LoginSign Up
← Back to all sparks
C

ClamAV

INFRA · APIS
Velocity5.0

Open-source antivirus engine for detecting malware

www.clamav.net ↗

Eight CVEs in one August batch — ClamAV's parser surface is the whole story.

antiviruscve patchesfile parsersdual branchmemory safety
◆Current state
ClamAV runs two supported lines, 1.5.x and 1.4.x, and publishes near-identical patch releases seconds apart whenever vulnerabilities land. The August pair is the largest yet in this window: eight CVEs in 1.5.4, six of them backported to 1.4.6, spanning the ZIP catalogue, GPT partition, PESpin, PDF, Mach-O and XAR parsers. Several reach back a decade or more — the PESpin overflow affects builds from 0.90 onward.
◆Where it's heading
Feature work has been paused since 1.5.0 last October; everything since is patch traffic against the file format parsers, and the batches are growing rather than shrinking. The August release widens the surface beyond parsing for the first time here, with a clamd STATS thread-safety bug that could disclose process memory or crash the daemon. Reporter credits increasingly come from automated discovery — Atuin, GitHub Security Lab, Trail of Bits — which suggests the find rate tracks the tooling pointed at this codebase, not new code being written.
◆Prediction
Expect the dual-branch pattern to continue and per-batch CVE counts to stay high while automated fuzzing keeps sweeping the parser surface. These entries give no indication of a 1.6 line opening — there has been no development release since the 1.5.0 cycle.

◆Recent moves

  1. 11d ago

    Eight parser CVEs and a clamd STATS disclosure fix

    The largest patch batch in this window: eight CVEs across the ZIP catalogue, GPT partition, PESpin, PDF, Mach-O and XAR parsers, plus a bundled UnRAR path-traversal fix adopted from upstream. A thread-safety bug in clamd's STATS command is the first issue here that sits in the daemon rather than a file parser.

    View source ↗
  2. 11d ago

    1.4 branch takes six of the eight parser CVEs

    The 1.4 counterpart, published twenty-three seconds before 1.5.4 and carrying six of its eight CVEs — the two ZIP catalogue issues are 1.5-only, since that code does not exist on this branch. It also restores safe quarantine move and remove actions on FreeBSD.

    View source ↗
  3. 1mo ago

    PESpin use-after-free and PE overflow patched

    Two PE-related flaws close: a PESpin unpacker cleanup path freeing pointers into the scanned file buffer, and an integer overflow in PE rebuild sizing. The first affects every version back to 2005, which says more about the age of the unpacker code than about this release.

    View source ↗
  4. 1mo ago

    Same PE fixes backported to the 1.4 line

    The 1.4 counterpart of the July patch, published within seconds of 1.5.3 and carrying the identical advisory text. Maintaining two lines in lockstep is the project's answer to how long distributions hold a given version.

    View source ↗
  5. 5mo ago

    HTML parser crash fixed; Rust floor raised again

    An HTML parser error-handling bug that could crash the scanner is fixed, along with a possible infinite loop on some JPEGs. The JPEG fix arrives by upgrading a Rust image dependency, which drags the minimum Rust compiler version up with it — the recurring tax of the Rust components.

    View source ↗
  6. 5mo ago

    1.4 branch takes the HTML and TIFF parser fixes

    The March patch on the older line, pairing the same HTML parser CVE with a TIFF crash rather than the JPEG hang. It carries its own Rust minimum version bump, a larger jump on this branch than on 1.5.

    View source ↗