Security update ClamAV 1.4.6

[Larsen]

Version 1.4.6 of ClamAV has been released:
https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html

Currently, PMG is running 1.4.4.

# dpkg -l clamav | grep ii
ii  clamav         1.4.4+dfsg-1~deb13u1+pmg1 amd64        anti-virus utility for Unix - command-line interface

Is an update planned for PMG?

 

[longer]

ClamAV updates automatically via the clamav-freshclam.service, which run continuously in the background.

Check:
~# systemctl status clamav-freshclam



PMG uses clamav from debian upstream - once they have an updated version - you will get it via regular update:

Post in thread 'ClamAV update problem'

May 3, 2019

WARNING: Your ClamAV installation is OUTDATED! WARNING: Local version: 0.100.3 Recommended version: 0.101.2 DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav

These messages occur every now and then with clamav (since it fetches its signatures from the internet it knows which the current upstream version is) - usually distributions need some time until they get the updated version into the respective repositories - see [0] for the last iteration of this issue in debian. Usually this is not a serious problem since the signatures are updated nonetheless...

• Stoiko Ivanov

• 

 

[Larsen]

clamav-freshclam only updates the dabases, not the program itself, and the package seems to be modified by Proxmox, hence the "+pmg1".
Also, https://packages.debian.org/trixie/clamav names 1.4.3+dfsg-1 as the version for trixie.

 

[longer]

You are right,

I just checked the Debian package tracker and version 1.4.6 is indeed flagged as "A new upstream version is available... consider packaging it.":
https://tracker.debian.org/pkg/clamav

Seems the Debian maintainers haven't compiled it into the distribution streams yet. as PMG uses clamav from debian upstream , once they have an updated version it should be avalible via regular update: