[Buildroot] [PATCH v2 for 2025.02.x 00/15] package/clamav: update to upstream LTS

[Thomas Perale]

In reply of:
> As indicated on ClamAV End of Life policy webpage [1], the 1.0 series is the
> previous LTS (and therefore unmaintained). The ClamAV 1.4 series is the current
> LTS version, maintained for 3 years. The latest release being ClamAV 1.4.6.
> 
> However, there is a breaking build-system change in ClamAV 1.4.4 [2]:
>     "The minimum Rust version for ClamAV 1.4.4 is now 1.87.0."
> 
> Unfortunately, Buildroot LTS 2025.02.x is still on Rust v1.82, and therefore
> building ClamAV>=1.4.4 fails because of missing features for Rust.
> 
> Consequently, this series:
> - Bump ClamAV to the latest LTS version that can be built with Buildroot
>   2025.02.x, which is ClamAV 1.4.3
> - Backport security fixes from ClamAV 1.4.4, 1.4.5 and 1.4.6
> 
> [1] https://docs.clamav.net/faq/faq-eol.html
> [2] https://github.com/Cisco-Talos/clamav/releases/tag/clamav-1.4.4
> 

Applied to 2025.02.x. Thanks

> ---
> Changes v1-v2:
>   - Removed patch 03/16 from series v1 which didn't work properly
> ---
> 
> Titouan Christophe (15):
>   package/clamav: bump to v1.4.3
>   package/clamav: add patch for CVE-2026-20031
>   package/clamav: add patch for CVE-2026-20217
>   package/clamav: add patch for CVE-2026-20213
>   package/clamav: add patch for CVE-2026-20216
>   package/clamav: add patch for CVE-2026-20214
>   package/clamav: add patch for CVE-2026-20243
>   package/clamav: add patch for CVE-2026-20215
>   package/clamav: add patch for CVE-2026-20244
>   package/clamav: add hardening patch for TOCTOU issue in quarantine
>     actions
>   package/clamav: add patch for CVE-2026-20345
>   package/clamav: add patch for CVE-2026-20339
>   package/clamav: add patch for CVE-2026-20346
>   package/clamav: add patch for CVE-2026-20347
>   package/clamav: add patch for CVE-2026-20348
> 
>  ...-panic-when-scanning-some-html-files.patch |  240 +
>  ...ix-pespin-cleanup-bitmap-tracking-47.patch |   46 +
>  ...ack-triggered-rebuild-pe-overflow-49.patch |   90 +
>  ...e-installshield-extraction-limits-55.patch |  126 +
>  ...av-fix-fsg-section-loop-underflow-51.patch |   40 +
>  ...rser-robustness-and-scan-coverage-63.patch | 1503 +++
>  ...v-fix-7z-substream-count-overflow-53.patch |   40 +
>  ...8-fix-32-bit-dmg-mish-size-checks-65.patch |  136 +
>  ...rantine-actions-against-toctou-races.patch | 8117 +++++++++++++++++
>  ...-partition-name-conversion-index-103.patch |   37 +
>  ...in-rebuilt-section-size-overflow-101.patch |  224 +
>  ...guard-pdf-hex-string-newline-skip-98.patch |   36 +
>  ...-harden-mach-o-section-validation-96.patch |  149 +
>  ...xar-limits-against-inflated-toc-size.patch |  277 +
>  package/clamav/clamav.hash                    |    5 +-
>  package/clamav/clamav.mk                      |   42 +-
>  16 files changed, 11105 insertions(+), 3 deletions(-)
>  create mode 100644 package/clamav/0001-fix-possible-panic-when-scanning-some-html-files.patch
>  create mode 100644 package/clamav/0002-libclamav-fix-pespin-cleanup-bitmap-tracking-47.patch
>  create mode 100644 package/clamav/0003-libclamav-fix-aspack-triggered-rebuild-pe-overflow-49.patch
>  create mode 100644 package/clamav/0004-libclamav-enforce-installshield-extraction-limits-55.patch
>  create mode 100644 package/clamav/0005-libclamav-fix-fsg-section-loop-underflow-51.patch
>  create mode 100644 package/clamav/0006-fix-alz-parser-robustness-and-scan-coverage-63.patch
>  create mode 100644 package/clamav/0007-libclamav-fix-7z-substream-count-overflow-53.patch
>  create mode 100644 package/clamav/0008-fix-32-bit-dmg-mish-size-checks-65.patch
>  create mode 100644 package/clamav/0009-harden-quarantine-actions-against-toctou-races.patch
>  create mode 100644 package/clamav/0010-libclamav-fix-gpt-partition-name-conversion-index-103.patch
>  create mode 100644 package/clamav/0011-libclamav-fix-pespin-rebuilt-section-size-overflow-101.patch
>  create mode 100644 package/clamav/0012-libclamav-guard-pdf-hex-string-newline-skip-98.patch
>  create mode 100644 package/clamav/0013-libclamav-harden-mach-o-section-validation-96.patch
>  create mode 100644 package/clamav/0014-libclamav-enforce-xar-limits-against-inflated-toc-size.patch
> 
> -- 
> 2.55.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot