libspice-server1-0.14.2-lp152.2.6.1<>,}`n/=„Ź}Ƙs0/h]}Y1lkO+,YaYTFnN䀬-k*L#\%tx*e,c3?#X>3X-j*Յ/1f0vE44na=t*l%ph;OOQG"•h^򎆏~ 6L@hC3AثfKS=tzvUZQq}ZfoPLQֶMad.2 K jVW es>C=?=d & ?  =CLl |    8`&& &( 8 9 H:Y>7v@7B7F7G7H7I7X7Y8\Z8[8\8]8^9?b9c:rd;e;f; l; u; v;@w< x<,yacarnold@suse.comBruce Rogers Bruce Rogers olaf@aepfle.deBruce Rogers astieger@suse.comBruce Rogers cbosdonnat@suse.comcbosdonnat@suse.comjengelh@inai.detchvatal@suse.comtchvatal@suse.comcbosdonnat@suse.compsimons@suse.comcbosdonnat@suse.comastieger@suse.comcbosdonnat@suse.commsuchanek@suse.comzaitor@opensuse.orgcbosdonnat@suse.comcbosdonnat@suse.comcbosdonnat@suse.comcbosdonnat@suse.comcrrodriguez@opensuse.orgzaitor@opensuse.org- bsc#1181686 - VUL-0: CVE-2021-20201: spice,spice-gtk: client initiated renegotiation denial of service 0001-With-OpenSSL-1.1-Disable-client-initiated-renegotiation.patch 0002-With-OpenSSL-1.0.2-and-earlier-disable-client-side-renegotiation.patch- Fix buffer overflow vulnerabilities in QUIC image decoding (CVE-2020-14355 bsc#1177158) 0001-quic-Check-we-have-some-data-to-start-decoding-quic-.patch 0002-quic-Check-image-size-in-quic_decode_begin.patch 0003-quic-Check-RLE-lengths.patch 0004-quic-Avoid-possible-buffer-overflow-in-find_bucket.patch- Update to v0.14.2 stable release The main changes are support for Meson build and graphic device info messages allowing to better support multi-monitor configurations. * support H265 in stream-channel * add support for building with meson/ninja * minor tests fixes improving CI * set char device state for smartcard, allowing Qemu optimization * improve red-parse-qxl.c interface making it more consistent * add some instrumentation for streaming device * QXL interface: add a function to identify monitors in the guest (spice_qxl_set_device_info) * add support for GraphicsDeviceInfo messages * video-stream: prevent crash on stream reattach * make channel client callbacks virtual functions * bumped minimum required glib version to 2.38 * attempt to have a reliable led state for keyboard modifiers - Removed patches: (The first two are altered versions of what is carried upstream. I think we're fine with what upstream does here) 0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch 0002-lz-More-checks-on-image-sizes.patch 0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch- Use plain python2 for SLE12 builds - Remove PYTHON=python3, configure will find and use the python3- Fix OOB memory access in internal tracking of slot_ids and group_ids. (CVE-2019-3813 bsc#1122706) * 0001-memslot-Fix-off-by-one-error-in-group-slot-boundary-.patch - Remove celt051 Requires directive- Upstream disabled support for the celt051 audio codec by default, do likewise in the spec - Note updated 0.14.1 build dependencies in the spec: * OpenSSL 1.0.0 or newer is now required * glib 2.32 required - add upstream signing key and verify source signature- Update to v0.14.1 stable release The announcement email describes this release as follows: The main change in this release is the addition of a new protocol extension in order to support streaming the remote display as a video stream rather than going through the QXL protocol. Together with spice-streaming-agent, and/or with more work on the qemu/ spice-server side, this should allow streaming of 3D accelerated VMs in the future. At this point, this part of spice-server is still a work in progress (multi-monitor support and various features are missing). * avoid performance issues on Windows 10 KVM guests (boo#1109044) * add new org.spice-space.stream.0 channel used for passing an encoded video stream from the guest to the client * add support for TCP_CORK to reduce the amount of packets that we send * fix CVE-2018-10873 (maintainer note: we already carried fix) * fix cursor related migration crash * fix regression causing sound recording to be muted after client disconnection/reconnection (introduced in 0.13.90) * fix regression in corner cases where images could be sent uncompressed when they used to be compressed with QUIC * disable TLS 1.0 support * CELT 0.5.1 support is now disabled by default. If celt051-devel is installed at build-time, --enable-celt051/--disable-celt051 must be explicitly specified * drop support for unsupported OpenSSL version. OpenSSL 1.0.0 or newer is now required * bumped minimum required glib version to 2.32 * endianness fixes * (small) leak fixes * usual round of code cleanups * not directly related to this release, but the upstream git repository is now hosted on gitlab.freedesktop.org - Removed patches: bb15d481-Fix-flexible-array-buffer-overflow.patch- Fix potential heap corruption when demarshalling (CVE-2018-10873, bsc#1104448) Added patch: bb15d481-Fix-flexible-array-buffer-overflow.patch- Avoid buffer overflow on image lz cheks (CVE-2018-10893, bsc#1101295) Added patches: 0001-lz-Avoid-buffer-reading-overflow-checking-for-image-.patch 0002-lz-More-checks-on-image-sizes.patch- Correct RPM group for shared library.- Split the sle condition again for exact features to allow their override- Enable smartcards on sle15 as the supportlib is available * Condition it using name everywhere instead of suse versions and join together with lz4 - Format with spec-cleaner - Convert dependencies to pkgconfig style - Install documentation and license file - Add configure arguments to most of the options to not rely on autotools automatic behavior * Also enable gstreamer and lz4 options - Drop the not needed python dependencies, they are needed only when building from git snapshot- Release 0.14.0 * fix client mouse with virgl * fix frozen display after seamless migration * set human-readable name on spice threads * add sanity-checks for ORC library as it can abort spice-server when selinux is in use * Close TCP connection early when client did not send the correct SPICE magic bytes: this allows VNC clients to gracefully fail when connecting to a SPICE port * Add VP9 encoding support when GStreamer is being used and misc streaming/encoding improvements * Improvements to replay utility * Limit (deprecated/unusud) QXLMessage size to 100,000 characters for improved safety * Improve image quality in low bitrate situation when using the GStreamer backend * Added GStreamer support to the video streaming code * Fix old migration bug causing migration to never end in some cases * Added lz4 compression to the spicevmc channel * Ongoing code cleanups * add spice_qxl_gl_scanout() spice_qxl_gl_draw_async() for local virgl support * spice_server_set_keepalive_timeout() has been removed in favour of unconditionally sending keepalive probes every 10 minutes * Added public spice_server_set_keepalive_timeout() to make it possible to tweak keepalive on all SPICE connection. This can prevent unwanted idle disconnections if proxies are used between the client and the host. * Fix important memory usage when the webdav channel is used * Do not disconnect when the client requests an unsupported compression type * Fix potential race condition when using multiple QXL devices * Fix display glitch when using XSpice * Improve help string for 'replay -s' * Fix small leak in MJPEG code - Removed patches: * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch * CVE-2016-9578-remote-dos-via-crafted-message.patch- Added patches to fix two security vulnerabilities. * CVE-2016-9577-buffer-overflow-in-main_channel_alloc_msg_rcv_buf.patch [CVE-2016-9577, bsc#1023078] * CVE-2016-9578-remote-dos-via-crafted-message.patch [CVE-2016-9578, bsc#1023079]- Synchronize with SLES (fate#322402): + bnc#894069: disable smartcard support for SLES + merge changelog- restrict suppression of obsoletes-not-provided warning to spice-client bsc#1013916- Obsolete spice-client (bsc#1013916)- remove ExclusiveArch (boo#1009438)- Update to version 0.12.8: + Fixes for bsc#982385 / CVE-2016-0749 and bsc#982386 / CVE-2016-2150.- Update to version 0.12.7 (fate#320079) + spice-server will now send TCP keepalive probes on the TCP connections it uses. This can prevent unwanted idle disconnections if proxies are used between the client and the host. + Fix important memory usage when the webdav channel is used + Do not disconnect when the client requests an unsupported compression type + Fix a few race conditions + Fix display glitch when using XSpice + Improve help string for 'replay -s' + Fix crashes in corner cases (buggy spice-html5 + win10, vnc + SPICE port configured, USB webcam redirection over a slow link) + Fix various compilation warning when building on 32 bit machines + Some fixes for big-endian machines, more work is likely to be needed + Do not build static libraries by default, this can be reenabled with --enable-static + Fix small leak in MJPEG code- Update to version 0.12.6 + Removed spicec client code, it has been superseded by remote-viewer and other spice-gtk based clients + Unix socket support + LZ4 support + Let clients specify their preferred image compression format + Allow to record and replay a spice-server session + Fixes for CVE-2015-3247 CVE-2015-5260 and CVE-2015-5261 bsc#944787, bsc#948976 + spice-protocol submodule has been removed, spice-protocol must now be installed when building spice-server + Remove write polling in chardevs to reduce wakeups - Remove upstream merged patches: + spice-Don-t-use-48kHz-for-playback-recording-rates.patch + password-length-check.patch + cve-2015-3247.patch- bsc#944460: fix CVE-2015-3247. cve-2015-3247.patch- Don't allow setting password longer than what the spice protocol allows. password-length-check.patch. boo#931044- Replace xorg-x11-devel buildrequire by selected pkgconfig(xlibs..)- Update to version 0.12.5: + Added Opus support. Celt support will be obsoleted in a future release. + Addition of webdav channel. + Force use of TLS 1.0 or newer for TLS connections. + Reference manual. + Some optimizations improving CPU use. + Various bug fixes for race conditions, memory corruption, which could be triggered on client disconnections, migration, and cause spice-server to misbehave. + Portability fixes. + Code cleanups. + bsc#848279: fix CVE-2013-4282. - Add pkconfig(opus) BuildRequires: Needed to build new opus support. - Add spice-Don-t-use-48kHz-for-playback-recording-rates.patch: Fix advertised sound playback/recording rates in public headers (rh#1129961). - Drop spice-glibc217.patch: No longer needed. - Run spec-clean on spec file, remove conditionals for obsolete versions of openSUSE, enable parallel build and drop obsolete clean section./sbin/ldconfig/sbin/ldconfigspice-clientlamb12 16233153100.14.2-lp152.2.6.10.14.2-lp152.2.6.10.14.2-lp152.2.6.1libspice-server.so.1libspice-server.so.1.13.0libspice-server1ChangeLogNEWSREADMElibspice-server1COPYING/usr/lib64//usr/share/doc/packages//usr/share/doc/packages/libspice-server1//usr/share/licenses//usr/share/licenses/libspice-server1/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:16488/openSUSE_Leap_15.2_Update/0bbbf904e7190908364c7950e098f310-spice.openSUSE_Leap_15.2_Updatedrpmxz5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9a6df360f61c829476cf5d6c0fa6487302d9a636, strippeddirectoryUTF-8 Unicode text, with very long linesASCII textJPPPPPPPPPPPPPPPPPPPPPPPPPPPP P P P P P P P P P PPPPPRRR R RRRRRRRRRRRR RRRRRRR R RR R!RRRRR)_x2l#'U utf-81113bc93fd977473457ce993f9258e394d78dd34d99fc29115fdaf59a144fafd?7zXZ !t/O;y]"k%+M`Y0a.`QdU>sѣѠͨIRDߖk.kΧVIҜ0z_f.5E`y2ޥF,w~'么D9=JhrW_(uA.xxY1]~]μ qJ%/آ&||{Bgv|G|Q`RP+ԵFC\ĺ'X>yBtr8E?"L PI }4)gM#xr E]w>maŀUٜ-rx2NbqbhYU8a VR9L%P[$ཪ~J`kx0)V#./e[ 9j*臮{/:QCo7R&S*B=5ĸ[TWI"Kl噮x LN]c2p6ᨛRi|Q}M᤟/(^:k $ʎM`M3bP洞iZгѪѮ u*hNM-N*F@>CXr[ś8uynZUz &;h1xiWlx2X`.1՞)x!`R t"&*Մ/{VGJsi.6Qhr66IN>X"XOom &BLrR=&" v qd1vSpv(ZŎI Uv @be+ 9f%;a-y K0#&p \gDO< 3jNH{rᰋLk#|DkP„`9xhxn}S9n9N8||>MSY\8<~kmʹzS۽(h,𢦄 V\3s 4y@HCinda?ؤ56Ja+ՆeѳDC8}#H;rnMԷr0";鵥X1ЩI4H_TI_7 A\iC@+ح7Sޠd:O$ 3I&D\uoM#Dэ;"sS$abƻ"V$#5cWg|ĵ5a'&]9ghg(7E\o#$ўπPZpщ BH8[48μςY RQ U0a|#TuUx[ *T|w;Tz]2e~TϻϣKv=9v>doB+zW8JO[QD0,L/I>ɬ__x"_A%jz[2y sM'%B dzG>*#j!)w?5cOU@]{98Bđ$&4[sLQ2gԗ >@<ÉD66rs#t-!8>YZL6 ^fEk#\ Av/3_cyzDʼJ{ս-O+Yfcn[u4՘RiaBPRHk|5|J~.Re&bƟ,J^3V,X%ljckCujA NeYI; NoէVƵt>.2]~- 'ʸ1ٳRHkW' &NM0Ut lwM.zmFj[h J19!q##UC6+eXLw#ĄL=n>95p\ؒV( f* IG;b/ q[hy=,o_51!*;啿$íkn.6L).8TkɕI}_>OlnV@ oo-A"rAy L WR+PxC K(Ь te:VGhM>9H1~E Ht.0M؀ = @RZFIi0wR7)ɁӇcV\pf4i@< *t%K r*%fN+<5}i@!9a8{qW#l. D3IiIGxg}SBfZ TSϼ"Z[ެ)y л 8# 6]R2a#z|ZR)<$q/u>c쎤zWmAu4a8/Jfr0tRlc |è5zZvH9n5ɇU4um2Wf7ͶΓϵc,l{ؐEyMvTlг (0.GSO؏jN*h= !#gTJHrև /P2 1iVx.1mz|Ezw LZ:|=?S]ҏ:`ӏɔ,?8p՚ߩj dng醭g*SʫY>әlQM6$#wgEh;B9EsQbqnjEIG1S?/V/AF܃H!;Kg P.ŽȆV7߈$@ ,tIwL V7/+8puJn[Ѭf+EY_Nj Pk0Z{ձ᧬θT"'S_\wsrϿ"ٙ 2R#KcL>i`?.2ϰ\ЈT)holoe }2pT0dFJVA51`no`ʱb:Y 6^R|eWgTs󱆄\hLLWپCE=/oI+yE`ґΖ5O~,z_o4o IDG\SAir޴Lnlu)JJi0F a :GhaS t'UV cX'$&6(O\_y>:Ve|חb[[vܥv>M퉖DrFZT2ŊMuy2 RE.Pz 6R0^+H[?ZPA`E,ծм m!Ԩ+t:k:2xk1-to0E]$KlX]e4x5G"x\XM!͂EN]*d^!u )&j%RmgB%#&# F,oHK3\)-R,E<ϬB,1 L 6?t8=\PPޱ5?/w+8X! atBv,`3h^$7gmnǜ^&f {X!sHV'X3.'ɍAjToĪ/e k #*f`FH?Rسf sO|bvLwq9kW06R~pym+Utpo<ߟe9 ˺YQB\*E;=oM_V{ڻjZ^ Ŋ Af BBɚY髰d(mqKӸ 9\jdna\xi!F1]-a;bΧM4RR^ $l:jjUGlD6 #6.eO7}3;^t73P7Mĵn΃a߇@”|]'mIv\{6w$@*(1:ۖ]rlEU:Q9bfC'PsgaMݠ% EZ:e0}=ۣsu |&w/AZÕtCT ꘅŢ3~p9҅<[/n !R]'O:^LKFp%̎3e< tD">_WUKGl2cxNރiyta£ ]Y&ϙfvRNZکq /vXD' 20n;(7d)b[.G-ND-gh@Cr̻ݾ0.<0KE9U=*n1T_Siq X`D~&yQH3T䈘4Wg. j/ÁϹ+8T0Tp#$4C-`gVuF氆Ml8 fS??D^?_a4a{jY }k2Vȉ4n(dzO$1lC$Yb1F@NDblj oXݰ Vw݃PV|M/{ 19;<ƌ{>[{dǽwFO4YeV qf/L,\ R7b3exg¯/v$8ݿ44wKb4jX_]UEga @<ϝwd-8^Sw.hy] \9iG,;Y>2q~2sFVgrSvH[j^(0.,/}BRcJUW'_88Ь qqRFpMfl dpprc   8c,u!#I:l EUW9bQkYhrr8&ȺG';"f#1%[#Z6/$qdlAB` bafX ROD3~0Ih)c] *1u.&BփLƳmNNHEV&/Ǧ@Mf=/f2C;/<8稿ޞT9y*ZW_& &py3`ӒbOWJ$x%CD-*"Ēe_θz5u+ o)*?qԜoV5tH: [Smo!KB^ut+<-kwHh*]RJ[ 2F. #5EHb|0v΂ Q(MD}byk ciz=WP{jfg&F~!u5G3S)@%8Lj%T7mz}6dr'}Ex\ EJ. ^MTj~ۣqDwsePij4S> Ht}Q1v[=HvaUn9)HI=98aF8 dC΢)Zvh4,VKį=Zm. W %610H( Pu]`?R#rp4ؼ&Χ`O{E"R?>r2W#սHCI.FI> iiRg*Y$VaV2WMȺQ N+".4xQ!dT e/zs**s{Cȳu-I2y%>,yoҪŻ59ޕݚ!tD!cb 8"BZUPg lj=4=^A$zƈzwθmx]MFX\A-YoėY;іf`9]F#ثT 0'pg?HѓԾ_(F  jX??P𒄼0KbLʹy$e̅X#wڻɌ nl]YE5, Sd>x찫œup08>kÖR2hLw*xlI,ACʪ2A ~^ meJ=-*8:#RI?gaB)0dRCZ<ߖh[KoOFV u(#jۋ].~{EK#1\144$K]*a+F"bAAdzaʥ#uJ*>X~K5WO0!ŐIzXv-< X \):\>"r|` T Ͻ "!:ȍ-yܫF;ۗvEFn6Sʷ&u67lgy88ou!=|$ʻ3HHovBF)]xI< 'ed8FwUЎAT͔rć#,&ǩo:3iPE7&F,=ђ=xe$81'nXpcVb ](jIykJ_4u;!k5*kܑvB'׿'LU~sby.?L2 ,#_*3AGmifSJtÉ8PXsH;d ;VRނnn),K+*N;2f &/iJ'-5jy|$*JsNHQK픏G#WU }G.ڄܠǜc\M<Prʗ|,sпF4;1VKi^vu*ۆ]FESA+jQ%+$ٚkɂm0̌-2&œn|= O ]?㦷qVHC&K/JO]'^|ld 5b,RRRSZ4a雁otx!F,ɒw;M.GmAHs7dMܸc%}Qra^le 0}ۦ\ߴr%sM(0b1eg^ث@3M Ё#SJБ+#RMR=t*RY_o_l|$ʦ0 !۞m "BV4>{7k^,9A:4uΨtk=C<8Ҍ2r"/>pk i?@,&0Ɨ '0*dp~k!y*uZL[?ⱸ5=Yu? 0c i gC3W"˹:uv!})(tBmv Jzc Z^9, nwƻzP\a^9lsl0w ͹#\LO'DqU0[DgBɳv"[u @_͗XTB ēs,%o3x& Bu'nK k=$WZoQѷƼjA0 -9XxC:ȥ T)D2 I(3Ywǜr}wEϙ#YrTe1ipbD(FY=2m)讏;^U] vp&!?,Cm)H$Avt#gZf;uvj\%(c1?x\$d)~lY`\- ;CDO=ˏPZka}Pw=MWEK,$2CQ&W;x0 0NKlua6 A.>Է~ǀ+B ]LBN$䯁\}(XʮZme.6OePK JYM|1B ~HCӴE9֫"ih&k;;­?m):WqZ9PƬf3ޤb'4aMn z~ǎޘBajiܪTxHN T7w #4,7ؘ']TY2s7 sp02I'õh02̹ 4$tү7̈nϬs'#wHc]<;H¼_iOkkzbZ/kRoJNV⩏Uyưcv jMgjTMzjiɚ:"]lI`X"*Rlj4s6`It _H|LZ(~+.}03`[e.ZZ 5b̈t-k$((LH&@"Y'݉.RjgpjFEQlcy3_< :jO=siаpi+{. @]/ʜX4N3q.=qDmH̑D/{gNmc/ҕW _eVĩG|'ϒ1Hmz *|L3% g~L0 zi8K:s[0zV;}sLF%Ue \.MxV"w+D)Y2࣋UnIIcW>S=l Jζܸ#buqH/!Me3nZGVG6r3 FR"1foS!2]$9w(]I|?F*}aO R5R篧)vË9*s==\ԺLas' >7S[@0Hdi hY0d| U~ҵT?6mVU)cA$q6L-Mw0d\6!I9'pfc'0eD!廱BւCT .NQ<6̬Iáɨc>2g3[sI+Ps1(?^+q00\Kd-b]\|2ޢԳ[:q=ADX wLqɇNπ2DS6e FVYxo {mV],?L3FJ:Pel JfhhΣyZ7:p*.D*G߾"R!owѐuH~Ia6l=?l^0q4;7a }%a7l`QrDJƥ#}ƈ7N,́ʣUl}|gQwXmP:z,/E:* [!rV.:Fj֪`?Qc¥~]J W.$ZIc3(6IrK oiW,k\ C:[F-PcrZZUӻ=E'l$XgC' G+"#n͍^z3M+RjLs~xvGoMnojgU04ScPGmF|yBB1.ZtM_?L*\cqliWN܌}z@q}> Yzb@shF{/.LBd$:p19&(e7TcnEa.>a>)H~8sMԬn;8*HlاRi6â^Լ8ρjS%vjk$AG`M ݩbzc\=U- wYR)-D!H,g`e~OBj6xvndJrh>}[L%ŏ݉6yG) "SeM|He k0V.-}g_Fq-lVE7;kٯG#wo!'WꤗTt)?gV:t+G.T79YUjĞOrU=}|֌ĠT2JT&{Yfm3pZdịwH,AF5UwW4DW;(KE9Zl>#հxnT܁?X=;. |$T& ">z=xL8-$\]5UYGLrP/Z8?XLW%KooF쉍gԔD$? 'a(YY\4K~9#!~Aj > U6Ƃo[c1KJBM .XTTESܔ< Sg{~td֠BPU eL90oҹmcp@bF' ;6kwf#(1z>!` KYւBڻǐq=7ƒ]7J|اxMEb4\~4L6˜~Gc4Z$RHUr=*չ\cAPb7'5!5k>zũP5o rT˳ɹ!c鯿jgDރ<,(5zHZseZ`z2`bѮOUGC듬/džMMoDϺ#h!4fRʯ\?7_NG-<ذ{my4\X]" *c5~BŗĪ_^H-`*7J^0PNdDKL-11p2 )Fui['g81Fހؗ;|+J9Aq%7)S6aDtQfxC14 G"rghe%{J p옵dYb"4 9c%` P~ҳLTMT4;6dU%7ekKB00@Э~Dc)kȪ(8B[ĎVSY`q$Y!#D%%C"?WQ!I/