security/clamav: update to 1.4.6
1.4.6 (2026-08-07)
ClamAV 1.4.6 is a patch release with the following fixes:
- [CVE-2026-20345](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20345):
Fixed an indexing error while converting GPT partition names that could
read or write beyond a stack-allocated partition entry.
This issue affects ClamAV 0.98.2 through 1.5.3.
The fix is included in 1.4.6 and 1.5.4.
Thank you to Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen
of Tencent Xuanwu Lab for identifying this issue.
- [CVE-2026-20339](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20339):
Fixed an integer overflow in the PESpin unpacker that could allocate an
undersized buffer and then write beyond it while rebuilding a PE file.
[62 lines not shown]
wip/ruby18: import ruby18-1.8.7pl374
Ruby is the interpreted scripting language for quick and
easy object-oriented programming. It has many features to
process text files and to do system management tasks (as in
Perl). It is simple, straight-forward, and extensible.
This package tracks 1.8 release branch.
nvmm(4): Fix race in clearing vcpu->comm->stop bit.
Don't touch vcpu after nvmm_vcpu_put when we no longer hold the lock,
and certainly not after nvmm_machine_put when the vcpu could even be
freed.
PR kern/60544: nvmm_vcpu_run: use after mutex release
nvmm(4) vmx: Don't read VMCS_EXIT_REASON if vmlaunch/vmresume failed.
It is not valid in that case; we might end up operating on the
_previous_ successful vmlaunch/vmresume's now-stale exit reason.
kern/60545: nvmm_x86_vmx: stale exit reason on launch/resume failure
proc_regio: Clarify control flow and sprinkle comments.
Use `if (error) goto out' instead of `if (error == 0) error = ...' to
make the error case non-linear and indented, and the success case a
straight line of logic.
No functional change intended.
PR port-amd64/60556: panic in process_read_fpregs_xmm