diff --git a/CVE-2022-20698.patch b/CVE-2022-20698.patch deleted file mode 100644 index 8d5bb62faf2aa9c66b6e5c2e0732f5921b3b2026..0000000000000000000000000000000000000000 --- a/CVE-2022-20698.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 9a6bb57f89721db637f4ddb5b233c1c4e23d223a Mon Sep 17 00:00:00 2001 -From: Micah Snyder -Date: Wed, 15 Sep 2021 15:51:53 -0700 -Subject: [PATCH] OOXML: Fix invalid pointer dereference - -The OOXML parser in libclamav may try to extract an entry that is -missing a file name. This results in an invalid 0x1 pointer dereference -in the ZIP parser that is likely to crash the scanning application. - -This commit fixes the issue by requiring both the PartName (PN) *and* -the ContentType (CT) variables to be non-NULL or else the entry will be -skipped. - -Thank you Laurent Delosieres for reporting this issue. ---- - libclamav/ooxml.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/libclamav/ooxml.c b/libclamav/ooxml.c -index 16c436f1a5..644779432c 100644 ---- a/libclamav/ooxml.c -+++ b/libclamav/ooxml.c -@@ -245,7 +245,7 @@ static cl_error_t ooxml_content_cb(int fd, const char *filepath, cli_ctx *ctx, c - cli_dbgmsg("%s: %s\n", localname, value); - } - -- if (!CT && !PN) continue; -+ if (!CT || !PN) continue; - - if (!xmlStrcmp(CT, (const xmlChar *)"application/vnd.openxmlformats-package.core-properties+xml")) { - /* default: /docProps/core.xml*/ diff --git a/clamav-0.103.2.tar.gz b/clamav-0.103.6.tar.gz similarity index 58% rename from clamav-0.103.2.tar.gz rename to clamav-0.103.6.tar.gz index 5e4e2c1f69a4576b2a7ec2faff835de62933922e..385c5779ac4f13d14b9b295935074c06d7ad0425 100644 Binary files a/clamav-0.103.2.tar.gz and b/clamav-0.103.6.tar.gz differ diff --git a/clamav-check.patch b/clamav-check.patch deleted file mode 100644 index e3d37a4d3ee89abf167f06aa74eca5aa8b497d7a..0000000000000000000000000000000000000000 --- a/clamav-check.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up clamav-0.103.0/unit_tests/check_jsnorm.c.check clamav-0.103.0/unit_tests/check_jsnorm.c ---- clamav-0.103.0/unit_tests/check_jsnorm.c.check 2020-09-12 18:27:10.000000000 -0600 -+++ clamav-0.103.0/unit_tests/check_jsnorm.c 2020-09-17 22:15:26.199957518 -0600 -@@ -247,7 +247,7 @@ static void tokenizer_test(const char *i - fd = open(filename, O_RDONLY); - if (fd < 0) { - jstest_teardown(); -- ck_assert_msg("failed to open output file: %s", filename); -+ ck_assert_msg(0, "failed to open output file: %s", filename); - } - - diff_file_mem(fd, expected, len); diff --git a/clamav-clamonacc-service.patch b/clamav-clamonacc-service.patch deleted file mode 100644 index bdac52d9150e211e1956dfd5e7b9c1c561f7c4fe..0000000000000000000000000000000000000000 --- a/clamav-clamonacc-service.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff -up clamav-0.103.0/clamonacc/clamav-clamonacc.service.in.clamonacc-service clamav-0.103.0/clamonacc/clamav-clamonacc.service.in ---- clamav-0.103.0/clamonacc/clamav-clamonacc.service.in.clamonacc-service 2020-09-12 18:27:09.000000000 -0600 -+++ clamav-0.103.0/clamonacc/clamav-clamonacc.service.in 2020-09-18 19:49:35.400152760 -0600 -@@ -4,14 +4,12 @@ - [Unit] - Description=ClamAV On-Access Scanner - Documentation=man:clamonacc(8) man:clamd.conf(5) https://www.clamav.net/documents --Requires=clamav-daemon.service --After=clamav-daemon.service syslog.target network.target -+After=clamd@scan.service syslog.target network.target - - [Service] - Type=simple - User=root --ExecStartPre=/bin/bash -c "while [ ! -S /run/clamav/clamd.ctl ]; do sleep 1; done" --ExecStart=@prefix@/sbin/clamonacc -F --config-file=@APP_CONFIG_DIRECTORY@/clamd.conf --log=/var/log/clamav/clamonacc.log --move=/root/quarantine -+ExecStart=@prefix@/sbin/clamonacc -F --config-file=/etc/clamd.d/scan.conf - - [Install] - WantedBy=multi-user.target diff --git a/clamav.spec b/clamav.spec index 083f7e9be38a97f98ba2940b25f313c3524e111e..95ec5f5ce3eb18e2baddd648f49ae9f62154e294 100644 --- a/clamav.spec +++ b/clamav.spec @@ -1,7 +1,7 @@ Name: clamav Summary: End-user tools for the Clam Antivirus scanner -Version: 0.103.2 -Release: 4 +Version: 0.103.6 +Release: 1 License: GPLv2 and Public Domain and bzip2-1.0.6 and Zlib and Apache-2.0 URL: https://www.clamav.net/ @@ -24,13 +24,10 @@ Source15: clamd@.service Patch0001: clamav-stats-deprecation.patch Patch0002: clamav-default_confs.patch Patch0003: clamav-0.99-private.patch -Patch0004: clamav-check.patch -Patch0005: clamav-clamonacc-service.patch Patch0006: clamav-freshclam.service.patch Patch0007: clamav-type-conversion.patch Patch0008: clamav-return-val-process.patch Patch0009: clamav-clamonacc-version-return.patch -Patch0010: CVE-2022-20698.patch BuildRequires: autoconf automake gettext-devel libtool libtool-ltdl-devel BuildRequires: gcc-c++ zlib-devel bzip2-devel gmp-devel curl-devel json-c-devel @@ -415,6 +412,10 @@ test -e %_var/log/clamav-milter.log || { %changelog +* Fri May 13 2022 houyingchao - 0.103.6-1 +- Upgrade to 0.103.6 +- Fix CVE-2022-20785 CVE-2022-20771 CVE-2022-20770 CVE-2022-20792 + * Mon Jan 24 2022 wangkai - 0.103.2-4 - Fix CVE-2022-20698