After six months of development, Cisco has published the release of the open-source antivirus package ClamAV 1.4.0. The project came under Cisco's ownership in 2013 after acquiring Sourcefire, which developed ClamAV and Snort. The project's code is distributed under the GPLv2 license. The 1.4.0 branch is categorized as normal (not LTS), with updates being published for at least 4 months after the first release of the next branch. The ability to download signature databases for non-LTS branches is also provided for at least another 4 months after the release of the next branch.
Key changes in ClamAV 1.4:
- Added support for scanning the contents of archives in ALZ, LHA, and LZH formats.
- A feature has been added to disable fuzzy hashing of images, which allows for the detection of similar objects with a certain degree of probability to block images used for phishing or distributing malware. To manage image scanning and the use of fuzzy hashing in ClamScan, options ‘—scan-image’ and ‘—scan-image-fuzzy-hash’ have been proposed, which can take values ‘yes’ or ‘no’. In ClamD, the corresponding ScanImage and ScanImageFuzzyHash settings have been added.
- Cross-compilation instructions for the ARM64 (Aarch64) architecture have been added for Linux and Windows.
- Freshclam now includes warnings when blocking or restricting traffic, including Cloudflare Ray ID.
- Unnecessary memory allocation checks have been removed when the size is fixed or calculated from trusted sources.
- An optimization has been implemented to disable file hash calculations if the cache of verified files is disabled.
- The systemd service for starting ClamOnAcc has been improved.
- Build scripts have been enhanced using CMake.
- The generation of ready-made 32-bit packages for Linux has been discontinued (the ability to build for 32-bit systems from source code has been retained).
- Builds for Windows have started being prepared for the ARM64 architecture. Ready ARM64 packages for Linux are not yet provided.
- ClamAV Bytecode Compiler 1.4.0 has been released, now utilizing LLVM 16 and generating multiple files with shared objects instead of a single file for all compilation passes.
Source: opennet.ru
