Firmware release notes 4.8.x

This article is a stub. Main article: DSOS release notes.

Release 4.8.7 build 2

Release name: "Stecknadelhorn" 4.8.7 build 2. Release date: June 3^rd, 2025.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party DSOS players.
Firmware version number: 4.8.7-2.0.0-d2b8005a

Improvements

Updated the firmware update engine (updater) to version 1.17 to support upgrading to the DSOS 4.9.× versions, without intermediate updates. Note that the player will boot into Recovery mode to perform the firmware update operation.

Release 4.8.7

Release name: "Stecknadelhorn" 4.8.7. Release date: April 8^th, 2025.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party DSOS players.
Firmware version number: 4.8.7-1.0.1-1881e811

Improvements

Added support for SharePoint news posts created after August 2024, which expose the title area differently in the Microsoft Graph API.

Fixes

Restoring a configuration backup generated on a device with a different DSOS license (a.k.a., Feature Set) could fail, complaining that some features are not supported even if the current license on the player supports all features.
The timezone database used to display the list of timezones and their UTC offsets in Control Center was outdated and did not match the timezone data used by the system; this only affected the display of the timezone offset in Control Center and not the offset actually used (e.g., Almaty was shown as being at UTC+6:00, although it was in fact UTC+5:00).

Applies to all DSOS players, except HMP350, HMP300, and DiVA

Touchscreens that implement the pointer with absolute coordinates HID protocol instead of the multi-touch protocol did not work correctly on players other than HMP350, HMP300 and DiVA. This only affects older single-touch models, modern touchscreens implement the multi-touch protocol even if they are single-touch.

Applies to HMP400W, iBX410W and third-party DSOS players

Unconfigured players sometimes failed to show the information and QR code to connect to the Wi-Fi configuration interface at boot due to a race condition.
The Wi-Fi configuration interface did not correctly escape backslash and space characters in passwords and other data, hence Wi-Fi networks using those characters in their configuration did not work.

Applies to iBX410/W and third-party DSOS players based on Elkhart Lake or Jasper Lake CPU platforms

Improved system stability by optimizing GPU and CPU power states.

Applies to iBX440

The video output streaming configuration could, in some conditions, list resolutions higher than 4K, although the hardware does not support it.

Security

Fixed two cross-site scripting vulnerabilities (severity level: low) in Control Center.
The Recovery Console is updated to version 2.22.0.

Release 4.8.6 build 2

Release name: "Stecknadelhorn" 4.8.6 build 2. Release date: February 5^th, 2025.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party DSOS players.
Firmware version number: 4.8.6-2.0.0-b4815329

Improvements

Add missing caching directives for Control Center static resources to improve performance by reducing repeated requests for static content.

Applies to all DSOS players, except HMP350, HMP300, and DiVA

Update intel-microcode from 20240312 to 20241112 version for improved system stability.
Added support for many USB to RS-232 adapters: Silicon Labs CP210x, Moschip 7720, Moschip 7840/7820, Moxa UPORT, MaxLinear/Exar, Fintek F81232, and compatibles.

Applies to iBX410/W and third-party DSOS players based on Elkhart Lake or Jasper Lake CPU platforms

Improved system stability by optimizing CPU power states.

Release 4.8.6

Release name: "Stecknadelhorn" 4.8.6. Release date: November 18^th, 2024.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party DSOS players.
Firmware version number: 4.8.6-1.0.0-314c32d5

New

Added support for having an independent overlay content which shows on top of the regular content. This enables scenarios such as independently managed dynamic alert projects which show only when specific events occur; the URI of this overlay content is added in the player configuration. This feature requires a KIOSK or SYSTEMS Feature Set.
Added support for Bluefin Ocean platform with Intel N97 CPUs embedded in Flex-OS displays from Bluefin.

Improvements

The hardware watchdog is now used to trigger reboots when the software watchdog detects a malfunction; previously a normal software driven reboot was used which is less robust and could eventually result in hanging the player during the reboot, requiring a power cycle to recover depending on the type of malfunction.
Added support for extracting all media types from SharePoint news posts and pages, including images, videos, titles, descriptions, and links to full articles.

Applies to all DSOS players, except HMP350, HMP300, and DiVA

More information about the graphics rendering device are now included in the player report, for better diagnostics.

Fixes

Changes to the display power save configuration that should have resulted in changing the screen power state were not always correctly applied until the next power state change, or a reboot.
Player enrollment in the SpinetiX cloud failed and rebooted the player if an HTTP proxy was configured, it required credentials and the configured credentials were invalid; the repeated crashes resulted in the player entering Recovery mode.
The player content server was enabled even when the Feature Set did not allow it. This was a regression introduced with 4.7.5.
Having a standalone Feature Set on a player connected to an SpinetiX ARYA Enterprise account with a bundled license of a different type made the embedded web server return invalid headers in responses.
Raised the limit on the number of slices permitted in H.264 videos from 16 to 32, as some streaming encoders may use more than 16 slices.
H.264 videos with negative Picture Order Count (POC) values, which occur when using open-GOP with Instantaneous Decoder Refresh (IDR) frames, were not decoded correctly, leading to choppy playback.
Control Center inadvertently logged trace level messages to a temporary file.
Limit excessive connected / disconnected log messages that occur on Bluefin N97 based displays when enabling display power saving.

Applies to all DSOS players, except HMP350, HMP300, and DiVA

Control Center and many of the player APIs endpoints exposed by the embedded web server had slow response times (~600 ms) due to the Feature Set checking; the license checking mechanism was reworked to avoid this overhead and now response times are in the 30 to 40 ms range.

Applies to iBX410/W and third-party DSOS players based on Elkhart Lake and Jasper Lake CPU platforms

Enabled the hardware watchdog to ensure the player automatically reboots in case of a complete system freeze, complementing the software watchdog that handles reboots in most cases.

Developer

Web Storage REST API

Some CORS response headers returned by the embedded web server were incorrect, response headers which are only for preflight requests were returned for all requests.
The PURGE method was not CORS enabled.
The proper Content-Type and Cache-Control headers were not always returned, and browsers could cache the responses depending on modification dates.

Release 4.8.5

Release name: "Stecknadelhorn" 4.8.5. Release date: August 12^th, 2024.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party players.
Firmware version number: 4.8.5-1.0.0-2c483a1f

Improvements

Improved the pairing PIN display in Control Center, used to add a player to ARYA. The PIN is now hidden by default and show button is available, this makes sure the displayed PIN is always current.
Recovery Console is updated to version 2.20.0.
Improved the clock skew compensation mechanism added in DSOS 4.8.4 to reduce the number of requests needing to be retried.

Fixes

Failed requests or requests requiring authentication were mistakenly considered as successful, making Pull Mode operations fail when an HTTP proxy was used.

Security

Updated base libraries and components, the main changes are as follows:

Apache httpd: update from version 2.4.61 to 2.4.62, which fixes CVE-2024-40725, which affected DSOS, and CVE-2024-40898, which did not affect DSOS.

Release 4.8.4

Release name: "Stecknadelhorn" 4.8.4. Release date: July 24^th, 2024.

Applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA, and third-party players.
Firmware version number: 4.8.4-1.0.0-e62e6443

New

Added support for retrieving SharePoint news posts, including title, description, header image, and link to full article. This social network channel is available within the advanced data feed widgets of Elementi X.

Improvements

Control Center
- Added the pairing PIN on the main page to ease adding a player to ARYA.
- The display info box no longer shows the "type" item, as the information was misleading and not useful with current platforms.
Recovery Console is updated to version 2.19.0.
The Apache httpd version is no longer returned within the HTTP response headers to avoid misdetection of security vulnerabilities, since often vulnerabilities are fixed by backports without increasing the version number.
Added capability to select audio track by number, using "#n" syntax in the spx:audio attribute.
Added new spx:rangeRequests attribute to media layers for disabling the use of HTTP byte range requests for compatibility with servers that do not support it properly.
Added automatic clock skew compensation so that players or computers whose local clock is off by more than 5 minutes can still communicate with the SpinetiX cloud; the compensation is however limited, as very large offsets anyhow break TLS certificate validation.
Updated EULA to the December 5, 2023, version.

Applies to HMP400 and HMP400W

The Status API now includes information about the present power sources (usb, poe, or poe+usb).

Applies to third-party DSOS players

Added support for the iQnetiX EMP-III player.
Added support for the Intel AX101 Wi-Fi module.

Fixes

SRT streams with multiple audio tracks failed to be decoded.
Elementi and the player on DSOS did not use the same user HTTP user agent string, now they both use "Mozilla/5.0 (compatible) AppleWebKit/537.36 (KHTML, like Gecko) SpinetiX-resac/1.1".

Applies to iBX440 and third-party players using Gen12 Intel GPUs

The video output streaming feature did not work

Applies to HMP400, HMP400W, iBX410, iBX410W, iBX440, and third-party players

The video timings for the 4096x2160@60p-256:135 video mode were incorrect, using 2106 lines instead of 2160 lines, due to a typo.

Applies to HMP300, HMP350, and DiVA

The "ENERGY_PERF_BIAS set to normal (6)" message was being logged at boot, even if the platform had no ENERGY_PERF_BIAS setting.

Security

Updated base libraries and components, the main changes are as follows:

curl: fix CVE-2024-2398, which did not affect DSOS.
httpd: update from version 2.4.58 to 2.4.61, which fixes CVE-2024-24795, CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2023-38709, CVE-2024-39573 and CVE-2024-39884 which may affect DSOS and CVE-2024-27316, CVE-2024-38472 and CVE-2024-36387, none of which affect DSOS.
libxml2: fix CVE-2024-25062, which did not affect DSOS.
ncurses: fix CVE-2023-50495, which may have affected DSOS.
openssh: fix CVE-2024-0727, which did affect DSOS.
shadow: fix CVE-2023-4641, which did not affect DSOS.
tar: fix CVE-2023-39804, which did not affect DSOS.

Applies to HMP400, HMP400W, iBX410, iBX410W, iBX440, and third-party players.

linux-firmware: updated from 20231030 to 20240220
wireless-regdb: updated from 2023.05.03 to 2024.01.23
intel-microcode: updated from 20230808 to 20240312, fixing CVE-2023-22655, CVE-2023-23583, CVE-2023-28746, CVE-2023-38575, CVE-2023-39368, CVE-2023-43490

Release 4.8.3

Release name: "Stecknadelhorn" 4.8.3. Release date: May 2^nd, 2024.

Applies to HMP400, HMP400W, iBX410, iBX410W, iBX440, HMP350, HMP300, DiVA, and third-party players.
Firmware version number: 4.8.3-1.0.0-45ef4dae

Improvements

Display power schedule changes no longer require a reboot to be applied.
Recovery console is updated to version 2.18.2.
It is now possible to configure web page layers to run in secure context, as if they were loaded via HTTPS; this is controlled by the new spx:secureContext attribute, which defaults to false for backwards compatibility. Running in a secure context allows access to some restricted HTML APIs, like audio and video capture, but disables loading of content from HTTP sources

Applies to iBX440 only.

Multi-output configurations now support individual rotation of each display, using per output attributes; no particular Feature Set is required for using the rotation, but the resulting display layout should be compatible with the Feature Set activated on the player.

Fixes

The buffer size used for streaming was too small for high resolutions streams with bursty bitrates, and could cause lost video frames from streaming sources.
Configuring SNMP as "open to everybody" after having configured it to be open for only some IP addresses resulted in SNMP still being partially restricted to those IP addresses.
The power_state indicator in the display-info did not always reflect the true value of the display power state set by the player.
The Control Center wizard did not clear the previous display configuration before applying the new one, which could result in mixed display configurations.
When disabling a display power schedule not all the related services were disabled, the serial port part remained active.

Applies to iBX440 only.

Images downloaded from remote servers were downscaled to 4K resolution although decoding 8K images is supported, they are now downscaled to 8K on these players.

Applies to iBX410 and third-party players using Elkhart Lake Intel CPUs

The video output streaming feature did not work on these players.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players

The unused grub components removed from DSOS in 4.8.2 were not removed during firmware updates, only on newly installed DSOS.
Spurious error messages related to the "wlan-cfg" network interface from various network daemons appeared when resetting a device to factory default settings.

Applies to HMP300, HMP350, and DiVA

A spurious "failed to run licensecheck" error message appeared in the system log, but these player models do not need any license check.

Security

Updated base libraries and components, the main changes are as follows:

binutils: fixed CVE-2022-47007, CVE-2022-47008, CVE-2022-47010, CVE-2022-47011, CVE-2022-48063 and CVE-2022-47695, none of which affected DSOS.
curl: fixed CVE-2023-46218, which affected DSOS.
gnutls: fixed CVE-2023-5981 and CVE-2024-0553, both if which may have affected DSOS.
httpd: update from version 2.4.57 to 2.4.58, which fixes CVE-2023-31122 and CVE-2023-43622, none of which affected DSOS.
libxml2: fixed CVE-2023-45322, which affected DSOS.
ncurses: fixed CVE-2023-29491, which did not affect DSOS.
openssh: fixed CVE-2023-48795 and CVE-2023-51385, none of which affected DSOS.
sqlite3: fixed CVE-2023-7104, which may have affected DSOS.
tzdata: updated from version 2023c to 2024a, affecting Ittoqqortoormiit, Vostok, Casey, Palestine, Kazakhstan.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players.

Updated Linux kernel from version 5.15.133 to 5.15.137, which fixes the following vulnerabilities.

That affected DSOS: CVE-2023-42754, CVE-2023-52501, CVE-2023-52580, CVE-2023-52527, CVE-2023-52523, CVE-2023-52522, CVE-2023-52531, CVE-2023-52477, CVE-2023-52504, CVE-2023-52476 and CVE-2023-5717.
That did not affect DSOS: CVE-2023-52574, CVE-2023-52484, CVE-2023-4563, CVE-2023-52500, CVE-2023-52482, CVE-2023-52511, CVE-2023-52516, CVE-2023-4244, CVE-2023-52517, CVE-2023-52563, CVE-2023-52578, CVE-2023-5197, CVE-2023-52566, CVE-2023-52573, CVE-2023-34324, CVE-2023-52519, CVE-2024-0641, CVE-2023-31085, CVE-2023-52479, CVE-2023-52513, CVE-2023-52529, CVE-2023-52528, CVE-2023-5158, CVE-2023-52475, CVE-2023-52559, CVE-2023-52509, CVE-2023-52510, CVE-2023-52520, CVE-2023-52507, CVE-2023-52515, CVE-2023-52478, CVE-2023-52503, CVE-2023-52502, CVE-2023-35827, CVE-2023-52499, CVE-2023-46343, CVE-2023-52483 and CVE-2023-46813.
bluez: fixed CVE-2023-45866, which did not affect DSOS.
flac: fixed CVE-2021-0561, which may have affected DSOS.
linux-firmware: updated to version 20231030

Release 4.8.2

Release name: "Stecknadelhorn" 4.8.2. Release date: February 21^st, 2024.

Applies to HMP400, HMP400W, iBX410, iBX410W, iBX440, HMP350, HMP300, DiVA, and third-party players.
Firmware version number: 4.8.2-1.0.1-e42c318a

New

Added support for new iBX410W model, variant of iBX410 with Wi-Fi capability.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players.

Added support for exFAT filesystems, USB storage formatted as exFAT can now be used like FAT formatted storage.

Improvements

Recovery console is updated to version 2.17.1
The display-info file now supports reporting information about multiple displays on the iBX440.
Expiration of sign in to Control Center is now also applied to endpoints which are directly served by the Apache httpd server; now all endpoints which can be accessed after signing in to Control Center without further authentication, apply the same expiration.
The value of the bootcount counter is now explicitly logged on each boot for ease of diagnostics.
Moved the uploader spx.publish logs from trace to debug level for ease of diagnostics.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players

Enabled transparent huge pages for improved performance, in particular on iBX410, iBX440, and recent third-party players.
Removed some unused grub components from DSOS to optimize storage use.
Improved the error logging of the Wi-Fi and 802.1x daemon (iwd) to aid in diagnostics.
The UEFI Secure Boot database is now re-provisioned on boot if it was cleared from the BIOS.
The logs from the HTML5 rendering engine (CEF) are now rotated when they exceed 800 KB.

Applies to iBX410 and iBX410W.

Tuned the system parameters to optimize the performance when heavily loaded and make the performance more consistent and predictable.

Applies to iBX440.

Display power saving is now applied to all displays on the iBX440.

Fixes

The "Update Now" button normally shown on the firmware version tile of the Control Center main page when there is a new firmware available was not shown. This was a regression introduced in 4.8.0.
The Scheduled Download settings UI in Control Center sometimes did not reflect the actual settings. This was a regression introduced in 4.8.0.
Removed unused authentication mechanism in Control Center with per-user API keys which was not exposed and was unused.
Reports taken on third party players with eMMC based storage were missing the recovery data.
There was a spurious error about missing NTP peers on each boot.

Applies to HMP400W, iBX410, iBX440, and third-party players

The Wi-Fi configuration interface would not generate a correct configuration if a certificate in PEM format was provided and had Windows or Mac line endings, or was missing a final newline.

Applies to iBX410, iBX440 and third-party players.

Make sure the Intel Energy performance bias is set to "normal" on boot, irrespective of what the BIOS sets.
Some miscellaneous drivers were not enabled.

Applies to HMP400, HMP400W, and third-party players

Connecting a DisplayPort multi-stream capable display would confuse DSOS, DisplayPort multi-stream is now disabled.
The counter that limits the number of times the EFI boot manager entries may be re-written was not reset on a reset to factory defaults.
The Wi-Fi automated BSS blacklist timings were too long, misbehaving or misconfigured networks would often retry only every 24 hours, they are now retried every 10 minutes at most, with the back-off starting at 5 seconds.

Applies to HMP300, HMP350, and DiVA

It was not possible to adjust content duration in a playlist within the content management interface. This was a regression introduced in 4.8.0.
Some text animations could lead to a crash and reboot of the player.
Some 60 Hz stretch displays could report the vertical refresh frequency as 59 Hz instead of 60.

Security

Updated base libraries and components, the main changes are as follows:

libxml2: fixed CVE-2023-39615, which may have affected DSOS, and CVE-2021-3516, which did not affect DSOS.
openssh: fixed CVE-2023-38408, which did not affect DSOS.
bind: fixed CVE-2023-2828 and CVE-2023-3341, which did not affect DSOS.
php: fixed CVE-2023-3824, which may have affected DSOS, and CVE-2023-3247 and CVE-2022-4900, which did not affect DSOS.
httpd: fixed CVE-2023-45802, which did not affect DSOS.
glib-2.0: fixed CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665, which affected DSOS.
curl: fixed CVE-2023-28321 and CVE-2023-28322, which affected DSOS, and CVE-2023-38546 and CVE-2023-38545, which did not affect DSOS.
openssl: updated to version 1.1.1w, fixing CVE-2023-4807, which did not affect DSOS.
busybox: fixed CVE-2022-48174, which may have affected DSOS.
dbus: fixed CVE-2023-34969, which did not affect DSOS.
gawk: fixed CVE-2023-4156, which affected DSOS.
glibc: fixed CVE-2023-4911 and CVE-2023-4813, which did not affect DSOS.
binutils: fixed CVE-2023-25584 and CVE-2021-46174, which did not affect DSOS.
avahi: fixed CVE-2023-1981, CVE-2023-38469, CVE-2023-38470, CVE-2023-38471, CVE-2023-38472 and CVE-2023-38473, which may have affected DSOS.
shadow: fixed CVE-2023-29383, which did not affect DSOS.
zlib: fixed CVE-2023-45853, which did not affect DSOS.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players.

flac: fixed CVE-2020-22219, which did not affect DSOS.
libsndfile: fixed CVE-2021-4156 and CVE-2022-33065, which affected DSOS.
linux-firmware: updated to version 20230804
grub: fixed CVE-2023-4692 and CVE-2023-4693, which did not affect DSOS

Applies to iBX410, iBX410W, iBX440, and third-party players.

Updated the UEFI Secure Boot forbidden signatures list (dbx) to version 2023-05-09 from UEFI.
Added the 2023 Microsoft UEFI Secure Boot certificates to the signature database (db), "Microsoft UEFI CA 2023" and "Windows UEFI CA 2023".
Added the "Microsoft Corporation KEK 2K CA 2023" KEK certificate to the UEFI Secure Boot Key Exchange Key (KEK) database.

Developer

Configuration API

The <display-video-mode> configuration element, can now be used without parameters to reset the display video mode for all outputs, thus making it possible to use multiple such tags in an additive way.
The <hdmi-link-type> configuration element, supported only on DiVA, HMP300, and HMP350 models, would mess up the display configuration instead of being ignored on the other player models. This was a regression introduced in 4.8.0.

Release 4.8.1

Release name: "Stecknadelhorn" 4.8.1. Release date: December 6^th, 2023.

Applies to HMP400, HMP400W, iBX440, iBX410, HMP350, HMP300, DiVA, and third-party players.
Firmware version number: 4.8.1-1.0.1-291f7ae0

New

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players.

Added support for High Efficiency Video Coding (HEVC / H.265 / MPEG-H Part 2) streaming sources with SRT, HLS and DASH protocols. This is a Technology Preview Feature.

Improvements

Recovery Console is updated to version 2.16.2.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players

All users with admin rights now have access to the Recovery Console; requires recovery console version 2.16.2 or higher and becomes effective when a new user is added or a password is changed.
The EFI boot manager entries and order (i.e., BIOS boot priorities) for DSOS are now re-created if missing or not in the correct order.
The bootloader and its configuration used by the BIOS to boot DSOS are now updated during a firmware update.
The player report now includes the device information for license activation, as well as information about the TPM Endorsement Key (EK) and related certificates, for improved diagnostics.

Fixes

The release name, "Stecknadelhorn", was not properly set.
The software watchdog rebooted the system via the hardware watchdog instead of the kernel, which made diagnostics confusing. This was a regression introduced in 4.5.0.
An innocuous "no such table: WEBSTORAGE" error message, without consequence, could appear during boot.
Fixed PHP warning about undefined offset.
Animated GIFs would play at a maximum of 10 fps, any higher fps animated GIF was playing in slow motion.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players

4K was proposed as the default resolution in the Control Center wizard, instead of 1080p as in 4.7.7 and earlier versions; this was an unintended change in 4.8.0.
In some cases, players could crash and reboot due to contention on the GPU memory. This was a regression introduced in 4.8.0.
Sometimes the temperature from the internal sensor could be reported as "not found".
The configuration backup included a portNumber attribute for serial ports, although it is ignored and useless on players other than DiVA, HMP300 and HMP350.
Color Emojis could sometimes be accidentally rendered in black and white.

Applies to iBX410 and iBX440 players.

The "DSOS boot menu" boot option did not show the boot menu, instead it booted DSOS directly.
The DMC firmware for the GPU on iBX410 and third-party players with Elkhart Lake processors was missing.
Under rare circumstances, the synchronization of the multiple outputs on the iBX440 could be suboptimal due to CPU scheduling.
Images in 8K would not display for 8K capable players, such as iBX440.

Applies to HMP400, HMP400W, and third-party players

The hardware watchdog was not available on HMP400, HMP400W, and Intel NUC 8 Chaco Canyon, only the software watchdog was being used. This was a regression introduced in 4.8.0.

Applies to third-party players

The bootloader would fail to load on systems which failed TPM measurement operations (e.g., due to buggy BIOS), making the system impossible to boot; this was a compatibility problem introduced in 4.7.5; now TPM measurement errors do not prevent booting.

Security

Updated base libraries and components, the main changes are as follows.

curl: fixed CVE-2023-32001, which could affect DSOS, and CVE-2023-28320, which does not affect DSOS.
elfutils: fixed CVE-2021-33294, which does not affect DSOS.
libcap: fixed CVE-2023-2602 and CVE-2023-2603, all of which could affect DSOS.
libjpeg-turbo: fixed CVE-2020-35538 and CVE-2023-2804, all of which could affect DSOS.
ntp: fixed CVE-2023-26551, CVE-2023-26552, CVE-2023-26553, CVE-2023-26554, and CVE-2023-26555, none of which affected DSOS.
openssl: updated to 1.1.1v, fixing CVE-2023-2650, CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-3446, and CVE-2023-3817, all of which could affect DSOS.
procps: fixed CVE-2023-4016, which does not affect DSOS.
timezone database (tzdata): updated from 2022g to 2023c, affecting Egypt, Morocco, Palestine, Greenland.

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players

Linux kernel updated from 5.15.119 to 5.15.133 fixing the following security issues:
- That affected DSOS: CVE-2023-1206, CVE-2022-40982, CVE-2023-40283, CVE-2023-42752, CVE-2023-45871.
- That did not affect DSOS: CVE-2023-31248, CVE-2023-38432, CVE-2023-3866, CVE-2023-2898, CVE-2023-44466, CVE-2023-4132, CVE-2023-3611, CVE-2022-48502, CVE-2023-3865, CVE-2023-35001, CVE-2023-3776, CVE-2023-3863, CVE-2023-20593, CVE-2023-3777, CVE-2023-4004, CVE-2023-4015, CVE-2023-4147, CVE-2023-20569, CVE-2023-20588, CVE-2023-4128, CVE-2023-4208, CVE-2023-4206, CVE-2023-4207, CVE-2023-4569, CVE-2023-39194, CVE-2023-4273, CVE-2023-3772, CVE-2023-4921, CVE-2023-4623, CVE-2023-42753, CVE-2023-39189, CVE-2023-4881, CVE-2023-39193, CVE-2023-39192 and CVE-2023-42755.
dmidecode: CVE-2023-30630, which does not affect DSOS.
grub: fixed CVE-2020-27749, CVE-2021-20225, CVE-2021-20233, all of which could affect DSOS.
intel-microcode: updated to version 20230808, fixing CVE-2022-40982, which affects some of the supported platforms, and CVE-2023-23908 and CVE-2022-41804, none of which affects any of the supported platforms.
linux-firmware: updated to version 20230515
wireless-regdb: updated to version 2023.05.03

Developer

RPC API

The "restarted" RPC notification sent to RPC Concentrators had an empty bootid value most of the time, in both the parameter and the property of the "info" object.

Release 4.8.0

Release name: "Stecknadelhorn" 4.8.0. Release date: September 27^th, 2023.

Applies to HMP400, HMP400W, iBX410, iBX440, HMP350, HMP300, DiVA, and third-party players.
Firmware version number: 4.8.0-1.0.2-9acad3cd

New

Added support for the new SpinetiX player models: iBX410 and iBX440.
Added support for having multiple, perfectly-synchronized, video outputs on supported devices (e.g., iBX440).

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players.

Added support for close subtitling/captioning (CC) on video files or streaming media – subtitles can now be displayed on screen in the selected language; supported formats: EIA-708 (Line 21), Teletext, DVB, DVD, Blu-ray, SSA.
Added support for SRT protocol for streaming sources.

Applies to third-party players

Added support for Intel NUC 11 Atlas Canyon
Added support for Sharp/NEC SDM with Elkhart Lake CPU.
Added support for platforms using Intel Tiger Lake CPUs.

Improvements

Improved the Control Center user interface:
- Reworked the info-boxes on the Control Center home page to include the player model, Feature Set details, serial number, player time.
- Added the power source (PoE/USB) and power consumption info-boxes on HMP400 and HMP400W (hardware revision dependent).
- The source of each Feature Set is now shown, it can be either DSOS or content.
- Replaced "Power" with "Status" in the DISPLAY tab popover to avoid ambiguity.
- A warning is shown if the player time is off with respect to the browser time.
- The check for firmware update is now asynchronous to avoid blocking the PHP server.
- A warning dialog is displayed instead of the configuration wizard if no license is activated on a player.
- The name "uploader" and names starting with a period are disallowed when a user is created to avoid conflicts with internal users.
- When manual DNS is used, the DNS suffix is checked to make sure it is a valid domain name.
- Reworked the Output Streaming section for clarity.
- The "Capture stream packets" option is removed on players that do not support streaming, i.e., on the HMP300 and on players that do not have a SYSTEMS license.
- Added a "Web page data" option under the Operations ⇾ Reset section, to clear the HTML rendering engine data (HTTP cache, HTTP web storage, cookies). The "Web storage" option has been renamed to "Shared variables".
- The display power management controls are now available on third party players.
The net-snmp daemon is no longer started if SNMP is not enabled; previously it was always started but listening on only localhost by default.
The system report now includes a decoded dump of the EDID from the screen for improved diagnostics.
Added capability to select a particular audio track within a video file by setting the spx:audio attribute to a language code (e.g., "ENG", "FRA", "SPA", etc.), "QAA" (for the original language), or "QAD" (for audio description).

Applies to HMP400, HMP400W, iBX410, iBX440, and third-party players

Updated the HTML rendering engine to CEF / Chromium 95.
Updated FFmpeg to version 4.4.3 for subtitles support and other improved video support.
Updated GStreamer to version 1.20
Added support for Opus audio codec.
Updated graphics stack to support Intel CPUs with Gen12 (Xe) GPUs.
The intel-media-driver hardware acceleration decoders are now used on all Intel platforms, the legacy intel-vaapi-driver decoders have been removed since no longer used.
The Linux kernel has been updated from version 5.4 to 5.15.
Support for Thunderbolt / USB 4 devices has been added.
The packaging of firmware files for Intel GPUs has been reworked so that only the ones necessary for the supported platforms are included in DSOS.

Fixes

Control Center:

Added a check to prevent restoring a configuration if the passphrase or the secret key used when it was generated does not match the one configured on the player.
Display power schedules with invalid on/off time configurations are now forbidden.
When signing in, users with content right only are redirected to the user profile page, which is the only one they can access.
DHCP was shown when a static address was configured.
Applying a license would tell that a restart was needed even if the license failed.
Was not using a private directory for the runtime directory.
The timeout used to connect to DBus was too long and could cause long interruptions if ever the DBus system malfunctioned.

Others:

Firmware updates could fail with an out of space error when the update included very large packages (e.g., libcef).
Limit number of log messages for videos that cannot be decoded.
Show correct bitstream header names in logs.
Status API - the snapshotURI now points to the correct endpoint.
Error message on invalid power off time contained incorrect data.

Applies to HMP400 and HMP400W.

The daemon that gathers data from the microcontroller would report spurious communication errors due an invalid CRC on some data patterns, this had no effect in the hardware functionality.

Applies to HMP400, HMP400W, and third-party players

Some of the ancillary filesystems used in DSOS could not store timestamps past 2038 due to limited inode size, and a warning was logged when mounting them; all newly created filesystems are now capable of storing timestamps past 2038.

Applies to third-party players

The instant messaging service was not announced on Bonjour for these players.

Security

Updated base libraries and components, the main changes are as follows.

apache2: updated from 2.4.56 to 2.4.57 (fixes minor issues, none security related).
libxml2: fixed CVE-2023-29469, which could affect DSOS and CVE-2023-28484, which did not affect DSOS.
freetype: fixed CVE-2023-2004, which could affect DSOS.
curl: fixed CVE-2023-23916, which affected DSOS, and CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536 and CVE-2023-27538, none of which affected DSOS.
openssl: fixed CVE-2023-0464, CVE-2023-0465 and CVE-2023-0466, which could affect DSOS.
ffmpeg: the update from 4.2.4 to 4.4.3 fixed the following security issues, CVE-2019-13312, CVE-2019-13390, CVE-2019-15942, CVE-2019-17542, CVE-2020-12284, CVE-2020-13904, CVE-2020-14212, CVE-2020-20446, CVE-2020-20448, CVE-2020-20450, CVE-2020-20451, CVE-2020-20453, CVE-2020-20891, CVE-2020-20892, CVE-2020-20896, CVE-2020-20898, CVE-2020-20902, CVE-2020-21041, CVE-2020-22015, CVE-2020-22016, CVE-2020-22017, CVE-2020-22019, CVE-2020-22020, CVE-2020-22021, CVE-2020-22022, CVE-2020-22023, CVE-2020-22024, CVE-2020-22025, CVE-2020-22026, CVE-2020-22027, CVE-2020-22028, CVE-2020-22029, CVE-2020-22030, CVE-2020-22031, CVE-2020-22032, CVE-2020-22034, CVE-2020-22035, CVE-2020-22036, CVE-2020-22037, CVE-2020-22038, CVE-2020-22039, CVE-2020-22040, CVE-2020-22041, CVE-2020-22042, CVE-2020-22043, CVE-2020-22044, CVE-2020-22046, CVE-2020-22048, CVE-2020-23906, CVE-2020-24020, CVE-2020-35964, CVE-2020-35965, CVE-2021-30123, CVE-2021-33815, CVE-2021-38090, CVE-2021-38091, CVE-2021-38092, CVE-2021-38093, CVE-2021-38094, CVE-2021-38114, CVE-2021-38171, CVE-2021-38171, CVE-2021-38291, CVE-2021-38291, CVE-2022-1475, CVE-2022-3109 and CVE-2022-48434.

Updated several JavaScript libraries used by the player web interface, such as: jQuery (3.6.0), Bootstrap (3.4.1), Knockout (3.5.1)

The update of jQuery from 3.2.1 to 3.6.0 fixed CVE-2020-11022 and CVE-2020-11023 (they didn't affect DSOS though).

Applies to HMP400, HMP400W, and third-party players

Linux kernel updated from 5.4.209 to 5.15.119 fixing the following security issues:
- That affected DSOS: CVE-2020-12362, CVE-2020-12363, CVE-2020-12364, CVE-2020-36691, CVE-2021-3669, CVE-2021-3759, CVE-2021-4148, CVE-2021-4150, CVE-2021-4159, CVE-2021-20239, CVE-2021-29155, CVE-2022-1679, CVE-2022-2588, CVE-2022-3169, CVE-2022-3303, CVE-2022-3524, CVE-2022-3534, CVE-2022-3564, CVE-2022-3586, CVE-2022-3623, CVE-2022-3707, CVE-2022-4662, CVE-2022-20166, CVE-2022-20369, CVE-2022-26373, CVE-2022-41222, CVE-2022-41674, CVE-2022-42703, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721, CVE-2022-42895, CVE-2022-42896, CVE-2022-45887, CVE-2022-45934, CVE-2023-0045, CVE-2023-0160, CVE-2023-0266, CVE-2023-0394, CVE-2023-0458, CVE-2023-0459, CVE-2023-0461, CVE-2023-1073, CVE-2023-1077, CVE-2023-1249, CVE-2023-1582, CVE-2023-2002, CVE-2023-2163, CVE-2023-2513, CVE-2023-2860, CVE-2023-3006, CVE-2023-3161, CVE-2023-3268, CVE-2023-3567, CVE-2023-28327 and CVE-2023-34256.
- That did not affect DSOS: CVE-2019-15794, CVE-2019-19449, CVE-2020-16120, CVE-2020-24504, CVE-2020-27835, CVE-2020-29373, CVE-2020-29534, CVE-2020-36310, CVE-2020-36385, CVE-2021-0929, CVE-2021-4023, CVE-2021-4037, CVE-2021-4218, CVE-2021-20177, CVE-2021-32078, CVE-2021-44879, CVE-2022-0168, CVE-2022-1789, CVE-2022-2153, CVE-2022-2327, CVE-2022-2586, CVE-2022-2602, CVE-2022-2663, CVE-2022-2978, CVE-2022-2991, CVE-2022-3028, CVE-2022-3061, CVE-2022-3108, CVE-2022-3176, CVE-2022-3344, CVE-2022-3424, CVE-2022-3521, CVE-2022-3535, CVE-2022-3542, CVE-2022-3545, CVE-2022-3565, CVE-2022-3594, CVE-2022-3621, CVE-2022-3625, CVE-2022-3628, CVE-2022-3629, CVE-2022-3633, CVE-2022-3635, CVE-2022-3643, CVE-2022-3646, CVE-2022-3649, CVE-2022-4095, CVE-2022-4129, CVE-2022-4269, CVE-2022-4382, CVE-2022-4744, CVE-2022-20148, CVE-2022-20421, CVE-2022-20422, CVE-2022-23816, CVE-2022-27672, CVE-2022-29900, CVE-2022-29901, CVE-2022-34918, CVE-2022-36280, CVE-2022-39189, CVE-2022-39842, CVE-2022-40307, CVE-2022-40768, CVE-2022-41218, CVE-2022-41849, CVE-2022-41850, CVE-2022-42432, CVE-2022-43750, CVE-2022-45886, CVE-2022-45919, CVE-2022-47520, CVE-2022-47521, CVE-2022-47929, CVE-2022-47946, CVE-2023-0240, CVE-2023-0386, CVE-2023-0590, CVE-2023-0615, CVE-2023-1074, CVE-2023-1076, CVE-2023-1078, CVE-2023-1079, CVE-2023-1095, CVE-2023-1118, CVE-2023-1281, CVE-2023-1380, CVE-2023-1382, CVE-2023-1513, CVE-2023-1611, CVE-2023-1670, CVE-2023-1829, CVE-2023-1855, CVE-2023-1859, CVE-2023-1989, CVE-2023-1990, CVE-2023-2124, CVE-2023-2162, CVE-2023-2194, CVE-2023-2248, CVE-2023-2269, CVE-2023-2483, CVE-2023-2985, CVE-2023-3090, CVE-2023-3111, CVE-2023-3117, CVE-2023-3141, CVE-2023-3212, CVE-2023-3220, CVE-2023-3338, CVE-2023-3358, CVE-2023-3390, CVE-2023-3609, CVE-2023-3812, CVE-2023-20928, CVE-2023-23004, CVE-2023-23454, CVE-2023-23455, CVE-2023-23559, CVE-2023-26545, CVE-2023-26607, CVE-2023-28466, CVE-2023-30456, CVE-2023-30772, CVE-2023-31436, CVE-2023-32233, CVE-2023-32269, CVE-2023-33203, CVE-2023-33288, CVE-2023-34255, CVE-2023-35788, CVE-2023-35823, CVE-2023-35824 and CVE-2023-35828.

Developer

jSignage API

Improved the RSS parsing by adding the support for retrieving the default media of a media object/group, defined with the "isDefault" attribute (used by Fox News RSS feeds, for instance).
Replaced setInterval timer with an SVG timer in jSignage.UI.fingerTouchClass to prevent safe mode when using the fingerTouch animation within a multiscreen project. Increased the JSignage UI plugin library version to 1.1.2.

Configuration API

Removed the deprecated tags from the Configuration API, which are not used on models currently supported by DSOS.

RPC API

Modified the get_info RPC command to report the power inputs data for the HMP400/W players, when the power flag is provided.