- x2go-dev - X2Go ListServ

Generic Release Steps Documented on the Wiki
by Mihai Moldovan 18 Feb '15

18 Feb '15

Hi As promised, I have documented the generic release steps on this wiki page: http://wiki.x2go.org/doku.php/wiki:development:release-howto Also, this howto is accessible via http://wiki.x2go.org/doku.php/wiki:development:start There's probably still room for improvement and I will add more documentation related to Jenkins and Launchpad when I'm more clear on these matters. Mihai

1 0

X.org Coverity fixes (from 2006) & nx-libs
by Michael DePaulo 18 Feb '15

18 Feb '15

While I was backporting the CVE-2015-0255 fix from X.org to nx-libs, I noticed that there were a ton of Coverity fixes from 2006 in the X.org Xserver: http://cgit.freedesktop.org/xorg/xserver/log/?qt=grep&q=Coverity I backported only one of them as a prereq for CVE-2015-0255: http://cgit.freedesktop.org/xorg/xserver/commit/?id=47bdc9528c2dd4ea9d59a09… Thoughts/Comments? -Mike

3 3

Preview of X2Go Client 4.0.3.2 available
by Mihai Moldovan 18 Feb '15

18 Feb '15

Hi all I am happy to announce a preview of X2Go Client 4.0.3.2 based on on my bugfix/osx branch based on my feature/cleanup branch based on current master. This pre-release includes a fix for the problem of X2Go Client deadlocking when trying to establish more than one session sequentially. Please grab the desired DMG file from this location and optionally check the checksums and signature: http://code.x2go.org/releases/binary-macosx/x2goclient/previews/4.0.3.2/ Note that this preview includes two versions of X2Go Client. One was built on OS X 10.6 and is best-suited for OS X 10.6 and 10.7, while the other was built on OS X 10.9 and is best suited for OS X 10.9 and 10.10. For users on OS X 10.8, I recommend first trying the 10.9 version and if this misbehaves, resorting to the 10.6 version. As always, I would be delighted to get feedback and criticism. Best, Mihai

3 4

Status of fixing CVE-2015-0255 (2015-02-10)
by Michael DePaulo 18 Feb '15

18 Feb '15

I am looking into fixing the recently announced X.org vulnerability (CVE-2015-0255) in nx-libs. http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/ It looks like nx-libs is affected. It also looks like some distros (Fedora, Debian) have fixed it, while others (RHEL 5, 6 and 7, Debian LTS) have not. It also looks like the X.org 1.16.x commits are easier to apply to nx-libs than the X.org 1.17.x commits are. The 1.17.x commits are linked to on that advisory page. The X.org 1.16.x commits are here: the branch: http://cgit.freedesktop.org/xorg/xserver/log/?h=server-1.16-branch the prereq: http://cgit.freedesktop.org/xorg/xserver/commit/?h=server-1.16-branch&id=74… the fix itself: http://cgit.freedesktop.org/xorg/xserver/commit/?h=server-1.16-branch&id=8f… -Mike#2

3 6

Re: [X2Go-Dev] [X2Go-Commits] [x2goclient] 01/02: Reformat onmainwindow.cpp
by Michael DePaulo 17 Feb '15

17 Feb '15

On Tue, Feb 17, 2015 at 6:18 AM, <git-admin(a)x2go.org> wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch master > in repository x2goclient. > > commit 2b105f11d73998111956b9964292ff23583d29f4 > Author: Oleksandr Shneyder <o.shneyder(a)phoca-gmbh.de> > Date: Tue Feb 17 12:15:18 2015 +0100 > > Reformat onmainwindow.cpp > --- > debian/changelog | 1 + > onmainwindow.cpp | 6 +++--- > 2 files changed, 4 insertions(+), 3 deletions(-) > > diff --git a/debian/changelog b/debian/changelog > index c40f3ab..14c1bca 100644 > --- a/debian/changelog > +++ b/debian/changelog > @@ -5,6 +5,7 @@ x2goclient (4.0.3.2-0x2go1) UNRELEASED; urgency=medium > - Reformat onmainwindow.cpp > - Fix placement of session folders in session card column. (Fixes: #681). > - Send empty message in x2gohelper to stop AppStarting cursor. (Fixes: #616). > + - Reformat onmainwindow.cpp > > [ Mike Gabriel ] > * New upstream release (4.0.3.2): > diff --git a/onmainwindow.cpp b/onmainwindow.cpp > index 6dadd87..5bb4210 100644 > --- a/onmainwindow.cpp > +++ b/onmainwindow.cpp > @@ -3032,7 +3032,7 @@ void ONMainWindow::slotSessEnter() > > if(brokerMode) > { > - if (config.brokerNoAuth && brokerNoauthWithSessionUsername) { > + if (config.brokerNoAuth && brokerNoauthWithSessionUsername) { > config.brokerUser = login->text(); > } > broker->selectUserSession(sessionExplorer->getLastSession()->id()); > @@ -9723,8 +9723,8 @@ void ONMainWindow::startPulsed() > else > { > pulseCookieArg="auth-cookie="+ > - QDir::toNativeSeparators (wapiShortFileName( pulseBaseDir))+ > - "\\.pulse-cookie"; > + QDir::toNativeSeparators (wapiShortFileName( pulseBaseDir))+ > + "\\.pulse-cookie"; > // Double backslashes are required in config.pa > pulseCookieArg.replace("\\", "\\\\"); > out << "load-module module-native-protocol-tcp port="+ > > -- > Alioth's /srv/git/_hooks_/post-receive-email on /srv/git/code.x2go.org/x2goclient.git Hi Alex, Did I mess up the whitespace with those last 2 lines? I am asking because I want to avoid making the same mistake in the future. -Mike

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 28/52: CVE-2014-0210: unvalidated length fields in fs_read_list() from xorg/lib/libXfont commit 5fa73ac18474be3032ee7af9c6e29deab163ea39
by Mihai Moldovan 17 Feb '15

17 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit ef439da38d3a4c00a4e03e7d8f83cb359cd9a230 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:35:21 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_list() from xorg/lib/libXfont commit 5fa73ac18474be3032ee7af9c6e29deab163ea39 > > fs_read_list() parses a reply from the font server. The reply > contains a list of strings with embedded length fields, none of > which are validated. This can cause out of bound reads when looping > over the strings in the reply. > --- > nx-X11/lib/font/fc/fserve.c | 15 +++++++++++++++ > 1 file changed, 15 insertions(+) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 26218e5..60d9017 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -2365,6 +2365,7 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FSBlockedListPtr blist = (FSBlockedListPtr) blockrec->data; > fsListFontsReply *rep; > char *data; > + long dataleft; /* length of reply left to use */ Same here. long dataleft = 0; > int length, > i, > ret; > @@ -2382,16 +2383,30 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > return AllocError; > } > data = (char *) rep + SIZEOF (fsListFontsReply); > + dataleft = (rep->length << 2) - SIZEOF (fsListFontsReply); > > err = Successful; > /* copy data into FontPathRecord */ > for (i = 0; i < rep->nFonts; i++) > { > + if (dataleft < 1) > + break; Just as a heads-up: I would have moved this into the for loop condition like so: for (i = 0; (i < rep->nFonts) && (dataleft > 0); i++) to make clear, that it's really part of the looping condition. The current patch as provided by upstream is functionally equivalent and OK, though. Everything else in the patch looks good.

5 5

Bug#790: Add language chooser to X2GoClient
by Mihai Moldovan 16 Feb '15

16 Feb '15

package: x2goclient severity: wishlist On local desktops, the login manager allows users to choose a GUI language. X2GoClient, which is basically our login manager replacement (even in non-TCE mode) lacks such an option. Since we offer an option to switch the keyboard layout, a similar option to switch the GUI language (and maybe additionally automatically also the timezone) would be nice.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 51/52: glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3)
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 9c558f9ca2c0d4e34fa71dff272ed1c39c22cd9d > Author: Adam Jackson <ajax(a)redhat.com> > Date: Mon Nov 10 12:13:43 2014 -0500 > > glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3) > > This is a half-measure until we start passing request length into the > varsize function, but it's better than the nothing we had before. > > v2: Verify that there's at least a large render header's worth of > dataBytes (Julien Cristau) > > v3: backport to RHEL5 > > v4: backport to nx-libs 3.6.x (Mike DePaulo) > > Reviewed-by: Michal Srb <msrb(a)suse.com> > Reviewed-by: Andy Ritger <aritger(a)nvidia.com> > Signed-off-by: Adam Jackson <ajax(a)redhat.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Signed-off-by: Fedora X Ninjas <x(a)fedoraproject.org> > Signed-off-by: Dave Airlie <airlied(a)redhat.com> > > fixup swap > --- > nx-X11/programs/Xserver/GL/glx/glxcmds.c | 58 +++++++++++++++---------- > nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c | 59 ++++++++++++++++---------- > 2 files changed, 71 insertions(+), 46 deletions(-) > > diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmds.c b/nx-X11/programs/Xserver/GL/glx/glxcmds.c > index 831c65b..20c12f3 100644 > --- a/nx-X11/programs/Xserver/GL/glx/glxcmds.c > +++ b/nx-X11/programs/Xserver/GL/glx/glxcmds.c > @@ -1535,6 +1535,8 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** duplicated there. > */ > > + REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq); > + > req = (xGLXRenderLargeReq *) pc; > glxc = __glXForceCurrent(cl, req->contextTag, &error); > if (!glxc) { > @@ -1542,12 +1544,15 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > __glXResetLargeCommandStatus(cl); > return error; > } > + if (safe_pad(req->dataBytes) < 0) > + return BadLength; > + > dataBytes = req->dataBytes; > > /* > ** Check the request length. > */ > - if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) { > + if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) { > client->errorValue = req->length; > /* Reset in case this isn't 1st request. */ > __glXResetLargeCommandStatus(cl); > @@ -1557,7 +1562,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > > if (cl->largeCmdRequestsSoFar == 0) { > __GLXrenderSizeData *entry; > - int extra, cmdlen; > + int extra = 0, cmdlen; > /* > ** This is the first request of a multi request command. > ** Make enough space in the buffer, then copy the entire request. > @@ -1567,9 +1572,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > return __glXBadLargeRequest; > } > > + if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE) > + return BadLength; > + > hdr = (__GLXrenderLargeHeader *) pc; > - cmdlen = hdr->length; > opcode = hdr->opcode; > + if ((cmdlen = safe_pad(hdr->length)) < 0) > + return BadLength; > > /* > ** Check for core opcodes and grab entry data. > @@ -1603,16 +1612,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > if (extra < 0) { > return BadLength; > } > - /* large command's header is 4 bytes longer, so add 4 */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4 + extra)) { > - return BadLength; > - } > - } else { > - /* constant size command */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4)) { > - return BadLength; > - } > } > + > + /* the +4 is safe because we know entry.bytes is small */ > + if (cmdlen != safe_pad(safe_add(entry->bytes + 4, extra))) { > + return BadLength; > + } > + > /* > ** Make enough space in the buffer, then copy the entire request. > */ > @@ -1641,6 +1647,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** We are receiving subsequent (i.e. not the first) requests of a > ** multi request command. > */ > + int bytesSoFar; /* including this packet */ > > /* > ** Check the request number and the total request count. > @@ -1659,7 +1666,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > /* > ** Check that we didn't get too much data. > */ > - if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) { > + if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) { > + client->errorValue = dataBytes; > + __glXResetLargeCommandStatus(cl); > + return __glXBadLargeRequest; > + } > + > + if (bytesSoFar > cl->largeCmdBytesTotal) { > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > @@ -1673,17 +1686,16 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** This is the last request; it must have enough bytes to complete > ** the command. > */ > - /* NOTE: the two pad macros have been added below; they are needed > - ** because the client library pads the total byte count, but not > - ** the per-request byte counts. The Protocol Encoding says the > - ** total byte count should not be padded, so a proposal will be > - ** made to the ARB to relax the padding constraint on the total > - ** byte count, thus preserving backward compatibility. Meanwhile, > - ** the padding done below fixes a bug that did not allow > - ** large commands of odd sizes to be accepted by the server. > + /* NOTE: the pad macro below is needed because the client library > + ** pads the total byte count, but not the per-request byte counts. > + ** The Protocol Encoding says the total byte count should not be > + ** padded, so a proposal will be made to the ARB to relax the > + ** padding constraint on the total byte count, thus preserving > + ** backward compatibility. Meanwhile, the padding done below > + ** fixes a bug that did not allow large commands of odd sizes to > + ** be accepted by the server. > */ > - if (__GLX_PAD(cl->largeCmdBytesSoFar) != > - __GLX_PAD(cl->largeCmdBytesTotal)) { > + if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) { cl->largeCmdBytesTotal is not wrapped in safe_pad(). This looks odd and could be a mistake. > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > index 2685355..2e228c0 100644 > --- a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > +++ b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > @@ -587,6 +587,8 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** duplicated there. > */ > > + REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq); > + > req = (xGLXRenderLargeReq *) pc; > __GLX_SWAP_SHORT(&req->length); > __GLX_SWAP_INT(&req->contextTag); > @@ -599,12 +601,15 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > __glXResetLargeCommandStatus(cl); > return error; > } > + if (safe_pad(req->dataBytes) < 0) > + return BadLength; > + > dataBytes = req->dataBytes; > > /* > ** Check the request length. > */ > - if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) { > + if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) { > client->errorValue = req->length; > /* Reset in case this isn't 1st request. */ > __glXResetLargeCommandStatus(cl); > @@ -614,7 +619,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > > if (cl->largeCmdRequestsSoFar == 0) { > __GLXrenderSizeData *entry; > - int extra; > + int extra = 0; > size_t cmdlen; > /* > ** This is the first request of a multi request command. > @@ -624,12 +629,17 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > client->errorValue = req->requestNumber; > return __glXBadLargeRequest; > } > + if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE) > + return BadLength; > + > hdr = (__GLXrenderLargeHeader *) pc; > __GLX_SWAP_INT(&hdr->length); > __GLX_SWAP_INT(&hdr->opcode); > - cmdlen = hdr->length; > opcode = hdr->opcode; > > + if ((cmdlen = safe_pad(hdr->length)) < 0) > + return BadLength; > + > if ( (opcode >= __GLX_MIN_RENDER_OPCODE) && > (opcode <= __GLX_MAX_RENDER_OPCODE) ) { > entry = &__glXRenderSizeTable[opcode]; > @@ -661,16 +671,12 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > if (extra < 0) { > return BadLength; > } > - /* large command's header is 4 bytes longer, so add 4 */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4 + extra)) { > - return BadLength; > - } > - } else { > - /* constant size command */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4)) { > - return BadLength; > - } > } > + /* the +4 is safe because we know entry->bytes is small */ > + if (cmdlen != safe_pad(safe_add(entry->bytes + 4, extra))) { > + return BadLength; > + } > + > /* > ** Make enough space in the buffer, then copy the entire request. > */ > @@ -698,6 +704,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** We are receiving subsequent (i.e. not the first) requests of a > ** multi request command. > */ > + int bytesSoFar; /* including this packet */ > > /* > ** Check the request number and the total request count. > @@ -716,7 +723,13 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > /* > ** Check that we didn't get too much data. > */ > - if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) { > + if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) { > + client->errorValue = dataBytes; > + __glXResetLargeCommandStatus(cl); > + return __glXBadLargeRequest; > + } > + > + if (bytesSoFar > cl->largeCmdBytesTotal) { > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > @@ -730,17 +743,17 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** This is the last request; it must have enough bytes to complete > ** the command. > */ > - /* NOTE: the two pad macros have been added below; they are needed > - ** because the client library pads the total byte count, but not > - ** the per-request byte counts. The Protocol Encoding says the > - ** total byte count should not be padded, so a proposal will be > - ** made to the ARB to relax the padding constraint on the total > - ** byte count, thus preserving backward compatibility. Meanwhile, > - ** the padding done below fixes a bug that did not allow > - ** large commands of odd sizes to be accepted by the server. > + /* NOTE: the pad macro below is needed because the client library > + ** pads the total byte count, but not the per-request byte counts. > + ** The Protocol Encoding says the total byte count should not be > + ** padded, so a proposal will be made to the ARB to relax the > + ** padding constraint on the total byte count, thus preserving > + ** backward compatibility. Meanwhile, the padding done below > + ** fixes a bug that did not allow large commands of odd sizes to > + ** be accepted by the server. > */ > - if (__GLX_PAD(cl->largeCmdBytesSoFar) != > - __GLX_PAD(cl->largeCmdBytesTotal)) { > + > + if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) { Similarly not wrapped in safe_pad() here. Not sure whether this happened on purpose or is an error.

2 1

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 13/52: LZW decompress: fix for CVE-2011-2895 From xorg/lib/Xfont commit d11ee5886e9d9ec610051a206b135a4cdc1e09a0
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit af55da1e9c1a6a352b24823a8f7062c288ffbbc0 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 19:15:20 2015 -0500 > > LZW decompress: fix for CVE-2011-2895 From xorg/lib/Xfont commit d11ee5886e9d9ec610051a206b135a4cdc1e09a0 > > Specially crafted LZW stream can crash an application using libXfont > that is used to open untrusted font files. With X server, this may > allow privilege escalation when exploited > --- > nx-X11/lib/font/fontfile/decompress.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/nx-X11/lib/font/fontfile/decompress.c b/nx-X11/lib/font/fontfile/decompress.c > index a4c5468..553b315 100644 > --- a/nx-X11/lib/font/fontfile/decompress.c > +++ b/nx-X11/lib/font/fontfile/decompress.c > @@ -261,6 +261,8 @@ BufCompressedFill (BufFilePtr f) > */ > while ( code >= 256 ) > { > + if (stackp - de_stack >= STACK_SIZE - 1) > + return BUFFILEEOF; Personally, I would have written that as if ((stackp - de_stack) >= (STACK_SIZE - 1)) But that's my personal style and I like to over-parenthesis.

2 5

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 19/52: CVE-2014-0210: unvalidated length in _fs_recv_conn_setup() from xorg/lib/libXfont commit 891e084b26837162b12f841060086a105edde86d
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 94c6de0649cd295044b1e4ff7265949c9c787519 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 21:03:33 2015 -0500 > > CVE-2014-0210: unvalidated length in _fs_recv_conn_setup() from xorg/lib/libXfont commit 891e084b26837162b12f841060086a105edde86d > > The connection setup reply from the font server can include a list > of alternate servers to contact if this font server stops working. > > The reply specifies a total size of all the font server names, and > then provides a list of names. _fs_recv_conn_setup() allocated the > specified total size for copying the names to, but didn't check to > make sure it wasn't copying more data to that buffer than the size > it had allocated. > --- > nx-X11/lib/font/fc/fserve.c | 21 ++++++++++++++++++--- > 1 file changed, 18 insertions(+), 3 deletions(-) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index bac0b8e..0fdcc1d 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -2782,7 +2782,7 @@ _fs_recv_conn_setup (FSFpePtr conn) > int ret; > fsConnSetup *setup; > FSFpeAltPtr alts; > - int i, alt_len; > + unsigned int i, alt_len; > int setup_len; > char *alt_save, *alt_names; > > @@ -2809,9 +2809,9 @@ _fs_recv_conn_setup (FSFpePtr conn) > } > if (setup->num_alternates) > { > + size_t alt_name_len = setup->alternate_len << 2; > alts = (FSFpeAltPtr) xalloc (setup->num_alternates * > - sizeof (FSFpeAltRec) + > - (setup->alternate_len << 2)); > + sizeof (FSFpeAltRec) + alt_name_len); > if (alts) > { > alt_names = (char *) (setup + 1); > @@ -2820,10 +2820,25 @@ _fs_recv_conn_setup (FSFpePtr conn) > { > alts[i].subset = alt_names[0]; > alt_len = alt_names[1]; > + if (alt_len >= alt_name_len) { > + /* > + * Length is longer than setup->alternate_len > + * told us to allocate room for, assume entire > + * alternate list is corrupted. > + */ > +#ifdef DEBUG > + fprintf (stderr, > + "invalid alt list (length %lx >= %lx)\n", > + (long) alt_len, (long) alt_name_len); > +#endif > + free(alts); Shouldn't this be xfree(alts) if using xalloc previously?

2 3

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 23/52: CVE-2014-0210: unvalidated length fields in fs_read_query_info() from xorg/lib/libXfont commit 491291cabf78efdeec8f18b09e14726a9030cc8f
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit c6aebf9284855a0e24ad9c5ffdd36aa65e16bec7 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:08:09 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_query_info() from xorg/lib/libXfont commit 491291cabf78efdeec8f18b09e14726a9030cc8f > > fs_read_query_info() parses a reply from the font server. The reply > contains embedded length fields, none of which are validated. This > can cause out of bound reads in either fs_read_query_info() or in > _fs_convert_props() which it calls to parse the fsPropInfo in the reply. > --- > nx-X11/lib/font/fc/fsconvert.c | 19 ++++++++++++++----- > nx-X11/lib/font/fc/fserve.c | 40 ++++++++++++++++++++++++++++++++++++++-- > 2 files changed, 52 insertions(+), 7 deletions(-) > > [...] > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 7762653..2a6f6c9 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -865,6 +865,7 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FSFpePtr conn = (FSFpePtr) fpe->private; > fsQueryXInfoReply *rep; > char *buf; > + long bufleft; /* length of reply left to use */ Please initialize variables. Even if they are re-set later on. long bufleft = 0; > fsPropInfo *pi; > fsPropOffset *po; > pointer pd; > @@ -895,7 +896,10 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > > buf = (char *) rep; > buf += SIZEOF(fsQueryXInfoReply); > - > + > + bufleft = rep->length << 2; > + bufleft -= SIZEOF(fsQueryXInfoReply); > + > /* move the data over */ > fsUnpack_XFontInfoHeader(rep, pInfo); > > @@ -903,19 +907,51 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > _fs_init_fontinfo(conn, pInfo); > > /* Compute offsets into the reply */ > + if (bufleft < SIZEOF(fsPropInfo)) > + { > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, "fsQueryXInfo: bufleft (%ld) < SIZEOF(fsPropInfo)\n", > + bufleft); > +#endif > + goto bail; > + } > pi = (fsPropInfo *) buf; > buf += SIZEOF (fsPropInfo); > + bufleft -= pi->num_offsets * SIZEOF(fsPropOffset); This looks wrong. You probably meant to use: bufleft -= SIZEOF (fsPropInfo); > + if (bufleft < pi->data_len) This looks wrong, too. Check: https://git.centos.org/blob/rpms!libXfont.git/cf1e18c13a5ba2054e36a6f0b044c… You probably meant to use: if ((bufleft / SIZEOF(fsPropOffset)) < pi->num_offsets) or if (bufleft < (SIZEOF(fsPropOffset) * pi->num_offsets)) and > + { > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, > + "fsQueryXInfo: bufleft (%ld) < data_len (%d)\n", > + bufleft, pi->data_len); here either: "fsQueryXInfo: (bufleft / SIZEOF(fsPropOffset)) (%ld) < pi->num_offsets (%d)\n", bufleft / SIZEOF(fsPropOffset), pi->num_offsets); or "fsQueryXInfo: bufleft (%ld) < (SIZEOF(fsPropOffset) * pi->num_offsets) (%d)\n", bufleft, SIZEOF(fsPropOffset) * pi->num_offsets); depending on what you used before. > +#endif > + goto bail; > + } > po = (fsPropOffset *) buf; > buf += pi->num_offsets * SIZEOF(fsPropOffset); > + bufleft -= pi->data_len; Same problem here. Should be: bufleft -= pi->num_offsets * SIZEOF(fsPropOffset); > + { This block will ALWAYS be executed and ALWAYS *FAIL*! You're missing (*before* the curly brace): if (bufleft < pi->data_len) > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, > + "fsQueryXInfo: bufleft (%ld) < data_len (%d)\n", > + bufleft, pi->data_len); > +#endif > + goto bail; > + } > pd = (pointer) buf; > buf += pi->data_len; > + bufleft -= pi->data_len; > > /* convert the properties and step over the reply */ > ret = _fs_convert_props(pi, po, pd, pInfo); > + bail: > _fs_done_read (conn, rep->length << 2); > - > + > if (ret == -1) > { > fs_cleanup_bfont (bfont); This looks OK again.

2 4

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 12/52: Move COPYING.full+lite as COPYING to /
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 902dc519d96be582088e5fe0644cefac7ecc0133 > Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> > Date: Sat Feb 14 15:58:11 2015 +0100 > > Move COPYING.full+lite as COPYING to / > > Adapted packaging scripts: > > debian/roll-tarballs.sh > nx-libs.spec > --- > debian/COPYING.full+lite => COPYING | 0 > debian/roll-tarballs.sh | 1 - > nx-libs.spec | 11 +++++++---- > 3 files changed, 7 insertions(+), 5 deletions(-) > > diff --git a/debian/COPYING.full+lite b/COPYING > similarity index 100% > rename from debian/COPYING.full+lite > rename to COPYING > diff --git a/debian/roll-tarballs.sh b/debian/roll-tarballs.sh > index fcb8367..c7cac5f 100755 > --- a/debian/roll-tarballs.sh > +++ b/debian/roll-tarballs.sh > @@ -96,7 +96,6 @@ else > echo ${file##*/} >> doc/applied-patches/series > done > fi > -cp -v debian/COPYING.full+lite COPYING > > # apply all patches shipped in debian/patches and create a copy of them that we ship with the tarball > if [ -s "doc/applied-patches/series" ]; then > diff --git a/nx-libs.spec b/nx-libs.spec > index 5c1064f..f4084d9 100644 > --- a/nx-libs.spec > +++ b/nx-libs.spec > @@ -768,7 +768,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files > %defattr(-,root,root) > -%doc nx-X11/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nx-X11/README Have you removed LICENSE by accident or was that intended? > %dir %{_libdir}/nx > %dir %{_libdir}/nx/X11 > %dir %{_datadir}/nx > @@ -913,7 +914,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcomp3 > %defattr(-,root,root) > -%doc nxcomp/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nxcomp/README Same here. > %_libdir/libXcomp.so.3* > > %files -n libXcompext-devel > @@ -924,7 +926,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcompext3 > %defattr(-,root,root) > -%doc nxcompext/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nxcompext/README Same here. > %_libdir/libXcompext.so.3* > > %files -n libXcompshad-devel > @@ -944,7 +947,7 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcompshad3 > %defattr(-,root,root) > -%doc nxcompshad/{COPYING,LICENSE} > +%doc COPYING Same here.

3 4

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 32/52: dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit d4c76981f7fddb364166464c571ed8d3de3086cd > Author: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Date: Mon Jan 6 23:30:14 2014 -0800 > > dix: integer overflow in GetHosts() [CVE-2014-8092 2/4] > > GetHosts() iterates over all the hosts it has in memory, and copies > them to a buffer. The buffer length is calculated by iterating over > all the hosts and adding up all of their combined length. There is a > potential integer overflow, if there are lots and lots of hosts (with > a combined length of > ~4 gig). This should be possible by repeatedly > calling ProcChangeHosts() on 64bit machines with enough memory. > > This patch caps the list at 1mb, because multi-megabyte hostname > lists for X access control are insane. > > v2: backport to nx-libs 3.6.x (Mike DePaulo) > Reported-by: Ilja Van Sprundel <ivansprundel(a)ioactive.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Reviewed-by: Peter Hutterer <peter.hutterer(a)who-t.net> > > Conflicts: > os/access.c > --- > nx-X11/programs/Xserver/os/access.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/nx-X11/programs/Xserver/os/access.c b/nx-X11/programs/Xserver/os/access.c > index b6a70a7..0e9d138 100644 > --- a/nx-X11/programs/Xserver/os/access.c > +++ b/nx-X11/programs/Xserver/os/access.c > @@ -1719,6 +1719,10 @@ GetHosts ( > { > nHosts++; > n += (((host->len + 3) >> 2) << 2) + sizeof(xHostEntry); > + /* Could check for INT_MAX, but in reality having more than 1mb of > + hostnames in the access list is ridiculous */ > + if (n >= 1048576) Not an error: I'd change the number "1048576" to "1024*1024", because "1048576" is not easily recognized as 1 MB while the latter is more clear (and the compiler statically optimizes it at compile/preprocessing time anyway.) if (n >= 1024*1024) Everything else looks fine.

1 1

Where can I download the NXagent source code?
by Chernousov Anton 16 Feb '15

16 Feb '15

Hi! I trying to compile from source x2goserver and can't find GIT repository for nxagent. Please tell me where it is. :) Thank you for your assistance. ================ *Chernousov Anton.* E-mail: anton(a)th22.ru Skype: anton10146 Web: http://th22.ru

2 1

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 01/01: Fix FTBFS due to the nxproxy executable already existing under /usr/lib/nx/bin/nx
by Mike Gabriel 16 Feb '15

16 Feb '15

HI Michael, On Sa 14 Feb 2015 23:07:49 CET, git-admin wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.5.0.x > in repository nx-libs. > > commit 7b0c8a2acdb866f23c0569b4ba549e9e8c94428e > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sat Feb 14 17:07:21 2015 -0500 > > Fix FTBFS due to the nxproxy executable already existing under > /usr/lib/nx/bin/nx > --- > debian/Makefile.nx-libs | 2 -- > debian/changelog | 2 ++ > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/debian/Makefile.nx-libs b/debian/Makefile.nx-libs > index 3aeda73..52326fb 100644 > --- a/debian/Makefile.nx-libs > +++ b/debian/Makefile.nx-libs > @@ -62,8 +62,6 @@ install-lite: > $(INSTALL_DIR) $(DESTDIR)$(BINDIR) > for d in nxcomp nxproxy; do \ > $(MAKE) -C $$d install; done > - mkdir -p $(DESTDIR)$(NXLIBDIR)/bin/ > - mv $(DESTDIR)$(BINDIR)/nxproxy $(DESTDIR)$(NXLIBDIR)/bin/ > for f in nxproxy; do \ > $(INSTALL_PROGRAM) bin/$$f $(DESTDIR)$(BINDIR); done > For the record: o this fixes builds for all jobs on jenkins.x2go.org o it fixes the .deb packages o it breaks the .rpm packages (the ELF executable is missing in /usr/lib/nx/bin/nxproxy, whereas /usr/bin/nxproxy is only the wrapper script). /me is taking a deeper look at the different behaviours of debian/rules and nx-libs.spec at build time. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] branch 3.6.x updated (1fd8551 -> 1ea1cd8)
by Mihai Moldovan 16 Feb '15

16 Feb '15

Everything not mentioned looks either fine or rather passes basic sanity and plausibility checks.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 44/52: glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093 2/6]
by Mihai Moldovan 15 Feb '15

15 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit cdf0c3e65670c797a4fd0617d44d2bdff4011815 > Author: Adam Jackson <ajax(a)redhat.com> > Date: Mon Nov 10 12:13:37 2014 -0500 > > glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093 2/6] > > Before this we'd just clamp the image size to 0, which was just > hideously stupid; if the parameters were such that they'd overflow an > integer, you'd allocate a small buffer, then pass huge values into (say) > ReadPixels, and now you're scribbling over arbitrary server memory. > > v2: backport to nx-libs 3.6.x (Mike DePaulo) > > Reviewed-by: Keith Packard <keithp(a)keithp.com> > Reviewed-by: Julien Cristau <jcristau(a)debian.org> > Reviewed-by: Michal Srb <msrb(a)suse.com> > Reviewed-by: Andy Ritger <aritger(a)nvidia.com> > Signed-off-by: Adam Jackson <ajax(a)redhat.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Signed-off-by: Fedora X Ninjas <x(a)fedoraproject.org> > Signed-off-by: Dave Airlie <airlied(a)redhat.com> > --- > nx-X11/programs/Xserver/GL/glx/singlepix.c | 14 +++++++------- > nx-X11/programs/Xserver/GL/glx/singlepixswap.c | 14 +++++++------- > 2 files changed, 14 insertions(+), 14 deletions(-) > > diff --git a/nx-X11/programs/Xserver/GL/glx/singlepix.c b/nx-X11/programs/Xserver/GL/glx/singlepix.c > index 845c46a..be804d8 100644 > --- a/nx-X11/programs/Xserver/GL/glx/singlepix.c > +++ b/nx-X11/programs/Xserver/GL/glx/singlepix.c > @@ -70,7 +70,7 @@ int __glXDisp_ReadPixels(__GLXclientState *cl, GLbyte *pc) > swapBytes = *(GLboolean *)(pc + 24); > lsbFirst = *(GLboolean *)(pc + 25); > compsize = __glReadPixels_size(format,type,width,height); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst); > @@ -130,7 +130,7 @@ int __glXDisp_GetTexImage(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width, height, and depth would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,level,format,type,width,height,depth); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -227,7 +227,7 @@ int __glXDisp_GetSeparableFilter(__GLXclientState *cl, GLbyte *pc) > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > compsize2 = __glGetTexImage_size(target,1,format,type,height,1,1); > > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > if (compsize2 < 0) compsize2 = 0; NO ACTION NEEDED: This is bad, bad, bad. compsize is checked, but compsize2 completely ignored. However, a later patch fixes this, so we are good. > compsize = __GLX_PAD(compsize); > compsize2 = __GLX_PAD(compsize2); > @@ -291,7 +291,7 @@ int __glXDisp_GetConvolutionFilter(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width and height would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,1,format,type,width,height,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -346,7 +346,7 @@ int __glXDisp_GetHistogram(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -389,7 +389,7 @@ int __glXDisp_GetMinmax(__GLXclientState *cl, GLbyte *pc) > reset = *(GLboolean *)(pc + 13); > > compsize = __glGetTexImage_size(target,1,format,type,2,1,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -436,7 +436,7 @@ int __glXDisp_GetColorTable(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > diff --git a/nx-X11/programs/Xserver/GL/glx/singlepixswap.c b/nx-X11/programs/Xserver/GL/glx/singlepixswap.c > index ff68ece..cdc6f16 100644 > --- a/nx-X11/programs/Xserver/GL/glx/singlepixswap.c > +++ b/nx-X11/programs/Xserver/GL/glx/singlepixswap.c > @@ -79,7 +79,7 @@ int __glXDispSwap_ReadPixels(__GLXclientState *cl, GLbyte *pc) > swapBytes = *(GLboolean *)(pc + 24); > lsbFirst = *(GLboolean *)(pc + 25); > compsize = __glReadPixels_size(format,type,width,height); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); > glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst); > @@ -148,7 +148,7 @@ int __glXDispSwap_GetTexImage(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width, height, and depth would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,level,format,type,width,height,depth); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -257,7 +257,7 @@ int __glXDispSwap_GetSeparableFilter(__GLXclientState *cl, GLbyte *pc) > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > compsize2 = __glGetTexImage_size(target,1,format,type,height,1,1); > > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > if (compsize2 < 0) compsize2 = 0; NO ACTION NEEDED: Same problem here. Everything else in this patch looks fine.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 29/52: CVE-2014-0210: unvalidated length fields in fs_read_list_info() from xorg/lib/libXfont commit d338f81df1e188eb16e1d6aeea7f4800f89c1218
by Mihai Moldovan 15 Feb '15

15 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit b65259bf3bcca15b5069cb7a6c06f95a40f79813 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:38:32 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_list_info() from xorg/lib/libXfont commit d338f81df1e188eb16e1d6aeea7f4800f89c1218 > > fs_read_list_info() parses a reply from the font server. The reply > contains a number of additional data items with embedded length or > count fields, none of which are validated. This can cause out of > bound reads when looping over these items in the reply. > --- > nx-X11/lib/font/fc/fserve.c | 56 ++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 55 insertions(+), 1 deletion(-) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 60d9017..6ba3ad4 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -2500,6 +2500,7 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FSBlockedListInfoPtr binfo = (FSBlockedListInfoPtr) blockrec->data; > fsListFontsWithXInfoReply *rep; > char *buf; > + long bufleft; Same here. Everything else in this patch looks OK.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 27/52: CVE-2014-0210: unvalidated length fields in fs_read_glyphs() from xorg/lib/libXfont commit 520683652564c2a4e42328ae23eef9bb63271565
by Mihai Moldovan 15 Feb '15

15 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit ece51493f1d970f45e53588e33a700464a42fbab > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:27:47 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_glyphs() from xorg/lib/libXfont commit 520683652564c2a4e42328ae23eef9bb63271565 > > fs_read_glyphs() parses a reply from the font server. The reply > contains embedded length fields, none of which are validated. > This can cause out of bound reads when looping over the glyph > bitmaps in the reply. > --- > nx-X11/lib/font/fc/fserve.c | 29 ++++++++++++++++++++++++++++- > 1 file changed, 28 insertions(+), 1 deletion(-) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 79de4f3..26218e5 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -1916,6 +1916,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FontInfoPtr pfi = &pfont->info; > fsQueryXBitmaps16Reply *rep; > char *buf; > + long bufleft; /* length of reply left to use */ I'd also initialize this: long bufleft = 0; Everything else here is OK.

1 0

Re: [X2Go-Dev] Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Michael DePaulo 15 Feb '15

15 Feb '15

2015-02-15 8:31 GMT-05:00 Mike DePaulo <mikedep333(a)gmail.com>: > bQBuWYZZrHSq5sOQcsDIQWu+r/7qcjvr+dyRT+OpvosVpZFpWXshb9a7gEBqB85/ Sorry, please ignore that email. I told ThunderBird with the EnigMail extension to send the email about CVEs being mitigated by "-nolisten TCP" twice because the 1st time produced an error message. For whatever reason, the 1st time it was sent, but it was sent encrypted. The 2nd time, it was sent successfully, and was signed.

1 0

Re: [X2Go-Dev] Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Mike DePaulo 15 Feb '15

15 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Sat, Feb 14, 2015 at 12:43 PM, Mike DePaulo <mikedep333(a)gmail.com> wrote: > ... > https://docs.google.com/spreadsheets/d/1WeneRYO2TkXYOl5J0WozThsLkreF1DiuJAv… > > > ... > > Also, note that by default, X2GO launches nxagent (the nx-libs X > server) with "-nolisten tcp". This is configurable in > /etc/x2go/x2goagent.options . This setting mitigates many of the > vulnerabilities by preventing nxagent from ever talking to X11 > clients not running on the X2Go Server. I will now be determining > which vulnerabilities it does mitigate. Most CVEs are mitigated by "-nolisten TCP", or are N/A because the CVEs can only be exploited by local X11 clients (X11 applications) anyway. "-nolisten TCP" is especially important for mitigating CVE-2014-8091 because an X11 client need not be authenticated to exploit it. An exploit would result in nxagent (and thus your X2Go session) crashing. (In layman's terms, unless you kept "-nolisten TCP" set, someone on the network can crash every X2Go session running on an X2Go server.) 2 CVEs are not mitigated by "-nolisten TCP": 2014-0210 CVE-2014-0211 A malicious remote X Font Server can trigger these vulnerabilities, even when the X11 clients are running locally on the X2Go server. - -Mike#2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlTgn+8ACgkQIFy22CVQsitHFwD/X2v6kUmf1+vVGbG5gvYMAT7d YlZ5Ks62wwK6eSutNR0BAJAI7H83e8TBtIc3vs0OIZamn3tCfBwJ3WZsjwOWT7WC =eykp -----END PGP SIGNATURE-----

1 0

Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Mike DePaulo 14 Feb '15

14 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello X2Go Developers, Over the last few weeks, I have been auditing nx-libs against all the vulnerabilities (CVEs) in X.org 6.9.0. nx-libs 3.5.0 (released by NoMachine in 2011) contains a fork of X.org 6.9.0 (released in December 2005). So our concern was that a large percentage of the X.org vulnerabilities announced since X.org 6.9.0 affect nx-libs. I wrote a spreadsheet with the results of my audit here. Note that I have not actually tested whether the vulnerabilities affect us. For example, I have not tried out any proof-of-concept exploits. But if the vulnerable code is present, and the vulnerable code is not totally ignored by nx-libs, then I assumed that the vulnerability affects nx-libs. The only exception is CVE-2013-1940; I inferred that it does not affect us because it only affects VT switching on Linux, and nx-libs does not use VTs. https://docs.google.com/spreadsheets/d/1WeneRYO2TkXYOl5J0WozThsLkreF1DiuJAv… To summarize the results: 1. Some vulnerabilities do not affect us for various reasons. Often because the code was removed by NoMachine. 2. NoMachine did a very good job of patching the vulnerabilities. The earliest vulnerability that was unpatched, CVE-2011-2895, was announced on 2011-08-10. 3. The majority of the vulnerabilities after 2011-08-10 did affect nx-libs 3.5.0.x and nx-libs 3.6.x. I fixed these and the fixes are now in git. See details below. As I audited nx-libs, I fixed each vulnerability. Before the December 2014 vulnerabilities, I backported the commit/patch from upstream X.org. For the December 2014 vulnerabilities, which were numerous and whose patches/commits were hard to merge, I obtained the patches from RHEL5 instead. RHEL 5 uses X.org 7.1 (xorg-server 1.1.1), so their patches were easier to apply to nx-libs. I am a beginner at programming in C. So I asked Mike#1 (Mike Gabriel) to review my work. He did, and did not find any issues. I still welcome further review though. Mike#1 committed my work to the 3.6.x branch: 1st commit: http://code.x2go.org/gitweb?p=nx-libs.git;a=commit;h=af55da1e9c1a6a352b2482… last (40th) commit: http://code.x2go.org/gitweb?p=nx-libs.git;a=commit;h=1ea1cd8c4f93b0c03e5b34… He also committed it to the 3.5.0.x branch as one commit with 40 patch files: http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=4587881130db36125c… However, because many lines of code have been changed, Mike#1 and I agreed that we will not release 3.5.0.29 with these fixes immediately. Instead, we will let users/developers do some testing to see if any regressions were introduced. Also, note that by default, X2GO launches nxagent (the nx-libs X server) with "-nolisten tcp". This is configurable in /etc/x2go/x2goagent.options . This setting mitigates many of the vulnerabilities by preventing nxagent from ever talking to X11 clients not running on the X2Go Server. I will now be determining which vulnerabilities it does mitigate. - -Mike#2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlTfiSUACgkQIFy22CVQsitDXAEAlte83RMq3iy218Q7zXggAb0R XpvCpQYOYnaZenHPqQsBAMVfH8olUE1mh6DNfTgeC2909c1t4JDAjx3pSEdSDdL5 =mUvD -----END PGP SIGNATURE-----

1 0

Bug#785: 785
by Sergey Savko 13 Feb '15

13 Feb '15

Yes, it's work. Thank you. This bug does not appear after turning on this option? https://bugs.launchpad.net/ubuntu/+source/libxrandr/+bug/985202 ----- Исходное сообщение ----- От: "Ulrich Sibiller" <uli42(a)gmx.de> Кому: "Sergey Savko" <savko(a)tophouse.ru> Отправленные: Пятница, 13 Февраль 2015 г 0:27:55 Тема: Re: 785 Ok, please enable the XFIXES extension. This can be done in /etc/x2go/x2goagent.options Ensure that you find +extension XFIXES in there: X2GO_NXAGENT_DEFAULT_OPTIONS+=" +extension XFIXES" Uli On Thu, Feb 12, 2015 at 9:33 PM, Sergey Savko <savko(a)tophouse.ru> wrote: > Versions x2goclient > Windows x2goclient 4.0.3.1 > Linux x2goclient: > $ apt-show-versions | grep x2goclient > x2goclient 4.0.3.2-0x2go1 newer than version in archive > nx-libs 3.5.0.29-0 > > $xdpyinfo > > name of display: :50 > version number: 11.0 > vendor string: The X.Org Foundation > vendor release number: 70000000 > X.Org version: 7.0.0 > maximum request size: 16777212 bytes > motion buffer size: 256 > bitmap unit, bit order, padding: 32, LSBFirst, 32 > image byte order: LSBFirst > number of supported pixmap formats: 7 > supported pixmap formats: > depth 1, bits_per_pixel 1, scanline_pad 32 > depth 4, bits_per_pixel 8, scanline_pad 32 > depth 8, bits_per_pixel 8, scanline_pad 32 > depth 15, bits_per_pixel 16, scanline_pad 32 > depth 16, bits_per_pixel 16, scanline_pad 32 > depth 24, bits_per_pixel 32, scanline_pad 32 > depth 32, bits_per_pixel 32, scanline_pad 32 > keycode range: minimum 8, maximum 255 > focus: window 0x1000018, revert to PointerRoot > number of extensions: 26 > BIG-REQUESTS > DAMAGE > DEC-XTRAP > DOUBLE-BUFFER > DPMS > Extended-Visual-Information > GLX > MIT-SHM > MIT-SUNDRY-NONSTANDARD > RANDR > RECORD > RENDER > SECURITY > SGI-GLX > SHAPE > SYNC > TOG-CUP > X-Resource > XC-APPGROUP > XC-MISC > XFree86-Bigfont > XINERAMA > XInputExtension > XKEYBOARD > XTEST > XVideo > default screen number: 0 > number of screens: 1 > > screen #0: > dimensions: 1920x1087 pixels (508x288 millimeters) > resolution: 96x96 dots per inch > depths (7): 24, 1, 4, 8, 15, 16, 32 > root window id: 0x59 > depth of root window: 24 planes > number of colormaps: minimum 1, maximum 1 > default colormap: 0x3f > default number of colormap cells: 256 > preallocated pixels: black 0, white 16777215 > options: backing-store YES, save-unders YES > largest cursor: 1920x1087 > current input event mask: 0xfac031 > KeyPressMask EnterWindowMask LeaveWindowMask > KeymapStateMask ExposureMask StructureNotifyMask > SubstructureNotifyMask SubstructureRedirectMask FocusChangeMask > PropertyChangeMask ColormapChangeMask > number of visuals: 5 > default visual id: 0x3a > visual: > visual id: 0x3a > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3b > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3c > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3d > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3e > class: StaticColor > depth: 24 planes > available colormap entries: 256 > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > > > ----- Исходное сообщение ----- > От: "Ulrich Sibiller" <uli42(a)gmx.de> > Кому: "Sergey Savko" <savko(a)tophouse.ru> > Отправленные: Четверг, 12 Февраль 2015 г 22:54:35 > Тема: Re: 785 > > On Thu, Feb 12, 2015 at 4:02 PM, Sergey Savko <savko(a)tophouse.ru> wrote: >> I tested with lastest nx-libs. Bug is present. >> Last video with this bug: http://youtu.be/QTk1G1jLT-I > > Hmm, interesting. > > I suspect that your client is too old. What is it's version? What > nx-libs are included there? > > And please post the output of xdpyinfo in your session. > > Uli > > -- > Yours truly, > Sergey Savko. -- С уважением, Сергей Савко, начальник IT отдела. +7-931-361-04-02

2 2

Bug#785: 785
by Sergey Savko 12 Feb '15

12 Feb '15

I tested with lastest nx-libs. Bug is present. Last video with this bug: http://youtu.be/QTk1G1jLT-I -- Yours truly, Sergey Savko.

1 0

Bug#785: Bug#785: Bug#785: x2go clipboard bug
by Sergey Savko 11 Feb '15

11 Feb '15

To be precise it's not quite FreeNX. This patched FreeNX, called the RX from the company etersoft. Tomorrow I will try to update and test. -- Yours truly, Sergey Savko. ----- Исходное сообщение ----- От: "Ulrich Sibiller" <uli42(a)gmx.de> Кому: "Sergey Savko" <savko(a)tophouse.ru> Отправленные: Четверг, 12 Февраль 2015 г 0:34:29 Тема: Re: [X2Go-Dev] Bug#785: Bug#785: x2go clipboard bug So then try a newer x2go version. You should ensure that nx-libs is 3.5.0.28. Regarding FreeNX: I am pretty sure nx 3.4.0 did not have that clipboard problem I fixed in 3.5.0.28. Uli

1 0

Bug#785: x2go clipboard bug
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal x2goclient doesnt work with clipboard properly. When you copy a file to clipboard and closed a source directory its just disapear from clipboard . It's with plain text also. When you copy to clipboard a part of a text from text document and then closed a text editor, the clipboard will be empty. -- Yours truly, Sergey Savko.

4 5

Re: [X2Go-Dev] CUPS-X2Go (3.0.1.1) released
by Orion Poplawski 11 Feb '15

11 Feb '15

On 02/10/2015 01:24 PM, Mihai Moldovan wrote: > Dear all > > The X2Go project is proud to announce a new release of the X2Go > component ,,cups-x2go''. > > New gains of this version of ,,cups-x2go'' are: > > o better RPM package support > > > X2Go Component: cups-x2go > Version: 3.0.1.1 > Status: RELEASE > Date: Tue, 10 Feb 2015 20:03:16 +0100 > Changes: > cups-x2go (3.0.1.1) RELEASED; urgency=low > . > [ Mike Gabriel ] > * New upstream version (3.0.1.1): > - Rename LICENSE.txt to COPYING. > * cups-x2go.spec: > + Pull-in packaging stuff from Jan Engelhardt's .spec files > on > https://build.opensuse.org/package/view_file/X11:RemoteDesktop:x2go. > + Make package arch-any, not noarch. I don't understand the reason for this change, it seems clearly to be a noarch package. Also, FYI: - on Fedora ssh is in openssh-clients. - cups backends go in %{_prefix}/lib, not %_libexecdir - You install the cups-x2go with 755: install -pm755 cups-x2go %{buildroot}%{_prefix}/lib/cups/backend/ then change it to 700 in %files: %attr(0700,root,root) %_libexecdir/cups/backend/cups-x2go Is there any reason for it to be 700? I see other stuff in that directory is a mix: -rwxr-xr-x. 1 root root 149216 Sep 23 06:37 bluetooth -rwx------. 1 root root 23648 Oct 22 03:30 dnssd - I have no idea about non-Fedora/RHEL distros, but %defattr() is no longer needed for any modern (RHEL5+) rpm systems. - Alsi, in Fedora, you should not own directories own by other packages that it requires. I have: %files %doc ChangeLog COPYING README.txt %{_prefix}/lib/cups/backend/cups-x2go %config(noreplace) %{_sysconfdir}/cups/cups-x2go.conf %{_datadir}/ppd/cups-x2go/ %{_datadir}/x2go/ -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

3 6

Bug#787: x2goclient
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal Windows x2goclient crashes when connecting to server if user's home directory name in cyrillic. If we use "--home=<dir>" parametr with new home directory with latin name, x2goclient works fine. -- Yours truly, Sergey Savko.

1 0

Bug#785: 785
by Sergey Savko 11 Feb '15

11 Feb '15

Clipboard in local Debian 7 and Kubuntu 14.04 it's work too. -- Yours truly, Sergey Savko.

1 0

Bug#786: x2goclient copy cyrillic text from x2go to local linux
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal If you copy in x2go Cyrillic text and paste it into local Linux, you'll get text in wrong codepage. -- Yours truly, Sergey Savko.

1 0

Bug#304: X2Go issue (in src:x2goplasmabindings) has been marked as closed
by X2Go Release Manager 10 Feb '15

10 Feb '15

close #304 thanks Hello, we are very hopeful that X2Go issue #304 reported by you has been resolved in the new release (3.0.2.1) of the X2Go source project »src:x2goplasmabindings«. You can view the complete changelog entry of src:x2goplasmabindings (3.0.2.1) below, and you can use the following link to view all the code changes between this and the last release of src:x2goplasmabindings. http://code.x2go.org/gitweb?p=x2goplasmabindings.git;a=commitdiff;h=39032a2… If you feel that the issue has not been resolved satisfyingly, feel free to reopen this bug report or submit a follow-up report with further observations described based on the new released version of src:x2goplasmabindings. Thanks a lot for contributing to X2Go!!! light+love X2Go Git Admin (on behalf of the sender of this mail) --- X2Go Component: src:x2goplasmabindings Version: 3.0.2.1-0x2go1 Status: RELEASE Date: Tue, 10 Feb 2015 23:22:29 +0100 Fixes: 304 Changes: x2goplasmabindings (3.0.2.1-0x2go1) RELEASED; urgency=low . [ Mike Gabriel ] * New upstream version (3.0.2.1): - Add copyright notices to file headers. Add COPYING file (LGPL-2). (Fixes: #304). - CMakeLists.txt. Set application name to plasma-applet-x2goplasmoid. - Fix installation path of Bokmal translation file by renaming po/nb_no.po to po/nb_NO.po. * debian/copyright: + Update file. Make it DEP-5 compliant. * x2goplasmabindings.spec: + Adapt to building on openSUSE/SLES. + Different RPM distros have different or no %cmake macro. + Find a common cmake approach for all RPM distros. + Drop ctest call. No tests present. + The plasmoid ends up in %{_libexecdir} (not %{_libdir}). + Rename plasma-widget-x2go to plasma-addons-x2go. + Use non-stanard Group: on SUSE. + Add to BR: intltool (otherwise no i18n support). + Set KDE4_PLASMA_LIBS instead of CMAKE_INSTALL_LIBDIR. + Set PLUGIN_INSTALL_DIR explicitly when evoking make install (should fix FTBFS on EPEL-7 based systems). + Always set BuildRoot: parameter. + For SUSE 11.x: set CMAKE_SKIP_RPATH to ON. + Be more explicit on what files to install and mark our dirs as owned. . [ Martti Pitkänen ] * New upstream version (3.0.2.1): - Add Finnish translation file. . [ Jos Wolfram ] * New upstream version (3.0.2.1): - Add Dutch translation file. . [ Robert Parts ] * New upstream version (3.0.2.1): - Add Estonian translation file. . [ Mark Pedersen-Cook ] * New upstream version (3.0.2.1): - Update Danish translation file. . [ Kaan Ozdincer ] * New upstream version (3.0.2.1): - Add Turkish translation file.

2 1

Bug#653: Info received (Bug#653: Info received (X2go and jetbrains java applications))
by Александр Демидов 10 Feb '15

10 Feb '15

Bug in openjdk platform https://bugs.openjdk.java.net/browse/JDK-7172749 [1] Links: ------ [1] https://bugs.openjdk.java.net/browse/JDK-7172749

2 2

Bug#784: X2Go issue (in src:x2gobroker) has been marked as pending for release
by Mike Gabriel 10 Feb '15

10 Feb '15

tag #784 pending fixed #784 0.0.3.0 thanks Hello, X2Go issue #784 (src:x2gobroker) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=a7d0a25 The issue will most likely be fixed in src:x2gobroker (0.0.3.0). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit a7d0a259447424064f224457a06fa74a3081b486 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Tue Feb 10 09:23:33 2015 +0100 add closure for #784 diff --git a/debian/changelog b/debian/changelog index c1c44e7..3e78007 100644 --- a/debian/changelog +++ b/debian/changelog @@ -101,7 +101,7 @@ x2gobroker (0.0.3.0-0x2go1) UNRELEASED; urgency=low - Provide tool: x2gobroker-testagent. - Allow for broker clients to send in public SSH keys that the client may use for authentication to X2Go Servers. - - broker agent: avoid one option system() calls in Perl. + - broker agent: avoid one option system() calls in Perl. (Fixes: #784). - For user context changes: set the HOME dir of the new user correctly. - Reduce Paramiko/SSH verbosity (logging.ERROR) when connecting to remote broker agents.

2 1

Bug#784: x2gobroker-agent.pl commands break if user shell environment has login settings it doesn't like
by Jason Alavaliant 10 Feb '15

10 Feb '15

Package: x2gobroker-agent Version: 0.0.2.3 One of my users started to get their connections to the x2go broker failing with 'Error downloading http://x2go-broker-url/plain/inifile - server replied: Internal Server Error' Tracking back through the commands the broker was logging the issue turned out be /usr/lib/x2go/x2gobroker-agent $USER listsessions (and other commands that x2gobroker-agent.pl runs by su - username -c command) returning things like OK [1] 32542 klipper: Command not found. [1] + exit 1 klipper which was a result of how the command is run; since the x2gobroker-agent $USER FOO commands all internally su to the named user to run the command it results in the user's environment being sourced which puts them at the risk of being broken by the user's environment. My user in this case had embedded a command that didn't exist on the broker host to run as soon as their shell environment was created which caused the broker to error out. (possibly compounded by in this case the shell tcsh being used as the user's default shell - tcsh in my experience being very temperamental with it's startup files - a single failure will stop the environment file sourcing to error our instantly and not process further lines. I've not had time to cross compare with bash etc and see if this problem only exists for tcsh or if it effects most shells). I managed to work around the issue in my case by fixing the su commands in x2gobroker-agent.pl to use /bin/sh (which links to /bin/dash) on my system to avoid user shell startup file environment issues breaking logging in via the broker. It feels more like a workaround that a proper fix to me so I'm not suggesting the attached patch for merging, rather just as an example of how I got around it in my case. My feeling is that there must be a better way to ensure these x2gobroker-agent commands can't be broken by the user env but I'm not managing to come up with a better solution currently. Thanks Jason

3 2

Bug#776: nx-X11: Size of pointer 'server_support' used instead of size of its data
by Heinrich Schuchardt 10 Feb '15

10 Feb '15

package: nx-libs version: head In nx-libs/nx-X11/extras/Mesa/src/glx/x11/glxextensions.c the length of the zeroed memory is the length of the pointer (4 bytes in case of a 32bit system) not the length of the data the pointer points to (8 byte). static void __glXProcessServerString( const struct extension_info * ext, const char * server_string, unsigned char * server_support ) { unsigned base; unsigned len; (void) memset( server_support, 0, sizeof( server_support ) ); Furthermore the length of the memory area pointed to by server_support is defined in varying ways in the coding: #define __GL_EXT_BYTES ((__NUM_GL_EXTS + 7) / 8) unsigned char server_support[ __GL_EXT_BYTES ]; unsigned char server_support[8]; Currently __NUM_GL_EXTS = 123, so __GL_EXT_BYTES = 8. What is expected to happen if __GL_EXT_BYTES > 8 after defining six more values in the unamed (sic!) enum with the different bits? This questionable code was identified with cppcheck. http://cppcheck.sourceforge.net/ Best regards Heinrich Schuchardt

3 3

Bug#776: fix for #776 reverted
by Mike Gabriel 10 Feb '15

10 Feb '15

Control: tag -1 not-a-bug Control: close -1 Hi Heinrich, yesterday, I reverted the fix for #776 because while applying all the NX patches in preparation of the 3.6.x branch of nx-libs [1], I realized that the file in question (glxextensions.c) never gets used at build time. Greets, Mike [1] https://github.com/ArcticaProject/nx-libs -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

X2Go Gathering 2015
by Heinz-M. Graesing 09 Feb '15

09 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear Developers, dear friends of ΞX2Go! This year's community event will take place in Treuchtlingen. It is my pleasure to invite all developers and friends to visit this little franconian town. Once again - as we did last year - we will meet for 3 days to hack, discuss and have fun. X2Go was born in 2006 in Treuchtlingen. For our developers, we have reserved a hotel that is not far from the venue. Wi-Fi will be available. The reservation is valid until February 18th. Thus, please declare your participation on our wiki page so that we can make use of this reservation. Other accommodations in Treuchtlingen are available, but it would be great to stay together. Participation list including preliminary schedule and travelling information: http://wiki.x2go.org/doku.php/events:x2go-gathering-2015 Please stay tuned for further information! Regards, Heinz θ θ ∴ϒ∴ ΞX2Go - everywhere@home -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJU2SC0AAoJEKRUbBMT/NRx/UgQAJOIWf0tHuRkCrZdghsWdr2l B9MZJ4nibZLjC9MDNITFXBgxSU/gau2Cd02ek4GXqvWlJQeGKVjXz/rjciKZ+cSK BPmrNiKXKpCcM77XsvAY5Ye7l4IE/o2yBXczrVkfUKbS2jmKwrU0/5G7H2BzurN/ lOUHIBuG/kCeTD8fxBxHz4tIijq5ZXlpteON1Jk0L+8OcOSOSTyZBHLSBYjPXOH6 R2yvRgnA16ogYztt1pdS5x1UzlId8vXpj+AfSOLqzIkIdrNTcN4YgyWqsQPrz40m Q+MOR8N/FoVLDKw0JexlA2Az0MM3tfjzDoXyPoO1COawdkF3wcbVtZNYgN/dTLVK xUff19PhRmzS6PndcmiFVOxlrmtL9ndF+GFlbYcc458iaKptywLoVdbC148bjzQe O23sKP+Q/85ojW2Ca3kgu9J9wRybNVez6ljlLpMq3Gutb8SQ/XTg35s2Ik/wWNZc yeNLD3EhubJVg9/pclDRMW3QmRml6F2PJxLGEPm2OI5K20TZyjGbEgGgVRk1dten yhKkcbt/mTQheTH4wZS0ZmkxNvIywJ/OoL0b0tlZ4WXRFYrXMiKzM99JqHCE2Dbh UUGc9rQihI5u2I/C5uX5mCYEBM1gkqgwiFphFLPX3vIRrM9r5zHzTOLS7a4bePz7 m5pem+mnM3PyjXeA48fs =ea+m -----END PGP SIGNATURE-----

2 1

Bug#783: RPM Pre Script fail on Upgrade (Nightly)
by Schlomo Schapiro 09 Feb '15

09 Feb '15

Package: x2goserver Version: 4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6 RPM Upgrades of existing installations fail because of a broken %pre script in the x2goserver-common RPM: Resolving Dependencies --> Running transaction check ---> Package x2goserver-common.x86_64 0:4.1.0.0-0.0x2go1.0.git20150113.1214.heuler.el6 will be updated ---> Package x2goserver-common.x86_64 0:4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6 will be an update --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================== Package Arch Version Repository Size ============================================================================================================================================== Updating: x2goserver-common x86_64 4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6 is24-x2go-nightly 7.2 k Transaction Summary ============================================================================================================================================== Upgrade 1 Package(s) Total download size: 7.2 k Is this ok [y/N]: y Downloading Packages: x2goserver-common-4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6.x86_64.rpm | 7.2 kB 00:00 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Error in PREIN scriptlet in rpm package x2goserver-common-4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6.x86_64 groupadd: group 'x2gouser' already exists useradd: user 'x2gouser' already exists error: %pre(x2goserver-common-4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6.x86_64) scriptlet failed, exit status 9 error: install: %pre scriptlet failed (2), skipping x2goserver-common-4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6 Running post transaction command: report-yum-to-graphite.sh x2goserver-common-4.1.0.0-0.0x2go1.0.git20150113.1214.heuler.el6.x86_64 was supposed to be removed but is not! Verifying : x2goserver-common-4.1.0.0-0.0x2go1.0.git20150113.1214.heuler.el6.x86_64 1/2 Verifying : x2goserver-common-4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6.x86_64 2/2 Failed: x2goserver-common.x86_64 0:4.1.0.0-0.0x2go1.0.git20150113.1214.heuler.el6 x2goserver-common.x86_64 0:4.1.0.0-0.0x2go1.0.git20150201.1236.heuler.el6 Complete! The bad script is this: if getent group x2gouser 1>/dev/null; then groupadd -r x2gouser fi if getent passwd x2gouser >/dev/null; then useradd -r -g x2gouser -d /var/lib/x2go -s /sbin/nologin \ -c "x2go" x2gouser fi It should have a ! in the if clause to only call groupadd / useradd if the group or user DO NOT EXIST!! Don't you test upgrades??? Regards, Schlomo -- Schlomo Schapiro Systemarchitekt Open Source Evangelist Immobilien Scout GmbH Andreasstraße 10 10243 Berlin Fon +49 30 24 301-1229 Fax +49 30 24 301-1110 Mobile +49 170 753 72 60 schlomo.schapiro(a)immobilienscout24.de https://plus.google.com/100684964212588500616/about ---------------------------------------------------------- Immobilien Scout GmbH - Ein Unternehmen der Scout24-Gruppe Geschäftsführer: Gregory Ellis (CEO) und Christian Gisy (CFO) Handelsregister: Amtsgericht Charlottenburg, HRB 69108 Sitz der Gesellschaft: Berlin ---------------------------------------------------------- http://www.immobilienscout24.de Der Marktführer: Die Nr. 1 rund um Immobilien

4 3

upcoming releases for nearly all X2Go components
by Mike Gabriel 07 Feb '15

07 Feb '15

Hi all, I would like to make a release for nearly all X2Go components. Reason: o .spec files for SLE builds are now complete o several X2Go components are overdue for a release o x2godesktopsharing has now been fixed on x2goserver's master branch (and already way back on release/4.0.1.x branch). As this will be my last release cycle in X2Go (see [1]), I would like to take the chance to do the release cycle together with someone else (e.g. Heinz, Mihai, Stefan). So that the steps are clear and finally get documented. Also, we need to discuss, if it is time to release x2goserver 4.1.0.0 (Git master branch of x2goserver.git) or if we stick with 4.0.1.x (i.e. 4.0.1.19 as upcoming release). Both branches are ready for a release. The 4.1.0.0 has Telekinesis and Multimedia Support + SuperRenicer support. Furthermore, I also want to release NX-libs 3.5.0.29. There have been massive changes on NX-libs recently. The code base of actually used code could be reduced from 93mb to 41mb. It would be good if as many people as possible could test NX-libs from the nightly builds on non-productive systems. People interested in a snapshot tarball, can do this: git clone git://code.x2go.org/nx-libs.git cd nx-libs debian/roll-tarball.sh HEAD server @Heinz, Mihai: who of you is available for doing the next releases with me? @Stefan, Heinz, Alex, Mihai: What is your opinion about releasing X2Go Server 4.1.0.0? @Alex: It would be good if you could take a look at the reduced NX tarball and what I have removed from it (debian/CODE-REDUCTION_*). @Orion: you may also be interested in taking a look at the latest NX changes, I guess. Greets, Mike [1] http://lists.x2go.org/pipermail/x2go-project/2015-January/000002.html -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

3 3

Bug#781: X2Go issue (in src:x2goclient) has been marked as pending for release
by Mike Gabriel 06 Feb '15

06 Feb '15

tag #781 pending fixed #781 4.0.3.2 thanks Hello, X2Go issue #781 (src:x2goclient) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=58e4845 The issue will most likely be fixed in src:x2goclient (4.0.3.2). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 58e4845eb5ccb9ce9d3baca75698c91f7e71377d Author: Sergey_Savko <savko(a)tophouse.ru> Date: Fri Feb 6 14:15:53 2015 +0300 Add new cmdline option --broker-noauth-use-session-username. When --broker-noauth is used, the broker does not know on behalf of which user to operate. This new option enables username syncing. When logging into X2Go Server, that username will be sent to the broker and be used for querying X2Go Broker Agents etc. (Fixes: #781). diff --git a/debian/changelog b/debian/changelog index c6fe947..c40f3ab 100644 --- a/debian/changelog +++ b/debian/changelog @@ -39,6 +39,11 @@ x2goclient (4.0.3.2-0x2go1) UNRELEASED; urgency=medium * New upstream release (4.0.3.2): - Prevent passwordless re-logins into X2Go Session Broker if --broker-autologoff is used on the cmdline. (Fixes: #782). + - Add new cmdline option --broker-noauth-use-session-username. + When --broker-noauth is used, the broker does not know on behalf + of which user to operate. This new option enables username syncing. + When logging into X2Go Server, that username will be sent to the + broker and be used for querying X2Go Broker Agents etc. (Fixes: #781). [ Heinrich Schuchardt ] * New upstream release (4.0.3.2):

2 1

Bug#782: X2Go issue (in src:x2goclient) has been marked as pending for release
by Mike Gabriel 06 Feb '15

06 Feb '15

tag #782 pending fixed #782 4.0.3.2 thanks Hello, X2Go issue #782 (src:x2goclient) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=3f85fe2 The issue will most likely be fixed in src:x2goclient (4.0.3.2). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 3f85fe2186e8d06f8b92eb9b80a9b26ad6da836f Author: Sergey_Savko <savko(a)tophouse.ru> Date: Fri Feb 6 13:30:33 2015 +0300 Prevent passwordless re-logins into X2Go Session Broker if --broker-autologoff is used on the cmdline. (Fixes: #782). diff --git a/debian/changelog b/debian/changelog index afd5bf9..c6fe947 100644 --- a/debian/changelog +++ b/debian/changelog @@ -35,6 +35,11 @@ x2goclient (4.0.3.2-0x2go1) UNRELEASED; urgency=medium * x2goclient.spec: - Always set BuildRoot: parameter. + [ Sergey Savko ] + * New upstream release (4.0.3.2): + - Prevent passwordless re-logins into X2Go Session Broker if + --broker-autologoff is used on the cmdline. (Fixes: #782). + [ Heinrich Schuchardt ] * New upstream release (4.0.3.2): - Base the layout dialogue "Session ID" (which shows up when starting a

2 1

Bug#781: second patch
by Sergey Savko 06 Feb '15

06 Feb '15

-- Yours truly, Sergey Savko.

1 0

Bug#782: x2goclient next login without password after logout
by Sergey Savko 06 Feb '15

06 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: grave x2goclient start in broker mode with «--broker-autologoff» parameter. At the end of the session the user get into the authentication window, we can press the "OK" button and connect without a password under the user who last connected to the system. Video: http://youtu.be/dXu_clQfCtc Add lines config.brokerPass.clear(); config.brokerUser.clear(); in the function "void ONMainWindow :: slotGetBrokerAuth ()" does not help. -- Yours truly, Sergey Savko.

3 2

Bug#782: Patch for 782
by Sergey Savko 06 Feb '15

06 Feb '15

Tag: patch X2goclient connected under the old authid. -- Yours truly, Sergey Savko.

2 1

Bug#728: X2Go issue (in src:x2goserver) has been marked as pending for release
by Mike Gabriel 05 Feb '15

05 Feb '15

tag #728 pending fixed #728 4.0.1.19 thanks Hello, X2Go issue #728 (src:x2goserver) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=7fed553 The issue will most likely be fixed in src:x2goserver (4.0.1.19). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 7fed5538087dcb3ef76128f1830a61b0fc3cbdd9 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Feb 5 12:41:58 2015 +0100 Add man page for x2gogetapps. Weave into that a security / disclaimer message as proposed by Stefan Baur. (Fixes: #728). diff --git a/debian/changelog b/debian/changelog index 1839221..d58144d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -71,6 +71,8 @@ x2goserver (4.0.1.19-0x2go1) UNRELEASED; urgency=medium that. Works around a too-old DBD::SQLite package on SLE 11.x. - Legacy for applications (and X2Go scripts) that expect $SSH_CLIENT to be set in the X2Go session's environment. (Fixes: #644). + - Add man page for x2gogetapps. Weave into that a security / disclaimer + message as proposed by Stefan Baur. (Fixes: #728). * debian/control: + Add D (x2goserver): libfile-which-perl. + Add C (x2goserver: x2godesktopsharing (<< 3.1.1.2-0~). (Fixes: #700).

2 1

Bug#563: packages broken
by A 05 Feb '15

05 Feb '15

Package: x2goserver Version: Since the wiki doesn't say, and I'm unable to install it - I don't know what version but I presume the latest? CentOS 5 Transaction Check Error: /usr/share/man/man3/Sys::Syslog.3pm.gz from install of perl-Sys-Syslog-0.27-1.el5.rf.i386 conflicts with file from package perl-5.8.8-41.el5.i386 Conversation in IRC: [08:42] <geppetto> it's a packaging problem … yum can't see file conflicts [08:42] <geppetto> the fedora policy is that if you have a file conflict you have to promote it to a real conflict [08:42] <geppetto> but that's not QA'd :( [08:43] <geppetto> don't use the .rf. repo? … use a newer perl from the .rf repo? [08:43] <geppetto> Maybe install an older version of perl-SysSylog from the .rf repo. … if that doesn't have file conflicts [08:48] <geppetto> Those packages are conflicting with the ones from your distro. … but using file conflicts

5 9

Bug#644: X2Go issue (in src:x2goserver) has been marked as pending for release
by Mike Gabriel 05 Feb '15

05 Feb '15

tag #644 pending fixed #644 4.0.1.19 thanks Hello, X2Go issue #644 (src:x2goserver) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=b0ee871 The issue will most likely be fixed in src:x2goserver (4.0.1.19). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit b0ee871a4a710cf33f54e058e41f61ceaf358f64 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Thu Feb 5 12:14:22 2015 +0100 Legacy for applications (and X2Go scripts) that expect $SSH_CLIENT to be set in the X2Go session's environment. (Fixes: #644). diff --git a/debian/changelog b/debian/changelog index 25b004c..1839221 100644 --- a/debian/changelog +++ b/debian/changelog @@ -69,6 +69,8 @@ x2goserver (4.0.1.19-0x2go1) UNRELEASED; urgency=medium SLE 11.x. - Only call $dbh->sqlite_busy_timeout() if the $dbh object is capable of that. Works around a too-old DBD::SQLite package on SLE 11.x. + - Legacy for applications (and X2Go scripts) that expect $SSH_CLIENT to be + set in the X2Go session's environment. (Fixes: #644). * debian/control: + Add D (x2goserver): libfile-which-perl. + Add C (x2goserver: x2godesktopsharing (<< 3.1.1.2-0~). (Fixes: #700).

2 1

Re: [X2Go-Dev] [X2Go-Project] Invitation
by Mike Gabriel 04 Feb '15

04 Feb '15

Hi all, On Mo 02 Feb 2015 09:07:21 CET, Stefan Baur wrote: > Am 30.01.2015 um 13:25 schrieb Heinz-M. Graesing: >> So as the most of us are already meet on on our IRC channel, I >> would suggest to meet there as a fall-back. > > Would you please clarify if you intend to meet on IRC (i.e. no phone > conference call at all), or if you only intend to fall back to IRC in > case your phone connection becomes flaky? /me personally prefers IRC-only meetings, as they are likely to be more productive and to the point. An IRC-only meeting can be easily posted to the x2go-project ML after the meeting. People with not-so-much-typing-speed should prepare written questions / contributions / statements in advance to that they can be easily copy-pasted when appropriate. When doing a phone conference, we (1) should make sure that everyone can attend the call who wants to join in. (2) should all be in IRC so that we can share URLs etc. with each other (3) agree on someone responsible for a typed protocol that gets sent to the ML(s) later light+love, Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

2 1

Bug#715: X2Go issue (in src:x2goserver) has been marked as pending for release
by Mike Gabriel 04 Feb '15

04 Feb '15

tag #715 pending fixed #715 4.0.1.19 thanks Hello, X2Go issue #715 (src:x2goserver) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=3f14c03 The issue will most likely be fixed in src:x2goserver (4.0.1.19). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 3f14c03bba6794f1bbd8e4f7ab07de2ea4e9986b Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Wed Feb 4 16:38:06 2015 +0100 Provide legacy support for old File::Path packages in x2godbadmin. (Fixes: #715). diff --git a/debian/changelog b/debian/changelog index eb7c375..104e9be 100644 --- a/debian/changelog +++ b/debian/changelog @@ -62,6 +62,8 @@ x2goserver (4.0.1.19-0x2go1) UNRELEASED; urgency=medium #405). - Handle execution of ss command from Perl script x2golistdesktops in a way that not only works on Debian, but also on Fedora et al. (Fixes: #727). + - Provide legacy support for old File::Path packages in x2godbadmin. + (Fixes: #715). * debian/control: + Add D (x2goserver): libfile-which-perl. + Add C (x2goserver: x2godesktopsharing (<< 3.1.1.2-0~). (Fixes: #700).

2 1

Bug#781: x2goclient in broker mode with --broker-noauth
by Sergey Savko 04 Feb '15

04 Feb '15

Package: x2goclient Version: 4.0.3.1 Tag: patch If x2goclient started in broker mode without pass-through authentication (--broker-noauth) and authentication on the server, x2goclient connected from the user who started the x2goclient. That isn't right, we can run x2goclient from any user and connect to the servers as a different user. Just x2goclient can't restore session from suspend. This patch allows you to start x2goclient from any user on the local system and connect to the server by the user that was entered in the authentication window. -- Yours truly, Sergey Savko.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev