[ubuntu/plucky-proposed] clamav 1.4.1+dfsg-1ubuntu1 (Accepted)

[Bryce Harrington]

clamav (1.4.1+dfsg-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085222). Remaining changes:
    - clamav-base.postinst.in: Quell warning from check for clamav user
      (LP #1920217).
    - d/rules: use RelWithDebInfo profile as the Rust CMake scripts can not
      recognize the "None" type specified by dh-cmake.
      (LP #2071663)
    - Extend ifupdown script to support networkd-dispatcher.
      + d/clamav-freshclam-ifupdown: Modernize some parts of
        the script.  Implement support for networkd-dispatcher.
      + d/clamav-freshclam.links: Install the
        clamav-freshclam-ifupdown script inside the proper
        /usr/lib/networkd-dispatcher/{off,routable}.d/
        directories. (LP #1718227)
    - debian/po: update translations
  * Dropped:
    - SECURITY UPDATE: out of bounds read in PDF parser
      + debian/patches/CVE-2024-20505.patch: add more checks to
        libclamav/pdf.c, libclamav/pdfng.c.
      + CVE-2024-20505
      [Included in Debian 1.4.1+dfsg-1]
    - SECURITY UPDATE: file overwrite via log file symlinks
      + debian/patches/CVE-2024-20506.patch: disable following symlinks when
        opening log files in common/output.c.
      + CVE-2024-20506
      [Included in Debian 1.4.1+dfsg-1]
    - d/patches: add a patch to make the build system respect the rustflags
      (LP #2071663).
      [Taken upstream in 1.4.0]
    - d/rules, d/s/include-binaries,
      d/p/Fix-unit-test-caused-by-expiring-signing-certificate.patch:
      Fix signing of "text.exe" with expired certs.
      (LP #2078478)
      [Already present in Debian 1.3.1+dfsg-5]

clamav (1.4.1+dfsg-1) unstable; urgency=medium

  * Import 1.4.1 (Closes: #1080962)
    - CVE-2024-20506 (Changed the logging module to disable following symlinks
      on Linux)
    - CVE-2024-20505 (Fixed a possible out-of-bounds read bug in the PDF file
      parser).

Date: Thu, 16 Jan 2025 16:27:52 -0800
Changed-By: Bryce Harrington <bryce at canonical.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/+source/clamav/1.4.1+dfsg-1ubuntu1
-------------- next part --------------
Format: 1.8
Date: Thu, 16 Jan 2025 16:27:52 -0800
Source: clamav
Built-For-Profiles: noudeb
Architecture: source
Version: 1.4.1+dfsg-1ubuntu1
Distribution: plucky
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Bryce Harrington <bryce at canonical.com>
Closes: 1080962
Launchpad-Bugs-Fixed: 2085222
Changes:
 clamav (1.4.1+dfsg-1ubuntu1) plucky; urgency=medium
 .
   * Merge with Debian unstable (LP: #2085222). Remaining changes:
     - clamav-base.postinst.in: Quell warning from check for clamav user
       (LP #1920217).
     - d/rules: use RelWithDebInfo profile as the Rust CMake scripts can not
       recognize the "None" type specified by dh-cmake.
       (LP #2071663)
     - Extend ifupdown script to support networkd-dispatcher.
       + d/clamav-freshclam-ifupdown: Modernize some parts of
         the script.  Implement support for networkd-dispatcher.
       + d/clamav-freshclam.links: Install the
         clamav-freshclam-ifupdown script inside the proper
         /usr/lib/networkd-dispatcher/{off,routable}.d/
         directories. (LP #1718227)
     - debian/po: update translations
   * Dropped:
     - SECURITY UPDATE: out of bounds read in PDF parser
       + debian/patches/CVE-2024-20505.patch: add more checks to
         libclamav/pdf.c, libclamav/pdfng.c.
       + CVE-2024-20505
       [Included in Debian 1.4.1+dfsg-1]
     - SECURITY UPDATE: file overwrite via log file symlinks
       + debian/patches/CVE-2024-20506.patch: disable following symlinks when
         opening log files in common/output.c.
       + CVE-2024-20506
       [Included in Debian 1.4.1+dfsg-1]
     - d/patches: add a patch to make the build system respect the rustflags
       (LP #2071663).
       [Taken upstream in 1.4.0]
     - d/rules, d/s/include-binaries,
       d/p/Fix-unit-test-caused-by-expiring-signing-certificate.patch:
       Fix signing of "text.exe" with expired certs.
       (LP #2078478)
       [Already present in Debian 1.3.1+dfsg-5]
 .
 clamav (1.4.1+dfsg-1) unstable; urgency=medium
 .
   * Import 1.4.1 (Closes: #1080962)
     - CVE-2024-20506 (Changed the logging module to disable following symlinks
       on Linux)
     - CVE-2024-20505 (Fixed a possible out-of-bounds read bug in the PDF file
       parser).
Checksums-Sha1:
 9750a30539ec7c2b8d0ad45bb4036f8fa0612faf 3187 clamav_1.4.1+dfsg-1ubuntu1.dsc
 587f15fe0a3863030a4b698b8a5e0bef7b93d68c 33150848 clamav_1.4.1+dfsg.orig.tar.xz
 ad394ae25b11931dfed444cf8d7bc580757df2f7 505772 clamav_1.4.1+dfsg-1ubuntu1.debian.tar.xz
 dcc588297398ce5608fea3bcf7261232a11f22b9 10893 clamav_1.4.1+dfsg-1ubuntu1_source.buildinfo
Checksums-Sha256:
 b6bb2a815dcb6d4b9a05aca2a162f9393b7e9dc3811997882d094e92e8ac6574 3187 clamav_1.4.1+dfsg-1ubuntu1.dsc
 9a994a41d0110a874be7183b3410c91f53c0a6c2eb9dc94c47d47ae0d4a62d0f 33150848 clamav_1.4.1+dfsg.orig.tar.xz
 28066b32382d76438b43f1c056e1991c6b30bcef76499025843373cfa8583b07 505772 clamav_1.4.1+dfsg-1ubuntu1.debian.tar.xz
 347645e12b6b4e1b30ff18e2430dd5f625b3c6b63d5cfc89ce09f00dc295a47e 10893 clamav_1.4.1+dfsg-1ubuntu1_source.buildinfo
Files:
 5b2c2ce40fa95676fb57a4093ea15976 3187 utils optional clamav_1.4.1+dfsg-1ubuntu1.dsc
 88d72153305c1c8f0dda1d3380e82c94 33150848 utils optional clamav_1.4.1+dfsg.orig.tar.xz
 594b79e7e63dea1670799486da96fd4d 505772 utils optional clamav_1.4.1+dfsg-1ubuntu1.debian.tar.xz
 2f0f8f6479f36e16326562b4daf03296 10893 utils optional clamav_1.4.1+dfsg-1ubuntu1_source.buildinfo
Original-Maintainer: ClamAV Team <pkg-clamav-devel at lists.alioth.debian.org>
Vcs-Git: https://git.launchpad.net/~bryce/ubuntu/+source/clamav
Vcs-Git-Commit: f2e7924af2cf9ac61e21486fe18bb80cbab948d2
Vcs-Git-Ref: refs/heads/merge-v1.4.1adfsg-1-plucky