Dear all

The X2Go project is proud to announce a new release of the X2Go component ,,cups-x2go''.

New gains of this version of ,,cups-x2go'' are:

o Better support for RPM-based system. Directory owning has been minimized, dependencies added or changed to make them more appropriate. Documentation is now installed in the canonical directory. o Port script to File::Temp perl module to fix insecure use of temporary files. o Bugfix for Gentoo, where ps2pdf command line was not split up correctly.

This release fixes several security issues relating to improper use of temporary files within the cups-x2go script.

The X2Go team especially thanks Jeremy "thrig" Mates <jmates@cpan.org> for pointing out the problems.

All users of cups-x2go are encouraged to update as soon as possible.

X2Go Component: cups-x2go Version: 3.0.1.2 Status: RELEASE Date: Sun, 14 Jun 2015 18:09:54 +0200 Changes: cups-x2go (3.0.1.2) RELEASED; urgency=high . [ Mihai Moldovan]

• cups-x2go.spec:
  • Depend on openssh-clients on Fedora, RHEL, EPEL and CentOS instead of pulling in the complete openssh suite.
  • Change %{_libexecdir} to ${_prefix}/lib as the standard install location for CUPS backends on Fedora, RHEL, (Open)SUSE and EPEL.
  • Wrap macros in curly braces where appropriate.
  • Do not own alien directories.
  • Add docs.
  • Re-add %{_datadir}/ppd/cups-x2go as owned directory.
  • Use slashes to correctly mark directories.
  • Fedora: require cups-filesystem and cups for %{_prefix}/lib/cups et al.
  • All but Fedora: require cups or cups-filters at build-time.
  • Fedora: require cups-filesystem at build-time, too.
  • SUSE: require cups-filters at build- and run-time for %{_datadir}/ppd/.
  • SUSE: require cups-backends for %{_datadir}/ppd/ for older release versions.
  • Revert previous change. Own %{_datadir}/ppd/ for all SUSE releases for the time being.
  • Also own %{_prefix}/lib for SLES < 12, as previous versions ship the arch-dependent %{_libdir}/cups only.
  • Make package noarch again.
• New upstream version (3.0.1.2):
  • cups-x2go{,.conf}: port to File::Temp. Use Text::ParseWords to split up the ps2pdf command line correctly. Don't use system() but IPC::Open2::open2(). Capture the ps2pdf program's stdout and write it to the temporary file handle "manually". Should fix problems reported by Jan Bi on IRC.
  • cups-x2go: fix commented out second ps2pdf definition to output PDF data to stdout.

Regards,

Mihai Moldovan