clamav - Debian Package Tracker

general

source: clamav (main)
version: 1.4.5+dfsg-3
maintainer: ClamAV Team (archive) (DMD)
uploaders: Michael Meskes [DMD] – Michael Tautschnig [DMD] – Sebastian Andrzej Siewior [DMD] – Andreas Cadhalpun [DMD]
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.103.10+dfsg-0+deb11u1
o-o-sec: 1.4.3+dfsg-1~deb11u1
o-o-upd: 0.103.10+dfsg-0+deb11u1
oldstable: 1.4.3+dfsg-1~deb12u2
stable: 1.4.3+dfsg-1
testing: 1.4.4+dfsg-1
unstable: 1.4.5+dfsg-3

versioned links

0.103.10+dfsg-0+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.9+dfsg-1~deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.3+dfsg-1~deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.3+dfsg-1~deb12u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.3+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.4+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.5+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

clamav (10 bugs: 0, 9, 1, 0)
clamav-base
clamav-daemon (21 bugs: 0, 17, 4, 0)
clamav-doc
clamav-docs
clamav-freshclam (17 bugs: 0, 14, 3, 0)
clamav-milter (4 bugs: 0, 0, 4, 0)
clamav-testfiles
clamdscan (1 bugs: 0, 1, 0, 0)
libclamav-dev
libclamav12

action needed

7 security issues in forky high

There are 7 open security issues in forky.

7 important issues:

CVE-2026-20213: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20214: A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20215: A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20216: A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.
CVE-2026-20217: A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20243: A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in ALZ files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains ALZ content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20244: A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Created: 2026-07-02 Last update: 2026-07-12 01:00

8 security issues in bullseye high

There are 8 open security issues in bullseye.

7 important issues:

CVE-2026-20213: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20214: A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20215: A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20216: A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.
CVE-2026-20217: A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20243: A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in ALZ files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains ALZ content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20244: A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

1 issue postponed or untriaged:

CVE-2026-20031: (postponed; to be fixed through a stable update) A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

Created: 2026-07-02 Last update: 2026-07-12 01:00

8 security issues in bookworm high

There are 8 open security issues in bookworm.

7 important issues:

CVE-2026-20213: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20214: A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20215: A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20216: A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.
CVE-2026-20217: A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20243: A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in ALZ files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains ALZ content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20244: A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

1 issue left for the package maintainer to handle:

CVE-2026-20031: (needs triaging) A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-02-16 Last update: 2026-07-12 01:00

Depends on packages which need a new maintainer normal

The packages that clamav depends on which need a new maintainer are:

sendmail (#740070)
- Depends: libmilter1.0.1
- Build-Depends: libmilter-dev

Created: 2019-11-22 Last update: 2026-07-13 05:30

4 bugs tagged patch in the BTS normal

The BTS contains patches fixing 4 bugs, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-07-13 05:00

18 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 97a37bb25ec2e1df84da99aa2771297a45e61a84
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sun Jul 12 11:52:16 2026 +0200

    d/ci: Disable blhc
    
    This fails due
    | 2132:NONVERBOSE BUILD:    Compiling clamav_rust v0.0.1 (/build/package/package/libclamav_rust)
    | 2139:NONVERBOSE BUILD:    Compiling onenote_parser v0.3.1 (https://github.com/Cisco-Talos/onenote.rs.git?branch=CLAM-2329-new-from-slice#8b450447)
    
    disable for now
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit b47e256a24110d1bdecd57e738bb747288c93cb2
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jul 11 15:42:23 2026 +0200

    Prepare 1.4.5+dfsg-3
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 18b8bc836a47ec0e8faeaa8d080bce5155ad6770
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jul 11 15:42:02 2026 +0200

    d: Update changelog
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit f84b5c9c203c1ec82654c0c14344e822f3c80c7c
Merge: 10af380e 915c00ef
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jul 11 15:27:38 2026 +0200

    merge patched-unstable into unstable

commit 915c00ef809a0c55f3ffe085a247ed0bcb334586
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jul 11 15:25:03 2026 +0200

    unit_tests: Don't set TMP
    
    Setting TMP to CMAKE_CURRENT_BINARY_DIR can result in a long path such
    as "/build/reproducible-path/clamav-1.4.5+dfsg/obj-arm-linux-gnueabihf/unit_tests"
    together with the temporary filename the testsuite can abort with
    "OSError: AF_UNIX path too long" during "TC.mock_mirror.start()" because
    the resulting unix socket name gets too long.
    
    Without setting, it ends up under /tmp/ which is brief enough.
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 10af380ec069bdd0f92015cc6a95b2f723b998ad
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jul 4 10:30:21 2026 +0200

    d: Enable salsa-ci
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 79a196b66337ecb413d1e5595ac9d0de859729c2
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jul 4 10:24:02 2026 +0200

    Prepare 1.4.5+dfsg-2
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit a0b8f86d033da8d0d9d25f609f8be752a40db9f7
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sat Jul 4 10:03:07 2026 +0200

    Run testsuite with -j1
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit cc2a43502a9f3893840cee69e61a7540c150522b
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jul 3 23:16:28 2026 +0200

    Prepare 1.4.5+dfsg-1
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 08860a50faa3ea39bf2c2ad39db00060378680da
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jul 3 23:16:02 2026 +0200

    d: Use -DCMAKE_BUILD_TYPE=RelWithDebInfo by default
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 478677ef97348d53030b6578020c326a6dc54818
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jul 3 23:09:12 2026 +0200

    d: Update symbols
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 96a9d3acd9687062bcebdf28dd4b772edfdcc1bb
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jul 3 23:08:22 2026 +0200

    Import 1.4.5
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 6c5fd1eec73657839aa9f800396d33b2f06d1131
Merge: d93139d8 b9f7b792
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jul 3 23:03:43 2026 +0200

    merge patched-unstable into unstable

commit b9f7b792afd396bdbefc9d8f20fdc36faa7e2f9b
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Thu Jun 4 20:39:11 2026 +0200

    libclamav/crypto: Use openssl parsing in cl_ASN1_GetTimeT()
    
    The ASN1_TIME type has been made opaque in OpenSSL 4.0
    
    Replace the manual parsing of the string with ASN1_TIME_to_tm() which is
    available since openssl 1.1.1.
    
    [ The last user has been removed in commit fa15aa98c7d5e ("bb11594 -
      allow for compilation against openssl 1.1.0") so we might remove it
      but it looks exported ]
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 2c5b0d4e7f6d16b0e8073c88933028d20cedf12d
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Sun Apr 12 17:35:41 2026 +0200

    clamav-milter: Add systemd service file
    
    Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

commit 8f75fd4e75d49311b9f96a33b8c559d2ce493a26
Author: Scott Kitterman <scott@kitterman.com>
Date:   Mon Mar 10 19:20:18 2014 -0400

    Change paths in sample conf file to match Debian
    
    Patch-Name: Change-paths-in-sample-conf-file-to-match-Debian.patch

commit d93139d8712d9303b0e5b364cee3f837ff5815a2
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jul 3 23:03:07 2026 +0200

    record new upstream branch created by importing clamav_1.4.5+dfsg.orig.tar.xz

commit ccffda7984e0a54ec2376b659917a24a6d25bd27
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date:   Fri Jul 3 23:03:05 2026 +0200

    Import clamav_1.4.5+dfsg.orig.tar.xz

Created: 2026-07-03 Last update: 2026-07-12 10:33

lintian reports 31 warnings normal

Lintian reports 31 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-12 Last update: 2026-07-12 04:48

3 open merge requests in Salsa normal

There are 3 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2025-09-21 Last update: 2026-07-10 16:51

debian/patches: 4 patches to forward upstream low

Among the 4 debian patches available in version 1.4.5+dfsg-3 of the package, we noticed the following issues:

4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-12 10:33

8 low-priority security issues in trixie low

There are 8 open security issues in trixie.

8 issues left for the package maintainer to handle:

CVE-2026-20031: (needs triaging) A vulnerability in the HTML Cascading Style Sheets (CSS) module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when splitting UTF-8 strings. An attacker could exploit this vulnerability by submitting a crafted HTML file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the scanning process.
CVE-2026-20213: (needs triaging) A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PE content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20214: (needs triaging) A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains portable executable content compressed with FSG to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20215: (needs triaging) A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains 7z content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20216: (needs triaging) A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to terminate the ClamAV scanning process and temporarily consume available system resources, resulting in a DoS condition on the affected software.
CVE-2026-20217: (needs triaging) A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20243: (needs triaging) A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in ALZ files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a crafted file that contains ALZ content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
CVE-2026-20244: (needs triaging) A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker could exploit this vulnerability by submitting a crafted file that contains DMG content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-02-16 Last update: 2026-07-12 01:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2024-06-06 Last update: 2026-06-29 10:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-07-12 00:20

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for clamav (1.4.4+dfsg-1 to 1.4.5+dfsg-3): Waiting for test results or another package, or too young (no action required now - check later)
- Issues preventing migration:
- ∙ ∙ Too young, only 1 of 2 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/c/clamav.html
- ∙ ∙ Autopkgtest for clamav/1.4.5+dfsg-3: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Autopkgtest for cyrus-imapd/3.12.2-1: amd64: Pass, arm64: Test triggered (failure will be ignored), armhf: Failed (not a regression) ♻ (reference ♻), i386: Failed (not a regression) ♻ (reference ♻), loong64: Pass, ppc64el: Pass, riscv64: Pass, s390x: Pass
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ Required age reduced by 3 days because of autopkgtest
- Not considered

news

[rss feed]

[2026-07-11] Accepted clamav 1.4.5+dfsg-3 (source) into unstable (Sebastian Andrzej Siewior)
[2026-07-04] Accepted clamav 1.4.5+dfsg-2 (source) into unstable (Sebastian Andrzej Siewior)
[2026-07-03] Accepted clamav 1.4.5+dfsg-1 (source) into unstable (Sebastian Andrzej Siewior)
[2026-06-28] Accepted clamav 1.4.4+dfsg-2 (source) into unstable (Sebastian Andrzej Siewior)
[2026-04-15] clamav 1.4.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-04-12] Accepted clamav 1.4.4+dfsg-1 (source) into unstable (Sebastian Andrzej Siewior)
[2026-01-30] Accepted clamav 1.4.3+dfsg-1~deb11u1 (source all amd64) into oldoldstable-security (Debian FTP Masters) (signed by: Emilio Pozuelo Monfort)
[2026-01-07] Accepted clamav 1.4.3+dfsg-1~deb12u2 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Sebastian Andrzej Siewior)
[2026-01-01] Accepted clamav 1.4.3+dfsg-1~deb12u1 (source all amd64) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Sebastian Andrzej Siewior)
[2025-12-22] clamav 1.4.3+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-12-20] Accepted clamav 1.4.3+dfsg-2 (source) into unstable (Sebastian Andrzej Siewior)
[2025-09-03] Accepted clamav 1.0.9+dfsg-1~deb11u1 (source) into oldoldstable-security (Lucas Kanashiro)
[2025-07-07] clamav 1.4.3+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-07-05] Accepted clamav 1.0.9+dfsg-1~deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Sebastian Andrzej Siewior)
[2025-06-29] Accepted clamav 1.4.3+dfsg-1 (source) into unstable (Sebastian Andrzej Siewior)
[2025-02-10] clamav 1.4.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-02-06] Accepted clamav 1.4.2+dfsg-1 (source) into unstable (Sebastian Andrzej Siewior)
[2024-12-06] Accepted clamav 1.0.7+dfsg-1~deb11u2 (source) into oldstable-security (Lucas Kanashiro)
[2024-12-05] Accepted clamav 1.0.7+dfsg-1~deb11u1 (source all amd64) into oldstable-security (Debian FTP Masters) (signed by: Lucas Kanashiro)
[2024-10-11] Accepted clamav 1.0.7+dfsg-1~deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Sebastian Andrzej Siewior)
[2024-10-05] clamav 1.4.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-10-03] Accepted clamav 1.4.1+dfsg-1 (source) into unstable (Sebastian Andrzej Siewior)
[2024-08-30] clamav 1.3.1+dfsg-5 MIGRATED to testing (Debian testing watch)
[2024-08-27] Accepted clamav 1.3.1+dfsg-5 (source) into unstable (Sebastian Andrzej Siewior)
[2024-07-01] clamav 1.3.1+dfsg-4 MIGRATED to testing (Debian testing watch)
[2024-06-28] Accepted clamav 1.3.1+dfsg-4 (source) into unstable (Sebastian Andrzej Siewior)
[2024-06-07] clamav 1.3.1+dfsg-3 MIGRATED to testing (Debian testing watch)
[2024-06-04] Accepted clamav 1.3.1+dfsg-3 (source) into unstable (Sebastian Andrzej Siewior)
[2024-05-30] Accepted clamav 1.3.1+dfsg-2 (source all amd64) into experimental (Debian FTP Masters) (signed by: Sebastian Andrzej Siewior)
[2024-05-07] clamav 1.0.6+dfsg-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 54
RC: 0
I&N: 42
M&W: 12
F&P: 0
patch: 4

links

homepage
lintian (0, 31)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (90, -)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.4+dfsg-0ubuntu0.26.04.1
patches for 1.4.4+dfsg-0ubuntu0.26.04.1