HyperTask packages https://issues.hyperbola.info/ 2020-03-19T20:38:34Z FS#1512: [ispell] require FHS 2020-03-19T20:38:34Z 2020-03-17T20:58:01Z

Description:

cant open /usr/local/lib/english.hash

Additional info:

Repository      : extra
Name            : ispell
Version         : 3.3.02-7
Description     : An interactive spell-checking program for Unix
Architecture    : x86_64
URL             : http://ficus-www.cs.ucla.edu/geoff/ispell.html
Licenses        : BSD
Groups          : None
Provides        : None
Depends On      : ncurses
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 321.26 KiB
Installed Size  : 1336.00 KiB
Packager        : Evangelos Foutras <evangelos@foutrelis.com>
Build Date      : Sun Sep 6 12:07:06 2015
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

- Install package

Irene Yacila https://issues.hyperbola.info/:1512
FS#1511: [chdkptp] please add package to repos 2020-03-16T14:27:32Z 2020-03-16T14:27:32Z

CHDKPTP is part of CHDK project - a free software firmware add-on for Canon cameras. It enables controlling Canon cameras via the computer.

Attached is a modified iup PKGBUILD (Lua 5.3 build was removed as it failed to compile) and configuration files for chdkptp.

Code is available via svn:

$ svn co http://subversion.assembla.com/svn/chdkptp/trunk chdkptp

Copy chdkptp.sh and config.mk files to source tree then compile via make. Requires root privileges to connect to a camera.

Alon Ivtsan https://issues.hyperbola.info/:1511
FS#1510: [chdkptp] please add package to control Canon cameras 2020-03-16T14:25:55Z 2020-03-16T14:25:55Z

CHDKPTP is part of CHDK project - a free software firmware add-on for Canon cameras. It enables controlling Canon cameras via the computer.

Attached is a modified iup PKGBUILD (Lua 5.3 build was removed as it failed to compile) and configuration files for chdkptp.

Code is available via svn:

$ svn co http://subversion.assembla.com/svn/chdkptp/trunk chdkptp

Copy chdkptp.sh and config.mk files to source tree then compile via make. chdkptp requires root privileges to connect to a camera.

Alon Ivtsan https://issues.hyperbola.info/:1510
FS#1507: [gstreamer] needed rebuild 2020-02-28T02:48:39Z 2020-02-14T17:37:16Z

(gst-plugin-scanner:17336): GStreamer-WARNING : Failed to load plugin ‘/usr/lib/gstreamer-1.0/libgstzbar.so’: libzbar.so.0: cannot open shared object file: No such file or directory
(gst-plugin-scanner:17336): GStreamer-WARNING
: Failed to load plugin ‘/usr/lib/gstreamer-1.0/libgstfluidsynthmidi.so’: libfluidsynth.so.1: cannot open shared object file: No such file or directory

Repositorio : extra
Nombre : gstreamer
Versión : 1.12.0-1
Descripción : GStreamer open-source multimedia framework core library
Arquitectura : x86_64
URL : https://gstreamer.freedesktop.org/ Licencias : LGPL Grupos : Nada
Provee : Nada
Depende de : libxml2 glib2 libunwind libcap libelf
Dependencias opcionales : Nada
En conflicto con : Nada
Remplaza a : Nada
Tamaño de la descarga : 1897,45 KiB
Tamaño de la instalación : 17241,00 KiB
Encargado : Jan Alexander Steffens (heftig) jan.steffens@gmail.com Fecha de creación : jue 04 may 2017 14:13:05 -05
Validado por : Suma MD5 Suma SHA-256 Firma

Irene Yacila https://issues.hyperbola.info/:1507
FS#1480: [qt5] request for upgrade 2020-02-27T19:24:34Z 2019-11-14T17:05:07Z

I know that upgrading Qt is not a trivial task, but would it be possible to do this anyway? Qt 5.8 has issues that other versions do not have. See for example the discussion here about Projecteur, a very useful tool. Hyperbola seems to be the only Linux distribution unable to run it, just because of Qt 5.8:

https://github.com/jahnf/Projecteur/issues/26

Robert Alessi https://issues.hyperbola.info/:1480
FS#1508: [opensmtpd] CVE-2020-8794 2020-02-25T13:58:18Z 2020-02-25T13:58:18Z

Description: https://www.openwall.com/lists/oss-security/2020/02/24/5 https://www.bleepingcomputer.com/news/security/new-critical-rce-bug-in-openbsd-smtp-server-threatens-linux-distros/

Qualys Security Advisory

LPE and RCE in OpenSMTPD’s default install (CVE-2020-8794)

Contents

Summary
Analysis
...
Acknowledgments

Summary

We discovered a vulnerability in OpenSMTPD, OpenBSD’s mail server. This
vulnerability, an out-of-bounds read introduced in December 2015 (commit
80c6a60c, “when peer outputs a multi-line response ...”), is exploitable
remotely and leads to the execution of arbitrary shell commands: either
as root, after May 2018 (commit a8e22235, “switch smtpd to new
grammar”); or as any non-root user, before May 2018.

Because this vulnerability resides in OpenSMTPD’s client-side code
(which delivers mail to remote SMTP servers), we must consider two
different scenarios:

- Client-side exploitation: This vulnerability is remotely exploitable

in OpenSMTPD's (and hence OpenBSD's) default configuration. Although
OpenSMTPD listens on localhost only, by default, it does accept mail
from local users and delivers it to remote servers. If such a remote
server is controlled by an attacker (either because it is malicious or
compromised, or because of a man-in-the-middle, DNS, or BGP attack --
SMTP is not TLS-encrypted by default), then the attacker can execute
arbitrary shell commands on the vulnerable OpenSMTPD installation.

- Server-side exploitation: First, the attacker must connect to the

OpenSMTPD server (which accepts external mail) and send a mail that
creates a bounce. Next, when OpenSMTPD connects back to their mail
server to deliver this bounce, the attacker can exploit OpenSMTPD's
client-side vulnerability. Last, for their shell commands to be
executed, the attacker must (to the best of our knowledge) crash
OpenSMTPD and wait until it is restarted (either manually by an
administrator, or automatically by a system update or reboot).

We developed a simple exploit for this vulnerability and successfully
tested it against OpenBSD 6.6 (the current release), OpenBSD 5.9 (the
first vulnerable release), Debian 10 (stable), Debian 11 (testing), and
Fedora 31.

The fix is delivered in OpenSMTPD 6.6.4p1, available here, which the developer recommends installing “AS SOON AS POSSIBLE.”

bugmen0t https://issues.hyperbola.info/:1508
FS#1505: [hypervideo] "HTTP Error 403: Forbidden" error on some videos 2020-02-04T00:14:40Z 2020-01-23T15:39:24Z

Is there any way to force it to try from yt as it did in the final attempt?

$ hypervideo -f 22 https://www.youtube.com/watch?v=X7v2aHUPp14 [youtube] X7v2aHUPp14: Downloading webpage
[youtube] X7v2aHUPp14: Downloading video info webpage
[youtube] X7v2aHUPp14: Checking URL Invidious API [youtube] X7v2aHUPp14: Downloading JSON metadata
[youtube] X7v2aHUPp14: Downloading from Invidious API ERROR: unable to download video data: HTTP Error 403: Forbidden

$ hypervideo -f 22 https://www.youtube.com/watch?v=X7v2aHUPp14 [youtube] X7v2aHUPp14: Downloading webpage
[youtube] X7v2aHUPp14: Downloading video info webpage
[youtube] X7v2aHUPp14: Checking URL Invidious API [youtube] X7v2aHUPp14: Trying from YT
[download] Destination: Caroline’s First Day _ Green Wing _ Series 1 Episode 1 _ Dead Parrot-X7v2aHUPp14.mp4
[download] 100% of 418.57MiB in 03:31

Alon Ivtsan https://issues.hyperbola.info/:1505
FS#1485: [hypervideo] soundcloud downloads display 401 unauthorized error 2020-02-04T00:13:34Z 2019-11-26T08:36:15Z

An example:

$ hypervideo https://soundcloud.com/moshe-feiglin/wuh9dlykfhok [soundcloud] moshe-feiglin/wuh9dlykfhok: Downloading webpage
[soundcloud] moshe-feiglin/wuh9dlykfhok: Downloading info JSON
[soundcloud] 717666847: Downloading track url
WARNING: Unable to download JSON metadata: HTTP Error 401: Unauthorized
[soundcloud] 717666847: Checking fallback video format URL [soundcloud] 717666847: fallback video format URL is invalid, skipping
ERROR: No video formats found;

                  Error: Nonfree Bytecode Required!
     It's currently impossible to download this video with DRM.
    Hypervideo protects your freedom by avoiding DRM and nonfree
                        bytecode parsing.
                            More info:

It works in latest youtube-dl (the 401 error does not appear). Not sure the soundcloud hypervideo downloader ever worked in hypervideo (it might require non-free scripts).

Alon Ivtsan https://issues.hyperbola.info/:1485
FS#1484: [smplayer] Removal of unfree "Chromecast"-plugin 2020-01-29T17:34:16Z 2019-11-25T20:50:23Z

Within the current version of smplayer in the repositories a proprietary interface to Chromecast is activated and therefore a risk for privacy of the users as this hardware is the complete opposite of freedom.

Tobias Dausend https://issues.hyperbola.info/:1484
FS#1504: [tigervnc] Multiple CVE 2020-01-08T00:44:40Z 2020-01-07T21:01:12Z

https://www.openwall.com/lists/oss-security/2019/12/20/2

“This is a security release to fix a number of issues that were found by Kaspersky Lab. These issues affect both the client and server and could theoretically allow an malicious peer to take control over the software on the other side.”

bugmen0t https://issues.hyperbola.info/:1504