LoginSign Up
← Back to all sparks
C

ClamAV

INFRA · APIS
Velocity0.0

Open-source antivirus engine for detecting malware

www.clamav.net ↗

ClamAV's file parsers keep yielding CVEs — and every fix ships twice, to two branches.

antiviruscve patchesfile parsersdual branchrust dependencies
◆Current state
ClamAV runs two supported lines, 1.5.x and 1.4.x, and publishes identical patch releases seconds apart whenever a vulnerability lands. The recurring source is the same: file format parsers. The July pair fixed a PESpin unpacker use-after-free and an integer overflow in PE rebuild size calculations; the March pair fixed an HTML parser error-handling crash and a JPEG scanning hang inherited from a Rust image dependency. One of the July issues reaches back to code from 2005.
◆Where it's heading
Feature work has effectively paused since 1.5.0 last October, which added OLE2 encryption detection and HTML URI recording in JSON metadata. Everything since is patch traffic. The more consequential trend is the Rust dependency chain: fixing image parsing bugs by upgrading crates has twice forced the minimum Rust compiler version upward, which pushes cost onto distribution packagers rather than end users.
◆Prediction
Expect the dual-branch CVE pattern to continue at roughly quarterly intervals, with the PE and archive parsers the likeliest source given their history here. Whether a 1.6 line opens is not something these entries indicate — there has been no development release since the 1.5.0 cycle.

◆Recent moves

  1. 1mo ago

    PESpin use-after-free and PE overflow patched

    Two PE-related flaws close: a PESpin unpacker cleanup path freeing pointers into the scanned file buffer, and an integer overflow in PE rebuild sizing. The first affects every version back to 2005, which says more about the age of the unpacker code than about this release.

    View source ↗
  2. 1mo ago

    Same PE fixes backported to the 1.4 line

    The 1.4 counterpart of the July patch, published within seconds of 1.5.3 and carrying the identical advisory text. Maintaining two lines in lockstep is the project's answer to how long distributions hold a given version.

    View source ↗
  3. 5mo ago

    HTML parser crash fixed; Rust floor raised again

    An HTML parser error-handling bug that could crash the scanner is fixed, along with a possible infinite loop on some JPEGs. The JPEG fix arrives by upgrading a Rust image dependency, which drags the minimum Rust compiler version up with it — the recurring tax of the Rust components.

    View source ↗
  4. 5mo ago

    1.4 branch takes the HTML and TIFF parser fixes

    The March patch on the older line, pairing the same HTML parser CVE with a TIFF crash rather than the JPEG hang. It carries its own Rust minimum version bump, a larger jump on this branch than on 1.5.

    View source ↗
  5. 9mo ago

    PE and TNEF scanning performance fixes

    A non-security patch, and the only one in this window: a significant PE scanning slowdown resolved, TNEF attachment scanning sped up, and a ZIP central directory bug that produced spurious max-files alerts. This is the kind of release that changes what operators actually feel day to day.

    View source ↗
  6. 10mo ago

    1.5.0 adds OLE2 encryption checks and HTML URI capture

    The last release in this window to add capability rather than repair it: detection of encrypted OLE2 Office documents, and optional recording of URIs found in HTML into the JSON metadata output. Everything published since has been patch traffic against the parsers.

    View source ↗