clamav (1.5.3+dfsg-0ubuntu0.22.04.3) jammy; urgency=medium

  [ Bryan Fraschetti ]
  * Modify the socket generator to support concurrent LocalSocket and
    TCPSocket ListenStreams and add the ability to configure LocalSocketMode
    and LocalSocketGroup options within the generator.
    - d/clamav-daemon-socket-generator

  [ Ioanna Alifieraki ]
  * Add a socket generator for clamav-daemon that independently supports TCP
    and LocalSocket ListenStreams to resolve an issue where using
    dpkg-reconfigure to configure the clamav-daemon had no effect and did not
    create the expected socket (LP: #2129160).
    - d/clamav-daemon-socket-generator
    - d/clamav-daemon.install

 -- Bryan Fraschetti <bryan.fraschetti@canonical.com>  Mon, 13 Jul 2026 16:40:37 -0400

clamav (1.5.3+dfsg-0ubuntu0.22.04.2) jammy-security; urgency=medium

  * Update to 1.5.3 to fix security issues and FIPS compatibility
    - debian/watch: switch to 1.5.*.
    - upstream/signing-key.asc: updated.
    - debian/rules: bump CL_FLEVEL to 233.
    - debian/libclamav12.symbols: updated symbols to new version.
    - debian/*postinst.in: added new options.
    - debian/libclamav12.install: bump so versions.
    - debian/clamav-freshclam.*: added new /etc/clamav/certs directory.
    - debian/usr.bin.freshclam, debian/usr.sbin.clamd: add
      /etc/clamav/certs to profile.
    - CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
      CVE-2026-20217, CVE-2026-20243, CVE-2026-20244
  * Fix FTBFS on armhf caused by 32-bit time_t and 2224 expiration test cert
    - debian/patches/fix_mktime.patch: don't use mktime() on 32-bit time_t
      platforms in libclamav/asn1.c.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 03 Jul 2026 10:21:30 -0400

clamav (1.4.4+dfsg-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * Updated to version 1.4.4 to fix security issue.
    - debian/rules: bump CL_FLEVEL to 214, set DH_ALWAYS_EXCLUDE = *.orig.
    - debian/libclamav12.symbols: updated symbols to new version.
    - debian/control, debian/rules: build with rustc 1.91.
    - CVE-2026-20031

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 14 Apr 2026 06:02:01 -0400

clamav (1.4.3+dfsg-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * Rebuild as security update for Ubuntu 22.04 LTS.
    - debian/control: remove BD on dpkg-dev and systemd-dev
    - CVE-2025-20234
    - CVE-2025-20260

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 25 Jun 2025 13:10:29 -0400

clamav (1.4.3+dfsg-0ubuntu1) questing; urgency=medium

  * Updated to version 1.4.3 to fix security issue.
    - debian/rules: bump CL_FLEVEL to 213.
    - debian/libclamav12.symbols: updated CLAMAV_PRIVATE and
      cl_retflevel symbols to new version.
    - CVE-2025-20234
    - CVE-2025-20260

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 25 Jun 2025 12:39:40 -0400

clamav (1.4.2+dfsg-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - clamav-base.postinst.in: Quell warning from check for clamav user
      (LP #1920217).
    - d/rules: use RelWithDebInfo profile as the Rust CMake scripts can not
      recognize the "None" type specified by dh-cmake.
      (LP #2071663)
    - Extend ifupdown script to support networkd-dispatcher.
      + d/clamav-freshclam-ifupdown: Modernize some parts of
        the script.  Implement support for networkd-dispatcher.
      + d/clamav-freshclam.links: Install the
        clamav-freshclam-ifupdown script inside the proper
        /usr/lib/networkd-dispatcher/{off,routable}.d/
        directories. (LP #1718227)
    - debian/po: update translations
  * Dropped:
    - Updated to version 1.4.2 to fix security issue.
      + debian/rules: bump CL_FLEVEL to 212.
      + debian/libclamav12.symbols: updated CLAMAV_PRIVATE and
        cl_retflevel symbols to new version.
      + CVE-2025-20128
      [Debian now carries 1.4.2]

 -- Bryce Harrington <bryce@canonical.com>  Fri, 13 Jun 2025 01:02:43 -0700

clamav (1.4.2+dfsg-1) unstable; urgency=medium

  * Import 1.4.2 (Closes: #1093880)
    - CVE-2025-20128 (buffer overflow read bug in the OLE2 file parser).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Thu, 06 Feb 2025 21:56:48 +0100

clamav (1.4.2+dfsg-0ubuntu2) questing; urgency=medium

  * No-change rebuild for libxml2 soname change.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 20 May 2025 12:23:37 +0200

clamav (1.4.2+dfsg-0ubuntu1) plucky; urgency=medium

  * Updated to version 1.4.2 to fix security issue.
    - debian/rules: bump CL_FLEVEL to 212.
    - debian/libclamav12.symbols: updated CLAMAV_PRIVATE and
      cl_retflevel symbols to new version.
    - CVE-2025-20128

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Jan 2025 12:58:42 -0500

clamav (1.4.1+dfsg-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085222). Remaining changes:
    - clamav-base.postinst.in: Quell warning from check for clamav user
      (LP #1920217).
    - d/rules: use RelWithDebInfo profile as the Rust CMake scripts can not
      recognize the "None" type specified by dh-cmake.
      (LP #2071663)
    - Extend ifupdown script to support networkd-dispatcher.
      + d/clamav-freshclam-ifupdown: Modernize some parts of
        the script.  Implement support for networkd-dispatcher.
      + d/clamav-freshclam.links: Install the
        clamav-freshclam-ifupdown script inside the proper
        /usr/lib/networkd-dispatcher/{off,routable}.d/
        directories. (LP #1718227)
    - debian/po: update translations
  * Dropped:
    - SECURITY UPDATE: out of bounds read in PDF parser
      + debian/patches/CVE-2024-20505.patch: add more checks to
        libclamav/pdf.c, libclamav/pdfng.c.
      + CVE-2024-20505
      [Included in Debian 1.4.1+dfsg-1]
    - SECURITY UPDATE: file overwrite via log file symlinks
      + debian/patches/CVE-2024-20506.patch: disable following symlinks when
        opening log files in common/output.c.
      + CVE-2024-20506
      [Included in Debian 1.4.1+dfsg-1]
    - d/patches: add a patch to make the build system respect the rustflags
      (LP #2071663).
      [Taken upstream in 1.4.0]
    - d/rules, d/s/include-binaries,
      d/p/Fix-unit-test-caused-by-expiring-signing-certificate.patch:
      Fix signing of "text.exe" with expired certs.
      (LP #2078478)
      [Already present in Debian 1.3.1+dfsg-5]

 -- Bryce Harrington <bryce@canonical.com>  Thu, 16 Jan 2025 16:27:52 -0800

# For older changelog entries, run 'apt-get changelog clamav-base'
