[From nobody Sat Oct 17 11:49:07 2026 Received: (at 1143939-close) by bugs.debian.org; 17 Oct 2026 10:47:08 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 65; hammy, 150; neutral, 356; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:40736) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xI1wS-00HKcn-2c for 1143939-close@bugs.debian.org; Sat, 17 Oct 2026 10:47:08 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xI1wR-008c7r-1n for 1143939-close@bugs.debian.org; Sat, 17 Oct 2026 10:47:07 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=sA2JcGTToH/rSgscaVkv2nVyJHJ04Y7oGArm8B0LqrA=; b=gQamApENF1whyrdlfnkhuM+eF7 Ho8JpJ2jyDpqrmScflUaqnckyh8JRMefRCGPzhJk/qMBawQtgqWuisqBNgJoXr2YNk7sGLOP4kCIO RPa8G3vkVtLI26WSsNlxxoHFii4qi6Schk7WOJZsd+bY7EiqYno+/EZ5tSaW3NHFaSZDvhDY8Kk6z SH9F77XvQehv/nLijVSE6I0kElBjxC5q1UjrXFZmY6jHBZ/I7UgDF0Wi7/Djn/3FDkqfCDPUBBs4b UtoH+GZeNUPNVwDSb0E1Ft00RwnA6MEJcXM2WjPe5t/QJKJmh30rJh60dAFNtdJcdE+gb03wqk+7T fZmhyCrg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xI1wQ-0000000B1FB-34EU; Sat, 17 Oct 2026 10:47:06 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> To: 1143939-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: clamav Debian: DAK Debian-Changes: clamav_1.4.6+dfsg-1~deb13u1_source.changes Debian-Source: clamav Debian-Version: 1.4.6+dfsg-1~deb13u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1143939: fixed in clamav 1.4.6+dfsg-1~deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8273291772432814375==" Message-Id: <E1xI1wQ-0000000B1FB-34EU@fasolo.debian.org> Date: Sat, 17 Oct 2026 10:47:06 +0000 --===============8273291772432814375== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: clamav Source-Version: 1.4.6+dfsg-1~deb13u1 Done: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> We believe that the bug you reported is fixed in the latest version of clamav, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1143939@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Sebastian Andrzej Siewior <sebastian@breakpoint.cc> (supplier of updated clam= av package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 05 Sep 2026 21:13:32 +0200 Source: clamav Architecture: source Version: 1.4.6+dfsg-1~deb13u1 Distribution: trixie Urgency: medium Maintainer: ClamAV Team <pkg-clamav-devel@lists.alioth.debian.org> Changed-By: Sebastian Andrzej Siewior <sebastian@breakpoint.cc> Closes: 1043428 1092882 1103001 1120998 1123913 1141347 1143939 Changes: clamav (1.4.6+dfsg-1~deb13u1) trixie; urgency=3Dmedium . [ Sebastian Andrzej Siewior ] * Import 1.4.5 - CVE-2026-20031 (Fixed an error handling bug in the HTML file parser) - Fixes a few bugs scanning JPEG/ TIFF files (Closes: #1120998) - CVE-2026-20217 ("Fixed a bug in the PESpin unpacker cleanup path") - CVE-2026-20213 ("Fixed an integer overflow in PE rebuild size calculations") - CVE-2026-20216 ("Fixed an InstallShield archive extraction limit bypass") - CVE-2026-20214 ("Fixed an FSG unpacker loop underflow") - CVE-2026-20243 ("Fixed ALZ parser size handling bugs") - CVE-2026-20215 ("Fixed a 7z parser substream count overflow") - CVE-2026-20244 ("Fixed 32-bit DMG parser size checks") * Update apparmor profile for clamd (Closes: #1092882, #1123913). * Use -DCMAKE_BUILD_TYPE=3DRelWithDebInfo by default (Closes: #1141347). * Add Romanian debconf templates translation (Closes: #1103001). * Mention in the README.Debian that clamAV AppArmor profiles do not allow OnAccess scanning ("Closes: #1043428). . [ Pino Toscano ] * Make sure to ignore the not installed files on all the architectures. * Limit systemd build dependencies as linux-any, as systemd is available o= nly on Linux. * Simplify handling of Linux-only files by using dh-exec, rather than crea= ting install and manpages files during build: - add the dh-exec build dependency - mark the Linux-only files in install and manpages files - simplify debian/rules accordingly * Wrap the whole override_dh_installsystemd to run on Linux, rather than o= nly the first command in it. . [ P=C3=A9tur Ingi Egilsson ] * clamav-daemon.postinst.in: honour "none" as a way to disable the LogFile directive. . [ Edmund Lodewijks ] * Import 1.4.6 (Closes: #1143939) - CVE-2026-20345 ("Fixed an indexing error while converting GPT partition names") - CVE-2026-20339 ("Fixed an integer overflow in the PESpin unpacker") - CVE-2026-20346 ("Fixed an integer underflow in the PDF parser") - CVE-2026-20347 ("Fixed undefined behavior and integer overflow in the Mach-O parser") - CVE-2026-20348 ("Fixed XAR parser size handling") - Fixed thread-safety issues in the clamd STATS command that could disclose process memory or crash the daemon Checksums-Sha1: cab9a2d68ee3cbc18ade037981c941a9032cf70d 3023 clamav_1.4.6+dfsg-1~deb13u1.dsc d076f78137f51afc0dbb7b67ec476c3c62487089 27698332 clamav_1.4.6+dfsg.orig.tar= .xz 1a4432935b80c9c0ef46f0bc33d90c378cba9e8b 519104 clamav_1.4.6+dfsg-1~deb13u1.= debian.tar.xz Checksums-Sha256: 2ded467a2b40e1077d1fa0d7eafe673195db487d00aa230dd51825ca89855bec 3023 clamav= _1.4.6+dfsg-1~deb13u1.dsc 09823124e9bae5d602699c2a2fe5d4876298283cf3e7f8982973571843572468 27698332 cl= amav_1.4.6+dfsg.orig.tar.xz 53056aa745141d97192fdfe7b20ebbba318117850b3cab43b81a766ba9ff39a5 519104 clam= av_1.4.6+dfsg-1~deb13u1.debian.tar.xz Files: 511c576d3776aff040ef69cd0e1bdc3e 3023 utils optional clamav_1.4.6+dfsg-1~deb= 13u1.dsc 1342952a4063eee18d239cd7761ef0ff 27698332 utils optional clamav_1.4.6+dfsg.o= rig.tar.xz 2833c186fa3b02773c3a16d4d24d439e 519104 utils optional clamav_1.4.6+dfsg-1~d= eb13u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEV4kucFIzBRM39v3RBWQfF1cS+lsFAmqcdYYACgkQBWQfF1cS +luhGAv+P+70X+/7JvTXk0NLBQ8zIcac3QVbOYqH2fmoBot/UDmacA/FOakGct7h XG38JFowevTq9d7c3zoZBbR0VpEdeGm0G9zXdZKR+y4BxLg56EXwEqMKI3Dh5nQJ hv+7n+hq5ozQzZzkM0bIr6P5jPkBtTwA7D5IJziYMkysPbYt6I/B7qKBJ4ofcPAb RDQw+9HDiAH6Bc0LcX51k+eZakdrXRPVhhaFycvSr+YEyTeiBqhMwpsODC9x/eT3 87eWcOr5oajmjraW14mSK5rOYiBuIqpMF2jsqxeOQjlMPsYsHFqMCBiU1Korit2I MkFbPX0oIPmOxaooyArxqPDaoLhrQIBMdZR2U3Hlz0wQQJKGdBUBLzc4XnKEmyK1 4JlbK7as/r31+vQ5g7xqqex1wmSIOLk66i+ZzaZifhAR2uCEU2V/qkGK28S5vIS1 nb8lRYLMoHpzo5HEk0OH5qv5L9gNLQcGM78qjNLAw0YizVJZoRKJTr4pGTfEajNQ q5d4Qzid =3DTRXP -----END PGP SIGNATURE----- --===============8273291772432814375== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCatNSKgAKCRCb9qggYcy5 Ifk8AP46/wfAWD93aXnVzgdWUYn/lB7twfg35LtgTHX0kSN9bgD6AuKUyBYhvSz9 P4mAqEfk7nbCrTM0RKSwDE89RzblTAA= =qFSa -----END PGP SIGNATURE----- --===============8273291772432814375==-- ]