forked from clamwin/clamav-win32-old
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ChangeLog
21752 lines (17121 loc) · 742 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Wed, 24 Feb 2016 18:45:00 -0500 (Steven Morgan)
------------------------------------------
* ClamAV 0.99.1 release build.
Wed, 24 Feb 2016 13:29:42 -0500 (Kevin Lin)
------------------------------------------
* hwp5.x: fix for streams without names
Sat, 20 Feb 2016 15:53:48 +0100 (Sebastian Andrzej Siewior)
------------------------------------------
* libclamav: yara: avoid unaliged access to 64bit variable
Thu, 11 Feb 2016 15:56:47 -0500 (Mickey Sola)
------------------------------------------
* bb11455 - patch by Mark Allan to add show-progress option to freshclam.
Tue, 16 Feb 2016 14:15:18 -0500 (Kevin Lin)
------------------------------------------
* added 'CustomXML' as trigger for likely OOXML
Tue, 3 Feb 2016 17:30:00 -0500 (Steven Morgan)
------------------------------------------
* ClamAV 0.99.1 beta1 release.
Tue, 2 Feb 2016 14:23:13 -0500 (Kevin Lin)
------------------------------------------
* add scanning options for scanning xml-based documents
(MSXML, OOXML, HWPML) and HWP3
Fri, 29 Jan 2016 16:17:40 -0500 (Kevin Lin)
------------------------------------------
* add dconfs for XDP, MBR, GPT, APM, OOXML, MSXML, and HWP formats
Tue, 2 Feb 2016 12:38:27 -0500 (Kevin Lin)
------------------------------------------
* hwp: scan decompressed data on limits exceeded
Sun, 31 Jan 2016 15:41:54 -0500 (Steven Morgan)
------------------------------------------
* Fix for signature name length<3 in .ign & .ign2 CVD files.
Fri, 29 Jan 2016 11:21:46 -0500 (Steven Morgan)
------------------------------------------
* Change RTF file magic from '{\rtf' to '{\rt'
Wed, 27 Jan 2016 14:17:47 -0500 (Mickey Sola)
------------------------------------------
* bb11444 - zeroing out buffer at allocation to avoid writing uninitialized
bytes to a file
Wed, 20 Jan 2016 16:21:58 -0500 (Mickey Sola)
------------------------------------------
* bb11446 - adding check for compressed input stream
Wed, 13 Jan 2016 14:56:46 -0500 (Kevin Lin)
------------------------------------------
* clean up and boost accuracy to detecting OOXML documents
Thu, 14 Jan 2016 17:01:01 -0500 (Steven Morgan)
------------------------------------------
* 11477 - Fix crash when using pcre statistics due to inconsistent memory
management function calls
Thu, 14 Jan 2016 15:31:02 -0500 (Mickey Sola)
------------------------------------------
* bb11444: adding check to verify a valid number of rounds for rijndael aes
encryption/decryption
Wed, 13 Jan 2016 13:18:01 -0500 (Mickey Sola)
------------------------------------------
* bb11441 - fixing edge case revealed by unit testing
Tue, 12 Jan 2016 17:20:26 -0500 (Steven Morgan)
------------------------------------------
* bb11466 - let html be scanned raw when --scan-html=no is in effect.
Tue, 12 Jan 2016 16:14:40 -0500 (Steven Morgan)
------------------------------------------
* bb11475: fix crash due to memory overlay with crafted 7z files.
Tue, 12 Jan 2016 14:30:41 -0500 (Mickey Sola)
------------------------------------------
* bb11441 - fixing off by one OOB write in htmlnorm
Mon, 11 Jan 2016 14:47:30 -0500 (Mickey Sola)
------------------------------------------
* bb11446 - fixing autoit OOB bufferread
Wed, 6 Jan 2016 14:57:48 -0500 (Mickey Sola)
------------------------------------------
* sigtool: adding support for decoding cdb sigs
Tue, 5 Jan 2016 13:13:47 -0500 (Steven Morgan)
------------------------------------------
* bb11467 - fix embedded http links.
Tue, 22 Dec 2015 19:04:42 -0500 (Steven Morgan)
------------------------------------------
* bb11451 - fix guard macro name collision on AIX.
Tue, 22 Dec 2015 13:36:51 -0500 (Steven Morgan)
------------------------------------------
* fix regression crash on sid 1005597703 due to uninitialzed
(i.e., garbage initialized) structure.
Mon, 21 Dec 2015 17:39:47 -0500 (Steven Morgan)
------------------------------------------
* bb11456 - corrects mso stream prefix value for big endian processors.
Patch by Jim Morris.
Thu, 17 Dec 2015 16:16:55 -0500 (Kevin Lin)
------------------------------------------
* ooxml_hwp: add support for filetyping and preclassification
Thu, 17 Dec 2015 11:04:00 -0500 (Kevin Lin)
------------------------------------------
* hwpole2: new filetype and handler for hwp embedded ole2 files
Thu, 17 Dec 2015 12:46:38 -0500 (Mickey Sola)
------------------------------------------
* bb11443 - fixing possible oob dereference when parsing mbox files
Tue, 15 Dec 2015 16:12:01 -0500 (Mickey Sola)
------------------------------------------
* bb11442 - adding explicit wwunpack oob checks
Tue, 15 Dec 2015 10:53:05 -0500 (Mickey Sola)
------------------------------------------
* bb11445 - fixing edge case where a null terminator was unintentionally
written into an adjacent buffer.
Wed, 16 Dec 2015 16:13:05 -0500 (Kevin Lin)
------------------------------------------
* hwpml: use msxml_parser callback scanner for binary data
Wed, 16 Dec 2015 16:12:20 -0500 (Kevin Lin)
------------------------------------------
* msxml_parser: add callback-based scanning mechanism
Tue, 15 Dec 2015 13:01:40 -0500 (Kevin Lin)
------------------------------------------
* HWPML: added hwpml_keys for hwpml parsing
Tue, 15 Dec 2015 10:54:20 -0500 (Kevin Lin)
------------------------------------------
* add HMPML filetype, tab fixes in filetype.c
Mon, 14 Dec 2015 16:34:11 -0500 (Kevin Lin)
------------------------------------------
* Hwp3.x: inflate compressed segment and offset tracking
Fri, 11 Dec 2015 17:50:40 -0500 (Kevin Lin)
------------------------------------------
* Hwp3.x file header parsing and preclass
Wed, 16 Dec 2015 14:56:56 -0500 (Kevin Lin)
------------------------------------------
* pcre: fixed minimum pcre version check
Fri, 11 Dec 2015 17:41:38 -0500 (Steven Morgan)
------------------------------------------
* bb11452 - endianess correction for swf files on sparc -
patch supplied by Jim Morris.
Wed, 9 Dec 2015 12:15:16 -0500 (Mickey Sola)
------------------------------------------
* bb11424 - correcting buffer alignemnt for riff detection on sparc systems;
patch by Jim Morris
Wed, 9 Dec 2015 00:17:41 +0100 (Andreas Cadhalpun)
------------------------------------------
* fix detection of libcheck without pkg-config file
Wed, 9 Dec 2015 11:43:35 -0500 (Kevin Lin)
------------------------------------------
* add HWP5 filetype tracking to preclassification
Tue, 8 Dec 2015 15:05:30 -0500 (Kevin Lin)
------------------------------------------
* add HWP 3.x internal filetypes
Tue, 8 Dec 2015 14:47:12 -0500 (Kevin Lin)
------------------------------------------
* add hwp5 contents to preclass set
Fri, 4 Dec 2015 11:55:52 -0500 (Kevin Lin)
------------------------------------------
* proper identification of HWP file format
Tue, 8 Dec 2015 18:36:48 -0500 (Steven Morgan)
------------------------------------------
* bb11438 - strengthen file typing for OOXML.
Wed, 2 Dec 2015 14:06:32 -0500 (Mickey Sola)
------------------------------------------
* bb-11099 - normalization of whitelist signatures
Wed, 2 Dec 2015 16:23:48 -0500 (Steven Morgan)
------------------------------------------
* github issue #9 - wrong length & offset.
Wed, 25 Nov 2015 11:30:00 -0500 (Steven Morgan)
------------------------------------------
* ClamAV 0.99 Release.
Wed, 4 Nov 2015 14:46:46 -0500 (Steven Morgan)
------------------------------------------
* ClamAV 0.99-rc2 Release.
Wed, 4 Nov 2015 14:46:46 -0500 (Steven Morgan)
------------------------------------------
* bb11420 - fix preclass/cache interaction.
Fri, 30 Oct 2015 13:34:56 -0400 (Steven Morgan)
------------------------------------------
* bb11419 - fix valgrind-detected uninitialized value when caching
is disabled.
Fri, 30 Oct 2015 12:48:26 -0400 (Steven Morgan)
------------------------------------------
* bb11418 - fix clamdscan segfault when using stream(stdin) input.
Thu, 29 Oct 2015 17:44:43 -0400 (Kevin Lin)
------------------------------------------
* bb#11421 - CUD digital signature verification and empty files
Wed, 28 Oct 2015 17:05:37 -0400 (Kevin Lin)
------------------------------------------
* change unknown database default to skip from .db
Thu, 22 Oct 2015 20:50:53 +0200 (Andreas Cadhalpun)
------------------------------------------
* use pkg-config to determine CHECK_LIBS
Mon, 26 Oct 2015 15:19:22 -0400 (Kevin Lin)
------------------------------------------
* bb#11015(2) - refactor automated pwdb target assignment for tdb
Mon, 26 Oct 2015 11:47:25 -0400 (Kevin Lin)
------------------------------------------
* fix error reporting for pwdb signature loading
Mon, 26 Oct 2015 12:49:01 -0400 (Steven Morgan)
------------------------------------------
* fix crash in clamd scan callback function.
Thu, 22 Oct 2015 14:50:41 -0400 (Kevin Lin)
------------------------------------------
* fix for openssl build with specific openssl location
Mon, 21 Sep 2015 18:28:54 -0400 (Mickey Sola)
------------------------------------------
* onas: adding better feedback for users attempting to use fanotify
prevention on kernels with unsupported configurations.
Thu, 15 Oct 2015 15:16:40 -0400 (Mickey Sola)
------------------------------------------
* onas: adding throttling to notifications when handling fanotify errors
on large files.
Mon, 5 Oct 2015 13:48:03 -0400 (Mickey Sola)
------------------------------------------
* onas: adding optional extra scanning for inotify events
Wed, 14 Oct 2015 09:37:59 -0400 (Mickey Sola)
------------------------------------------
* onas: improving handling of fanotify read errors for large files.
Wed, 6 Oct 2015 14:25:00 -0400 (Steven Morgan)
------------------------------------------
* ClamAV 0.99-rc1 Release.
Mon, 5 Oct 2015 14:24:58 -0400 (Mickey Sola)
------------------------------------------
* Configuration patch by Bernd Kuhls to allow for building statically
linked libraries.
Fri, 2 Oct 2015 12:24:58 -0400 (Steven Morgan)
------------------------------------------
* bb11209: fix for static-only build for uClibc - patch supplied by
Yann E. Morin.
Thu, 1 Oct 2015 17:47:37 -0400 (Steven Morgan)
------------------------------------------
* Add 'virus found' callback. Refactor scan-all API.
Thu, 1 Oct 2015 17:23:35 -0400 (Steven Morgan)
------------------------------------------
* Improve freshclam performance - patch posted to clamav-users list by
Andreas Schulze.
Tue, 29 Sep 2015 11:10:14 -0400 (Mickey Sola)
------------------------------------------
* onas: preventing use of ddd system to watch '/'
Mon, 21 Sep 2015 15:05:19 -0400 (Steven Morgan)
------------------------------------------
* Change ClamAV Windows icon.
Mon, 21 Sep 2015 14:41:19 -0400 (Mickey Sola)
------------------------------------------
* Sanity check update patches submitted by Bill Parker
Fri, 18 Sep 2015 17:43:06 -0400 (Steven Morgan)
------------------------------------------
* Change windows install directory, change windows Sourcefire artifacts
to Cisco.
Thu, 17 Sep 2015 16:49:42 -0400 (Mickey Sola)
------------------------------------------
* onas: changing clamd NotifyOnly option to Prevention and disabling
Prevention option by default.
Wed, 16 Sep 2015 13:40:19 -0400 (Mickey Sola)
------------------------------------------
* bb11250 - Removing deprecated function gethostbyname
Mon, 14 Sep 2015 12:11:47 -0400 (Mickey Sola)
------------------------------------------
* fanotify: consolidating prevention options into a single NotifyOnly option.
Mon, 14 Sep 2015 11:46:35 -0400 (Mickey Sola)
------------------------------------------
* fanotify: adding option to watch and notify on mountpoints.
Fri, 11 Sep 2015 14:17:35 -0400 (Mickey Sola)
------------------------------------------
* fanotify: adding clamd configuration toggle options to prevent read and
access attempts
Thu, 10 Sep 2015 16:43:45 -0400 (Mickey Sola)
------------------------------------------
* fanotify: adding clamd option to disable ddd
Wed, 9 Sep 2015 17:58:04 -0400 (Steven Morgan)
------------------------------------------
* Improve pkgconfig. Patch supplied by Andreas Cadhalpun.
Wed, 9 Sep 2015 11:19:11 -0400 (Mickey Sola)
------------------------------------------
* fanotify: blocking fanotify during database reload.
Tue, 8 Sep 2015 16:15:52 -0400 (Mickey Sola)
------------------------------------------
* onas: improving handling of thread exit cleanup and db reload.
Tue, 1 Sep 2015 18:53:45 -0400 (Steven Morgan)
------------------------------------------
* DLP: refactor inline code CC range checks to table based. Check IIN
range before applying Luhn algorithm.
Tue, 1 Sep 2015 16:13:00 -0400 (Kevin Lin)
------------------------------------------
* ac-alt: check last altstr for fixed property in expr analysis
Fri, 28 Aug 2015 17:10:00 -0400 (Mickey Sola)
------------------------------------------
* Adding FANOTIFY checks to ddd and onas hash files.
Fri, 28 Aug 2015 16:03:29 -0400 (Mickey Sola)
------------------------------------------
* Overhauling clamd onaccess scanning to support dynamic directory
determination.
Tue, 25 Aug 2015 15:12:03 -0400 (Steven Morgan)
------------------------------------------
* bb11352 - fix HP-UX 11.11 compile warnings. Patch sent by
Michael Pelletier.
Tue, 25 Aug 2015 10:53:23 -0400 (Steven Morgan)
------------------------------------------
* bb11351 - add missing sys/un.h header. Patch by Dmitry Marakasov.
Mon, 24 Aug 2015 15:17:02 -0400 (Steven Morgan)
------------------------------------------
* make retcode passed to post-scan callback to be CL_VIRUS when an
heuristic virus was detected.
Fri, 21 Aug 2015 12:43:26 -0400 (Kevin Lin)
------------------------------------------
* bb#11377 - stub pcre functions for dynamic library mapping
Thu, 20 Aug 2015 18:46:30 -0400 (Kevin Lin)
------------------------------------------
* bb#11377 - search for pcre/pcre.h if pcre.h not found
Fri, 14 Aug 2015 15:28:02 -0400 (Steven Morgan)
------------------------------------------
* bb11371 - fix integer underflow. Issue identified by Felix Groebert
and the Google Security Team.
Fri, 14 Aug 2015 12:22:49 -0400 (Kevin Lin)
------------------------------------------
* bb#11372 - finalize encrypted hex strings correctly
Thu, 13 Aug 2015 15:59:27 -0400 (Kevin Lin)
------------------------------------------
* bb#11370 - do not update mirrors on custom database urls
Tue, 11 Aug 2015 17:12:15 -0400 (Kevin Lin)
------------------------------------------
* dconf: disable swizzor heuristic by default
Mon, 3 Aug 2015 17:18:31 -0400 (Kevin Lin)
------------------------------------------
* bb#11366 - add 7z heuristic for encrypted header
Thu, 30 Jul 2015 18:05:09 -0400 (Kevin Lin)
------------------------------------------
* win32: update 3rdparty pcre to 8.37; clean up pcre sources
Thu, 30 Jul 2015 17:37:05 -0400 (Kevin Lin)
------------------------------------------
* tiff: added heuristic check for invalid tiff IFD fields
Wed, 29 Jul 2015 12:51:19 -0400 (Steven Morgan)
------------------------------------------
* bb11361 - add file magics for TIFF files.
Wed, 29 Jul 2015 12:05:44 -0400 (Steven Morgan)
------------------------------------------
* bb11359 - correct clamdscan handling of the --infected flag for files
excluded with ExcludePath clamd parameter. Patch provided by
devel at rinx dot com.
Tue, 28 Jul 2015 13:44:41 -0400 (Kevin Lin)
------------------------------------------
* bb#11196 - autoit script file misclassified as HTML
Fri, 24 Jul 2015 13:24:11 -0400 (Mickey Sola)
------------------------------------------
* bb11343: Automatically appennding YARA. to all yara rule sigs.
Thu, 23 Jul 2015 15:36:16 -0400 (Mickey Sola)
------------------------------------------
* bb11343: Adding yara-rules (yes|no|only) runtime option for clamscan.
Thu, 23 Jul 2015 16:37:15 -0400 (Kevin Lin)
------------------------------------------
* bb#9858 - added target 14 for binary (unidentified) files
Wed, 22 Jul 2015 18:09:50 -0400 (Kevin Lin)
------------------------------------------
* sigtool: added nested string alternative handling
Tue, 21 Jul 2015 16:35:48 -0400 (Mickey Sola)
------------------------------------------
* bb11343: Adding configure option to remove yara at compile-time.
Tue, 21 Jul 2015 17:30:14 -0400 (Kevin Lin)
------------------------------------------
* sigtool: added usage of cli_ldbtokenize to sigtool sigtool: handles
signature modifiers
Tue, 21 Jul 2015 14:16:14 -0400 (Kevin Lin)
------------------------------------------
* PCREMaxFileSize now correctly parses sizes (K,M,G suffixes)
Thu, 16 Jul 2015 12:35:38 -0400 (Kevin Lin)
------------------------------------------
* dconf: added passwd dconf for archives, applied to unzip
Tue, 14 Jul 2015 18:26:22 -0400 (Kevin Lin)
------------------------------------------
* unzip: added scanning of decrypted files
Tue, 14 Jul 2015 17:25:01 -0400 (Kevin Lin)
------------------------------------------
* unzip: added traditional PKWARE decryption password verification
Tue, 14 Jul 2015 17:23:43 -0400 (Kevin Lin)
------------------------------------------
* pwdb: added name tracking the pwdb entry
Thu, 9 Jul 2015 17:30:47 -0400 (Kevin Lin)
------------------------------------------
* engine: added .pwdb handler and storage
Wed, 15 Jul 2015 17:08:17 -0400 (Mickey Sola)
------------------------------------------
* bb11253: Upgrading win32 pthreads to version 2.9.1
Thu, 9 Jul 2015 15:35:49 -0400 (Mickey Sola)
------------------------------------------
* bb11219: Fixing scanscript to scan on a normalized map when using
relative offsets with type 7 signatures.
Wed, 8 Jul 2015 12:16:03 -0400 (Kevin Lin)
------------------------------------------
* bb#11356 - fixed an issue regarding yara_exec OP_OF
Tue, 7 Jul 2015 16:46:19 -0400 (Mickey Sola)
------------------------------------------
* Adding ascii file normalization option to sigtool.
Tue, 7 Jul 2015 14:02:57 -0400 (Kevin Lin)
------------------------------------------
* check-matcher: added prefix altstr test cases
Thu, 2 Jul 2015 15:06:04 -0400 (Kevin Lin)
------------------------------------------
* matcher-ac: added calc and storage for min/max lengths
Wed, 1 Jul 2015 16:53:07 -0400 (Kevin Lin)
------------------------------------------
* ac_special: tracks both the min and max lengths
Wed, 1 Jul 2015 16:14:14 -0400 (Steven Morgan)
------------------------------------------
* bb11348 - Patch for HPUX sent by Michael Pelletier.
Fri, 19 Jun 2015 16:33:59 -0400 (Steven Morgan)
------------------------------------------
* Add support for YARA private rules and referencing other rules in a
YARA condition.
Sat, 22 Nov 2014 15:26:02 +0100 (Andreas Cadhalpun)
------------------------------------------
* Avoid emitting incremental progress messages when not outputting to a
terminal.
Tue, 16 Jun 2015 14:56:32 -0400 (Mickey Sola)
------------------------------------------
* bb-11305: Initialized dbstat entries after clamd first loads.
Wed, 10 Jun 2015 17:39:50 -0400 (Steven Morgan)
------------------------------------------
* add unit tests for offset matching yara rules using 'at' and 'in' keywords.
Tue, 9 Jun 2015 11:12:20 -0400 (Kevin Lin)
------------------------------------------
* unit_test: pcre and sigopt test cases added to check_matchers
Fri, 5 Jun 2015 11:28:50 -0400 (Kevin Lin)
------------------------------------------
* unit_tests: added a few pcre test cases
Fri, 5 Jun 2015 11:11:35 -0400 (Kevin Lin)
------------------------------------------
* pcre: added warnings in regard to CVE-2015-3210
Thu, 4 Jun 2015 17:14:26 -0400 (Mickey Sola)
------------------------------------------
* bb-11149: Fixing bzip2 scan to cease scanning after reaching max filesize.
Wed, 3 Jun 2015 15:28:39 -0400 (Kevin Lin)
------------------------------------------
* unit_test: basis for pcre subsig testing
Mon, 1 Jun 2015 17:48:39 -0400 (Kevin Lin)
------------------------------------------
* removed offset 0 limitation on cli_scanraw (revert change from 0.95.2)
Mon, 1 Jun 2015 17:45:14 -0400 (Kevin Lin)
------------------------------------------
* updated internal msxml 2003 file magics
Mon, 1 Jun 2015 16:33:03 -0400 (Kevin Lin)
------------------------------------------
* added 'PCRE_STATIC' to preprocessor macros for 3rdparty pcre linking
Fri, 29 May 2015 16:08:35 -0400 (Kevin Lin)
------------------------------------------
* added pcre source for windows build; needs trimming
Thu, 28 May 2015 18:10:54 -0400 (Kevin Lin)
------------------------------------------
* win32: added yara compiler source to build
Thu, 28 May 2015 18:00:16 -0400 (Steven Morgan)
------------------------------------------
* Add the YARA compiler files.
Thu, 28 May 2015 17:50:20 -0400 (Kevin Lin)
------------------------------------------
* win32: updated sources to include new yara sources
Wed, 27 May 2015 18:27:48 -0400 (Steven Morgan)
------------------------------------------
* Enable YARA include directives, import YARA compiler struct and
functions, improve YARA parse/lex error messages.
Thu, 21 May 2015 15:04:22 -0400 (Kevin Lin)
------------------------------------------
* altstr: optimized fixed length alternate runtime
Thu, 21 May 2015 15:03:46 -0400 (Kevin Lin)
------------------------------------------
* added implementation of cli_qsort_r (qsort with cb arg)
Tue, 19 May 2015 12:21:36 -0400 (Kevin Lin)
------------------------------------------
* yara: added support for PUA, IGN, and sigload_cb
Tue, 19 May 2015 12:04:59 -0400 (Kevin Lin)
------------------------------------------
* ac_special_altstr: sigopt support
Mon, 18 May 2015 09:59:04 -0400 (Kevin Lin)
------------------------------------------
* matcher-ac: wildcard support for variable alternates (needs optimization)
Thu, 14 May 2015 13:03:21 -0400 (Steven Morgan)
------------------------------------------
* bb6934 - Incorporate Bill Parker's DLP functions for Canadian RTN/EFT
and U.S. MICR codes. TBD - options for invoking those functions.
Thu, 14 May 2015 12:47:54 -0400 (Kevin Lin)
------------------------------------------
* ac: verifier alternative to handling nocase
Wed, 13 May 2015 17:48:22 -0400 (Kevin Lin)
------------------------------------------
* matcher-ac: expansion of nested alternates within alternate expr
matcher-ac: three types of alternates: byte, fixed, and generic
Wed, 13 May 2015 17:27:44 -0400 (Steven Morgan)
------------------------------------------
* bb6230 - additional credit/debit card checks for dlp.c. Function by
Bill Parker.
Mon, 11 May 2015 11:55:43 -0400 (Kevin Lin)
------------------------------------------
* matcher-ac: basic framework+debug for processing nested alternates
Fri, 8 May 2015 15:52:30 -0400 (Steven Morgan)
------------------------------------------
* bb10731 specify group for socket of which user is not a member - patch by
Sebastian Andrzej Siewior.
Fri, 1 May 2015 17:15:55 -0400 (Steven Morgan)
------------------------------------------
* Improve fidelity of reporting error conditions from YARA strings and
to continue processing additional YARA rules within files where previous
string errors are found.
Wed, 29 Apr 2015 17:17:31 -0400 (Kevin Lin)
------------------------------------------
* msxml: virus detection and allmatch fixes
Tue, 28 Apr 2015 17:28:23 -0400 (Kevin Lin)
------------------------------------------
* bb#11306 - LZMA decompression support for flash files
Tue, 28 Apr 2015 14:56:14 -0400 (Kevin Lin)
------------------------------------------
* added default filetype magic for LZMA compressed SWF
Wed, 22 Apr 2015 04:34:02 -0400 (Kevin Lin)
------------------------------------------
* ole2: added MSO inflation and scanning (detached)
Mon, 27 Apr 12:00:00 EDT
-----------------------------------
* 0.98.7 Release.
Tue, 14 Apr 2015 15:53:17 EDT (klin)
-----------------------------------
* bb#11296 - various fixes to pdf string base64 string conversion
Mon, 13 Apr 2015 12:14:41 EDT (smorgan)
-----------------------------------
* bb11298 - look for TOC element name <unarchived-checksum>
(as a synonynm for <extracted-checksum>). Continue processing rather
than exit in the event of missing or error in TOC checksum specification.
Wed, 8 Apr 2015 15:51:04 EDT (smorgan)
-----------------------------------
* iso9660: remove unnecessaty parameter on iso_parse_dir() and reset return
code when scanall is in effect.
Wed, 1 Apr 2015 17:41:59 EDT (klin)
-----------------------------------
* pdf: correctly handle decoding, decryption, character set conversions,
and file properties collection(base64 encoded as needed).
Fri, 27 Mar 2015 13:21:49 EDT (klin)
-----------------------------------
* converted cb_file_props from using engine-based ctx to file-based ctx
Thu, 26 Mar 2015 12:24:02 EDT (smorgan)
-----------------------------------
* bb11281 - Reworked reverted upack.c crash patch to fix regression
false negatives.
Tue, 24 Mar 2015 12:06:57 EDT (klin)
-----------------------------------
* make check: added env check 'T' to set timeout
Mon, 23 Mar 2015 17:58:35 EDT (klin)
-----------------------------------
* bb#11282 - patch for code clean up in rebuildpe. Patch
supplied by Sebastian Andrzej Siewior.
Mon, 23 Mar 2015 13:04:54 EDT (klin)
-----------------------------------
* bb#11284 - fixed integer underflow in detecting W32.Polipos.A method.
Patch supplied by Sebastian Andrzej Siewior.
Mon, 16 Mar 2015 18:35:14 EDT (klin)
-----------------------------------
* updated documentation on document property collection
Mon, 16 Mar 2015 18:26:07 EDT (klin)
-----------------------------------
* added support for MS Office 2003 XML(msxml) document types and msxml
file properties collection.
Mon, 16 Mar 2015 13:11:56 EDT (klin)
-----------------------------------
* fixed converity issue ID 12109 buffer was not freed on rare error case
Mon, 16 Mar 2015 13:08:03 EDT (klin)
-----------------------------------
* fixed coverity ID 12110 12111 changed a the type of a value from unsigned
to signed due to possible negative values
Thu, 12 Mar 2015 19:06:23 EDT (smorgan)
-----------------------------------
* Fix for infinite loop on crafted xz file.
Wed, 11 Mar 2015 15:03:43 EDT (smorgan)
-----------------------------------
* bb11278 - was not detecting viruses on files inside iso9660.
Also fix up all-match logic.
Mon, 9 Mar 2015 13:02:25 EDT (smorgan)
-----------------------------------
* bb11274 - adds out of bounds check for petite packed files.
Patch from Sebastian Andrzej Siewior.
Wed, 4 Mar 2015 14:04:24 EDT (klin)
-----------------------------------
* updated example fileprop analysis bytecodes moved old example bytecodes
to examples/fileprop_analysis/old/
Wed, 4 Mar 2015 12:08:34 EDT (klin)
-----------------------------------
* backwards compatibility for target type 13 json scanning
Tue, 3 Mar 2015 17:47:55 EDT (klin)
-----------------------------------
* generates fmap from desc if no map is NULL
Tue, 3 Mar 2015 16:37:08 EDT (smorgan)
-----------------------------------
* Apply y0da cryptor patch sent in by Sebastian Andrzej Siewior.
Tue, 3 Mar 2015 16:12:48 EDT (klin)
-----------------------------------
* flevel updated to 80 (new bytecode hook type)
Tue, 3 Mar 2015 16:12:22 EDT (klin)
-----------------------------------
* clambc info option updated for new hook type
Tue, 3 Mar 2015 15:00:41 EDT (klin)
-----------------------------------
* added BC_PRECLASS hook support; replaces target type 13
Mon, 2 Mar 2015 19:06:23 EDT (klin)
-----------------------------------
* pdf string UTF-16 conversion no longer solely depends on ICONV reason:
no ICONV meant no conversion even though conversion function existed
Fri, 27 Feb 2015 15:23:51 EDT (klin)
-----------------------------------
* bb#11269 - bm matcher no longer sets scanning window offset reason:
certain segments could be hashed multiple times
Wed, 25 Feb 2015 14:55:21 EDT (klin)
-----------------------------------
* bb#11269 - hash does not compute on segments smaller than the maxpatlen
Tue, 24 Feb 2015 16:21:09 EDT (klin)
-----------------------------------
* bb#11267 - libclamav upx cover against hand crafted section ove patch
supplied bySebastian Andrzej Siewior.
Fri, 27 Feb 2015 16:57:19 EDT (smorgan)
-----------------------------------
* Patch for integer overflow checks for petite unpack code supplied by
Sebastian Andrzej Siewior.
Fri, 27 Feb 2015 16:54:55 EDT (smorgan)
-----------------------------------
* remove obsolete parameters from the clamd.conf man page: MailMaxRecursion,
ArchiveMaxFileSize, ArchiveMaxRecursion, ArchiveMaxFiles,
ArchiveMaxCompressionRatio, ArchiveBlockMax, ArchiveLimitMemoryUsage, Clamuko*.
Wed, 18 Feb 2015 15:23:54 EDT (klin)
-----------------------------------
* bb#11212 - fix MEW unpacker
Mon, 16 Feb 2015 11:46:21 EDT (smorgan)
-----------------------------------
* bb11264 - patch for 'possible' heap overflow submitted by the Debian team.
Tue, 10 Feb 2015 15:16:48 EDT (smorgan)
-----------------------------------
* bb11260: fix compile error when './configure --disable-pthreads' is specified.
Fri, 6 Feb 2015 14:59:43 EDT (klin)
-----------------------------------
* bb#11254 - removed built-in llvm configure check and added
--with-llvm-linking option to specify system-llvm linking method
Fri, 6 Feb 2015 13:22:35 EDT (klin)
-----------------------------------
* improved documentation on macro subsignatures
Wed, 4 Feb 2015 18:52:01 EDT (smorgan)
-----------------------------------
* fix documentation errors in example logical signature.
Fri, 30 Jan 2015 12:15:07 EDT (klin)
-----------------------------------
* bb#12887 - fixed an issue regarding (fd==-1) in WinAPI
Wed, 28 Jan 2015 11:20:35 EDT (klin)
-----------------------------------
* fixed Windows API SetOption/GetOption CLAM_LIMIT_RECURSION
Wed, 21 Jan 2015 11:41:07 EDT (klin)
-----------------------------------
* added ICONV to clamconf optional features report
Thu, 15 Jan 2015 15:15:01 EDT (klin)
-----------------------------------
* fixed an incorrect return value for magic_scandesc
Wed, 14 Jan 2015 09:25:47 EDT (klin)
-----------------------------------
* cleaned up configure help strings by using AS_HELP_STRING
Mon, 12 Jan 2015 13:45:36 EDT (klin)
-----------------------------------
* bb#11238 - added missing PDF preclass operations
> added whitespace fix for indirect references strings
> added PDF escape sequence handling (including octal)
Thu, 8 Jan 2015 09:48:20 EDT (klin)
-----------------------------------
* bb#11237 - fixed bug in building CUD file
Wed, 7 Jan 2015 04:46:15 EDT (smorgan)
-----------------------------------
* bb11233 - fix a strange bus error on Mac OS X PPC when using debug mode.
Mon, 22 Dec 2014 12:13:38 EDT (klin)
-----------------------------------
* bb#11226 - fixed gpt GUID debugging message
*** End of 0.98.6, Start of 0.98.7
Tue Dec 16 16:21:40 2014 EDT (swebb)
-------------------------------------
bb#11215 - Change a variable to be an unsigned int to compensate for
compiler optimization issue with crafted petite file. Fix
suggested by Sebastian Andrzej Siewior.
Fri Dec 12 14:33:41 2014 EDT (klin)
-----------------------------------
Added missing break statements(FireAmp #12710) to correct handling of
prescan callback return code.
Fri Dec 5 15:26:06 2014 EDT (smorgan)
-------------------------------------
bb#11216 - add boundary checks for fuzzed upack file. This issue
was reported by Sebastian Andrzej Siewior. CVE-2014-9328.
Thu Dec 4 18:29:17 2014 EDT (klin)
-----------------------------------
bb#11212 - fixed section boundary mismatch in MEW unpacker. This issue
was identified by Felix Groebert of the Google Security Team.
Thu Dec 4 08:43:43 2014 EDT (swebb)
-------------------------------------
bb#11213 - Enforce bounds checking before integer overflow in upx files.
This issue was reported by Kevin Szkudlapski of Quarkslab.
Tue Dec 2 15:15:55 2014 EDT (swebb)
-------------------------------------
bb#11210: Apply a basic fix for y0da crafted file. This issue was
identified by Felix Groebert of the Google Security Team.
Fri, 21 Nov 2014 15:55:12 EDT (swebb)
-------------------------------------
bb#11194: Include OpenSSL's headers after the local headers
Thu, 20 Nov 2014 12:39:00 EDT (swebb)
-------------------------------------
bb#10907: Add trailing newline to the end of the pidfile
(patch submitted by Sebastian Andrzej Siewior)
Wed, 12 Nov 2014 14:30:39 EDT (swebb)
-------------------------------------
* bb11176 - Instruct OpenSSL to allow MD5 when in FIPS-compliant mode.
Patch submitted by Reinhard Max.
Mon, 10 Nov 2014 11:03:29 EDT (swebb)
-------------------------------------
* bb11155 - Adjust the logic surrounding adjusting the PE section sizes
This fixes a crash with maliciously crafted yoda's crypter files and
also improves virus detections for PE files.
Thu, 6 Nov 2014 14:51:26 EDT (swebb)
-------------------------------------
* bb11088 - Merge in fixes for clamscan -a crash bug
Mon, 20 Oct 2014 11:33:18 EDT (swebb)
-------------------------------------
* Revert "bb#10731 - Allow to specificy a group for the socket of which
the user is not a member"
Thu, 31 Jul 2014 19:11:22 EDT (swebb)
-------------------------------------
* Add support for XDP PDF file format
Thu, Jul 31 11:50:23 EDT 2014 (swebb)
------------------------------------
* bb#10731 - Allow specification of a group for the milter socket of which
the user is not a member - patch submitted by Sebastian Andrzej Siewior
Fri, 25 Jul 2014 12:26:04 EDT (klin)
------------------------------------
* bb#10981 - applied LLVM 3.1-3.4 - patch submitted by Andreas Cadhalpun
Fri, 25 Jul 2014 12:06:13 (klin)
--------------------------------
* clambc: added diagnostic tools for bytecode IR
Tue, 8 Jul 2014 19:53:41 EDT (swebb)
------------------------------------
* mass cleanup of compiler warnings
Tue, 08 Jul 11:30:00 EDT 2014 (morgan)
------------------------------------
* 0.98.5 beta release
Mon, 07 Jul 09:00:00 EDT 2014 (swebb)
------------------------------------
* 0.98.5-beta1 release engineering
Thu, 03 Jul 22:14:40 EDT 2014 (swebb)
------------------------------------
* Call cl_initialize_crypto() in cl_init()
Thu, 03 Jul 16:28:10 EDT 2014 (swebb)
------------------------------------
* Finalize PDF parsing code for the preclassification feature
Wed, 25 Jun 16:26:33 EDT 2014 (swebb)
------------------------------------
* Finalize linking in libjson, a new optional dependency
Fri, 13 Jun 2014 16:11:15 EDT (smorgan)
---------------------------------------
* add timeout facility for file property scanning
Tue, 3 Jun 2014 13:31:50 EDT (smorgan)
--------------------------------------
* add callback for user processing of json string and json scan result
Wed, 7 May 2014 10:56:35 EDT (swebb)
------------------------------------
* PE file properties collection
Tue, 6 May 2014 15:26:30 EDT (klin)
-----------------------------------
* add api to read json to the bytecode api
Thu, 1 May 2014 16:59:01 EDT (klin)
-----------------------------------
* docx/pptx/xlsx file properties collection
Wed, 30 Apr 2014 16:38:55 EDT (swebb)
-------------------------------------
* pdf file properties collection
Tue, 22 Apr 2014 14:22:39 EDT (klin)
------------------------------------
* json api wrapper
Mon, 21 Apr 2014 18:30:28 EDT (klin)
------------------------------------
* doc/ppt/xls file properties collection
Wed, 16 Apr 18:14:45 2014 EDT (smorgan)
--------------------------------------
* Initial libjson-c configure/build support and json file properties work
---------------------------------
Beginning of 0.98.5 Development |
---------------------------------
Mon, 12 May 17:30:00 EDT 2014 (morgan)
------------------------------------
* 0.98.4 release