ClamAV EOL of 0.100.x versions

Effective Oct. 29, 2021, ClamAV 0.100.0 (and all patch versions) will no longer be supported in accordance with ClamAV's EOL policy. 

End of life (EOL) for ClamAV means:

• We will no longer be testing against that version when we write signatures.
• We may break that version with something with a future release.
• Signature updates for that version will be blocked when attempting to download from the mirror update system.

Please upgrade to the newest version of ClamAV, currently at 0.103.3, available for download now!

As always, thank you for using ClamAV.

ClamAV EOL versions prior to 0.100

ClamAV community, we want to inform you that, effective March 1, ClamAV 0.99.0 (and all minor versions) will no longer be supported in accordance with ClamAV's EOL policy.  For clarification, anything prior to 0.100.0.

End of life (EOL) for ClamAV essentially means that we will no longer be testing against that version when we write signatures, and we may break something with a future release. So, while signatures may work past March 1, we are no longer testing that configuration. 

Please upgrade to the newest version of ClamAV, currently at 0.103.1, available for download now!

As always, thank you for using ClamAV.

ClamAV 0.100.0 has been released!

Join us as we welcome ClamAV 0.100.0 to the family officially.  You can grab it, as always, from the downloads page on ClamAV.net.

ClamAV 0.100.0 is a feature release which includes many code submissions from the ClamAV community.  Some of the more prominent submissions include:

• Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
• Support for Visual Studio 2015 for Windows builds.  Please note that we have deprecated support for Windows XP, and while Vista may still work, we no longer test ClamAV on Windows XP or Vista.
• Support libmspack internal code or as a shared object library. The internal library is the default and includes modifications to enable parsing of CAB files that do not entirely adhere to the CAB file format.
• Linking with OpenSSL 1.1.0.
• Deprecation of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default.
• Numerous bug fixes, typo corrections, and compiler warning fixes.

Additionally, we have introduced important changes and new features in ClamAV 0.100, including but not limited to:

• Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: ./configure --with-system-llvm=no, but it no longer compiles on all platforms.
• Compute and check PE import table hash (a.k.a. "imphash") signatures.
• Support file property collection and analysis for MHTML files.
• Raw scanning of PostScript files.
• Fix clamsubmit to use the new virus and false positive submission web interface.
• Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
• Improved decoders for PDF files.
• Reduced number of compile time warnings.
• Improved support for C++11.
• Improved detection of system installed libraries.
• Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures.
• Improvements to clamd's On-Access scanning capabilities for Linux.

Acknowledgements

The ClamAV team thanks the following individuals for their code submissions:

• Andreas Schulze
• Anthony Chan
• Bill Parker
• Chris Miserva
• Daniel J. Luke
• Georgy Salnikov
• James Ralston
• Jonas Zaddach
• Keith Jones
• Marc Deslauriers
• Mark Allan
• Matthew Boedicker
• Michael Pelletier
• Ningirsu
• Sebastian Andrzej Siewior
• Stephen Welker
• Tuomo Soini

Known Issues

ClamAV has an active issue queue and enjoys continual improvement but as sad as
 I am to say it, we couldn't address every bug in this release.  I want to draw
 your attention a couple bugs in particular so as not to frustrate users
 setting up ClamAV:

• Platform: macOS:
• Bug:  If you attempt to build ClamAV with a system installed LLVM you may receive a linker error.  We recently changed default linking behavior to prefer dynamic linking over static linking.  As a result, we've uncovered a bug in building on macOS where dynamic linking against the LLVM libraries fails.  To work around this bug, please add the --with-llvm-linking=static option to your ./configure call.

• Platform: CentOS 6 32bit, older versions of AIX:
• Bug:  On CentOS 6 32bit we observed that specific versions of zlib fail to correctly decompress the CVD signature databases.  If you are on an older system such as CentoOS 6 32bit and observe failures loading the signature database, please consider upgrading to a newer version of zlib.

• Platform: Miscellaneous
• Bug:  When cross compiling on certain legacy systems (Solaris, AIX, OSX) against older system libraries that do not support strn functions linking may fail during compile time. While automatic checking is done during configure time to check for unsupported libs, this problem can be manually avoided using the --enable-strni configure flag if it is encountered.

ClamAV 0.100.0-rc has been posted!

0.100.0-rc (Release Candidate) Notes

ClamAV 0.100.0 is a feature release (candidate) which includes many code submissions from the ClamAV community.  As always, it can be downloaded from our downloads site on clamav.net. Some of the more prominent submissions include:

•  Interfaces to the Prelude SIEM open source package for collecting ClamAV virus events.
•  Support for Visual Studio 2015 for Windows builds.
•  Support libmspack internal code or as a shared object library. The internal library is the default and contains additional integrity checks.
•  Linking with openssl 1.1.0.
•  Deprecation of the AllowSupplementaryGroups parameter statement in clamd, clamav-milter, and freshclam. Use of supplementary is now in effect by default.
•  Numerous bug fixes, typo corrections, and compiler warning fixes.

Additionally, we have introduced important changes and new features in ClamAV 0.100, including but not limited to:

• Deprecating internal LLVM code support. The configure script has changed to search the system for an installed instance of the LLVM development libraries, and to otherwise use the bytecode interpreter for ClamAV bytecode signatures. To use the LLVM Just-In-Time compiler for executing bytecode signatures, please ensure that the LLVM development package at version 3.6 or lower is installed. Using the deprecated LLVM code is possible with the command: `./configure --with-system-llvm=no`, but it no longer compiles on all platforms.
•  Compute and check PE import table hash (a.k.a. "imphash") signatures.
•  Support file property collection and analysis for MHTML files.
•  Raw scanning of PostScript files.
•  Fix clamsubmit to use the new virus and false positive submission web interface.
•  Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when size limitations are exceeded.
•  Improved decoders for PDF files.
•  Reduced number of compile time warnings.
•  Improved support for C++11.
•  Improved detection of system installed libraries.
•  Fixes to ClamAV's Container system and the introduction of Intermediates for more descriptive signatures.
•  Improvements to clamd's On-Access scanning capabilities for Linux.

Acknowledgements

The ClamAV team thanks the following individuals for their code submissions:

Andreas Schulze
Anthony Chan
Bill Parker
Chris Miserva
Daniel J. Luke
Georgy Salnikov
James Ralston
Jonas Zaddach
Keith Jones
Marc Deslauriers
Mark Allan
Matthew Boedicker
Michael Pelletier
Ningirsu
Sebastian Andrzej Siewior
Stephen Welker
Tuomo Soini

Known Issues

ClamAV has an active issue queue and enjoys continual improvement but as sad as I am to say it, we couldn't address every bug in this release.  I want to draw your attention a couple bugs in particular so as not to frustrate users setting up ClamAV:

• Platform: macOS: 
• Bug:  If you attempt to build ClamAV with a system installed LLVM you may receive a linker error.  We recently changed default linking behavior to prefer dynamic linking over static linking.  As a result, we've uncovered a bug in building on macOS where dynamic linking against the LLVM libraries fails.  To work around this bug, please add the --with-llvm-linking=static option to your ./configure call. 
• Platform: CentOS 6 32bit, older versions of AIX:
• Bug:  On CentOS 6 32bit we observed that specific versions of zlib fail to correctly decompress the CVD signature databases.  If you are on an older system such as CentoOS 6 32bit and observe failures loading the signature database, please consider upgrading to a newer version of zlib. 
•  Platform: Miscellaneous
• Bug:  When cross compiling on certain legacy systems (Solaris, AIX, OSX) against older system libraries that do not support strn functions linking may fail during compile time. While automatic checking is done during configure time to check for unsupported libs, this problem can be manually avoided using the --enable-strni configure flag if it is encountered.

Please check out 0.100.0-rc and provide us feedback on the ClamAV Mailing lists.  As always, a big thank you to the ClamAV Community!

ClamAV 0.100.0 beta has been released!

ClamAV 0.100.0-beta is the successor to the previous 0.99.3-beta2.  The 0.99.3 patch release on January 25th was required to address vulnerability fixes in a timely manner, so the features previously found in 0.99.3 betas have been bumped to this new version.  If you haven’t read it, please read the announcement regarding the version number change. 

The 0.100.0-beta includes all of the feature improvements and bug fixes that were in the previous 0.99.3-beta2, plus some additional bug fixes and requested improvements that were found by users of the previous beta.  These include:

• Eliminating warnings regarding with variables being used before being initialized. 
• Correcting an issue for those using private mirrors where freshclam attempts to pull down the CVD file if the CLD is up-to-date. 
• Fixed a bug in the filtering system that caused unexpected behavior for signatures that use the case insensitive signatures (:i). 
• Increased the max stack size when building ClamAV for non-glibc Linux machines (i.e. musl). 
• Deprecated the AllowSupplementaryGroups config option in a more graceful way.
• Bug fixes to on-access scanning.
• A few other bug fixes.

We could use community support testing these fixes, of course.  That said, our main goal of 0.100.0-beta is to get the community ready for the version string change.  Mirror maintainers have been asked to verify that ClamAV clients using the 0.100.0 version number in the HTTP user agent are not blacklisted by regexes intended to drop support for older versions of ClamAV.

As a disclaimer, 0.100.0-beta isn’t a release candidate because we have a few outstanding known issues that we must address prior to the 0.100.0 release, and because once the fixes are made we will have to complete regression testing.  The known issues blocking release include the following:

• The libmspack library install location, name. Bug
• BlockMax config option may differ slightly from —block-max command line option. Bug
• Using the ./configure --disable-static will still require llvm-static. Bug
• Improvements in PDF object parsing (in progress). 
• Messages when clamscan skips a file due to max file size settings, along with corrections to the —help string. Bug
• Warnings when building on macOS.  Bugs, Bugs 

Bugs should be brought to our attention via the clamav-devel mailing list or via bugzilla

ClamAV Version number adjustment

This is a heads up to the ClamAV community, we are changing our version numbering scheme as follows. Our versions will follow x.y.z (major.minor.patch). Major releases will be reserved for major feature additions or changes that may be incompatible with previous releases. Minor releases will be for regular bug fixes and minor feature changes/additions. Patches will be reserved for security fixes to address CVE and other critical bug fixes.

This change was driven by our need to address a security vulnerability release to resolve a number of CVEs which will be published shortly. We internally discussed a number of options, and reviewed these options with a few key members of the community before making this decision.

What this means for our community members? We will shortly be releasing a 0.99.3 release. This release will specifically target the aforementioned CVEs. The 0.99.3 betas we had previously shared will be renumbered to 0.100.0 instead.

We apologize for any confusion this change will cause, but we feel this will impact the least number of community members, while allowing us flexibility to quickly address critical bugs or security issues, without undue issues with other work underway.