December 2014 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 908364] New: CVE-2014-9219: phpMyAdmin: XSS vulnerability in redirection mechanism
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.opensuse.org/show_bug.cgi?id=908364 Bug ID: 908364 Summary: CVE-2014-9219: phpMyAdmin: XSS vulnerability in redirection mechanism Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: All URL: http://www.phpmyadmin.net/home_page/security/PMASA-201 4-18.php OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: chris(a)computersalat.de, ecsos(a)schirra.net Found By: --- Blocker: --- >From http://www.phpmyadmin.net/home_page/security/PMASA-2014-18.php > Announcement-ID: PMASA-2014-18 > Date: 2014-12-03 > Summary: XSS vulnerability in redirection mechanism. > Description: With a crafted URL it was possible to trigger an XSS in the redirection mechanism in phpMyAdmin. > > Severity: We consider this vulnerability to be non critical. > Affected Versions: Versions 4.2.x (prior to 4.2.13.1) are affected. > Solution: Upgrade to phpMyAdmin 4.2.13.1 or newer, or apply the patch listed below. > Assigned CVE ids: CVE-2014-9219 > CWE ids: CWE-661 CWE-79 > Patches: 9b2479b7216dd91a6cc2f231c0fd6b85d457f6e2 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 880889] openconnect XML response has no "auth" node
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.opensuse.org/show_bug.cgi?id=880889 Rick Salevsky <rsalevsky(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WONTFIX --- Comment #3 from Rick Salevsky <rsalevsky(a)suse.com> --- Fixed in openSUSE 13.2, back porting is not possible due to many dependencies. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 899718] multimedia:apps/cdrtools: Don't have permissions for cdrtools binaries
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.novell.com/show_bug.cgi?id=899718 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |obs:running:3281:low -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 897845] kmod-18 depmod test fails on bigendian
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.suse.com/show_bug.cgi?id=897845 Hanns-Joachim Uhl <hannsj_uhl(a)de.ibm.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|bugproxy(a)us.ibm.com |hannsj_uhl(a)de.ibm.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 905988] System immediately waking from sleep (suspend to RAM) with no user intervention.
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.novell.com/show_bug.cgi?id=905988 --- Comment #27 from Paul Tannington <paul.pgp-7(a)gmx.com> --- (In reply to Benjamin Poirier from comment #26) > Thank you for this explanation. Is it correct then to say that you used the > same procedure to shut down the system in both the "turn off" and "power off" > cases (i.e. "(KDE) Leave -> Turn off computer")? The difference is only that > in the second case you also unplugged the computer (or shut off the power > supply). Yes, that is correct. "Turn off" (computer in standby mode) retains the wol setting on restart. After "Power off" (power disconnected) and restart the wol setting reverts to "ug". > If that is correct, then it rules out power off scripts fiddling with wol > settings. It seems likely that the nic retains wol settings so long as it has > power and looses them otherwise. The next thing to check is whether they are > somehow initialized in a different way in 13.2 compared to 13.1. > > When you test the 13.1 kernel using the instructions in comment 15, please > also test the reboot, "turn off" and "power off" cases to see if the behavior > is the same. OK. However prior to that, a few observations. "Something" has changed, as I was previously using openSUSE 13.1, 3.11.10-21 kernel on this same hardware with suspend/resume working correctly. To try to eliminate my own (software) setup I booted, from a "power off" condition, with the "live" version of openSUSE 13.2 (openSUSE-13.2-KDE-Live-x86_64.iso Last modified: Thu, 30 Oct 2014 15:16:32 GMT). Ethtool reported wol as "ug". There was an immediate restart after suspend to ram, although for some reason this did not complete. I repeated that using a USB stick on which I still had a copy of V13.1 (openSUSE-13.1-KDE-Live-x86_64.iso Last modified: Wed, 06 Nov 2013 15:56:17 GMT). Ethtool reported wol as also being "ug"! When suspended to ram the nic (as indicated by the connected router) had dropped down to 10M and was still active, but there was no (unwanted) restart. Manual resume also failed to complete, I'm guessing that has something to do with the live environment and can be ignored. I appreciate you efforts on this, but I don't see any other bug reports about this behaviour. 13.2 has been released for about a month now and I believe the realtek nic is fairly common still. Whilst I'm quite happy to provide information where able, please don't forget that I have a work-around for this problem coutesy of Takashi Iwai from Comment # 10 - I don't know that it is worth pursuing, but you are the judge of that :) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 906730] Yast Services Manager does NOT start or stop services
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.novell.com/show_bug.cgi?id=906730 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |obs:running:3280:low -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 906900] PostgreSQL improper shutdown
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.suse.com/show_bug.cgi?id=906900 Reinhard Max <max(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #615884|application/x-shellscript |text/plain mime type| | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 906900] PostgreSQL improper shutdown
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.suse.com/show_bug.cgi?id=906900 Thomas Blume <thomas.blume(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(max(a)suse.com) | --- Comment #49 from Thomas Blume <thomas.blume(a)suse.com> --- Ok, attached the files modificed according to comment #45. Michael, for testing please copy the manager script to: /usr/lib/postgresql/ and postgresql.service to /etc/systemd/system. Reinhard, can you take a look wheter it's ok now? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 906900] PostgreSQL improper shutdown
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.suse.com/show_bug.cgi?id=906900 Thomas Blume <thomas.blume(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #615714|0 |1 is obsolete| | --- Comment #48 from Thomas Blume <thomas.blume(a)suse.com> --- Created attachment 615884 --> http://bugzilla.suse.com/attachment.cgi?id=615884&action=edit manager -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 906900] PostgreSQL improper shutdown
by bugzilla_noreply＠novell.com 04 Dec '14

04 Dec '14

http://bugzilla.suse.com/show_bug.cgi?id=906900 Thomas Blume <thomas.blume(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #615713|0 |1 is obsolete| | --- Comment #47 from Thomas Blume <thomas.blume(a)suse.com> --- Created attachment 615883 --> http://bugzilla.suse.com/attachment.cgi?id=615883&action=edit postgresql.service -- You are receiving this mail because: You are on the CC list for the bug.

1 0