February 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1022512] java-1.8.0-openjdk: NSS 3.28 update causes davmail to crash
by bugzilla_noreply＠novell.com 01 Feb '17

01 Feb '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1022512 http://bugzilla.opensuse.org/show_bug.cgi?id=1022512#c1 Jean Delvare <jdelvare(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |astieger(a)suse.com, | |jdelvare(a)suse.com, | |wolfgang(a)rosenauer.org --- Comment #1 from Jean Delvare <jdelvare(a)suse.com> --- Probably a duplicate of bug #1022053. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1022943] New: pmount installation script should create /media directory
by bugzilla_noreply＠novell.com 01 Feb '17

01 Feb '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1022943 Bug ID: 1022943 Summary: pmount installation script should create /media directory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: pvorel(a)suse.cz QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- pmount installation script should create /media directory as pmount requires that: $ pmount /dev/sdc2 Error: could not create directory: No such file or directory # mkdir /media $ pmount /dev/sdc2 # ok -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1022441] Marvell 88SE91xx raid not detected during install
by bugzilla_noreply＠novell.com 01 Feb '17

01 Feb '17

http://bugzilla.suse.com/show_bug.cgi?id=1022441 http://bugzilla.suse.com/show_bug.cgi?id=1022441#c2 Marlos Correa <marlos.mc(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(marlos.mc(a)gmail.c | |om) | --- Comment #2 from Marlos Correa <marlos.mc(a)gmail.com> --- Created attachment 712356 --> http://bugzilla.suse.com/attachment.cgi?id=712356&action=edit Yast installation log Logs gathered just before the end of the install. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1022066] SEGABRT (6) Multiple coredumps for /usr/lib64/tumbler-1/tumblerd
by bugzilla_noreply＠novell.com 01 Feb '17

01 Feb '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1022066 http://bugzilla.opensuse.org/show_bug.cgi?id=1022066#c1 --- Comment #1 from Mikhail Kasimov <mikhail.kasimov(a)gmail.com> --- (gdb) bt #0 0x00007fc1955c18d7 in raise () at /lib64/libc.so.6 #1 0x00007fc1955c2caa in abort () at /lib64/libc.so.6 #2 0x00007fc1955ba866 in __assert_fail_base () at /lib64/libc.so.6 #3 0x00007fc1955ba912 in () at /lib64/libc.so.6 #4 0x00007fc185b9b7d3 in jpc_pi_next () at /usr/lib64/libjasper.so.1 #5 0x00007fc185b9bc3b in jpc_dec_decodepkts () at /usr/lib64/libjasper.so.1 #6 0x00007fc185b84d43 in () at /usr/lib64/libjasper.so.1 #7 0x00007fc185b841dd in jpc_decode () at /usr/lib64/libjasper.so.1 #8 0x00007fc185b7db47 in jp2_decode () at /usr/lib64/libjasper.so.1 #9 0x00007fc185b7252d in jas_image_decode () at /usr/lib64/libjasper.so.1 #10 0x00007fc185dbcfbd in () at /usr/lib64/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-jasper.so #11 0x00007fc19429e61b in gdk_pixbuf_loader_close () at /usr/lib64/libgdk_pixbuf-2.0.so.0 #12 0x00007fc188e53a23 in () at /usr/lib64/tumbler-1/plugins/tumbler-pixbuf-thumbnailer.so #13 0x00007fc188e53d83 in () at /usr/lib64/tumbler-1/plugins/tumbler-pixbuf-thumbnailer.so #14 0x00000000004100c4 in () #15 0x00007fc195bbe32c in () at /usr/lib64/libglib-2.0.so.0 #16 0x00007fc195bbd9a5 in () at /usr/lib64/libglib-2.0.so.0 #17 0x00007fc195938734 in start_thread () at /lib64/libpthread.so.0 #18 0x00007fc195676d3d in clone () at /lib64/libc.so.6 (gdb) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1022922] New: VUL-0: ffmpeg: remote exploitaion results code execution [ 3 - ffserver.c ]
by bugzilla_noreply＠novell.com 01 Feb '17

01 Feb '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1022922 Bug ID: 1022922 Summary: VUL-0: ffmpeg: remote exploitaion results code execution [ 3 - ffserver.c ] Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/245 =================================================== This letter is a result of research made by Emil Lerner <neex.emil () gmail com <mailto:neex.emil () gmail com>> and Pavel Cheremushkin <paulcher () seclab cs msu su <mailto:paulcher () seclab cs msu su>> and it is supposed to disclosed multiple issues we managed to find and exploit in FFmpeg software. Despite that all vulnerabilities have been successfully patched by FFmpeg developers this letter is supposed to clarify all these issues and show that they are exploitable. --[ 3 - ffserver.c ] This issue is completely like the first one and it results heap overflow. This issue was fixed in https://github.com/FFmpeg/FFmpeg/commit/a5d25faa3f4b18dac737fdb35d0dd68eb0d… =================================================== Comment on Ref: http://seclists.org/oss-sec/2017/q1/251 =================================================== In case anyone else is curious, here are the corresponding commits reachable from the n3.2.2 release tag: https://github.com/FFmpeg/FFmpeg/commit/c12ee64e80af2517005231388fdf4ea78f1… =================================================== (open-)SUSE: https://software.opensuse.org/package/ffmpeg TW: 3.2.22 42.2: 3.2 42.1: 2.8.8 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1022921] New: VUL-0: ffmpeg: remote exploitaion results code execution [ 2 - libavformat/rtmppkt.c ]
by bugzilla_noreply＠novell.com 01 Feb '17

01 Feb '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1022921 Bug ID: 1022921 Summary: VUL-0: ffmpeg: remote exploitaion results code execution [ 2 - libavformat/rtmppkt.c ] Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/245 =================================================== This letter is a result of research made by Emil Lerner <neex.emil () gmail com <mailto:neex.emil () gmail com>> and Pavel Cheremushkin <paulcher () seclab cs msu su <mailto:paulcher () seclab cs msu su>> and it is supposed to disclosed multiple issues we managed to find and exploit in FFmpeg software. Despite that all vulnerabilities have been successfully patched by FFmpeg developers this letter is supposed to clarify all these issues and show that they are exploitable. --[ 2 - libavformat/rtmppkt.c ] Issue is connected with buffer overflow on the heap in RTMP protocol. After a bit of reverse engineering of RTMP protocol you can notice that it uses chunk (of max 0x80 bytes) to _transfer_ data, but chunks of more size could be used to _store_ the data. Because size of packet is not check that it is the same as it was in the same transmission you can first send packet with smaller size and then bigger size, and this results heap-overflow[1]. If you can align chunks right you can achieve white-what-where condition and that results and RCE. * [1] - https://github.com/FFmpeg/FFmpeg/blob/d903b4e3ad4a81b3dd79f12c2f3b9cb16e511… The issue was fixed in https://github.com/FFmpeg/FFmpeg/commit/7d57ca4d9a75562fa32e40766211de150f8… =================================================== Comment on Ref: http://seclists.org/oss-sec/2017/q1/251 =================================================== In case anyone else is curious, here are the corresponding commits reachable from the n3.2.2 release tag: https://github.com/FFmpeg/FFmpeg/commit/32b95471a86ae383c0f76361d954aec511f… =================================================== (open-)SUSE: https://software.opensuse.org/package/ffmpeg TW: 3.2.22 42.2: 3.2 42.1: 2.8.8 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1022920] New: VUL-0: ffmpeg: remote exploitaion results code execution [ 1 - libavformat/http.c ]
by bugzilla_noreply＠novell.com 01 Feb '17

01 Feb '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1022920 Bug ID: 1022920 Summary: VUL-0: ffmpeg: remote exploitaion results code execution [ 1 - libavformat/http.c ] Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/245 =================================================== This letter is a result of research made by Emil Lerner <neex.emil () gmail com <mailto:neex.emil () gmail com>> and Pavel Cheremushkin <paulcher () seclab cs msu su <mailto:paulcher () seclab cs msu su>> and it is supposed to disclosed multiple issues we managed to find and exploit in FFmpeg software. Despite that all vulnerabilities have been successfully patched by FFmpeg developers this letter is supposed to clarify all these issues and show that they are exploitable. --[ 1 - libavformat/http.c ] After executing of http_read_stream we read each http header, where we pass "Transfer-Encoding: chunked” header, and we come into http_buf_read function [1]. Due to incorrect use of strtoll function and integer sizes (chunk_size in int64_t)[2], it was possible to pass negative chunk_size in chunk encoding, so after computing final size using FFMIN function later on it would be passed as argument to avio_read function. This results a heap-overflow which we found out to be exploitable, because overflowed buffer is allocated right next to the AVIOContext structure[3]. Overflowing function pointer in this structure immediately results rip control and then code execution. * [1] - https://github.com/FFmpeg/FFmpeg/blob/51020adcecf4004c1586a708d96acc6cbddd0… * [2] - https://github.com/FFmpeg/FFmpeg/blob/51020adcecf4004c1586a708d96acc6cbddd0… * [3] - https://github.com/FFmpeg/FFmpeg/blob/51020adcecf4004c1586a708d96acc6cbddd0… This issue was fixed in https://github.com/FFmpeg/FFmpeg/commit/2a05c8f813de6f2278827734bf8102291e7… =================================================== Comment on Ref: http://seclists.org/oss-sec/2017/q1/251 =================================================== In case anyone else is curious, here are the corresponding commits reachable from the n3.2.2 release tag: https://github.com/FFmpeg/FFmpeg/commit/0e0a413725e0221e1a9d0b7595e22bf57e2… =================================================== (open-)SUSE: https://software.opensuse.org/package/ffmpeg TW: 3.2.22 42.2: 3.2 42.1: 2.8.8 -- You are receiving this mail because: You are on the CC list for the bug.

1 0