Bump the version to 1.5.2, the FLEVEL to 232, and update NEWS.md

Author: val-ms

CMakeLists.txt

@@ -22,7 +22,7 @@ string(TIMESTAMP TODAY "%Y%m%d")
 set(VERSION_SUFFIX "")
 
 project( ClamAV
-         VERSION "1.5.1"
+         VERSION "1.5.2"
          DESCRIPTION "ClamAV open source email, web, and end-point anti-virus toolkit." )
 
 set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake" ${CMAKE_MODULE_PATH})

Jenkinsfile

@@ -10,7 +10,7 @@ properties(
         parameters(
             [
                 string(name: 'VERSION',
-                       defaultValue: '1.5.1',
+                       defaultValue: '1.5.2',
                        description: 'ClamAV version string'),
                 string(name: 'FRAMEWORK_BRANCH',
                        defaultValue: '1.5',

NEWS.md

@@ -3,6 +3,38 @@
 Note: This file refers to the official packages. Things described here may
 differ slightly from third-party binary packages.
 
+## 1.5.2
+
+ClamAV 1.5.2 is a patch release with the following fixes:
+
+- [CVE-2026-20031](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20031):
+  Fixed an error handling bug in the HTML file parser that may crash the program
+  and cause a denial-of-service (DoS) condition.
+
+  This issue was introduced in version 1.1.0.
+  The fix is included in 1.5.2 and 1.4.4.
+
+- Fixed a possible infinite loop when scanning some JPEG files by upgrading
+  affected ClamAV dependency, a Rust image library.
+
+  Unfortunately, this change requires a newer Rust compiler for ClamAV.
+  The minimum Rust version for ClamAV 1.4.3 was 1.85.1.
+  The minimum Rust version for ClamAV 1.4.4 is now 1.87.0.
+
+- Fixed a possible crash on Windows when scanning some files while using the
+  `LeaveTemporaryFiles` and `TemporaryDirectory` features.
+
+- The CVD verification process will now ignore certificate files in the CVD
+  certs directory when the user lacks read permissions.
+
+- Freshclam: Fixed CLD verification bug with `PrivateMirror` option.
+
+- Upgraded the Rust `bytes` dependency to a newer version to resolve the
+  RUSTSEC-2026-0007 advisory.
+
+- Fixed a possible crash caused by invalid pointer alignment on some platforms.
+  This fix is courtesy of Hsuan-Ming Chen at Synology PSIRT.
+
 ## 1.5.1
 
 ClamAV 1.5.1 is a patch release with the following fixes:

libclamav/bytecode_api.h

@@ -200,6 +200,7 @@ enum FunctionalityLevels {
 
     FUNC_LEVEL_1_5   = 230, /**< LibClamAV release 1.5.0 */
     FUNC_LEVEL_1_5_1 = 231, /**< LibClamAV release 1.5.1 */
+    FUNC_LEVEL_1_5_2 = 232, /**< LibClamAV release 1.5.2 */
 };
 
 /**

libclamav/others.h

@@ -71,7 +71,7 @@
  * in re-enabling affected modules.
  */
 
-#define CL_FLEVEL 231
+#define CL_FLEVEL 232
 #define CL_FLEVEL_DCONF CL_FLEVEL
 #define CL_FLEVEL_SIGTOOL CL_FLEVEL