On 2014-10-10, 4.0.2.1+hotfix1+build6 was released with the following changes: CVE-2014-6278

1. Windows: Cygwin Bash (sh.exe) updated from 4.1.14-7 to 4.1.17-9. 4.1.17-9 fixes CVE-2014-6278.
2. Windows: The aforementioned Cygwin Bash update also fixes the vulnerabilities fixed in 4.1.16-8, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277.
3. Windows: Cygwin krb5 (Kerberos) updated from 1.12.1-2 to 1.12.2-1, which fixes CVE-2014-4341 through -4345.

For the exact details of the bash and krb5 updates, see the respective release announcements: https://cygwin.com/ml/cygwin-announce/2014-10/msg00015.html

https://cygwin.com/ml/cygwin-announce/2014-10/msg00004.html

https://cygwin.com/ml/cygwin-announce/2014-10/msg00008.html

As with most vulnerabilities in 3rd party software, the X2Go project has not done an analysis of whether X2Go Client was actually affected by these vulnerabilities. In fact, it seems unlikely that X2Go Client for Windows is affected by the krb5 vulnerabilities because X2Go Client for Windows uses PuTTY for Kerberos authentication instead. (Cygwin krb5 is merely installed because it is a dependency of Cygwin SSH.) However, as a precaution, we are releasing this updated build of X2Go Client for Windows. Unless an analysis is performed, we strongly encourage all users to update. This includes users of the “misc” fonts and “full” fonts builds.

On 2014-09-30, 4.0.2.1+hotfix1+build5 was released with the following changes:

1. Windows: Cygwin Bash (sh.exe) updated from 4.1.10-4 to 4.1.14-7. This fixes the “Shellshock” vulnerability.

For the exact details of the bash update, see the Cygwin Bash release announcement for 4.1.14-7

https://cygwin.com/ml/cygwin-announce/2014-09/msg00040.html

The X2Go project has not done an analysis of whether X2Go Client was actually affected by the “Shellshock” vulnerability. However, as a precaution, we are releasing this updated build of X2Go Client for Windows with the fixed cygwin bash. Unless an analysis is performed, we strongly encourage all users to update. This includes users of the “misc” fonts and “full” fonts builds.

On 2014-09-02, 4.0.2.1+hotfix1+build4 was released with the following changes:

1. Windows: Fix missing VcXsrv/zlib1.dll . The impact of this bug was that VcXsrv would not start if the cwd was changed from the x2goclient directory. (The start menu and desktop shortcuts do have the x2goclient directory as the cwd. So they were not affected.) (Fixes: #587)

Users are advised to update from 4.0.2.1+hotfix1+build3 to 4.0.2.1+hotfix1+build4 if they are affected by this bug.

On 2014-08-09, 4.0.2.1+hotfix1+build3 was released with the following changes:

1. Windows: Win32 OpenSSL updated from 1.0.1h to 1.0.1i, which fixes the 9 CVEs announced on 2014-08-06.
2. Windows: Cygwin OpenSSL updated from 1.0.1h-1 to 1.0.1i-1, which fixes the 9 CVEs announced on 2014-08-06.

All users of 4.0.2.1+hotfix1 and earlier are strongly encouraged to update to 4.0.2.1+hotfix1+build3. This includes users of the “misc” fonts and “full” fonts builds.

Also, please note:

1. x2goclient “4.0.2.1+hotfix1+build2” was posted to http://code.x2go.org/releases/ , but users should ignore it because bug #564 was discovered in it. This bug was part of the manually performed build process. “4.0.2.1+hotfix1+build3” should be used instead, it contains the fix for bug #564.

The size of the NSIS installer has been reduced from about 21MB to about 16MB by switching to lzma solid compression

nxproxy (nx-libs-lite) now uses cygwin's libjpeg-turbo, instead of cygwin's libjpeg. This reduces the CPU usage of nxproxy.

All builds with version “4.0.2.1+hotfix1+build6” in their filename are current.

The regular build, x2goclient-4.0.2.1+hotfix1+build6-setup.exe, is available under this folder:

• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build6/

The “misc” fonts build, x2goclient-4.0.2.1+hotfix1+build6-miscfonts-setup.exe, is available under the folder listed below. See the “Noteworthy Windows-Specific Bugs” below for more info.

The “full” fonts build, x2goclient-4.0.2.1+hotfix1+build6-fullfonts-setup.exe, is available under the folder listed below. See the “Noteworthy Windows-Specific Bugs” below for more info.

A debug build, x2goclient-4.0.2.1+hotfix1+build6-debug-setup.exe, is also available under the folder listed below. If you experience a bug and would like to assist with debugging it, this build is for you. It does not include any of the fonts.

• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build6/non-default-builds/

The regular builds, x2goclient-4.0.2.1+hotfix1 through x2goclient-4.0.2.1+hotfix1+build5-setup.exe, are available under these folders:

• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build5/
• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build4/
• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build3/
• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1/

The “misc” fonts builds, x2goclient-4.0.2.1+hotfix1-miscfonts-setup.exe through x2goclient-4.0.2.1+hotfix1+build5-miscfonts-setup.exe, are available under the folders listed below. See the “Noteworthy Windows-Specific Bugs” below for more info.

The “full” fonts builds, x2goclient-4.0.2.1+hotfix1-fullfonts-setup.exe through x2goclient-4.0.2.1+hotfix1+build5-fullfonts-setup.exe, are available under the folder listed below. See the “Noteworthy Windows-Specific Bugs” below for more info.

Debug builds, x2goclient-4.0.2.1+hotfix1-debug-setup.exe through x2goclient-4.0.2.1+hotfix1+build5-debug-setup.exe, are also available under the folder listed below. If you experience a bug and would like to assist with debugging it, these builds are for you. They do not include any of the fonts.

• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build5/non-default-builds/
• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build4/non-default-builds/
• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1+build3/non-default-builds/
• http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1/non-default-builds/

X2Go Client is currently only released as a 32-bit x86 build. Both 32-bit x86 and 64-bit x86 versions of Windows are supported via this build.

• Windows XP 32-bit SP3
• Windows XP 64-bit SP2
• Windows Vista SP2
• Windows 7 SP1
• Windows 8
• Windows 8.1 (with or without “Update 1”)

These versions of Windows without the latest (specified) service pack may be compatible, but are rarely (if ever) tested. They are not officially supported.

Corresponding server versions of Windows are also supported, but receive minimal testing:

• Windows Server 2003 SP2
• Windows Server 2003 R2 SP2
• Windows Server 2008 SP2
• Windows Server 2008 R2 SP1
• Windows Server 2012
• Windows Server 2012 R2 (with or without “Update 1”)

Any incompatibility or bug with a specific version of Windows should be reported via our bug-tracker.

See this page:

• http://wiki.x2go.org/doku.php/doc:installation:x2goclient

As mentioned in the regular release notes:

• Fix starting sshd on Win XP. (Fixes: #421)
• Fix “fullscreen” mode on Windows 7 with multiple monitors.
• Prevent high PulseAudio CPU usage on Windows XP by lowering PulseAudio's CPU priority from “high” to “normal” on XP specifically. Also do so on Windows Server 2003 (R2) (Fixes #526)
• Enable PulseAudio log when –debug is passed. (Technically not a bugfix, but it is a minor enhancement which helps users and developers debug X2Go Client.)
• nxproxy (nx-libs-lite) was downloaded and compiled from the release tarball, rather than from git, so that the patches are actually applied. (This may fix multiple nx-libs bugs in X2Go Client for Windows.)
• Switch from regular NSIS 2.46 to Unicode NSIS 2.46.5 (Fixes: #528)

• bug 108 - Certain legacy applications fail to start (or exhibit font-related bugs) due to the fonts not being installed on the X2Go Client. This can be worked around by using the x2goclient-4.0.2.1+hotfix1-miscfonts-setup.exe installer located here: http://code.x2go.org/releases/binary-win32/x2goclient/releases/4.0.2.1+hotfix1/non-default-builds/ . If the problem still persists, try using x2goclient-4.0.2.1+hotfix1-fullfonts-setup.exe instead.
• bug 109 - x2goclient refuses to start after selecting a nonexistent external X server. To prevent this bug, do not select to use an external X server without specifying the path to an external X server that is actually installed. (The default path usually does not exist.) If you are experiencing this bug, work around it by setting this registry value: HKEY_CURRENT_USER\Software\Obviously Nice\x2goclient\settings\useintx = true