Description: https://www.openwall.com/lists/oss-security/2020/02/24/5 https://www.bleepingcomputer.com/news/security/new-critical-rce-bug-in-openbsd-smtp-server-threatens-linux-distros/

Qualys Security Advisory

LPE and RCE in OpenSMTPD’s default install (CVE-2020-8794)

in OpenSMTPD's (and hence OpenBSD's) default configuration. Although
OpenSMTPD listens on localhost only, by default, it does accept mail
from local users and delivers it to remote servers. If such a remote
server is controlled by an attacker (either because it is malicious or
compromised, or because of a man-in-the-middle, DNS, or BGP attack --
SMTP is not TLS-encrypted by default), then the attacker can execute
arbitrary shell commands on the vulnerable OpenSMTPD installation.

OpenSMTPD server (which accepts external mail) and send a mail that
creates a bounce. Next, when OpenSMTPD connects back to their mail
server to deliver this bounce, the attacker can exploit OpenSMTPD's
client-side vulnerability. Last, for their shell commands to be
executed, the attacker must (to the best of our knowledge) crash
OpenSMTPD and wait until it is restarted (either manually by an
administrator, or automatically by a system update or reboot).

A Material-like flat theme for GTK+ 2/3, and GNOME shell, released under a GNU General Public Licence (GNU GPL) 2 and later.

• Arch package URL: https://www.archlinux.org/packages/community/any/materia-gtk-theme
• Source code URL: https://github.com/nana-4/materia-theme

CVE-2020-5260 has been fixed very recently in Debian, so I thought I would apply this patch. However, I found out that security patches have not been applied for quite a while (I could account for at least 6 CVEs).

Considering that the version in Debian stretch (2.11.0) is the nearest version with security patches released by Debian and that git project oldest supported version is 2.17, I have used patches from Debian stretch to apply on 2.12.2 currently in Milky Way.

But I have the following error on check():

 |  *** prove ***
 |
 |  Test Summary Report
 |  -------------------
 |  t5570-git-daemon.sh                              (Wstat: 256 Tests: 20 Failed: 10)
 |    Failed tests:  3-7, 15-19
 |    Non-zero exit status: 1
 |  t5811-proto-disable-git.sh                       (Wstat: 256 Tests: 26 Failed: 16)
 |    Failed tests:  2-6, 9-11, 15-19, 21-23
 |    Non-zero exit status: 1
 |  Files=769, Tests=14137, 1101 wallclock secs ( 8.08 usr  1.12 sys + 144.48 cusr 63.42 csys = 217.10 CPU)
 |  Result: FAIL
 |  make[1]: *** [Makefile:45: prove] Error 1
 |  make[1]: Leaving directory '/build/git/src/git-2.12.2/t'
 |  make: *** [Makefile:2291: test] Error 2
 |  ==> ERROR: A failure occurred in check().
 |      Aborting...

This does not seem to be related to my change as the current version in Milky Way produces the same error (IOW the package currently in Milky Way is not rebuidable).

Description:
There is an issue with Christian Rebischke key, i’ve tried to delete /etc/pacman.d/gnupg/ and repopulate it but it doesn’t fix the issue.

error: ascii: signature from “Christian Rebischke (Arch Linux Security Team-Member) Chris.Rebischke@archlinux.org” is unknown trust
File /var/cache/pacman/pkg/ascii-3.15-2-x86_64.pkg.tar.xz is corrupted (invalid or corrupted package (PGP signature)).

Steps to reproduce:

sudo pacman -S ascii

Description:

Init script is missing for this package.

I think has some systemd dependecies.

/tmp/alpm_sYmHUS/.INSTALL: line 7: systemd-sysusers: command not found
error: command failed to execute correctly

package version: varnish-5.1.2-1

Description: User reporting problems with sndio. A further check with ALSA showed no active device being used. User has HDMI-sound in usage.

Description:
the program game crash-down when select a tank

Additional info:
* package version(s) : extra/warzone2100 3.3.0-3
* config and/or log files etc. ↓ and attach the log file

[ user | 2021-11-05 | 07:41 ]
[/home/user] [0]
$ warzone2100
which: no gdb in (/usr/bin:/usr/java/jre1.8.0/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games:/usr/local/sbin:/usr/sbin:/sbin:/home/user/.hyperterm/personal/commands:/opt/chrome)
Saved dump file to ‘/home/user/.local/share/warzone2100-3.3.0//logs/warzone2100.gdmp-bspbru’ If you create a bugreport regarding this crash, please include this file.
Segmentation fault

Steps to reproduce:
after install, start a new campaing, select a tank, and the program crash

Description: Bug related to the font handling under Hyperbola. xfontsel doesn’t list the PCF bitmapped fonts, which are used for some legacy tools with Motif/Athena for instance. If you want to use a font with good coverage of symbols (misc fixed 10×20 iso10646-1) under DDD (for accented/non ASCII characters), you can’t, you are restricted to ASCII 9×15 fonts.

Additional info:
This error happens even if all -meta font meta-packages are installed.

the screen moves back and forth from left to right randomly, no matter what I do, any games any adapters do not work.

I wanted to have some fun with some old games...

Has anyone used mupen64plus successfully on hyperbola 0.2? I cannot get it to work without being completely confusing for the reasons I have mentioned and also, the glaring of the screen. Which only happens with mupen64plus...

community/wireshark-cli 2.2.6-1
    a free network protocol analyzer for Unix/Linux and Windows - CLI version
community/wireshark-common 2.2.6-1
    Common files used by wireshark-gtk and wireshark-qt
community/wireshark-gtk 2.2.6-1
    a free network protocol analyzer for Unix/Linux and Windows - GTK frontend
community/wireshark-qt 2.2.6-1
    a free network protocol analyzer for Unix/Linux and Windows - Qt frontend

It’s better to change to a more neutral description such as “a cross-platform network protocol analyzer - CLI/GTK/Qt version”.

This package contains vague terminology “Open Source”:

extra/openjpeg 1.5.2-1
    An open source JPEG 2000 codec

According to:
https://www.gnu.org/distros/free-system-distribution-guidelines.html

We shall avoid vague terminology such as “Open Source”, please see here:
https://www.gnu.org/philosophy/words-to-avoid.html#Open

It would be good example to set to have proper description of packages without using “Open Source”.

eg.

A free software JPEG 2000 codec

Description:

extra/qpdf 6.0.0-2
    QPDF: A Content-Preserving PDF Transformation System

The description is vague.

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Content

Description:

extra/webkitgtk 2.4.11-6.hyperbola1
    Legacy Web content engine for GTK+ 3, without geoclue2 support

The description is vague. There is not even need to use “content” here. Web engine should be very clear. “Content” alone does not make sense.

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Content

community/antiword 0.37-6 [installed]
     A free MS Word reader for Linux and RISC OS

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

Description is referring to operating system, and not to the kernel itself (Linux). It shall be amended.

community/clamtk 5.24-1
     Easy to use, light-weight, on-demand virus scanner for Linux systems

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

Description is referring to operating system, and not to the kernel itself (Linux). It shall be amended.

Description:

community/hexedit 1.2.13-3
     Hex Editor for Linux

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

Description:

community/python2-pyinotify 0.9.6-3 [installed]
     Python module used for monitoring filesystems events on Linux platforms with inotify.
 community/qlandkartegt 1.8.1-8

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

Description:

community/wireshark-cli 2.2.6-1
     a free network protocol analyzer for Unix/Linux and Windows - CLI version

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

I would remove Unix and Windows from description as those words steer users towards non-free proprietary software.

Description:

community/wireshark-gtk 2.2.6-1
     a free network protocol analyzer for Unix/Linux and Windows - GTK frontend

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

Please remove references to proprietary software.

Description:

community/wireshark-qt 2.2.6-1
     a free network protocol analyzer for Unix/Linux and Windows - Qt frontend

See:
https://www.gnu.org/philosophy/words-to-avoid.html#Linux

The current version of the package icewm within the Hyperbola-repositories is 1.3.8. The latest version is 1.6.3!
An update would be helpful as this window-manager follows absolutely the principles of the distribution Hyperbola itself, being simple and fast.

The list contains some icons before being removed for displaying non-libre and trademark-related stuffs, which may infringe the GNU Free System Distribution Guidelines and Hyperbola Packaging Guidelines.

/usr/share/icons/material-design-{dark,light}/scalable/applications/:

• Icons that are libre apps but has problematic issues:
  • nodejs.svg
  • npm.svg
  • umbraco.svg
• Icons that are non-libre apps:
  • apple-finder.svg
  • apple-safari.svg
  • edge.svg
  • emby.svg
  • evernote.svg
  • google-chrome.svg
  • google-earth.svg
  • internet-explorer.svg (discontinued)
  • itunes.svg
  • jira.svg
  • opera.svg
  • plex.svg
  • quicktime.svg
  • skype.svg
  • slack.svg
  • steam.svg
  • teamviewer.svg
  • unity.svg
  • visualstudio.svg
  • whatsapp.svg
• Icons that are non-libre games:
  • black-mesa.svg
  • minecraft.svg
• Icons that are non-libre network services:
  • amazon.svg
  • appnet.svg (discontinued)
  • basecamp.svg
  • bing.svg
  • bitbucket.svg
  • blogger.svg
  • deviantart.svg
  • disqus.svg
  • dribbble.svg
  • dropbox.svg
  • ebay.svg
  • etsy.svg
  • facebook.svg
  • flattr.svg
  • foursquare.svg
  • github.svg
  • gmail.svg
  • google-drive.svg
  • google-maps.svg
  • google-photos.svg
  • google-play.svg
  • google-plus.svg (discontinued)
  • google-translate.svg
  • google-wallet.svg (discontinued, now as Google Pay)
  • instagram.svg
  • jsfiddle.svg
  • lastfm.svg
  • linkedin.svg
  • linode.svg
  • mixcloud.svg
  • onedrive.svg
  • pandora.svg
  • pinterest.svg
  • rdio.svg (discontinued)
  • reddit.svg
  • soundcloud.svg
  • spotify.svg
  • stackexchange.svg
  • stackoverflow.svg
  • telegram.svg
  • tumblr.svg
  • twitch.svg
  • twitter.svg
  • vimeo.svg
  • vine.svg (discontinued)
  • vk.svg
  • wechat.svg
  • xing.svg
  • yelp.svg
  • youtube.svg
• Icons that are non-FSDG operating systems:
  • android.svg
  • ubuntu.svg
• Icons that are non-libre operating systems:
  • apple-ios.svg
• Icons that are trademarked brands and products:
  • apple.svg
  • beats.svg
  • blackberry.svg
  • dolby.svg
  • google.svg
  • google-cardboard.svg (discontinued)
  • google-glass.svg
  • microsoft.svg
  • playstation.svg
  • wii.svg (discontinued)
  • wiiu.svg (discontinued)
• Icons that are trademarked characters:
  • clippy.svg (appearance from the Office Assistant part of M$ Office 97 to 2003)

Description: Package xlsfonts is missing and should absolutely being added also within groups for ‘xenocara-apps’ and ‘xorg-apps’.

Description:

Devede fails to convert transcoded videos to iso format with libburn-1.5.0.

Drive current: -outdev 'stdio:/home/heckyel/movie/movie.iso'
Media current: stdio file, overwriteable
Media status : is blank
Media summary: 0 sessions, 0 data blocks, 0 data,  334g free
xorriso : FAILURE : -as genisofs: Unsupported option '-dvd-video'
xorriso : NOTE : -return_with SORRY 32 triggered by problem severity FAI

Additional info:

$ pacman -Si devede
Repositorio               : community
Nombre                    : devede
Versión                   : 4.8.8-1
Descripción               : A program to create VideoDVDs and CDs
Arquitectura              : any
URL                       : http://www.rastersoft.com/programas/devede.html
Licencias                 : GPL3
Grupos                    : Nada
Provee                    : Nada
Depende de                : mencoder  ffmpeg  dvdauthor  vcdimager  cdrkit  ttf-dejavu
                            gtk3  python-cairo  python-gobject  python-setuptools
Dependencias opcionales   : mplayer
                            vlc
                            mpv
En conflicto con          : Nada
Remplaza a                : Nada
Tamaño de la descarga     : 1640,88 KiB
Tamaño de la instalación  : 3331,00 KiB
Encargado                 : Sergej Pupykin <pupykin.s+arch@gmail.com>
Fecha de creación         : vie 10 feb 2017 05:06:37 -05
Validado por              : Suma MD5  Suma SHA-256  Firma

Link’s code:

- https://gitlab.com/rastersoft/devedeng/blob/master/src/devedeng/mkisofs.py#L61

- https://gitlab.com/rastersoft/devedeng/blob/master/src/devedeng/genisoimage.py#L61

Steps to reproduce:

- Install devede
- Create video DVD disc

New versión v2.2.7

References:

• https://github.com/apple/cups/releases/tag/v2.2.7
• https://security-tracker.debian.org/tracker/source-package/cups
• https://debian.simnet.is/debian/pool/main/c/cups/cups_2.2.7-3.debian.tar.xz