This is a minor update to the gradm package. It includes updates to support the HTTP Anti Virus Proxy (HAVP). The HAVP project is intended for border use environments as a method of implementing a centralized clamav anti-virus scanner for desktop systems.

This is a minor update to the ASL httpd daemon package. While it does include security fixes, none of these issues apply to the manner in which ASL Web is designed. They were updated purely to maintain parity with the upstream source. And also because we're awesome like that.

Changelog:

- mod_ssl: improved fix for SSLRequire's OID() function (#625452)
- add security fixes for CVE-2010-1452, CVE-2010-2791 (#623210)
- mod_deflate: rebase to 2.2.15 (#625435)
- stop multiple invocations of filter init functions (#625451)

To upgrade:

yum upgrade asl-httpd

This is a major firewall management update for ASL, incorporating an extensive set of features in the later linux kernels. It maintains full backwards compatibility with existing configurations.

Changelog

- added default values for IPTABLES_STATUS_VERBOSE and
IPTABLES_STATUS_LINENUMBERS in init script
- added missing lsb keywords Required-Start and Required-Stop to init script
- support for all new features of 2.6.33 (rhbz#570767)
- libip4tc: Add static qualifier to dump_entry()
- libipq: build as shared library
- recent: reorder cases in code (cosmetic cleanup)
- several man page and documentation fixes
- policy: fix error message showing wrong option
- includes: header updates
- Lift restrictions on interface names
- fixed license and moved iptables-xml into base package according to review
- moved libip*tc and libxtables libs to /lib[64], added symlinks for .so libs
to /usr/lib[64] for compatibility (rhbz#558796)
-  support for all new features of 2.6.32
- several man page fixes
- Support for nommu arches
- realm: remove static initializations
- libiptc: remove unused functions
- libiptc: avoid strict-aliasing warnings
- iprange: do accept non-ranges for xt_iprange v1
- iprange: warn on reverse range
- iprange: roll address parsing into a loop
- iprange: do accept non-ranges for xt_iprange v1 (log)
- iprange: warn on reverse range (log)
- libiptc: fix wrong maptype of base chain counters on restore
- iptables: fix undersized deletion mask creation
- style: reduce indent in xtables_check_inverse
- libxtables: hand argv to xtables_check_inverse
- iptables/extensions: make bundled options work again
- CONNMARK: print mark rules with mask 0xffffffff as set instead of xset
- iptables: take masks into consideration for replace command
- doc: explain experienced --hitcount limit
- doc: name resolution clarification
- iptables: expose option to zero packet/byte counters for a specific rule
- build: restore --disable-ipv6 functionality on system w/o v6 headers
- MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmark
- DNAT: fix incorrect check during parsing
- extensions: add osf extension
- conntrack: fix --expires parsing

- dropped nf_ext_init remains from cloexec patch
- support for all new features of 2.6.31
- libxt_NFQUEUE: add new v1 version with queue-balance option
- xt_conntrack: revision 2 for enlarged state_mask member
- libxt_helper: fix invalid passed option to check_inverse
- libiptc: split v4 and v6
- extensions: collapse registration structures
- iptables: allow for parse-less extensions
- iptables: allow for help-less extensions
- extensions: remove empty help and parse functions
- xtables: add multi-registration functions
- extensions: collapse data variables to use multi-reg calls
- xtables: warn of missing version identifier in extensions
- multi binary: allow subcommand via argv[1]
- iptables: accept multiple IP address specifications for -s, -d
- several build fixes
- several man page fixes
- fixed two leaked file descriptors on sockets (rhbz#521397)
- support for all new features of 2.6.30
- several man page fixes
- iptables: replace open-coded sizeof by ARRAY_SIZE
- libip6t_policy: remove redundant functions
- policy: use direct xt_policy_info instead of ipt/ip6t
- policy: merge ipv6 and ipv4 variant
- extensions: add `cluster' match support
- extensions: add const qualifiers in print/save functions
- extensions: use NFPROTO_UNSPEC for .family field
- extensions: remove redundant casts
- iptables: close open file descriptors
- fix segfault if incorrect protocol name is used
- replace open-coded sizeof by ARRAY_SIZE
- do not include v4-only modules in ip6tables manpage
- use direct xt_policy_info instead of ipt/ip6t
- xtables: fix segfault if incorrect protocol name is used
- libxt_connlimit: initialize v6_mask
- SNAT/DNAT: add support for persistent multi-range NAT mappings

- also install iptables/internal.h, needed for iptables.h and ip6tables.h
- libiptc is now shared
- dropped typo_latter patch

To upgrade:

yum upgrade iptables

Unforunately the changelog for clamav is only distributed as the SVN log. Please note that the format for the clamav signatures has changed, 3rd party sources may need to be removed if clamd will not start after an upgrade.

Changelog:
Thu Aug 12 18:49:37 CEST 2010 (tk)
----------------------------------
* V 0.96.2

Thu Aug 12 13:18:24 CEST 2010 (tk)
----------------------------------
* contrib: add safe_clamd from Luca (bb#2026)

Wed Aug 11 13:39:11 EEST 2010 (edwin)
-------------------------------------
* freshclam: uses private symbol which changed proto, change name to prevent crash (bb #2187)

Tue Aug 10 14:01:27 CEST 2010 (tk)
----------------------------------
* clamdscan: fix parsing of virus names in extended mode and --stream (bb#2184)

Mon Aug 9 19:46:58 EEST 2010 (edwin)
-------------------------------------
* libclamav/c++/detect.cpp: Mac OS X can run 64-bit apps on 32-bit kernel (bb #2153).

Mon Aug 9 16:49:44 CEST 2010 (tk)
----------------------------------
* libclamav/others.h: bump f-level

Mon Aug 9 13:21:31 CEST 2010 (tk)
----------------------------------
* sigtool/sigtool.c: fix handling of --datadir (bb#2180)

Mon Aug 9 13:02:26 CEST 2010 (tk)
----------------------------------
* libclamav/matcher-ac.c: improve offset handling (bb#2170)

Sun Aug 8 15:59:41 CEST 2010 (acab)
------------------------------------
* libclamav/7z/Archive/7z/7zDecode.c: shut up a warning (bb#2172)

Fri Aug 6 13:47:18 CEST 2010 (acab)
------------------------------------
* libclamav/autoit.c: properly resume from empty files
regression introduced in ac867aad (bb#2171)

Fri Aug 6 11:37:14 CEST 2010 (tk)
----------------------------------
* libclamav/elf.c: fix zero mem alloc warning (bb#2173)

Thu Aug 5 11:58:56 CEST 2010 (acab)
------------------------------------
* win32: fix libclamav's triple and fix GetVersion (bb#2152 and bb#2153)

Mon Aug 2 23:05:50 EEST 2010 (edwin)
-------------------------------------
* libclamav/bytecode.c: save lsig counts/offsets (bb #2055).

Mon Aug 2 21:51:32 EEST 2010 (edwin)
-------------------------------------
* libclamav/{bytecode,matcher}.c: matchicon API (bb #2139)

Mon Aug 2 17:16:24 CEST 2010 (acab)
------------------------------------
* libclamav/pe_icons.c: BE fixes (bb#2151)

Mon Aug 2 16:08:04 CEST 2010 (tk)
----------------------------------
* freshclam/manager.c: don't call cli_bytecode_prepare() when Bytecode is
disabled in freshclam.conf (bb#2149)

Mon Aug 2 15:37:19 CEST 2010 (tk)
----------------------------------
* libclamav/matcher: make icon sigs work with bytecode (bb#2137)

Fri Jul 30 17:46:14 CEST 2010 (acab)
------------------------------------
* libclamav/others.h: bump CLI_MAX_ALLOCATION by 5 MB (needed by lzma - bb#2124)

Fri Jul 30 15:51:06 CEST 2010 (acab)
------------------------------------
* libclamav, unit_tests: use cached PE metadata when matching icons (better fix for
bb#2064, partially reverts d932a6d)
add some unit tests for ign2, ldb, idb

Fri Jul 30 15:15:35 CEST 2010 (tk)
----------------------------------
* freshclam: fix parsing of extended log entries

Fri Jul 30 14:20:50 EEST 2010 (edwin)
-------------------------------------
* libclamav/pdf.c: improve extraction of PDF objects (bb #1596, #1994, #2029).

Thu Jul 29 16:56:00 CEST 2010 (acab)
------------------------------------
* libclamav/matcher.c: make cli_lsig_eval use cached executable metadata rather
than parsing the file again

Thu Jul 29 14:07:31 EEST 2010 (edwin)
-------------------------------------
* libclamav: introduce BC_STARTUP bytecode that can turn off JIT (bb #2078, #2101)

Thu Jul 29 03:54:45 CEST 2010 (acab)
------------------------------------
* libclamav/scanners.c: use fmap in scan_embpe

Thu Jul 29 02:40:16 CEST 2010 (acab)
------------------------------------
* libclamav: use fmap in autoit

Tue Jul 27 14:16:59 CEST 2010 (acab)
------------------------------------
* clamav-milter: noisily fallback on default value if MaxFileSize is set
to 0 (bb#2081)

Mon Jul 26 13:16:07 EEST 2010 (edwin)
-------------------------------------
* libclamav/phishcheck.c: don't phishcheck email addresses (bb #2067)

Mon Jul 26 12:55:20 EEST 2010 (edwin)
------------------------------------
* clamd/session.c: treat MULTISCAN as CONTSCAN on non-directories (bb #1869).

Sat Jul 24 17:43:16 CEST 2010 (acab)
------------------------------------
* win32: upgrade project files to vs10

Fri Jul 23 22:32:18 EEST 2010 (edwin)
-------------------------------------
* libclamav/bytecode_vm.c: fix use of uninitialized value (bb #2140).

Thu Jul 22 22:32:08 EEST 2010 (edwin)
-------------------------------------
* libclamav/c++/bytecode2llvm.cpp: detect PaX and fallback to intepreter if
needed (bb #2092).
* libclamav/bytecode.c: selfcheck on startup (bb #2092).

Thu Jul 22 16:36:32 CEST 2010 (tk)
----------------------------------
* libclamav/mspack.c: fix write error

Wed Jul 21 18:54:13 CEST 2010 (tk)
----------------------------------
* sigtool/sigtool.c: fix build problem (bb#2133)

Mon Jul 19 18:48:08 CEST 2010 (tk)
----------------------------------
* sigtool/sigtool.c: add support for creating cdiffs with arbitrary
long lines (bb#2014)

Fri Jul 16 11:11:27 CEST 2010 (tk)
----------------------------------
* freshclam: remove empty temporary directories on EXIT_n (bb#2116)

Mon Jul 12 12:27:44 CEST 2010 (tk)
----------------------------------
* libclamunrar/unrar.c: fix error path memory leaks (bb#2100)
Thanks to Martin Olsen

Tue Jul 6 19:19:39 CEST 2010 (tk)
----------------------------------
* clamd: add ExtendedDetectionInfo (bb#1228, #1626)

Mon Jul 5 17:30:11 CEST 2010 (tk)
----------------------------------
* libclamav: fix some error messages (bb#2083)

Thu Jul 1 18:22:58 CEST 2010 (tk)
----------------------------------
* libclamav/matcher.c: fix counting of logical subsigs matched at boundaries (bb#2053)

Tue Jun 29 13:51:06 CEST 2010 (tk)
----------------------------------
* freshclam: fix memleak when testing safebrowsing.cvd (bb#2091)

Tue Jun 29 12:08:42 EEST 2010 (edwin)
-------------------------------------
* libclamav/mpool.c: reduce memory waste due to alignment (~14% improvement).

Tue Jun 29 12:05:59 EEST 2010 (edwin)
-------------------------------------
* clamdtop/clamdtop.c: fix display of sizes (off by 1000/1024).

Mon Jun 28 18:42:48 CEST 2010 (tk)
----------------------------------
* sigtool/sigtool.c: drop compatibility limit

Thu Jun 24 20:04:02 CEST 2010 (tk)
----------------------------------
* libclamav: reduce memory usage for MD5 sigs (bb#2057)

Wed Jun 23 09:39:14 CEST 2010 (tk)
----------------------------------
* libclamav/matcher.c: fix possible use of uninit value (bb#2084)

Mon Jun 21 20:07:09 CEST 2010 (tk)
----------------------------------
* libclamav: report correct offset via cli_ac_result (bb#2076)

Fri Jun 18 15:41:08 CEST 2010 (tk)
----------------------------------
* libclamav: minimize header parsing (bb#2065)

Thu Jun 17 17:11:04 EEST 2010 (edwin)
-------------------------------------
* libclamav/c++/llvm: apply PowerPC workaround from LLVM PR5201.

Wed Jun 16 16:52:46 CEST 2010 (tk)
----------------------------------
* libclamav/special.c: avoid false MS02-002 detections for corrupted files (bb#2074)

Tue Jun 15 18:07:00 CEST 2010 (tk)
----------------------------------
* libclamav: avoid scanpe() warnings for corrupted files (bb#2049)

Tue Jun 15 16:13:07 CEST 2010 (tk)
----------------------------------
* clamd/clamd.c: be more verbose when daemonize() fails (bb#2062)

Thu Jun 10 19:58:01 CEST 2010 (acab)
------------------------------------
* libclamav/pe*: fix virusnames being hijacked by idb sigs (bb#2064)

Thu Jun 10 16:06:56 CEST 2010 (tk)
----------------------------------
* libclamav/str.c: fix cli_isnumber() (bb#2070)

Thu Jun 10 12:15:17 CEST 2010 (tk)
----------------------------------
* sigtool: print match count and offsets in --test-sigs mode (bb#2054)
IMPORTANT NOTE: --test-sigs now only works against the final target file
(after all processing, normalization, etc. for which the tested
signature was directly created)

Wed Jun 9 13:38:11 EEST 2010 (edwin)
-------------------------------------
* libclamav/{matcher-bm.c, sha256.c}: improve DB load time (bb #1860).

Tue Jun 8 16:32:47 CEST 2010 (tk)
----------------------------------
* sigtool/sigtool.c: add --datadir (bb#2063)

Tue Jun 8 12:47:25 CEST 2010 (tk)
----------------------------------
* shared/cdiff.c: fix handling of massive XCHGs (bb#2017)

Fri Jun 4 18:04:37 CEST 2010 (tk)
----------------------------------
* libclamav/cvd.c: load daily.ign[2] files from CVDs (bb#2061)

Wed Jun 2 10:08:00 EEST 2010 (edwin)
-------------------------------------
* libclamav/others_common.c: fix typo (bb #2060).

Mon May 31 16:57:31 EEST 2010 (edwin)
-------------------------------------
* libclamav/{bytecode.c, others_common.c}: don't attempt to allocate 0 bytes (bb #2042).

Mon May 31 13:18:45 EEST 2010 (edwin)
-------------------------------------
* libclamav/readdb.c: fix memory leak in .idb handling

Fri May 28 18:45:46 EEST 2010 (edwin)
-------------------------------------
* clamd, libclamav: fix some error path leaks (bb #1990)

Fri May 28 13:24:21 CEST 2010 (tk)
----------------------------------
* freshclam/manager.c: randomize getaddrinfo()'s results (bb#2021)

Tue May 25 14:36:41 CEST 2010 (tk)
----------------------------------
* clamscan: add support for loading multiple dbs at command line with
-d (bb#2033)

To Upgrade:
yum upgrade clamav