Security update ClamAV 1.4.6

[Larsen]

Version 1.4.6 of ClamAV has been released:
https://blog.clamav.net/2026/08/clamav-154-and-146-security-patch.html

Currently, PMG is running 1.4.4.

# dpkg -l clamav | grep ii
ii  clamav         1.4.4+dfsg-1~deb13u1+pmg1 amd64        anti-virus utility for Unix - command-line interface

Is an update planned for PMG?

 

[longer]

ClamAV updates automatically via the clamav-freshclam.service, which run continuously in the background.

Check:
~# systemctl status clamav-freshclam



PMG uses clamav from debian upstream - once they have an updated version - you will get it via regular update:

Post in thread 'ClamAV update problem'

May 3, 2019

WARNING: Your ClamAV installation is OUTDATED! WARNING: Local version: 0.100.3 Recommended version: 0.101.2 DON'T PANIC! Read https://www.clamav.net/documents/upgrading-clamav

These messages occur every now and then with clamav (since it fetches its signatures from the internet it knows which the current upstream version is) - usually distributions need some time until they get the updated version into the respective repositories - see [0] for the last iteration of this issue in debian. Usually this is not a serious problem since the signatures are updated nonetheless...

• Stoiko Ivanov

• 

 

[Larsen]

clamav-freshclam only updates the dabases, not the program itself, and the package seems to be modified by Proxmox, hence the "+pmg1".
Also, https://packages.debian.org/trixie/clamav names 1.4.3+dfsg-1 as the version for trixie.

 

[longer]

You are right,

I just checked the Debian package tracker and version 1.4.6 is indeed flagged as "A new upstream version is available... consider packaging it.":
https://tracker.debian.org/pkg/clamav

Seems the Debian maintainers haven't compiled it into the distribution streams yet. as PMG uses clamav from debian upstream , once they have an updated version it should be avalible via regular update:

 

[Larsen]

Still no update from the Debian maintainers...
@Stoiko Ivanov Is Proxmox going to release a fixed version?

 

[Larsen]

There seems to have been an update as the date has changed in this output, but the version number itself is still the old one.

# clamd --version
ClamAV 1.4.4/28111/Wed Sep  2 08:24:01 2026

Would be nice to get some information if ClamAV on PMG is vulnerable or not...

 

[jtru]

It's rather easy to find that information if you know your way around Debian's infrastructure a bit: https://security-tracker.debian.org/tracker/source-package/clamav

The "No DSA" status means that the package maintainers and/or the Debian security team do not think the CVEs are severe/pressing enough to warrant a security update. I guess you can expect a fix with the next Debian PR. If you think the problem is more urgent, you can always file a Debian bug.

 

[Larsen]

Ok, thanks. Didn't know that.

https://security-tracker.debian.org/tracker/CVE-2026-20337 and https://security-tracker.debian.org/tracker/CVE-2026-20338 are empty. Both are causing a DoS, so I would assume a fix should be important, though.