clamav (1.2.1+dfsg-3) [PTS] [DDPO]

OLD: VCS is behind the version in the archive: 1.0.5+dfsg-1 < 1.2.1+dfsg-3.

Git: https://salsa.debian.org/clamav-team/clamav.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: unstable
Path: debian/changelog
Repo size: 1064960
Browser: https://salsa.debian.org/clamav-team/clamav
Last scan: 2024-04-15 01:59:15+00
Next scan: 2024-04-23 18:21:00+00
Open issues: 2
Merge requests: 2

Debian changelog in Git:

clamav (1.0.5+dfsg-1) unstable; urgency=medium

  * Import 1.0.4 (Closes: #1063479).
    - Update symbols.
    - CVE-2024-20290 (Fixed a possible heap overflow read bug in the OLE2 file
      parser that could cause a denial-of-service (DoS) condition.)
    - CVE-2024-20328 (Fixed a possible command injection vulnerability in the
      "VirusEvent" feature of ClamAV's ClamD service.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Thu, 08 Feb 2024 21:38:51 +0100

This branch is 37 commits ahead of tag debian-1.0.3+dfsg-2

Git log:

commit 6f8eba881a2ef1953ff746b0fee1fc10a3184246
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Thu Feb 8 21:38:57 2024 +0100

    Prepare 1.0.5+dfsg-1
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit a7467fdf403265199057495334b67c1cfc844377
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Thu Feb 8 21:07:41 2024 +0100

    d: Close CVE bug.
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 5a45ad70f0a36a7c573be15986adfa6d40a35d49
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Thu Feb 8 21:04:26 2024 +0100

    d: Import 1.0.5
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit dab0e8a8c233dec5dd2b4d5e2d88a0fc5d578bf2
Merge: 0f36182 a7ad834
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Thu Feb 8 21:03:44 2024 +0100

    merge patched-unstable into unstable

commit a7ad8342caeeb03a5a323b57cb4cd16db586d2d8
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Feb 18 10:45:50 2023 +0100

    Remove bundled tomfastmath library.
    
    Now that the tomfastmath library is no longer used, remove it from the
    tree.
    
    Patch-Name: Remove-bundled-tomfastmath-library.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit be786ed9358e61836cea5a336ace2fe4988592de
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Feb 18 10:47:53 2023 +0100

    libclamav: Use OpenSSL' BN instead tomfastmath.
    
    Use OpenSSL's big number/ multiprecision integer arithmetics
    functionality to replace tomfastmath.
    
    This is a first shot at doing just this. Further improvement could be
    use more RSA-signature verification from OpenSSL in crtmgr_rsa_verify()
    and less self parsing.
    _padding_check_PKCS1_type_1() has been borrowed from OpenSSL to make
    further replacments easier.
    
    Patch-Name: libclamav-Use-OpenSSL-BN-instead-tomfastmath.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 0579ca0d033181b3b6ab566c4b55e57fd4bef4ce
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jan 6 23:11:00 2023 +0100

    Add an option to avoid setting RPATH on unix systems.
    
    RPATH overrides the normal library search path, possibly interfering
    with local policy and causing problems for multilib, among other issues.
    
    Add an option to avoid setting it with letting it enabled by default.
    
    Patch-Name: Add-an-option-to-avoid-setting-RPATH-on-unix-systems.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 6b24f3ce88cacc34af8a122c28fae6cee8977ea7
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jan 6 21:42:30 2023 +0100

    libclamav/pe: Use endian wrapper in more places.
    
    A few user of VirtualAddress and Size in cli_exe_info::pe_image_data_dir
    don't use the endian wrapper while other places do. This leads to
    testsuite failures on big endian machines.
    
    Use the endian wrapper in all places across pe.c for the two members.
    
    Patch-Name: libclamav-pe-Use-endian-wrapper-in-more-places.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 0ca84a61c3d99389aeef2cebc029cbc49e62e72c
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Mon Jan 2 15:51:42 2023 +0100

    Add a version script for libclamav and libfreshclam
    
    Without a version script all symbols will be exported which are public
    within the libclamav library. This is true for the officially exported
    symbols as well as all the public symbols which are used within
    libclamav such as the rust symbols or the included libs like 7z and its
    XZ_SIG symbol.
    
    There is already a .map preset to limit the exported symbols of
    libclamav and libfreshclam. Use it.
    
    Patch-Name: Add-a-version-script-for-libclamav-and-libfreshclam.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 5d7566a3eac4dd6985e4c9fd8dc82656eced59b9
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Mon Jan 2 16:20:39 2023 +0100

    libclamav: Add missing symbols.
    
    These symbols are used by project files within clamav and not publicly
    exported. Add them to the private section.
    
    Patch-Name: libclamav-Add-missing-symbols.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 7910f52ddfb3d36255866caf3e8e8d603f85d7bd
Author: Scott Kitterman <scott@kitterman.com>
Date:   Sat Dec 31 12:12:58 2022 +0100

    cargo: Remove windows referenfes.
    
    The winapi code among other windows related rust code has been removed
    from the tar archive while repacking the tar ball. The build system
    still references it it needs to be removed because otherwise cargo will
    complain about it.
    
    Patch-Name: cargo-Remove-windows-referenfes.patch

commit f53238c36f763d9cad1e3b29483515550b7bccab
Author: Scott Kitterman <scott@kitterman.com>
Date:   Mon Mar 10 19:20:18 2014 -0400

    Change paths in sample conf file to match Debian
    
    Patch-Name: Change-paths-in-sample-conf-file-to-match-Debian.patch

commit 0f3618214a5718c88ef5b17ccdf0dd97eac8a418
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Thu Feb 8 20:59:23 2024 +0100

    record new upstream branch created by importing clamav_1.0.5+dfsg.orig.tar.xz

commit 3075ec387d1332975da55d4c08f4463a4fc82909
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Thu Feb 8 20:59:21 2024 +0100

    Import clamav_1.0.5+dfsg.orig.tar.xz

commit 6a844d432a98e022ae7fa6f06c20bfbe9b59581b
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jan 20 11:59:25 2024 +0100

    Prepare 1.0.4+dfsg-1
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit f7fb00ba76acba26d7929206396e6e6618984e3c
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jan 20 11:16:38 2024 +0100

    Mark clamav-base as foreign (Closes: #1060889)
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 430382fafb2978d4136133ad024b940721c4824d
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Tue Jan 16 19:16:22 2024 +0100

    d: systemd-dev to Build-Depends
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit b34278d4769279ce7ef804908cd3edf0e8d87e4a
Merge: 07ba021 d695b60
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sun Jan 14 18:20:10 2024 +0100

    merge patched-unstable into unstable

commit d695b60d110b6041b093fec0acc7da6ed5a46c63
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Feb 18 10:45:50 2023 +0100

    Remove bundled tomfastmath library.
    
    Now that the tomfastmath library is no longer used, remove it from the
    tree.
    
    Patch-Name: Remove-bundled-tomfastmath-library.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit c3d2f192f5e666da8fae850dbbeb04d0f7e4a904
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Feb 18 10:47:53 2023 +0100

    libclamav: Use OpenSSL' BN instead tomfastmath.
    
    Use OpenSSL's big number/ multiprecision integer arithmetics
    functionality to replace tomfastmath.
    
    This is a first shot at doing just this. Further improvement could be
    use more RSA-signature verification from OpenSSL in crtmgr_rsa_verify()
    and less self parsing.
    _padding_check_PKCS1_type_1() has been borrowed from OpenSSL to make
    further replacments easier.
    
    Patch-Name: libclamav-Use-OpenSSL-BN-instead-tomfastmath.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 0003055e21db15601281377ddef05bba277db544
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jan 6 23:11:00 2023 +0100

    Add an option to avoid setting RPATH on unix systems.
    
    RPATH overrides the normal library search path, possibly interfering
    with local policy and causing problems for multilib, among other issues.
    
    Add an option to avoid setting it with letting it enabled by default.
    
    Patch-Name: Add-an-option-to-avoid-setting-RPATH-on-unix-systems.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit fbb135cff699ca48f29d98c412f2655f11b00ca7
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jan 6 21:42:30 2023 +0100

    libclamav/pe: Use endian wrapper in more places.
    
    A few user of VirtualAddress and Size in cli_exe_info::pe_image_data_dir
    don't use the endian wrapper while other places do. This leads to
    testsuite failures on big endian machines.
    
    Use the endian wrapper in all places across pe.c for the two members.
    
    Patch-Name: libclamav-pe-Use-endian-wrapper-in-more-places.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 0792c3192b41dc3fc1492b4b5b38d7dcfa65d568
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Mon Jan 2 15:51:42 2023 +0100

    Add a version script for libclamav and libfreshclam
    
    Without a version script all symbols will be exported which are public
    within the libclamav library. This is true for the officially exported
    symbols as well as all the public symbols which are used within
    libclamav such as the rust symbols or the included libs like 7z and its
    XZ_SIG symbol.
    
    There is already a .map preset to limit the exported symbols of
    libclamav and libfreshclam. Use it.
    
    Patch-Name: Add-a-version-script-for-libclamav-and-libfreshclam.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 1fccc4ade2de4bb7678c42e401b90689f88e4392
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Mon Jan 2 16:20:39 2023 +0100

    libclamav: Add missing symbols.
    
    These symbols are used by project files within clamav and not publicly
    exported. Add them to the private section.
    
    Patch-Name: libclamav-Add-missing-symbols.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 07ba021cae64939113f3e0243256f3e6455e8d4a
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sun Jan 14 17:56:14 2024 +0100

    Import 1.0.4
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit e7c13701b4d439f1dad5e479e8c5071563013568
Merge: 70edc32 b8a0aa0
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sun Jan 14 17:12:10 2024 +0100

    merge patched-unstable into unstable

commit b8a0aa0f09c8f858ad9a824027d56b0d82639039
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Feb 18 10:45:50 2023 +0100

    Remove bundled tomfastmath library.
    
    Now that the tomfastmath library is no longer used, remove it from the
    tree.
    
    Patch-Name: Remove-bundled-tomfastmath-library.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit f0eeae8502d90257ff6758f1096574d6431f4594
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Feb 18 10:47:53 2023 +0100

    libclamav: Use OpenSSL' BN instead tomfastmath.
    
    Use OpenSSL's big number/ multiprecision integer arithmetics
    functionality to replace tomfastmath.
    
    This is a first shot at doing just this. Further improvement could be
    use more RSA-signature verification from OpenSSL in crtmgr_rsa_verify()
    and less self parsing.
    _padding_check_PKCS1_type_1() has been borrowed from OpenSSL to make
    further replacments easier.
    
    Patch-Name: libclamav-Use-OpenSSL-BN-instead-tomfastmath.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 1d061c36bc949c4b2d9c64d3b2d29317770104ad
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jan 6 23:11:00 2023 +0100

    Add an option to avoid setting RPATH on unix systems.
    
    RPATH overrides the normal library search path, possibly interfering
    with local policy and causing problems for multilib, among other issues.
    
    Add an option to avoid setting it with letting it enabled by default.
    
    Patch-Name: Add-an-option-to-avoid-setting-RPATH-on-unix-systems.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit f59083b82285e95ddb6985b4ab4508da83534711
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jan 6 21:42:30 2023 +0100

    libclamav/pe: Use endian wrapper in more places.
    
    A few user of VirtualAddress and Size in cli_exe_info::pe_image_data_dir
    don't use the endian wrapper while other places do. This leads to
    testsuite failures on big endian machines.
    
    Use the endian wrapper in all places across pe.c for the two members.
    
    Patch-Name: libclamav-pe-Use-endian-wrapper-in-more-places.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 7592171152494dfbcdc16793a9be91561595a3fb
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Mon Jan 2 15:51:42 2023 +0100

    Add a version script for libclamav and libfreshclam
    
    Without a version script all symbols will be exported which are public
    within the libclamav library. This is true for the officially exported
    symbols as well as all the public symbols which are used within
    libclamav such as the rust symbols or the included libs like 7z and its
    XZ_SIG symbol.
    
    There is already a .map preset to limit the exported symbols of
    libclamav and libfreshclam. Use it.
    
    Patch-Name: Add-a-version-script-for-libclamav-and-libfreshclam.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 519ef73a570e557d0b724463c9669ac31eeb893a
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Mon Jan 2 16:20:39 2023 +0100

    libclamav: Add missing symbols.
    
    These symbols are used by project files within clamav and not publicly
    exported. Add them to the private section.
    
    Patch-Name: libclamav-Add-missing-symbols.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 4ac2f6bc6d8e9d6962ee2012d89e3ab6a78057f9
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Mon Jan 2 16:13:35 2023 +0100

    libclamav: Sort libclamav.map and libfreshclam.map
    
    Sort libclamav.map and libfreshclam.map so adding new symbols can be
    added in one place.
    
    Patch-Name: libclamav-Sort-libclamav.map-and-libfreshclam.map.patch
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 24601bedfc51272c6ad4f08c56ec5042e1117c3c
Author: Scott Kitterman <scott@kitterman.com>
Date:   Sat Dec 31 12:12:58 2022 +0100

    cargo: Remove windows referenfes.
    
    The winapi code among other windows related rust code has been removed
    from the tar archive while repacking the tar ball. The build system
    still references it it needs to be removed because otherwise cargo will
    complain about it.
    
    Patch-Name: cargo-Remove-windows-referenfes.patch

commit 1da693d70de03239e12d5f8facacc15b591e4374
Author: Scott Kitterman <scott@kitterman.com>
Date:   Mon Mar 10 19:20:18 2014 -0400

    Change paths in sample conf file to match Debian
    
    Patch-Name: Change-paths-in-sample-conf-file-to-match-Debian.patch

commit 70edc329abb8992e63d14159ec953015b7d58563
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sun Jan 14 16:31:16 2024 +0100

    record new upstream branch created by importing clamav_1.0.4+dfsg.orig.tar.xz

commit 3ceaf77e3c4800e6bf8448f925efc2618abebd91
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sun Jan 14 16:31:14 2024 +0100

    Import clamav_1.0.4+dfsg.orig.tar.xz