.4.tar.gz.sig clamav-CVE-2026-46671.patch clamav-vendor-cve-2026-46671.tar.gz ----------(New B)---------- New: - CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to fix path traversal vulnerability in OneNote parser. ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ clamav.spec ++++++ --- /var/tmp/diff_new_pack.txaV7Y/_old 2026-08-24 15:48:32.309225308 +0200 +++ /var/tmp/diff_new_pack.txaV7Y/_new 2026-08-24 15:48:32.310225343 +0200 @@ -44,7 +44,7 @@ %define jsonc json-c-json-c-%vjsonc-20240915 Name: clamav -Version: 1.5.3 +Version: 1.5.4 Release: 0 Summary: Antivirus Toolkit License: GPL-2.0-only @@ -62,12 +62,14 @@ # w3m https://www.clamav.net/downloads | sed -n '/-BEGIN /,/-END /p' Source11: clamav.keyring Source12: service.clamonacc +Source13: clamav-vendor-cve-2026-46671.tar.gz Source65: system-user-vscan.conf Patch1: clamav-conf.patch Patch5: clamav-obsolete-config.patch Patch14: clamav-document-maxsize.patch Patch15: clamav-format.patch Patch16: clamav-workaround.patch +Patch17: clamav-CVE-2026-46671.patch ExcludeArch: %{arml} %{ix86} BuildRequires: cargo%{?vrust} @@ -204,6 +206,7 @@ %prep %setup -q +%setup -D -T -a 13 -q %if %{with static_jsonc} %setup -D -T -b 2 -q %endif @@ -212,6 +215,15 @@ %patch -P 14 %patch -P 15 %patch -P 16 +%patch -P 17 -p 1 + +# Update cargo checksums for patched onenote_parser files +sed -i \ + -e 's/"Cargo\.toml":"[^"]*"/"Cargo.toml":"3686e894fa5754caceaac071320facb1cb6d2179a64493226c3e04e25e56e021"/' \ + -e 's/"src\/errors\.rs":"[^"]*"/"src\/errors.rs":"69670dda64c2ff4ebe2a695e327bb3acb16ba449c9552d811b09844362719f1d"/' \ + -e 's/"src\/onenote\/mod\.rs":"[^"]*"/"src\/onenote\/mod.rs":"0663148eb403ed1b0052e0fa99ef4598b958bde91cba936e9fd962e1b4b08da1"/' \ + .cargo/vendor/onenote_parser/.cargo-checksum.json + chmod -x docs/html/images/flamegraph.svg %build ++++++ clamav-1.5.3.tar.gz -> clamav-1.5.4.tar.gz ++++++ /work/SRC/openSUSE:Factory/clamav/clamav-1.5.3.tar.gz /work/SRC/openSUSE:Factory/.clamav.new.1258/clamav-1.5.4.tar.gz differ: char 5, line 1 ++++++ clamav-CVE-2026-46671.patch ++++++ Nur in clamav-1.5.3.new/.cargo/vendor/onenote_parser: c9267b2c96e2542be7e7b557d67318e81b733585.patch. Nur in clamav-1.5.3.new/.cargo/vendor/onenote_parser: Cargo.lock. diff -ruBb clamav-1.5.3/.cargo/vendor/onenote_parser/Cargo.toml clamav-1.5.3.new/.cargo/vendor/onenote_parser/Cargo.toml --- clamav-1.5.3/.cargo/vendor/onenote_parser/Cargo.toml 2026-07-01 11:01:45.000000000 +0200 +++ clamav-1.5.3.new/.cargo/vendor/onenote_parser/Cargo.toml 2026-07-21 12:52:18.750916459 +0200 @@ -52,9 +52,11 @@ itertools = "0.10.3" num-traits = "0.2" paste = "1.0" +sanitise-file-name = "1.0" thiserror = "1.0" uuid = "1.1.2" widestring = "1.0.2" [dev-dependencies] insta = "1.21.1" +tempfile = "3.15" Nur in clamav-1.5.3.new/.cargo/vendor/onenote_parser: onenote-new.patch. diff -ruBb clamav-1.5.3/.cargo/vendor/onenote_parser/src/errors.rs clamav-1.5.3.new/.cargo/vendor/onenote_parser/src/errors.rs --- clamav-1.5.3/.cargo/vendor/onenote_parser/src/errors.rs 2026-07-01 11:01:46.000000000 +0200 +++ clamav-1.5.3.new/.cargo/vendor/onenote_parser/src/errors.rs 2026-07-21 12:59:28.000762400 +0200 @@ -130,4 +130,8 @@ #[from] err: widestring::error::MissingNulTerminator, }, + + /// Invalid path encountered while parsing. + #[error("Invalid path: {message}")] + InvalidPath { message: Cow<'static, str> }, } diff -ruBb clamav-1.5.3/.cargo/vendor/onenote_parser/src/onenote/mod.rs clamav-1.5.3.new/.cargo/vendor/onenote_parser/src/onenote/mod.rs --- clamav-1.5.3/.cargo/vendor/onenote_parser/src/onenote/mod.rs 2026-07-01 11:01:46.000000000 +0200 +++ clamav-1.5.3.new/.cargo/vendor/onenote_parser/src/onenote/mod.rs 2026-07-21 12:59:45.386877672 +0200 @@ -4,11 +4,11 @@ use crate::onenote::section::{Section, SectionEntry, SectionGroup}; use crate::onestore::parse_store; use crate::reader::Reader; +use sanitise_file_name::sanitise; use std::ffi::OsStr; use std::fs::File; -use std::io::{BufReader, Read, Cursor}; -use std::path::Path; -use std::str::FromStr; +use std::io::{BufReader, Read}; +use std::path::{Component, Path, PathBuf}; pub(crate) mod content; pub(crate) mod embedded_file; @@ -54,14 +54,13 @@ } let base_dir = path.parent().expect("no base dir found"); - let sections = notebook::parse_toc(store.data_root())? + let entries = notebook::parse_toc(store.data_root())?; + let entries = entries .iter() - .map(|name| { - let mut file = base_dir.to_path_buf(); - file.push(name); - - file - }) + .map(|name| resolve_entry_path(base_dir, name)) + .collect::<Result<Vec<_>>>()?; + let sections = entries + .into_iter() .filter(|p| p.exists()) .filter(|p| !p.ends_with("OneNote_RecycleBin")) .map(|path| { @@ -165,8 +164,109 @@ } } +fn resolve_entry_path(base_dir: &Path, entry: &str) -> Result<PathBuf> { + let entry_path = Path::new(entry); + if entry_path.is_absolute() { + return Err(ErrorKind::InvalidPath { + message: "section entry must be a relative path".into(), + } + .into()); + } + + let mut sanitized = PathBuf::new(); + for component in entry_path.components() { + match component { + Component::Normal(name) => { + let name = name.to_str().ok_or_else(|| ErrorKind::InvalidPath { + message: "section entry contains non-utf8 characters".into(), + })?; + let clean = sanitise(name); + if clean != name { + return Err(ErrorKind::InvalidPath { + message: format!("section entry contains invalid characters: {name}").into(), + } + .into()); + } + sanitized.push(name); + } + Component::CurDir => {} + Component::ParentDir | Component::RootDir | Component::Prefix(_) => { + return Err(ErrorKind::InvalidPath { + message: "section entry contains invalid path components".into(), + } + .into()); + } + } + } + + if sanitized.as_os_str().is_empty() { + return Err(ErrorKind::InvalidPath { + message: "section entry is empty".into(), + } + .into()); + } + + let candidate = base_dir.join(&sanitized); + if candidate.exists() { + let base_canon = base_dir.canonicalize().map_err(|err| ErrorKind::InvalidPath { + message: format!("failed to resolve base directory: {err}").into(), + })?; + let candidate_canon = + candidate + .canonicalize() + .map_err(|err| ErrorKind::InvalidPath { + message: format!("failed to resolve entry path: {err}").into(), + })?; + if !candidate_canon.starts_with(&base_canon) { + return Err(ErrorKind::InvalidPath { + message: "section entry escapes base directory".into(), + } + .into()); + } + } + + Ok(candidate) +} + impl Default for Parser { fn default() -> Self { Self::new() } } + +#[cfg(test)] +mod tests { + use super::resolve_entry_path; + use std::path::Path; + use tempfile::tempdir; + + #[test] + fn test_resolve_entry_path_rejects_traversal() { + let dir = tempdir().unwrap(); + let base = dir.path(); + + let err = resolve_entry_path(base, "../secret.one").unwrap_err(); + let err = format!("{err}"); + assert!(err.contains("invalid path components")); + } + + #[test] + fn test_resolve_entry_path_rejects_absolute() { + let dir = tempdir().unwrap(); + let base = dir.path(); + + let candidate = if cfg!(windows) { r"C:\secret.one" } else { "/etc/passwd" }; + let err = resolve_entry_path(base, candidate).unwrap_err(); + let err = format!("{err}"); + assert!(err.contains("relative path")); + } + + #[test] + fn test_resolve_entry_path_accepts_relative() { + let dir = tempdir().unwrap(); + let base = dir.path(); + + let resolved = resolve_entry_path(base, "Section 1.one").unwrap(); + assert_eq!(resolved, Path::new(base).join("Section 1.one")); + } +} Nur in clamav-1.5.3.new/.cargo/vendor/onenote_parser: target.
