Hello all,
clamav 1.4.5+dfsg-3 is flagged for autoremoval from testing on 2026-09-21
because of this bug, and it takes seven reverse dependencies with it:
c-icap-modules, clamassassin, clamsmtp, clamtk, cyrus-imapd, e2guardian and
libclamunrar. I was working on the cyrus-imapd patch, and thought I'd
also see if a contribution to clamav would be welcome.
Since I am not familiar with the git-dpm workflow, I just built it the
way I know, as a plain source package (I am still new to packaging for
Debian).
Upstream 1.4.6 (2026-08-07) fixes all five CVEs. Since the packaging
branch had no 1.4.6 work yet, I have prepared 1.4.6+dfsg-1. I do not
have upload rights, so I uploaded it to mentors.
Source package: https://mentors.debian.net/package/clamav/
I have kept the diff to the minimum a security update needs, but also
included commit 97a37bb2 from Salsa (d/ci: Disable blhc).
A debdiff is attached to this email.
Build: I built this with sbuild in unstable.
Tests: The upstream testsuite passes (6/6 test suites, plus the Rust
unit tests).
Lintian: Compared to 1.4.5+dfsg-3, lintian reports two new tags:
`no-nmu-in-changelog` and
`source-nmu-has-incorrect-version-number`.
Both are due to my name being in the changelog, but I
am not a
Maintainer or Uploader.
Some points that I think are noteworthy:
* All four patches in debian/patches/series still apply to 1.4.6; none have
been merged upstream. Only 0004-unit_tests-Don-t-set-TMP.patch needed a
refresh (3-line offset).
* No ABI break. LIBCLAMAV_CURRENT:REVISION:AGE is 12:3:0 in both 1.4.5 and
1.4.6. The SONAME stays libclamav.so.12.
* Your guard in override_dh_auto_configure did its job and stopped my first
build: CL_FLEVEL went 215 -> 216 in 1.4.6. I followed the same treatment
as 478677ef ("d: Update symbols") for the 1.4.5 bump -- the four 1.4.5
minvers in debian/libclamav12.symbols (CLAMAV_PRIVATE, cl_retflevel@
CLAMAV_PUBLIC, FRESHCLAM_PRIVATE, FRESHCLAM_PUBLIC) go to 1.4.6, and the
CL_FLEVEL literal in debian/rules goes to 216. Please do sanity-check
that, as I was trying to copy what has been done before.
* CVE-2025-8088 is not relevant to Debian: it is Windows-only. The security
tracker marks it NOT-FOR-US. I have not mentioned it in the changelog.
* I did not do anything with git-dpm, and therefore didn't touch
d/.git-dpm (it still has the 1.4.5 import).
* debian/rules runs debconf-updatepo in the `clean` target, so a plain
"dpkg-buildpackage -S" rewrites all twenty debian/po/*.po files. When I
did a diff between the newly built package and 1.4.5+dfsg-3, I saw all
these new .po files, which surprised me. Looking at that 1.4.5+dfsg-3
source package in the
archive, it still has POT-Creation-Date 2021-02-21, so I reckon these
don't usually get updated by the clamav team. Therefore, I rebuilt with
`-nc` and restored the .po files, so that the change is minimal. I just
wanted to write this out.
If it is easier for you to just do the 1.4.6 import yourselves and ignore my
package entirely, that is completely fine. Please let me know, and I
will remove it from mentors.
I hope that the changelog is written correctly. I presumed that the
clamav-team will upload the package, if they so desire. If they drop it,
fine. If someone else uploads it as an NMU, then the changelog will be
changed accordingly I'm sure.
Kind regards,
Edmund
--
Edmund Lodewijks <[email protected]>
TZ: UTC+2 / GMT+2
diff -Nru clamav-1.4.5+dfsg/debian/changelog clamav-1.4.6+dfsg/debian/changelog
--- clamav-1.4.5+dfsg/debian/changelog 2026-07-11 15:42:12.000000000 +0200
+++ clamav-1.4.6+dfsg/debian/changelog 2026-08-17 16:22:11.000000000 +0200
@@ -1,3 +1,21 @@
+clamav (1.4.6+dfsg-1) unstable; urgency=high
+
+ * Import 1.4.6 (Closes: #1143939)
+ - CVE-2026-20345 ("Fixed an indexing error while converting GPT
+ partition names")
+ - CVE-2026-20339 ("Fixed an integer overflow in the PESpin unpacker")
+ - CVE-2026-20346 ("Fixed an integer underflow in the PDF parser")
+ - CVE-2026-20347 ("Fixed undefined behavior and integer overflow in the
+ Mach-O parser")
+ - CVE-2026-20348 ("Fixed XAR parser size handling")
+ - Fixed thread-safety issues in the clamd STATS command that could
+ disclose process memory or crash the daemon
+ * Refresh 0004-unit_tests-Don-t-set-TMP.patch
+ * Update symbols and the CL_FLEVEL guard in d/rules for 1.4.6
+ (CL_FLEVEL 215 -> 216)
+
+ -- Edmund Lodewijks <[email protected]> Mon, 17 Aug 2026 16:22:11 +0200
+
clamav (1.4.5+dfsg-3) unstable; urgency=medium
* Allow the testsuite in parallel
diff -Nru clamav-1.4.5+dfsg/debian/libclamav12.symbols clamav-1.4.6+dfsg/debian/libclamav12.symbols
--- clamav-1.4.5+dfsg/debian/libclamav12.symbols 2026-07-11 15:27:37.000000000 +0200
+++ clamav-1.4.6+dfsg/debian/libclamav12.symbols 2026-08-17 16:22:11.000000000 +0200
@@ -3,10 +3,10 @@
*@CLAMAV_0.104.0 1.2.1
*@CLAMAV_1.0.0 1.2.1
*@CLAMAV_1.1.0 1.2.1
- *@CLAMAV_PRIVATE 1.4.5
+ *@CLAMAV_PRIVATE 1.4.6
*@CLAMAV_PUBLIC 1.2.1
- cl_retflevel@CLAMAV_PUBLIC 1.4.5
+ cl_retflevel@CLAMAV_PUBLIC 1.4.6
libfreshclam.so.3 libclamav12 #MINVER#
* Build-Depends-Package: libclamav-dev
- *@FRESHCLAM_PRIVATE 1.4.5
- *@FRESHCLAM_PUBLIC 1.4.5
+ *@FRESHCLAM_PRIVATE 1.4.6
+ *@FRESHCLAM_PUBLIC 1.4.6
diff -Nru clamav-1.4.5+dfsg/debian/patches/0004-unit_tests-Don-t-set-TMP.patch clamav-1.4.6+dfsg/debian/patches/0004-unit_tests-Don-t-set-TMP.patch
--- clamav-1.4.5+dfsg/debian/patches/0004-unit_tests-Don-t-set-TMP.patch 2026-07-11 15:27:38.000000000 +0200
+++ clamav-1.4.6+dfsg/debian/patches/0004-unit_tests-Don-t-set-TMP.patch 2026-08-17 16:04:22.000000000 +0200
@@ -16,11 +16,11 @@
unit_tests/CMakeLists.txt | 1 -
1 file changed, 1 deletion(-)
-diff --git a/unit_tests/CMakeLists.txt b/unit_tests/CMakeLists.txt
-index bf7e2ef..a4d2ea4 100644
---- a/unit_tests/CMakeLists.txt
-+++ b/unit_tests/CMakeLists.txt
-@@ -205,7 +205,6 @@ else()
+Index: clamav-1.4.6+dfsg/unit_tests/CMakeLists.txt
+===================================================================
+--- clamav-1.4.6+dfsg.orig/unit_tests/CMakeLists.txt
++++ clamav-1.4.6+dfsg/unit_tests/CMakeLists.txt
+@@ -208,7 +208,6 @@ else()
set(SOURCE ${CMAKE_SOURCE_DIR})
set(BUILD ${CMAKE_BINARY_DIR})
diff -Nru clamav-1.4.5+dfsg/debian/rules clamav-1.4.6+dfsg/debian/rules
--- clamav-1.4.5+dfsg/debian/rules 2026-07-11 15:41:16.000000000 +0200
+++ clamav-1.4.6+dfsg/debian/rules 2026-08-17 16:22:11.000000000 +0200
@@ -99,7 +99,7 @@
fi;\
done; \
# Check for library features which may have been upgraded.
- if ! grep -q "CL_FLEVEL 215" libclamav/others.h ; then \
+ if ! grep -q "CL_FLEVEL 216" libclamav/others.h ; then \
echo "cl_retflevel needs boosting in symbol file"; \
touch debian/exit; \
fi;
diff -Nru clamav-1.4.5+dfsg/debian/salsa-ci.yml clamav-1.4.6+dfsg/debian/salsa-ci.yml
--- clamav-1.4.5+dfsg/debian/salsa-ci.yml 2026-07-11 15:27:37.000000000 +0200
+++ clamav-1.4.6+dfsg/debian/salsa-ci.yml 2026-08-17 10:08:52.000000000 +0200
@@ -1,3 +1,7 @@
---
include:
- https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
+
+variables:
+ # Some RUST lines are identified as "NONVERBOSE BUILD"
+ SALSA_CI_DISABLE_BLHC: 1
