The following Fedora EPEL 8 Security updates need testing: Age URL 3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-2235745ae4 apptainer-1.3.2-1.el8 0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-9ef042c689 syncthing-1.27.7-1.el8 The following builds have been pushed to Fedora EPEL 8 updates-testing chromium-125.0.6422.141-1.el8 stb-0-0.48.20240531git013ac3b.el8 xorgxrdp-0.10.1-1.el8 xrdp-0.10.0-4.el8 Details about builds: ================================================================================ chromium-125.0.6422.141-1.el8 (FEDORA-EPEL-2024-d00a65eda0) A WebKit (Blink) powered web browser that Google doesn't want you to use -------------------------------------------------------------------------------- Update Information: update to 125.0.6422.141 High CVE-2024-5493: Heap buffer overflow in WebRTC High CVE-2024-5494: Use after free in Dawn High CVE-2024-5495: Use after free in Dawn High CVE-2024-5496: Use after free in Media Session High CVE-2024-5497: Out of bounds memory access in Keyboard Inputs High CVE-2024-5498: Use after free in Presentation API High CVE-2024-5499: Out of bounds write in Streams API -------------------------------------------------------------------------------- ChangeLog: * Fri May 31 2024 Than Ngo <than@xxxxxxxxxx> - 125.0.6422.141-1 - update to 125.0.6422.141 * High CVE-2024-5493: Heap buffer overflow in WebRTC * High CVE-2024-5494: Use after free in Dawn * High CVE-2024-5495: Use after free in Dawn * High CVE-2024-5496: Use after free in Media Session * High CVE-2024-5497: Out of bounds memory access in Keyboard Inputs * High CVE-2024-5498: Use after free in Presentation API * High CVE-2024-5499: Out of bounds write in Streams API - fixed rhbz#2264332 - Chromium is unable to send/receive video on MS Teams - cleanup chromium.conf * Wed May 29 2024 Than Ngo <than@xxxxxxxxxx> - 125.0.6422.112-3 - build against noopenh264 * Tue May 28 2024 Than Ngo <than@xxxxxxxxxx> - 125.0.6422.112-2 - Workaround for build error on pp64le * Sun May 26 2024 Than Ngo <than@xxxxxxxxxx> - 125.0.6422.112-1 - update to 125.0.6422.112 * High CVE-2024-5274: Type Confusion in V8 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2283084 - CVE-2024-5274 chromium: chromium-browser: Type Confusion in V8 [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2283084 -------------------------------------------------------------------------------- ================================================================================ stb-0-0.48.20240531git013ac3b.el8 (FEDORA-EPEL-2024-19d70e8364) Single-file public domain libraries for C/C++ -------------------------------------------------------------------------------- Update Information: stb_image 2.30: fix gcc bounds-check warning (believed erroneous) stb_image_resize2 2.07 fix for slow final split during threaded conversions of very wide scanlines when downsampling (caused by extra input converting), fix for wide scanline resamples with many splits (int overflow), fix GCC warning. -------------------------------------------------------------------------------- ChangeLog: * Fri May 31 2024 Benjamin A. Beasley <code@xxxxxxxxxxxxxxxxxx> - 0-0.48.20240531git013ac3b - stb_image 2.30 * Sun May 26 2024 Benjamin A. Beasley <code@xxxxxxxxxxxxxxxxxx> - 0-0.47.20240525git449758b - stb_image_resize2 2.07 -------------------------------------------------------------------------------- ================================================================================ xorgxrdp-0.10.1-1.el8 (FEDORA-EPEL-2024-bdcc1c789c) Implementation of xrdp backend as Xorg modules -------------------------------------------------------------------------------- Update Information: Release notes for xrdp v0.10.0 (2024/05/10) This section notes changes since the v0.10 branch was created. General announcements The biggest news of this release is that Graphic Pipeline Extension also called GFX in short has been supported. xrdp v0.10 with GFX achieves more frame rates and less bandwidth compared to v0.9. There is a significant performance improvement especially if the client is Windows 11's mstsc.exe or Microsoft Remote Desktop for Mac. GFX H.264/AVC 444 mode and hardware-accelerated encoding are not supported in this version yet. GFX implementation in xrdp is sponsored by an enterprise sponsor. @CyberTrust is also one of the sponsors. We very much appreciate the sponsorship. It helped us to accelerate xrdp development and land GFX earlier! Please consider sponsoring or making a donation to the project if you like xrdp. We accept financial contributions via Open Collective. Direct donations to each developer via GitHub Sponsors are also welcomed. Highlights This section describes the most user-visible new or changed features in xrdp since v0.9.19. See Branch v0.10 for all changes relative to v0.9.19. Added GFX support with multi-monitor support (including monitor hot plug/unplug) (#2256 #2338 #2595 #2879 #2891 #2911 #2929 #2933) Touchpad inertial scrolling (#2364, #2424). Thanks to new contributor @seflerZ New look of login screen (#2366) Scaled login screen on higher DPI monitors (#2341, #2427, #2435) This feature works automatically when monitor DPI information is sent by the client (i.e. a full-screen session) Native platform tools are now provided to manipulate .fv1 format font files. The format of the date and time in the log file has been changed to ISO 8601 with milliseconds (#2386 #2541) xrdp-sesman now supports a --reload switch to allow for the configuration to be changed when sessions are active (#2416) Security fixes None New features If the client announces support for the Image RemoteFX codec it is logged (back- port of #2946) Bug fixes Fix some monitor hotplug issues (#2951) GFX: Fix disconnect on resize of busy windows (#2962 #2957) Fall back to IPv4 if IPv6 capable but don't have an IPv6 address set (#2967 #2957) Remove tcutils channel from xrdp.ini (#2970 #2957) Don't generate a corefile when generating SIGSEGV during unit testing (#2987) If the drdynvc static channel isn't available, disable GFX gracefully (#3003) A buffer misconfiguration which affects performance on high bandwidth, high latency links has been addressed (cherry-pick of #2910) A permissions fix for the socketdir update in #2731 has been issued (cherry-pick of #3011) Internal changes Adjust log level not too verbose (#2954 #2972 #2957) Migrate GitHub actions to Node 20 (#2955 #2957) Bump copyright year and make easier to bump (#2956 #2957) Remove duplicate DEBUG output (#2976 #2977) Add script to make release tarball (#2983) Syscall filter for xrdp updated (cherry-pick of #3017) GFX memory usage for large screens is greatly improved (cherry-pick of #3013) librfxcodec SSE2 performance improvements (#3032) Known issues On-the-fly resolution change with the Microsoft Store version of Remote Desktop client sometimes crashes on connect (#1869) xrdp's login dialog is not relocated at the center of the new resolution after on-the-fly resolution change happens (#1867) Changes for users If moving from v0.9.x, read the 'User changes' for the v0.10 branch below. Changes for packagers or developers If moving from v0.9.x, read the 'User changes' and 'Significant changes for packagers or developers section' sections for the v0.10 branch below. Release notes for xorgxrdp v0.10.1 (2024/04/20) General announcements The biggest news of v0.10 is that Graphic Pipeline Extension also called GFX in short has been supported. xrdp v0.10 with GFX achieves more frame rates and less bandwidth compared to v0.9. There is a significant performance improvement especially if the client is Windows 11's mstsc.exe or Microsoft Remote Desktop for Mac. GFX H.264/AVC 444 mode and hardware-accelerated encoding are not supported in this version yet. GFX implementation in xrdp is sponsored by an enterprise sponsor. @CyberTrust is also one of the sponsors. We very much appreciate the sponsorship. It helped us to accelerate xrdp development and land GFX earlier! Please consider sponsoring or making a donation to the project if you like xrdp. We accept financial contributions via Open Collective. Direct donations to each developer via GitHub Sponsors are also welcomed. Security fixes None New features Switch to wyhash from CRC for capture tile diff and introduce lazy color conversion (#167 #301) Thanks to @trishume! Bug fixes None Internal changes None Known issues None Changes for packagers or developers If moving from v0.9.x, read the 'Significant changes for packagers or developers section' for the v0.10 branch below. -------------------------------------------------------------------------------- ChangeLog: * Wed May 15 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 0.10.1-1 - Bump up to 0.10.1 * Tue May 14 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 0.10.0-4 - Rebuild against xrdp 0.10.0 * Wed Apr 3 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 0.10.0-2 - Rebuild against xrdp 0.10.0-beta.2 -------------------------------------------------------------------------------- ================================================================================ xrdp-0.10.0-4.el8 (FEDORA-EPEL-2024-bdcc1c789c) Open source remote desktop protocol (RDP) server -------------------------------------------------------------------------------- Update Information: Release notes for xrdp v0.10.0 (2024/05/10) This section notes changes since the v0.10 branch was created. General announcements The biggest news of this release is that Graphic Pipeline Extension also called GFX in short has been supported. xrdp v0.10 with GFX achieves more frame rates and less bandwidth compared to v0.9. There is a significant performance improvement especially if the client is Windows 11's mstsc.exe or Microsoft Remote Desktop for Mac. GFX H.264/AVC 444 mode and hardware-accelerated encoding are not supported in this version yet. GFX implementation in xrdp is sponsored by an enterprise sponsor. @CyberTrust is also one of the sponsors. We very much appreciate the sponsorship. It helped us to accelerate xrdp development and land GFX earlier! Please consider sponsoring or making a donation to the project if you like xrdp. We accept financial contributions via Open Collective. Direct donations to each developer via GitHub Sponsors are also welcomed. Highlights This section describes the most user-visible new or changed features in xrdp since v0.9.19. See Branch v0.10 for all changes relative to v0.9.19. Added GFX support with multi-monitor support (including monitor hot plug/unplug) (#2256 #2338 #2595 #2879 #2891 #2911 #2929 #2933) Touchpad inertial scrolling (#2364, #2424). Thanks to new contributor @seflerZ New look of login screen (#2366) Scaled login screen on higher DPI monitors (#2341, #2427, #2435) This feature works automatically when monitor DPI information is sent by the client (i.e. a full-screen session) Native platform tools are now provided to manipulate .fv1 format font files. The format of the date and time in the log file has been changed to ISO 8601 with milliseconds (#2386 #2541) xrdp-sesman now supports a --reload switch to allow for the configuration to be changed when sessions are active (#2416) Security fixes None New features If the client announces support for the Image RemoteFX codec it is logged (back- port of #2946) Bug fixes Fix some monitor hotplug issues (#2951) GFX: Fix disconnect on resize of busy windows (#2962 #2957) Fall back to IPv4 if IPv6 capable but don't have an IPv6 address set (#2967 #2957) Remove tcutils channel from xrdp.ini (#2970 #2957) Don't generate a corefile when generating SIGSEGV during unit testing (#2987) If the drdynvc static channel isn't available, disable GFX gracefully (#3003) A buffer misconfiguration which affects performance on high bandwidth, high latency links has been addressed (cherry-pick of #2910) A permissions fix for the socketdir update in #2731 has been issued (cherry-pick of #3011) Internal changes Adjust log level not too verbose (#2954 #2972 #2957) Migrate GitHub actions to Node 20 (#2955 #2957) Bump copyright year and make easier to bump (#2956 #2957) Remove duplicate DEBUG output (#2976 #2977) Add script to make release tarball (#2983) Syscall filter for xrdp updated (cherry-pick of #3017) GFX memory usage for large screens is greatly improved (cherry-pick of #3013) librfxcodec SSE2 performance improvements (#3032) Known issues On-the-fly resolution change with the Microsoft Store version of Remote Desktop client sometimes crashes on connect (#1869) xrdp's login dialog is not relocated at the center of the new resolution after on-the-fly resolution change happens (#1867) Changes for users If moving from v0.9.x, read the 'User changes' for the v0.10 branch below. Changes for packagers or developers If moving from v0.9.x, read the 'User changes' and 'Significant changes for packagers or developers section' sections for the v0.10 branch below. Release notes for xorgxrdp v0.10.1 (2024/04/20) General announcements The biggest news of v0.10 is that Graphic Pipeline Extension also called GFX in short has been supported. xrdp v0.10 with GFX achieves more frame rates and less bandwidth compared to v0.9. There is a significant performance improvement especially if the client is Windows 11's mstsc.exe or Microsoft Remote Desktop for Mac. GFX H.264/AVC 444 mode and hardware-accelerated encoding are not supported in this version yet. GFX implementation in xrdp is sponsored by an enterprise sponsor. @CyberTrust is also one of the sponsors. We very much appreciate the sponsorship. It helped us to accelerate xrdp development and land GFX earlier! Please consider sponsoring or making a donation to the project if you like xrdp. We accept financial contributions via Open Collective. Direct donations to each developer via GitHub Sponsors are also welcomed. Security fixes None New features Switch to wyhash from CRC for capture tile diff and introduce lazy color conversion (#167 #301) Thanks to @trishume! Bug fixes None Internal changes None Known issues None Changes for packagers or developers If moving from v0.9.x, read the 'Significant changes for packagers or developers section' for the v0.10 branch below. -------------------------------------------------------------------------------- ChangeLog: * Sat Jun 1 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 1:0.10.0-4 - Explain downgrades from 0.10.x to 0.9.x in README.Fedora * Tue May 14 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 1:0.10.0-3 - Only require systemd-tmpfiles on Fedora * Tue May 14 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 1:0.10.0-2 - Explicitly run systemd-tmpfiles --remove on package removal BZ#2279775 * Tue May 14 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 1:0.10.0-1 - Update to 0.10.0 - Revert PR 2994 * Wed Apr 3 2024 Bojan Smojver <bojan@xxxxxxxxxxxxx> - 1:0.10.0-0.beta.2 - Update to 0.10.0-beta.2 -------------------------------------------------------------------------------- -- _______________________________________________ epel-devel mailing list -- epel-devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to epel-devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/epel-devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
