Lector de Feeds

Publication date: 25 Feb 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-12243 Description Gnutls impacted by inefficient DER decoding in libtasn1 leading to remote DoS. (CVE-2024-12243) References

• https://bugs.mageia.org/show_bug.cgi?id=34041
• https://ubuntu.com/security/notices/USN-7281-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12243

SRPMS 9/core

• gnutls-3.8.4-1.1.mga9

Publication date: 25 Feb 2025
Type: bugfix
Affected Mageia releases : 9
Description The updated packages fix a bug in GTK3 tooltips. References

• https://bugs.mageia.org/show_bug.cgi?id=30574

SRPMS 9/core

• gtk+3.0-3.24.38-1.2.mga9
• lxpanel-0.11.0-0.git20250215.1.mga9

‎Various software: gnome-calculator - more explanation.

← Older revision Revision as of 09:03, 25 February 2025 Line 361: Line 361:  {{Bug|33697}} - '''Nextcloud client''' - We fail to keep it updated.  Instead, upstream AppImage can be used, see [[Nextcloud-client]]. {{Bug|33697}} - '''Nextcloud client''' - We fail to keep it updated.  Instead, upstream AppImage can be used, see [[Nextcloud-client]].    −{{Bug|34028}} - '''gnome-calculator''' hang on start. '''WORKAROUND:''' Issue {{cmd|gsettings set org.gnome.calculator refresh-interval 0}} before starting it. Or use one of the alternatives available in our repositories: {{prog|galculator}}, {{prog|mate-calc}}, {{prog|kcalc}} or the less good looking {{prog|xcalc}}, or more text based like {{prog|qalculate-gtk}} / {{prog|qalculate-qt}} or {{prog|speedcrunch}}.+{{Bug|34028}} - '''gnome-calculator''' hang when trying to update currency rates, which it do by default on start. '''WORKAROUND:''' Set it to not update currency rates: issue {{cmd|gsettings set org.gnome.calculator refresh-interval 0}} before starting it. Currency rate is broken:Selecting Advanced mode, and in the dropdown "Currency", that section goes blank. To be able to select something else, set another mode temporarily.  Some other calculators available in our repositories: {{prog|galculator}}, {{prog|mate-calc}}, {{prog|kcalc}} or the less good looking {{prog|xcalc}}, or more text based like {{prog|qalculate-gtk}} / {{prog|qalculate-qt}} or {{prog|speedcrunch}}.     {{Bug|34029}} - '''grisbi''' We update grisbi to offer compatibility to users comming from other distributions that have the 3.0.4 version, but the 1st time wizard can't select custom folder for backups, please select it later in Edit -> Preferences {{Bug|34029}} - '''grisbi''' We update grisbi to offer compatibility to users comming from other distributions that have the 3.0.4 version, but the 1st time wizard can't select custom folder for backups, please select it later in Edit -> Preferences Morgano

← Older revision Revision as of 22:44, 24 February 2025 Line 278: Line 278:     {{Bug|33697}} - '''Nextcloud Client''' - Wir schaffen es nicht dieses aktuell zu halten. Verwenden Sie stattdessen das AppImage über den Upstream - siehe [[Nextcloud-client]]. {{Bug|33697}} - '''Nextcloud Client''' - Wir schaffen es nicht dieses aktuell zu halten. Verwenden Sie stattdessen das AppImage über den Upstream - siehe [[Nextcloud-client]].  +  +{{Bug|34028}} - '''gnome-calculator''' bleibt beim Start hängen. '''WORKAROUND:''' Führe {{cmd|gsettings set org.gnome.calculator refresh-interval 0}} aus, bevor Sie die Anwendung starten. Ansonsten können Sie eine alternative Anwendung aus unserem Repository verwenden: {{prog|galculator}}, {{prog|mate-calc}}, {{prog|kcalc}} oder das nicht so gut ausschauende {{prog|xcalc}}, oder das textbasierte {{prog|qalculate-gtk}} / {{prog|qalculate-qt}} oder {{prog|speedcrunch}}.  +  +{{Bug|34029}} - '''grisbi''' Wir aktualisieren grisbi, um Nutzern, welche von anderen Distributionen kommen, welche die Version 3.0.4 einsetzen, eine Kompatibilität anzubieten. Allerdings kann der 1st time wizard kein benutzerdefiniertes Verzeichnis für Sicherungen auswählen. Bitte wählen Sie dieses später unter Bearbeiten -> Einstellungen aus.     === Externe Software === === Externe Software === Line 306: Line 310:  * '''BEHOBEN durch  [https://advisories.mageia.org/MGAA-2023-0095.html eine Aktualisierung]''' von mgaonline in {{Bug|32382}}: {{bug|32354}} - In einigen Fällen, die noch nicht eingegrenzt werden konnten, hat die Variable PATH, welche mit /usr/sbin gesetzt wird, eine höhere Priorität als /usr/bin. Als Konsequenz startet mgaapplet urpmi.update ohne nach einer Berechtigung zur Ausführung zu fragen, wodurch die Ausführung fehlschlägt. Hierdurch wird keine Benachrichtigung zu vorhandenen Aktualisierungen angezeigt. Ein Workaround ist im Bugreport beschrieben. * '''BEHOBEN durch  [https://advisories.mageia.org/MGAA-2023-0095.html eine Aktualisierung]''' von mgaonline in {{Bug|32382}}: {{bug|32354}} - In einigen Fällen, die noch nicht eingegrenzt werden konnten, hat die Variable PATH, welche mit /usr/sbin gesetzt wird, eine höhere Priorität als /usr/bin. Als Konsequenz startet mgaapplet urpmi.update ohne nach einer Berechtigung zur Ausführung zu fragen, wodurch die Ausführung fehlschlägt. Hierdurch wird keine Benachrichtigung zu vorhandenen Aktualisierungen angezeigt. Ein Workaround ist im Bugreport beschrieben.    −* Unter GNOME muss die [[#Applet Sichtbarkeit|Applet Sichtbarkeit]] aktiviert werden.+* Unter GNOME muss die [[#GNOME|Applet Sichtbarkeit]] aktiviert werden.     == Sicherheit == == Sicherheit == Psyca

Publication date: 24 Feb 2025
Type: bugfix
Affected Mageia releases : 9
Description The updated packages fix a regression introduced by the fix for CVE-2025-1094 and a memory leak in pg_createsubscriber. References

• https://bugs.mageia.org/show_bug.cgi?id=34039
• https://www.postgresql.org/about/news/postgresql-174-168-1512-1417-and-1320-released-3018/

SRPMS 9/core

• postgresql15-15.12-1.mga9
• postgresql13-13.20-1.mga9

Publication date: 24 Feb 2025
Type: bugfix
Affected Mageia releases : 9
Description - Crash when trying to create a tab for a Magnatune panel or a Jamendo panel - bug: playback was skipping after 20 or 30 minutes running - Remove the nonfunctional Jamendo feature (the Jamendo site has modified its access and is no longer reachable for any Music Player) References

• https://bugs.mageia.org/show_bug.cgi?id=34034

SRPMS 9/core

• guayadeque-0.7.0-1.mga9

‎Various software: grisbi again

← Older revision Revision as of 20:04, 24 February 2025 (One intermediate revision by the same user not shown)Line 362: Line 362:     {{Bug|34028}} - '''gnome-calculator''' hang on start. '''WORKAROUND:''' Issue {{cmd|gsettings set org.gnome.calculator refresh-interval 0}} before starting it. Or use one of the alternatives available in our repositories: {{prog|galculator}}, {{prog|mate-calc}}, {{prog|kcalc}} or the less good looking {{prog|xcalc}}, or more text based like {{prog|qalculate-gtk}} / {{prog|qalculate-qt}} or {{prog|speedcrunch}}. {{Bug|34028}} - '''gnome-calculator''' hang on start. '''WORKAROUND:''' Issue {{cmd|gsettings set org.gnome.calculator refresh-interval 0}} before starting it. Or use one of the alternatives available in our repositories: {{prog|galculator}}, {{prog|mate-calc}}, {{prog|kcalc}} or the less good looking {{prog|xcalc}}, or more text based like {{prog|qalculate-gtk}} / {{prog|qalculate-qt}} or {{prog|speedcrunch}}.  +  +{{Bug|34029}} - '''grisbi''' We update grisbi to offer compatibility to users comming from other distributions that have the 3.0.4 version, but the 1st time wizard can't select custom folder for backups, please select it later in Edit -> Preferences     <br> <br> Katnatek

Publication date: 24 Feb 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-49393 , CVE-2024-49394 Description The To and Cc email header fields are not protected by cryptographic signing. (CVE-2024-49393) The In-reply-to email header field is not protected by cryptographic signing. (CVE-2024-49394) References

• https://bugs.mageia.org/show_bug.cgi?id=33814
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZYFPGXOX4Q4I4UNPEGXP2N372IN2YSAS/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49393
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49394

SRPMS 9/core

• neomutt-20241002-1.mga9

Publication date: 24 Feb 2025
Type: bugfix
Affected Mageia releases : 9
Description The current version can't handle files from newer versions. This update fixes the issue. Note the 1st time wizard can't select custom folder for backups, please select it later in Edit -> Preferences References

• https://bugs.mageia.org/show_bug.cgi?id=34029

SRPMS 9/core

• grisbi-3.0.4-1.mga9

Publication date: 22 Feb 2025
Type: bugfix
Affected Mageia releases : 9
Description Instructions to uninstall the telegram application are not accurate. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=32593

SRPMS 9/core

• get-telegram-1.7.7-3.1.mga9

‎Various software: gnome-calculator Workaround up-front

← Older revision Revision as of 18:54, 22 February 2025 Line 361: Line 361:  {{Bug|33697}} - '''Nextcloud client''' - We fail to keep it updated.  Instead, upstream AppImage can be used, see [[Nextcloud-client]]. {{Bug|33697}} - '''Nextcloud client''' - We fail to keep it updated.  Instead, upstream AppImage can be used, see [[Nextcloud-client]].    −{{Bug|34028}} - '''gnome-calculator''' crash, [https://gitlab.gnome.org/GNOME/gnome-calculator/-/issues/359 fix the issue could require new version] and is not sure could be fixed in mageia 9, try one of the alternatives available in our repositories: {{prog|galculator}}, {{prog|mate-calc}}, {{prog|kcalc}}, {{prog|qalculate-gtk}}, {{prog|qalculate-qt}}, also the less good looking {{prog|xcalc}}+{{Bug|34028}} - '''gnome-calculator''' hang on start. '''WORKAROUND:''' Issue {{cmd|gsettings set org.gnome.calculator refresh-interval 0}} before starting it. Or use one of the alternatives available in our repositories: {{prog|galculator}}, {{prog|mate-calc}}, {{prog|kcalc}} or the less good looking {{prog|xcalc}}, or more text based like {{prog|qalculate-gtk}} / {{prog|qalculate-qt}} or {{prog|speedcrunch}}.     <br> <br> Morgano

← Older revision Revision as of 10:48, 22 February 2025 Line 179: Line 179:  | werkt heel goed met Heroic Game Launcher en Proton-GE-Proton 7.51   | werkt heel goed met Heroic Game Launcher en Proton-GE-Proton 7.51    Environment variable : PROTON_USE_WINED3D11=1 Environment variable : PROTON_USE_WINED3D11=1  +  +|-  +| style="width: 5%"| [[File:App-accessories.png|25px|center]]  +| Sniper Ghost Warrior Contracts  +| werkt heel goed met Heroic Game Launcher en Proton-GE-Proton 9.16     |- |- Scroll44

← Older revision Revision as of 10:47, 22 February 2025 Line 176: Line 176:  | marche très bien avec Heroic Game Launcher and Proton-GE-Proton 7.51   | marche très bien avec Heroic Game Launcher and Proton-GE-Proton 7.51    Variable d’environnement : PROTON_USE_WINED3D11=1 Variable d’environnement : PROTON_USE_WINED3D11=1  +  +|-  +| style="width: 5%"| [[File:App-accessories.png|25px|center]]  +| Sniper Ghost Warrior Contracts  +| marche très bien avec Heroic Game Launcher and Proton-GE-Proton 9.16     |- |- Scroll44

← Older revision Revision as of 10:45, 22 February 2025 Line 177: Line 177:  | works very well with Heroic Game Launcher and Proton-GE-Proton 7.51   | works very well with Heroic Game Launcher and Proton-GE-Proton 7.51    Environment variable : PROTON_USE_WINED3D11=1 Environment variable : PROTON_USE_WINED3D11=1  +  +|-  +| style="width: 5%"| [[File:App-accessories.png|25px|center]]  +| Sniper Ghost Warrior Contracts  +| works very well with Heroic Game Launcher and Proton-GE-Proton 9.16     |- |- Scroll44

‎Update notifications: Fix link

← Older revision Revision as of 00:28, 22 February 2025 Line 398: Line 398:  * '''FIXED by [https://advisories.mageia.org/MGAA-2023-0095.html update]''' of mgaonline in {{Bug|32382}}: {{bug|32354}} - In some cases not yet fully understood, the PATH variable is set with /usr/sbin having a higher priority than /usr/bin. ''(Seem to be related to GDM, affecting all desktops.)'' As a consequence, mgaapplet launches urpmi.update without asking for execution privileges and fails. Thus no updates notifications are raised. A workaround is described in bug report. * '''FIXED by [https://advisories.mageia.org/MGAA-2023-0095.html update]''' of mgaonline in {{Bug|32382}}: {{bug|32354}} - In some cases not yet fully understood, the PATH variable is set with /usr/sbin having a higher priority than /usr/bin. ''(Seem to be related to GDM, affecting all desktops.)'' As a consequence, mgaapplet launches urpmi.update without asking for execution privileges and fails. Thus no updates notifications are raised. A workaround is described in bug report.    −* For GNOME, [[#Applet_visibility|Applet visibility]] need to be enabled.+* For GNOME, [[#GNOME|Applet visibility]] need to be enabled.     <br> <br> Katnatek

‎Go: Creating vendor.tar.xz

← Older revision Revision as of 21:36, 21 February 2025 (2 intermediate revisions by the same user not shown)Line 98: Line 98:     The [https://vuln.go.dev/ Go Vulnerability Database] can be used on an ongoing basis to find security issues in Go packages from the SBOMs of those packages. The [https://vuln.go.dev/ Go Vulnerability Database] can be used on an ongoing basis to find security issues in Go packages from the SBOMs of those packages.  +  +Some Go packages already have vendored dependencies (e.g. fzf) stored in a file called ''SOURCES/vendor.tar.xz'' (likely created through some variant of ''go mod download;go mod verify;go mod vendor;tar caf vendor.tar.xz vendor)''. These may also have ''Provide: bundled(golang(...))'' lines that list the vendored packages included, but there seems to be no mechanism to keep those in sync and they don't contain version numbers so they can't be used as a replacement for a proper SBOM.     A possible workflow: A possible workflow: Line 115: Line 117:  * [https://fosdem.org/2025/schedule/event/fosdem-2025-5570-rust-rpms-and-the-fine-art-of-dependency-bundling/ Rust, RPMs, and the Fine Art of Dependency Bundling] * [https://fosdem.org/2025/schedule/event/fosdem-2025-5570-rust-rpms-and-the-fine-art-of-dependency-bundling/ Rust, RPMs, and the Fine Art of Dependency Bundling]  * [https://ml.mageia.org/l/arc/dev/2023-04/msg00579.html Thread on packages with many components/modules/subpackages] * [https://ml.mageia.org/l/arc/dev/2023-04/msg00579.html Thread on packages with many components/modules/subpackages]  +* [https://github.com/openSUSE/obs-service-go_modules OBS method of vendoring Go dependencies]  * [https://vuln.go.dev/ Go Vulnerability Database] * [https://vuln.go.dev/ Go Vulnerability Database]  * [https://guac.sh/ GUAC] SBOM management tool * [https://guac.sh/ GUAC] SBOM management tool Danf