{"affected":[{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP4","name":"libtorrent-rasterbar","purl":"pkg:rpm/suse/libtorrent-rasterbar&distro=SUSE%20Package%20Hub%2015%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.0.9-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP4","name":"qbittorrent","purl":"pkg:rpm/suse/qbittorrent&distro=SUSE%20Package%20Hub%2015%20SP4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.6.2-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP5","name":"libtorrent-rasterbar","purl":"pkg:rpm/suse/libtorrent-rasterbar&distro=SUSE%20Package%20Hub%2015%20SP5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.0.9-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"SUSE:Package Hub 15 SP5","name":"qbittorrent","purl":"pkg:rpm/suse/qbittorrent&distro=SUSE%20Package%20Hub%2015%20SP5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.6.2-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.4","name":"libtorrent-rasterbar","purl":"pkg:rpm/opensuse/libtorrent-rasterbar&distro=openSUSE%20Leap%2015.4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.0.9-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.4","name":"qbittorrent","purl":"pkg:rpm/opensuse/qbittorrent&distro=openSUSE%20Leap%2015.4"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.6.2-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.5","name":"libtorrent-rasterbar","purl":"pkg:rpm/opensuse/libtorrent-rasterbar&distro=openSUSE%20Leap%2015.5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.0.9-bp155.2.3.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"libtorrent-rasterbar-devel":"2.0.9-bp155.2.3.1","libtorrent-rasterbar-doc":"2.0.9-bp155.2.3.1","libtorrent-rasterbar2_0":"2.0.9-bp155.2.3.1","python3-libtorrent-rasterbar":"2.0.9-bp155.2.3.1","qbittorrent":"4.6.2-bp155.2.3.1","qbittorrent-nox":"4.6.2-bp155.2.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.5","name":"qbittorrent","purl":"pkg:rpm/opensuse/qbittorrent&distro=openSUSE%20Leap%2015.5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"4.6.2-bp155.2.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for libtorrent-rasterbar, qbittorrent fixes the following issues:\n\nChanges in libtorrent-rasterbar:\n\n- Update to version 2.0.9\n\n  * fix issue with web seed connections when they close and\n    re-open\n  * fallocate() not supported is not a fatal error\n  * fix proxying of IPv6 connections via IPv4 proxy\n  * treat CGNAT address range as local IPs\n  * add stricter checking of piece layers when loading torrents\n  * add stricter checking of v1 and v2 hashes being consistent\n  * cache failed DNS lookups as well as successful ones\n  * add an i2p torrent state to control interactions with clear\n    swarms\n  * fix i2p SAM protocol parsing of quoted messages\n  * expose i2p peer destination in peer_info\n  * fix i2p tracker announces\n  * fix issue with read_piece() stopping torrent on pieces not\n    yet downloaded\n  * improve handling of allow_i2p_mixed setting to work for\n    magnet links\n  * fix web seed request for renamed single-file torrents\n  * fix issue where web seeds could disappear from resume data\n  * extend save_resume with additional conditional flags\n  * fix issue with retrying trackers in tiers > 0\n  * fix last_upload and last_download resume data fields to use\n    posix time\n  * improve error messages for no_connect_privileged_ports, by\n    untangle it from the port filter\n  * fix I2P issue introduced in 2.0.0\n  * add async tracker status query, post_trackers()\n  * add async torrent status query, post_status()\n  * support loading version 2 of resume data format\n  * fix issue with odd piece sizes\n  * add async piece availability query, post_piece_availability()\n  * add async download queue query, post_download_queue()\n  * add async file_progress query, post_file_progress()\n  * add async peer_info query, post_peer_info()\n\n- Update to version 2.0.8\n\n  * fix uTP streams timing out instead of closing cleanly\n  * add write_torrent_file_buf() overload for generating\n    .torrent files\n  * add create_torrent::generate_buf() function to generate into\n    a buffer\n  * fix copy_file when the file ends with a sparse region\n  * uTP performance, fix packet loss when sending is stalled\n  * fix trackers being stuck after session pause/resume\n  * fix bug in hash_picker with empty files\n  * uTP performance, prevent premature timeouts/resends\n  * add option to not memory map files below a certain size\n  * settings_pack now returns default values when queried for\n    missing settings\n  * fix copy_file fall-back when SEEK_HOL/SEEK_DATA is not\n    supported\n  * improve error reporting from file copy and move\n  * tweak pad file placement to match reference implementation\n    (tail-padding)\n  * uTP performance, more lenient nagle's algorithm to always\n    allow one outstanding undersized packet\n  * uTP performance, piggy-back held back undersized packet with\n    ACKs\n  * uTP performance, don't send redundant deferred ACKs\n  * support incoming SOCKS5 packets with hostnames as source\n    address, for UDP trackers\n  * ignore duplicate network interface change notifications on\n    linux\n  * fix total_want/want accounting when forcing a recheck\n  * fix merging metadata with magnet links added on top of\n    existing torrents\n  * add torrent_flag to default all file priorities to\n    dont_download\n  * fix &so= feature in magnet links\n  * improve compatibility of SOCKS5 UDP ASSOCIATE\n  * fix madvise range for flushing cache in mmap_storage\n  * open files with no_cache set in O_SYNC mode\n\n- Update to version 2.0.7\n\n  * fix issue in use of copy_file_range()\n  * avoid open-file race in the file_view_pool\n  * fix issue where stop-when-ready would not close files\n  * fix issue with duplicate hybrid torrent via separate v1 and\n    v2 magnet links\n  * added new function to load torrent files, load_torrent_*()\n  * support sync_file_range()\n  * fix issue in write_torrent_file() when file size is exactly\n    piece size\n  * fix file_num_blocks() and file_num_pieces() for empty files\n  * add new overload to make_magnet_uri()\n  * add missing protocol version to tracker_reply_alert and\n    tracker_error_alert\n  * fix privilege issue with SetFileValidData()\n  * add asynchronous overload of torrent_handle::add_piece()\n  * default to a single hashing thread, for full checks\n  * Fix bug when checking files and the first piece is invalid\n\nChanges in qbittorrent, qbittorrent:\n\n- Update to version 4.6.2\n\n  Bug fixes:\n\n  * Do not apply share limit if the previous one was applied\n  * Show Add new torrent dialog on main window screen\n\n  Web UI:\n\n  * Fix JS memory leak\n  * Disable stdout buffering for qbt-nox\n\n  Wayland:\n\n  * Fix parent widget of 'Lock qBittorrent' submenu\n\n- Also fixes boo#1217677 (CVE-2023-30801, upstream reference\n  gh#qbittorrent/qBittorrent#19738)\n\n- Update to version 4.6.1\n\n  New features:\n\n  * Add option to enable previous Add new torrent dialog behavior\n\n  Fixed bugs:\n\n  * Prevent crash due to race condition when adding magnet link\n  * Fix Enter key behavior when add new torrent\n  * Add missing main window icon\n  * Update size of selected files when selection is changed\n  * Correctly handle changing save path of torrent w/o metadata\n  * Use appropriate icon for 'moving' torrents in transfer list\n\n  Web UI:\n\n  * Drop WebUI default credentials\n  * Add I2P settings to WebUI\n  * Fix duplicate scrollbar on Transfer List\n  * Fix incorrect subcategory sorting\n  * Correctly set save path in RSS rules\n  * Allow to request torrents count via WebAPI\n  * Improve performance of getting torrent numbers via WebAPI\n  * Improve free disk space checking for WebAPI\n\n  Misc:\n\n  * Fix invisible tray icon with Qt5 in Linux\n\n\n- Update to version 4.6.0\n\n  New features:\n\n  * Add (experimental) I2P support\n  * Provide UI editor for the default theme\n  * Various UI theming improvements\n  * Implement torrent tags editing dialog\n  * Revamp 'Watched folder options' and 'Automated RSS\n    downloader' dialog\n  * Allow to use another icons in dark mode\n  * Allow to add new torrents to queue top\n  * Allow to filter torrent list by save path\n  * Expose 'socket send/receive buffer size' options\n  * Expose 'max torrent file size' setting\n  * Expose 'bdecode limits' settings\n  * Add options to adjust behavior of merging trackers to\n    existing torrent\n  * Add option to stop seeding when torrent has been inactive\n  * Allow to use proxy per subsystem\n  * Expand the scope of 'Proxy hostname lookup' option\n  * Add shortcut for 'Ban peer permanently' function\n  * Add option to auto hide zero status filters\n  * Allow to disable confirmation of Pause/Resume All\n  * Add alternative shortcut CTRL+E for CTRL+F\n  * Show filtered port numbers in logs\n  * Add button to copy library versions to clipboard\n\n  Bug fixes:\n\n  * Ensure ongoing storage moving job will be completed when\n    shutting down\n  * Refactored many areas to call non UI blocking code\n  * Various improvements to the SQLite backend\n  * Improve startup window state handling\n  * Use tray icon from system theme only if option is set\n  * Inhibit system sleep while torrents are moving\n  * Use hostname instead of domain name in tracker filter list\n  * Visually validate input path in torrent creator dialog\n  * Disable symlink resolving in Torrent creator\n  * Change default value for `file pool size` and `stop tracker\n    timeout` settings\n  * Log when duplicate torrents are being added\n  * Inhibit suspend instead of screen idle\n  * Ensure file name is valid when exporting torrents\n  * Open 'Save path' if torrent has no metadata\n  * Prevent torrent starting unexpectedly edge case with magnet\n  * Better ergonomics of the 'Add new torrent' dialog\n\n  WebUI:\n\n  * Add log viewer\n  * WebAPI: Allow to specify session cookie name\n  * Improve sync API performance\n  * Add filelog settings\n  * Add multi-file renaming\n  * Add 'Add to top of queue' option\n  * Implement subcategories\n  * Set 'SameSite=None' if CSRF Protection is disabled\n  * Show only hosts in tracker filter list\n  * Set Connection status and Speed limits tooltips\n  * set Cross Origin Opener Policy to `same-origin`\n  * Fix response for HTTP HEAD method\n  * Preserve the network interfaces when connection is down\n  * Add 'Add Tags' field for RSS rules\n  * Fix missing error icon\n\n  RSS:\n\n  * Add 'Rename rule' button to RSS Downloader\n  * Allow to edit RSS feed URL\n  * Allow to assign priority to RSS download rule\n\n  Search:\n\n  * Use python isolate mode\n  * Bump python version minimum requirement to 3.7.0\n\n  Other:\n\n  * Numerous code improvements and refactorings\n\n- Update to version 4.5.5\n\n  Bug fixes:\n\n  * Fix transfer list tab hotkey\n  * Don't forget to enable the Apply button in the Options dialog\n  * Immediately update torrent status on moving files\n  * Improve performance when scrolling the file list of large\n    torrents\n  * Don't operate on random torrents when multiple are selected\n    and a sort/filter is applied\n\n  RSS:\n\n  * Fix overwriting feeds.json with an incomplete load of it\n\n- Update to version 4.5.4\n\n  Bug fixes:\n\n  * Allow to disable confirmation of Pause/Resume All\n  * Sync flag icons with upstream\n\n  Web UI:\n\n  * Fix category save path\n\n- Update to version 4.5.3\n\n  Bug fixes:\n\n  * Correctly check if database needs to be updated\n  * Prevent incorrect log message about torrent content deletion\n  * Improve finished torrent handling\n  * Correctly initialize group box children as disabled in\n    Preferences\n  * Don't miss saving 'download path' in SQLite storage\n  * Improve logging of running external program\n\n  Web UI:\n\n  * Disable UPnP for web UI by default\n  * Use workaround for IOS file picker\n  * Work around Chrome download limit\n  * Improve 'exporting torrent' behavior\n\n- Update to version 4.5.2\n\n  Bug fixes:\n\n  * Don't unexpectedly activate queued torrents when prefetching\n    metadata for added magnets\n  * Update the cached torrent state once recheck is started\n  * Be more likely to allow the system to use power saving modes\n\n  Web UI:\n\n  * Migrate away from unsafe function\n  * Blacklist bad ciphers for TLS in the server\n  * Allow only TLS 1.2+ in the server\n  * Allow to set read-only directory as torrent location\n  * Reject requests that contain backslash in path\n\n  RSS:\n\n  * Prevent RSS folder from being moved into itself\n\n- Update to version 4.5.1\n\n  New features:\n\n  * Re-allow to use icons from system theme \n\n  Bug fixes:\n\n  * Fix Speed limit icon size \n  * Revise and fix some text colors \n  * Correctly load folder based UI theme \n  * Fix crash due to invalid encoding of tracker URLs \n  * Don't drop !qB extension when renaming incomplete file \n  * Correctly count the number of torrents in subcategories \n  * Use 'additional trackers' when metadata retrieving \n  * Apply correct tab order to Category options dialog \n  * Add all torrents passed via the command line \n  * Fix startup performance on Qt5 \n  * Automatic move will now overwrite existing files \n  * Some fixes for loading Chinese locales \n  * New Pause icon color for toolbar/menu \n  * Adjust env variable for PDB discovery \n\n  Web UI:\n\n  * Fix missing 'queued' icon \n  * Return paths using platform-independent separator format \n  * Change order of accepted types of file input \n  * Add missing icons \n  * Add 'Resume data storage type' option \n  * Make rename file dialog resizable \n  * Prevent incorrect line breaking \n  * Improve hotkeys \n  * Remove suggestions while searching for torrents \n  * Expose 'IS PRIVATE' flag \n  * Return name/hash/infohash_v1/infohash_v2 torrent properties \n\n  Other:\n\n  * Fix tray icon issues \n\n- Update to version 4.5.0\n\n  New features:\n\n  * Add `Auto resize columns` functionality\n  * Allow to use Category paths in `Manual` mode\n  * Allow to disable Automatic mode when default 'temp' path\n    changed\n  * Add tuning options related to performance warnings\n  * Add right click menu for status filters\n  * Allow setting the number of maximum active checking torrents\n  * Add option to toggle filters sidebar\n  * Allow to set `working set limit` on non-Windows OS\n  * Add `Export .torrent` action\n  * Add keyboard navigation keys\n  * Allow to use POSIX-compliant disk IO type\n  * Add `Filter files` field in new torrent dialog\n  * Implement new icon/color theme\n  * Add file name filter/blacklist\n  * Add support for custom SMTP ports\n  * Split the OS cache settings into Disk IO read/write modes\n  * When duplicate torrent is added set metadata to existing one\n  * Greatly improve startup time with many torrents\n  * Add keyboard shortcut to Download URL dialog\n  * Add ability to run external program on torrent added\n  * Add infohash and download path columns\n  * Allow to set torrent stop condition\n  * Add a `Moving` status filter\n  * Change color palettes for both dark, light themes\n  * Add a `Use proxy for hostname lookup` option\n  * Introduce a `change listen port` cmd option\n  * Implement `Peer ID Client` column for `Peers` tab\n  * Add port forwarding option for embedded tracker\n\n  Bug fixes:\n\n  * Store hybrid torrents using `torrent ID` as basename\n  * Enable Combobox editor for the `Mixed` file download priority\n  * Allow shortcut folders for the Open and Save directory\n    dialogs\n  * Rename content tab `Size` column to `Total Size`\n  * Fix scrolling to the lowermost visible torrent\n  * Allow changing file priorities for finished torrents\n  * Focus save path when Manual mode is selected initially\n  * Disable force reannounce when it is not possible\n  * Add horizontal scrolling for tracker list and torrent content\n  * Enlarge 'speed limits' icons\n  * Change Downloaded to Times Downloaded in trackers tab\n  * Remove artificial max limits from `Torrent Queueing` related\n    options\n  * Preserve `skip hash check` when there is no metadata\n  * Fix DHT/PeX/LSD status when it is globally disabled\n  * Fix rate calculation when interval is too low\n  * Add tooltip message when system tray icon isn't available\n  * Improve sender field in mail notifications\n  * Fix 'Add torrent dialog' spill-over on smaller screens\n  * Fix peer count issue when tracker responds with zero figure\n  * Don't merge trackers by default\n  * Don't inhibit system sleep/auto shutdown for torrents stuck\n    at downloading metadata\n  * Allow to pause a checking torrent from context menu\n  * Allow to use subnet notation in reverse proxy list\n  * Fine tune translations loading for Chinese locales\n  * Fix torrent content checkboxes not updated properly\n  * Correctly load state of `Use another path for incomplete\n    torrents` in Watched folders\n  * Add confirmation to resume/pause all\n  * Fix wrong count of errored trackers\n\n  WebUI:\n\n  * Allow blank lines in multipart form-data input\n  * Make various dialogs resizable\n  * Fix wrong v2 hash string displayed\n  * WebAPI: return correct status\n  * Fix empty selection in language combobox\n  * Store WebUI port setting in human readable number\n  * Add support for exporting .torrent\n  * WebAPI: Add endpoint to set speed limit mode\n  * Improve progress bar rendering\n  * Add transfer list refresh interval settings\n  * Use natural sort\n  * Apply i18n translation only to built-in WebUI\n  * Alert when HTTPS settings are incomplete\n  * Handle drag and drop events\n  * Fix wrong behavior for shutdown action\n  * Don't disable combobox for file priority\n\n  RSS:\n\n  * Increase limit of maximum number of articles per feed\n\n  Other:\n\n  * Mark as single window app in .desktop file\n  * Add Dockerfile\n  * Remove option of using icons from system theme\n\n- Update to version 4.4.5\n\n  Bug fixes:\n\n  * Fix missing trackers when adding magnet link. Affects\n    libtorrent 2.0.x builds.\n\n- Update to version 4.4.4.\n\n  * Improve D-Bus notifications handling\n\n  Bug fixes:\n\n  * Correctly handle data decompression with Qt 6.3\n  * Fix wrong file names displayed in tooltip\n  * Fix incorrect 'max outgoing port' setting\n  * Make working set limit available only on libtorrent 2.0.x\n    builds\n  * Try to recover missing tags\n\n  RSS:\n\n  * Clear RSS parsing error after use\n\n  Web API:\n\n  * Set HTTP method restriction on WebAPI actions\n\n- Update to version 4.4.3.1\n\n  Bug fixes:\n\n  * Fix broken translations\n\n- Update to version 4.4.3\n\n  Bug fixes:\n\n  * Correctly handle changing of temp save path\n  * Fix storage in SQLite\n  * Correctly apply content layout when 'Skip hash check' is\n    enabled\n  * Don't corrupt IDs of v2 torrents\n  * Reduce the number of hashing threads by default (improves\n    hashing speed on HDDs)\n  * Prevent the 'update dialog' from blocking input on other\n    windows\n  * Add trackers in exported .torrent files\n  * Fix wrong GUI behavior in 'Optional IP address to bind to'\n    setting\n\n  Web UI:\n\n  * Fix WebUI crash due to missing tags from config\n  * Show correct location path\n\n","id":"openSUSE-SU-2023:0391-1","modified":"2023-12-07T09:01:17Z","published":"2023-12-07T09:01:17Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/C23UTVCBL5APTKIVTETTSF3J62IAN2BP/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1217677"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-30801"}],"related":["CVE-2023-30801"],"summary":"Security update for libtorrent-rasterbar, qbittorrent","upstream":["CVE-2023-30801"]}