HyperTask packages https://issues.hyperbola.info/ 2020-05-08T10:10:54Z FS#1515: [keybase] Complete removal of tool 2020-05-08T10:10:54Z 2020-05-08T10:10:54Z

There is only the source code of the client available and since years nothing more happened. With keybase joining “Zoom” nothing more seems to happen. Look also here in the forum: https://forums.hyperbola.info/viewtopic.php?id=368

Tobias Dausend https://issues.hyperbola.info/:1515
FS#1514: [gtk-2] Severe problems with GTK2-applications 2020-04-21T23:53:33Z 2020-04-21T23:53:33Z

Description: Since the migration to xenocara there seems to be a bug with applications using GTK-2. From time to time there are crashes with assertion `!xcb_xlib_threads_sequence_lost’.

Looking into this a little bit more deep there are also other distributions affected and this is an upstream-bug. But the concrete situation is not that easy, while it could be also part of the library libX11 itself. Looking therefore here: https://bugs.launchpad.net/ubuntu/+source/pcmanfm/+bug/1782984

Affected are for example LXDE in general, icedove, iceweasel and many more!

Tobias Dausend https://issues.hyperbola.info/:1514
FS#1513: [git] Multiple CVEs 2020-04-16T07:07:23Z 2020-04-16T07:07:23Z

CVE-2020-5260 has been fixed very recently in Debian, so I thought I would apply this patch. However, I found out that security patches have not been applied for quite a while (I could account for at least 6 CVEs).

Considering that the version in Debian stretch (2.11.0) is the nearest version with security patches released by Debian and that git project oldest supported version is 2.17, I have used patches from Debian stretch to apply on 2.12.2 currently in Milky Way.

But I have the following error on check():

 |  *** prove ***
 |
 |  Test Summary Report
 |  -------------------
 |  t5570-git-daemon.sh                              (Wstat: 256 Tests: 20 Failed: 10)
 |    Failed tests:  3-7, 15-19
 |    Non-zero exit status: 1
 |  t5811-proto-disable-git.sh                       (Wstat: 256 Tests: 26 Failed: 16)
 |    Failed tests:  2-6, 9-11, 15-19, 21-23
 |    Non-zero exit status: 1
 |  Files=769, Tests=14137, 1101 wallclock secs ( 8.08 usr  1.12 sys + 144.48 cusr 63.42 csys = 217.10 CPU)
 |  Result: FAIL
 |  make[1]: *** [Makefile:45: prove] Error 1
 |  make[1]: Leaving directory '/build/git/src/git-2.12.2/t'
 |  make: *** [Makefile:2291: test] Error 2
 |  ==> ERROR: A failure occurred in check().
 |      Aborting...

This does not seem to be related to my change as the current version in Milky Way produces the same error (IOW the package currently in Milky Way is not rebuidable).

Arnaud Fontaine https://issues.hyperbola.info/:1513
FS#1512: [ispell] require FHS 2020-03-19T20:38:34Z 2020-03-17T20:58:01Z

Description:

cant open /usr/local/lib/english.hash

Additional info:

Repository      : extra
Name            : ispell
Version         : 3.3.02-7
Description     : An interactive spell-checking program for Unix
Architecture    : x86_64
URL             : http://ficus-www.cs.ucla.edu/geoff/ispell.html
Licenses        : BSD
Groups          : None
Provides        : None
Depends On      : ncurses
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 321.26 KiB
Installed Size  : 1336.00 KiB
Packager        : Evangelos Foutras <evangelos@foutrelis.com>
Build Date      : Sun Sep 6 12:07:06 2015
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

- Install package

Irene Yacila https://issues.hyperbola.info/:1512
FS#1511: [chdkptp] please add package to repos 2020-03-16T14:27:32Z 2020-03-16T14:27:32Z

CHDKPTP is part of CHDK project - a free software firmware add-on for Canon cameras. It enables controlling Canon cameras via the computer.

Attached is a modified iup PKGBUILD (Lua 5.3 build was removed as it failed to compile) and configuration files for chdkptp.

Code is available via svn:

$ svn co http://subversion.assembla.com/svn/chdkptp/trunk chdkptp

Copy chdkptp.sh and config.mk files to source tree then compile via make. Requires root privileges to connect to a camera.

Alon Ivtsan https://issues.hyperbola.info/:1511
FS#1510: [chdkptp] please add package to control Canon cameras 2020-03-16T14:25:55Z 2020-03-16T14:25:55Z

CHDKPTP is part of CHDK project - a free software firmware add-on for Canon cameras. It enables controlling Canon cameras via the computer.

Attached is a modified iup PKGBUILD (Lua 5.3 build was removed as it failed to compile) and configuration files for chdkptp.

Code is available via svn:

$ svn co http://subversion.assembla.com/svn/chdkptp/trunk chdkptp

Copy chdkptp.sh and config.mk files to source tree then compile via make. chdkptp requires root privileges to connect to a camera.

Alon Ivtsan https://issues.hyperbola.info/:1510
FS#1508: [opensmtpd] CVE-2020-8794 2020-02-25T13:58:18Z 2020-02-25T13:58:18Z

Description: https://www.openwall.com/lists/oss-security/2020/02/24/5 https://www.bleepingcomputer.com/news/security/new-critical-rce-bug-in-openbsd-smtp-server-threatens-linux-distros/

Qualys Security Advisory

LPE and RCE in OpenSMTPD’s default install (CVE-2020-8794)

Contents

Summary
Analysis
...
Acknowledgments

Summary

We discovered a vulnerability in OpenSMTPD, OpenBSD’s mail server. This
vulnerability, an out-of-bounds read introduced in December 2015 (commit
80c6a60c, “when peer outputs a multi-line response ...”), is exploitable
remotely and leads to the execution of arbitrary shell commands: either
as root, after May 2018 (commit a8e22235, “switch smtpd to new
grammar”); or as any non-root user, before May 2018.

Because this vulnerability resides in OpenSMTPD’s client-side code
(which delivers mail to remote SMTP servers), we must consider two
different scenarios:

- Client-side exploitation: This vulnerability is remotely exploitable

in OpenSMTPD's (and hence OpenBSD's) default configuration. Although
OpenSMTPD listens on localhost only, by default, it does accept mail
from local users and delivers it to remote servers. If such a remote
server is controlled by an attacker (either because it is malicious or
compromised, or because of a man-in-the-middle, DNS, or BGP attack --
SMTP is not TLS-encrypted by default), then the attacker can execute
arbitrary shell commands on the vulnerable OpenSMTPD installation.

- Server-side exploitation: First, the attacker must connect to the

OpenSMTPD server (which accepts external mail) and send a mail that
creates a bounce. Next, when OpenSMTPD connects back to their mail
server to deliver this bounce, the attacker can exploit OpenSMTPD's
client-side vulnerability. Last, for their shell commands to be
executed, the attacker must (to the best of our knowledge) crash
OpenSMTPD and wait until it is restarted (either manually by an
administrator, or automatically by a system update or reboot).

We developed a simple exploit for this vulnerability and successfully
tested it against OpenBSD 6.6 (the current release), OpenBSD 5.9 (the
first vulnerable release), Debian 10 (stable), Debian 11 (testing), and
Fedora 31.

The fix is delivered in OpenSMTPD 6.6.4p1, available here, which the developer recommends installing “AS SOON AS POSSIBLE.”

bugmen0t https://issues.hyperbola.info/:1508
FS#1507: [gstreamer] needed rebuild 2020-02-28T02:48:39Z 2020-02-14T17:37:16Z

(gst-plugin-scanner:17336): GStreamer-WARNING : Failed to load plugin ‘/usr/lib/gstreamer-1.0/libgstzbar.so’: libzbar.so.0: cannot open shared object file: No such file or directory
(gst-plugin-scanner:17336): GStreamer-WARNING
: Failed to load plugin ‘/usr/lib/gstreamer-1.0/libgstfluidsynthmidi.so’: libfluidsynth.so.1: cannot open shared object file: No such file or directory

Repositorio : extra
Nombre : gstreamer
Versión : 1.12.0-1
Descripción : GStreamer open-source multimedia framework core library
Arquitectura : x86_64
URL : https://gstreamer.freedesktop.org/ Licencias : LGPL Grupos : Nada
Provee : Nada
Depende de : libxml2 glib2 libunwind libcap libelf
Dependencias opcionales : Nada
En conflicto con : Nada
Remplaza a : Nada
Tamaño de la descarga : 1897,45 KiB
Tamaño de la instalación : 17241,00 KiB
Encargado : Jan Alexander Steffens (heftig) jan.steffens@gmail.com Fecha de creación : jue 04 may 2017 14:13:05 -05
Validado por : Suma MD5 Suma SHA-256 Firma

Irene Yacila https://issues.hyperbola.info/:1507
FS#1505: [hypervideo] "HTTP Error 403: Forbidden" error on some videos 2020-02-04T00:14:40Z 2020-01-23T15:39:24Z

Is there any way to force it to try from yt as it did in the final attempt?

$ hypervideo -f 22 https://www.youtube.com/watch?v=X7v2aHUPp14 [youtube] X7v2aHUPp14: Downloading webpage
[youtube] X7v2aHUPp14: Downloading video info webpage
[youtube] X7v2aHUPp14: Checking URL Invidious API [youtube] X7v2aHUPp14: Downloading JSON metadata
[youtube] X7v2aHUPp14: Downloading from Invidious API ERROR: unable to download video data: HTTP Error 403: Forbidden

$ hypervideo -f 22 https://www.youtube.com/watch?v=X7v2aHUPp14 [youtube] X7v2aHUPp14: Downloading webpage
[youtube] X7v2aHUPp14: Downloading video info webpage
[youtube] X7v2aHUPp14: Checking URL Invidious API [youtube] X7v2aHUPp14: Trying from YT
[download] Destination: Caroline’s First Day _ Green Wing _ Series 1 Episode 1 _ Dead Parrot-X7v2aHUPp14.mp4
[download] 100% of 418.57MiB in 03:31

Alon Ivtsan https://issues.hyperbola.info/:1505
FS#1504: [tigervnc] Multiple CVE 2020-01-08T00:44:40Z 2020-01-07T21:01:12Z

https://www.openwall.com/lists/oss-security/2019/12/20/2

“This is a security release to fix a number of issues that were found by Kaspersky Lab. These issues affect both the client and server and could theoretically allow an malicious peer to take control over the software on the other side.”

bugmen0t https://issues.hyperbola.info/:1504