http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 http://bugzilla.opensuse.org/show_bug.cgi?id=1193100#c1 Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Andreas.Stieger@gmx.de Component|X11 Applications |Security Assignee|screening-team-bugs@suse.de |gfx-bugs@suse.de Summary|TigerVNC 1.12.0 available |VUL-0: tigervnc: TLS |(new version) and contains |certificate exception |security fix |handling QA Contact|qa-bugs@suse.de |security-team@suse.de --- Comment #1 from Andreas Stieger ---

A security issue has been fixed in how the viewers handle TLS certificate exceptions

-- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 http://bugzilla.opensuse.org/show_bug.cgi?id=1193100#c3 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS Component|Security |X.Org Summary|VUL-0: tigervnc: TLS |Update tigervnc to 1.12.0 |certificate exception | |handling | Severity|Normal |Enhancement --- Comment #3 from Stefan Dirsch --- I must have missed this one. Setting to enhancement. A possible security issue would need to be handled separately. The team is informed. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 http://bugzilla.opensuse.org/show_bug.cgi?id=1193100#c4 --- Comment #4 from Jazz --- Hi Stefan, any news on this one? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 http://bugzilla.opensuse.org/show_bug.cgi?id=1193100#c6 --- Comment #6 from Jazz --- Hi Stefan, too bad. :-( Just for my information: What blocks the TigerVNC update in this moment? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 http://bugzilla.opensuse.org/show_bug.cgi?id=1193100#c8 --- Comment #8 from Jazz --- (In reply to Stefan Dirsch from comment #7)

Low priority. We have a bunch of patches. Usually some and even often many of these need to be adjusted. But you can help by branching the package, update it, adjust the patches and make a submit requrest. ;-)

Thanks for the update. I made some tests: https://build.opensuse.org/package/show/home:JayJayJazz/tigervnc_1.12 It looks like that most of the patches are already upstream. I excluded them from the spec file for this very moment. Still, I can't finish the build. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 http://bugzilla.opensuse.org/show_bug.cgi?id=1193100#c10 --- Comment #10 from Jazz --- (In reply to Stefan Dirsch from comment #9)

Well, you can't just disable patches assuming they are already upstream if they no longer apply. That's not how updating a package works.

I agree. I checked the commits on github for the TigerVNC project before disabling the patches. If this is the wrong way, how could I make it better? Sorry for hijacking the Bugtracker for such questions. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 http://bugzilla.opensuse.org/show_bug.cgi?id=1193100#c12 --- Comment #12 from Jazz --- (In reply to Stefan Dirsch from comment #11)

Well, you need to look at the patches and figure out how to add the changes to the new context. If you're not familiar with C/C++ programming it's probably not a good idea to try this.

Unfortunately, I am no C/C++ developer. :-( Does it make sense to forward my current findings regrading TigerVNC in any way? As mentioned: It looks like that some of the patches are deprecated. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.opensuse.org/show_bug.cgi?id=1193100 Stefan Dirsch changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |joan.torres@suse.com -- You are receiving this mail because: You are on the CC list for the bug.