Your message dated Sat, 17 Oct 2026 10:47:06 +0000
with message-id <[email protected]>
and subject line Bug#1143939: fixed in clamav 1.4.6+dfsg-1~deb13u1
has caused the Debian Bug report #1143939,
regarding clamav: CVE-2026-20339 CVE-2026-20345 CVE-2026-20346 CVE-2026-20347
CVE-2026-20348
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1143939: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143939
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: clamav
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for clamav.
CVE-2026-20339[0]:
| A vulnerability in the PESpin file format parser of ClamAV could
| allow an unauthenticated, remote attacker to cause a DoS condition
| or possibly other expanded impacts as a result of memory
| corruption on an affected device. This vulnerability is due to
| improper boundary checks for content in PESpin files during
| scanning, which may result in an integer overflow. An attacker could
| exploit this vulnerability by submitting a crafted file that
| contains PESpin content to be scanned by ClamAV on an affected
| device. A successful exploit could allow the attacker to cause the
| ClamAV scanning process to terminate, resulting in a DoS condition
| on the affected software.
CVE-2026-20345[1]:
| A vulnerability in the GPT file format parser of ClamAV could allow
| an unauthenticated, remote attacker to cause a DoS condition or
| possibly other expanded impacts as a result of memory
| corruption on an affected device. This vulnerability is due to
| improper handling of an endian conversion operation, which may
| result in an out-of-bounds buffer write. An attacker could exploit
| this vulnerability by submitting a crafted GPT file to be scanned by
| ClamAV on an affected device. A successful exploit could allow the
| attacker to cause the ClamAV scanning process to terminate,
| resulting in a DoS condition on the affected software.
CVE-2026-20346[2]:
| A vulnerability in the PDF file format parser of ClamAV could allow
| an unauthenticated, remote attacker to cause a DoS condition or
| possibly other expanded impacts as a result of memory
| corruption on an affected device. This vulnerability is due to
| improper boundary checks for content in PDF files during scanning,
| which may result in an out-of-bounds buffer read. An attacker could
| exploit this vulnerability by submitting a crafted PDF file to be
| scanned by ClamAV on an affected device. A successful exploit could
| allow the attacker to cause the ClamAV scanning process to
| terminate, resulting in a DoS condition on the affected software.
CVE-2026-20347[3]:
| A vulnerability in the Mach-O file format parser of ClamAV could
| allow an unauthenticated, remote attacker to cause a DoS condition
| or possibly other expanded impacts as a result of memory
| corruption on an affected device. This vulnerability is due to
| improper boundary checks for content in Mach-O files during
| scanning, which may result in an out-of-bounds buffer read. An
| attacker could exploit this vulnerability by submitting a crafted
| Mach-O file to be scanned by ClamAV on an affected device. A
| successful exploit could allow the attacker to cause the ClamAV
| scanning process to terminate, resulting in a DoS condition on the
| affected software.
CVE-2026-20348[4]:
| A vulnerability in the XAR file format parser of ClamAV could allow
| an unauthenticated, remote attacker to cause a DoS condition or
| possibly other expanded impacts as a result of memory
| corruption on an affected device. This vulnerability is due to
| improper boundary checks for content in XAR files during scanning.
| An attacker could exploit this vulnerability by submitting a crafted
| file that contains XAR content to be scanned by ClamAV on an
| affected device. A successful exploit could allow the attacker to
| cause the ClamAV scanning process to terminate, resulting in a DoS
| condition on the affected software.
https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-20339
https://www.cve.org/CVERecord?id=CVE-2026-20339
[1] https://security-tracker.debian.org/tracker/CVE-2026-20345
https://www.cve.org/CVERecord?id=CVE-2026-20345
[2] https://security-tracker.debian.org/tracker/CVE-2026-20346
https://www.cve.org/CVERecord?id=CVE-2026-20346
[3] https://security-tracker.debian.org/tracker/CVE-2026-20347
https://www.cve.org/CVERecord?id=CVE-2026-20347
[4] https://security-tracker.debian.org/tracker/CVE-2026-20348
https://www.cve.org/CVERecord?id=CVE-2026-20348
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: clamav
Source-Version: 1.4.6+dfsg-1~deb13u1
Done: Sebastian Andrzej Siewior <[email protected]>
We believe that the bug you reported is fixed in the latest version of
clamav, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sebastian Andrzej Siewior <[email protected]> (supplier of updated clamav
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 05 Sep 2026 21:13:32 +0200
Source: clamav
Architecture: source
Version: 1.4.6+dfsg-1~deb13u1
Distribution: trixie
Urgency: medium
Maintainer: ClamAV Team <[email protected]>
Changed-By: Sebastian Andrzej Siewior <[email protected]>
Closes: 1043428 1092882 1103001 1120998 1123913 1141347 1143939
Changes:
clamav (1.4.6+dfsg-1~deb13u1) trixie; urgency=medium
.
[ Sebastian Andrzej Siewior ]
* Import 1.4.5
- CVE-2026-20031 (Fixed an error handling bug in the HTML file parser)
- Fixes a few bugs scanning JPEG/ TIFF files (Closes: #1120998)
- CVE-2026-20217 ("Fixed a bug in the PESpin unpacker cleanup path")
- CVE-2026-20213 ("Fixed an integer overflow in PE rebuild size
calculations")
- CVE-2026-20216 ("Fixed an InstallShield archive extraction limit
bypass")
- CVE-2026-20214 ("Fixed an FSG unpacker loop underflow")
- CVE-2026-20243 ("Fixed ALZ parser size handling bugs")
- CVE-2026-20215 ("Fixed a 7z parser substream count overflow")
- CVE-2026-20244 ("Fixed 32-bit DMG parser size checks")
* Update apparmor profile for clamd (Closes: #1092882, #1123913).
* Use -DCMAKE_BUILD_TYPE=RelWithDebInfo by default (Closes: #1141347).
* Add Romanian debconf templates translation (Closes: #1103001).
* Mention in the README.Debian that clamAV AppArmor profiles do not allow
OnAccess scanning ("Closes: #1043428).
.
[ Pino Toscano ]
* Make sure to ignore the not installed files on all the architectures.
* Limit systemd build dependencies as linux-any, as systemd is available only
on Linux.
* Simplify handling of Linux-only files by using dh-exec, rather than
creating
install and manpages files during build:
- add the dh-exec build dependency
- mark the Linux-only files in install and manpages files
- simplify debian/rules accordingly
* Wrap the whole override_dh_installsystemd to run on Linux, rather than only
the first command in it.
.
[ Pétur Ingi Egilsson ]
* clamav-daemon.postinst.in: honour "none" as a way to disable
the LogFile directive.
.
[ Edmund Lodewijks ]
* Import 1.4.6 (Closes: #1143939)
- CVE-2026-20345 ("Fixed an indexing error while converting GPT
partition names")
- CVE-2026-20339 ("Fixed an integer overflow in the PESpin unpacker")
- CVE-2026-20346 ("Fixed an integer underflow in the PDF parser")
- CVE-2026-20347 ("Fixed undefined behavior and integer overflow in the
Mach-O parser")
- CVE-2026-20348 ("Fixed XAR parser size handling")
- Fixed thread-safety issues in the clamd STATS command that could
disclose process memory or crash the daemon
Checksums-Sha1:
cab9a2d68ee3cbc18ade037981c941a9032cf70d 3023 clamav_1.4.6+dfsg-1~deb13u1.dsc
d076f78137f51afc0dbb7b67ec476c3c62487089 27698332 clamav_1.4.6+dfsg.orig.tar.xz
1a4432935b80c9c0ef46f0bc33d90c378cba9e8b 519104
clamav_1.4.6+dfsg-1~deb13u1.debian.tar.xz
Checksums-Sha256:
2ded467a2b40e1077d1fa0d7eafe673195db487d00aa230dd51825ca89855bec 3023
clamav_1.4.6+dfsg-1~deb13u1.dsc
09823124e9bae5d602699c2a2fe5d4876298283cf3e7f8982973571843572468 27698332
clamav_1.4.6+dfsg.orig.tar.xz
53056aa745141d97192fdfe7b20ebbba318117850b3cab43b81a766ba9ff39a5 519104
clamav_1.4.6+dfsg-1~deb13u1.debian.tar.xz
Files:
511c576d3776aff040ef69cd0e1bdc3e 3023 utils optional
clamav_1.4.6+dfsg-1~deb13u1.dsc
1342952a4063eee18d239cd7761ef0ff 27698332 utils optional
clamav_1.4.6+dfsg.orig.tar.xz
2833c186fa3b02773c3a16d4d24d439e 519104 utils optional
clamav_1.4.6+dfsg-1~deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmqcdYYACgkQBWQfF1cS
+luhGAv+P+70X+/7JvTXk0NLBQ8zIcac3QVbOYqH2fmoBot/UDmacA/FOakGct7h
XG38JFowevTq9d7c3zoZBbR0VpEdeGm0G9zXdZKR+y4BxLg56EXwEqMKI3Dh5nQJ
hv+7n+hq5ozQzZzkM0bIr6P5jPkBtTwA7D5IJziYMkysPbYt6I/B7qKBJ4ofcPAb
RDQw+9HDiAH6Bc0LcX51k+eZakdrXRPVhhaFycvSr+YEyTeiBqhMwpsODC9x/eT3
87eWcOr5oajmjraW14mSK5rOYiBuIqpMF2jsqxeOQjlMPsYsHFqMCBiU1Korit2I
MkFbPX0oIPmOxaooyArxqPDaoLhrQIBMdZR2U3Hlz0wQQJKGdBUBLzc4XnKEmyK1
4JlbK7as/r31+vQ5g7xqqex1wmSIOLk66i+ZzaZifhAR2uCEU2V/qkGK28S5vIS1
nb8lRYLMoHpzo5HEk0OH5qv5L9gNLQcGM78qjNLAw0YizVJZoRKJTr4pGTfEajNQ
q5d4Qzid
=TRXP
-----END PGP SIGNATURE-----
pgpm6Q__Pdnng.pgp
Description: PGP signature
--- End Message ---
