Finally got around to prepare an update for ClamAV in Trixie. This got
stalled because newer clamav required rust which was too old in Trixie.
With the recent inclusion of rustc-web package in Trixie and update
become possible.

This a regular update to the current version of ClamAV which is also in
unstable. It addresses a handfull of CVEs.

I made a few updates to the packaging in unstable, which are also part
of this package.

I do know that this hits quite a few jiffies befire the pu freeze. I
don't mind if this gets delayed post the pu.

Here is the changelog:

|  [ Sebastian Andrzej Siewior ]
|  * Import 1.4.5
|    - CVE-2026-20031 (Fixed an error handling bug in the HTML file parser)
|    - Fixes a few bugs scanning JPEG/ TIFF files (Closes: #1120998)
|    - CVE-2026-20217 ("Fixed a bug in the PESpin unpacker cleanup path")
|    - CVE-2026-20213 ("Fixed an integer overflow in PE rebuild size
|      calculations")
|    - CVE-2026-20216 ("Fixed an InstallShield archive extraction limit
|      bypass")
|    - CVE-2026-20214 ("Fixed an FSG unpacker loop underflow")
|    - CVE-2026-20243 ("Fixed ALZ parser size handling bugs")
|    - CVE-2026-20215 ("Fixed a 7z parser substream count overflow")
|    - CVE-2026-20244 ("Fixed 32-bit DMG parser size checks")
|  * Update apparmor profile for clamd (Closes: #1092882, #1123913).
|  * Use -DCMAKE_BUILD_TYPE=RelWithDebInfo by default (Closes: #1141347).
|  * Add Romanian debconf templates translation (Closes: #1103001).
|  * Mention in the README.Debian that clamAV AppArmor profiles do not allow
|    OnAccess scanning ("Closes: #1043428).
|
|  [ Pino Toscano ]
|  * Make sure to ignore the not installed files on all the architectures.
|  * Limit systemd build dependencies as linux-any, as systemd is available only
|    on Linux.
|  * Simplify handling of Linux-only files by using dh-exec, rather than creating
|    install and manpages files during build:
|    - add the dh-exec build dependency
|    - mark the Linux-only files in install and manpages files
|    - simplify debian/rules accordingly
|  * Wrap the whole override_dh_installsystemd to run on Linux, rather than only
|    the first command in it.
|
|  [ Pétur Ingi Egilsson ]
|  * clamav-daemon.postinst.in: honour "none" as a way to disable
|    the LogFile directive.
|
|  [ Edmund Lodewijks ]
|  * Import 1.4.6 (Closes: #1143939)
|    - CVE-2026-20345 ("Fixed an indexing error while converting GPT
|      partition names")
|    - CVE-2026-20339 ("Fixed an integer overflow in the PESpin unpacker")
|    - CVE-2026-20346 ("Fixed an integer underflow in the PDF parser")
|    - CVE-2026-20347 ("Fixed undefined behavior and integer overflow in the
|      Mach-O parser")
|    - CVE-2026-20348 ("Fixed XAR parser size handling")
|    - Fixed thread-safety issues in the clamd STATS command that could
|      disclose process memory or crash the daemon

Sebastian

please find attached the complete debdiff.

Sebastian

Note that due to the lack of llvm-toolchain-22 in trixie-pu, rustc-web hasn't
been bootstrapped there. Andreas and I have been looking at fixing it without
success. Help there would be appreciated.

Cheers,
Emilio

You mean this is just an issue for armel right? Because I built against
rustc-web before my upload.

Sebastian

it complains about missing symbol

| ld.lld: error: undefined symbol: std::__atomic_futex_unsigned_base::_M_futex_notify_all(unsigned int*)

this is from gcc-14.

| (trixie_armhf-dchroot)bigeasy@amdahl:~/llvm$ readelf -aW /usr/lib/arm-linux-gnueabihf/libstdc++.so.6.0.33 |grep futex_notify_all
| 001a0eb0  00037d16 R_ARM_JUMP_SLOT        000a1061   _ZNSt28__atomic_futex_unsigned_base19_M_futex_notify_allEPj@@GLIBCXX_3.4.21
|    893: 000a1061    14 FUNC    GLOBAL DEFAULT   12 _ZNSt28__atomic_futex_unsigned_base19_M_futex_notify_allEPj@@GLIBCXX_3.4.21

but on armel

| (trixie_armel-dchroot)bigeasy@amdahl:~/llvm$ readelf -aW /usr/lib/arm-linux-gnueabi/libstdc++.so.6.0.33 |grep futex_notify_all
| (trixie_armel-dchroot)bigeasy@amdahl:~/llvm$

given that llvm asks for futex_notify_all means that the header file
provides the function (as in defines ATOMIC_INT_LOCK_FREE). It appears
that futex.cc gets compiled during the build of gcc-14 as per build log.
So my guess is that it either does not get linked to the finall
libstdc++.so or the symbol is not exported and so missing.

Sebastian

No. This is not consistent. Just compiled gcc-14 and here
ATOMIC_INT_LOCK_FREE is set to 1, so futex.cc is empty. Which makes
sense because the symbol is missing. Tomorrow I need to figure out why
the llvm sees it greater than 1.
Sebastian

I build something on amdahl that I hope works.

Sebastian

tada! Amdahl built the package. It aborted somewhere at the end and I
think during docs (but I did -B so?) but then a retry with -j1 -nc
passed. I am optimistic here.

I am attaching the slightly altered patch from what I had on Amdahl and
hopefully not fat fingered…

I keep the the 30G around in
| bigeasy@amdahl:~/llvm

unless you don't need it and I can free up.

Sebastian

package release.debian.org
tags 1146813 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: clamav
Version: 1.4.6+dfsg-1~deb13u1

Explanation: new upstream stable release; security fixes [CVE-2026-20031 CVE-2026-20213 CVE-2026-20214 CVE-2026-20215 CVE-2026-20216 CVE-2026-20217 CVE-2026-20243 CVE-2026-20244 CVE-2026-20339 CVE-2026-20345 CVE-2026-20346 CVE-2026-20347 CVE-2026-20348]

package release.debian.org
tags 1146813 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: clamav
Version: 1.4.6+dfsg-1~deb13u1

Explanation: new upstream stable release; security fixes [CVE-2026-20031 CVE-2026-20213 CVE-2026-20214 CVE-2026-20215 CVE-2026-20216 CVE-2026-20217 CVE-2026-20243 CVE-2026-20244 CVE-2026-20339 CVE-2026-20345 CVE-2026-20346 CVE-2026-20347 CVE-2026-20348]

I noticed that there's an additional change that is not mentioned in the changelog:

| Install and use sysusers.d/tmpfiles.d config files [1]

Is this safe for trixie? I don't know if changing this in a point release is
good unless there's a good reason for it. Also, this doesn't introduce a
dependency on sysusers, but it probably should (not sure how that dependency
should look like, with alternatives for systemd-standalone-sysusers).

Cheers,
Emilio

[1]
https://salsa.debian.org/clamav-team/clamav/-/commit/9414b9f9c40072c4a030afb0e4c1db32913c48a2