September 2014 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 894370] VUL-0: MozillaFirefox 32/31.1 security release
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=894370 https://bugzilla.novell.com/show_bug.cgi?id=894370#c Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:58812:importa |maint:running:58812:importa |nt |nt |obs:running:2982:moderate |obs:running:2982:moderate | |obs:running:2984:important -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 0

[Bug 893036] New: man page for dd documents arguments that work (or make sense)
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=893036 https://bugzilla.novell.com/show_bug.cgi?id=893036#c0 Summary: man page for dd documents arguments that work (or make sense) Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: All OS/Version: openSUSE 13.1 Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: Greg.Freemyer(a)gmail.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 I'm not sure if this is a documentation or functional bug or even a simple user error. The man page for dd documents flags: directory, noatime, and nofollow The implication is that this command should do something, although I admit to not knowing what I expect it to do: > dd if=tmp/ iflag=directory,noatime,nofollow of=tmp1/ oflag=directory In my test tmp/ is a small directory with 2 files in it. tmp1/ does not exist, so I'm expecting dd to create it. That is a pure guess on my part. The whole concept of dd allowing directories as either input or output objects is foreign to me. If this actually has a real use case, having an example of how to use it would be nice. If it only works on non-linux OSes, then a note to that effect would also be great. Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 9

[Bug 894370] VUL-0: MozillaFirefox 32/31.1 security release
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=894370 https://bugzilla.novell.com/show_bug.cgi?id=894370#c Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:58812:importa |maint:running:58812:importa |nt |nt | |obs:running:2982:moderate -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 0

[Bug 802882] New: Resume does not work after s2disk
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=802882 https://bugzilla.novell.com/show_bug.cgi?id=802882#c0 Summary: Resume does not work after s2disk Classification: openSUSE Product: openSUSE 12.3 Version: RC 1 Platform: x86-64 OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Kernel AssignedTo: kernel-maintainers(a)forge.provo.novell.com ReportedBy: mpluskal(a)suse.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- Steps to reproduce: 1) Change default configs of/etc/suspend.conf to: resume device = /dev/sda1 early writeout = y splash = n 2) s2disk - which seems to proceed fine (compressing image etc), in the end system halts. 3) After next boot, resume does not seem to happen - dmesg |grep "PM:" : [ 0.000000] PM: Registered nosave memory: 00000000000a0000 - 00000000000f0000 [ 0.000000] PM: Registered nosave memory: 00000000000f0000 - 0000000000100000 [ 0.128823] PM: Registering ACPI NVS region [mem 0xdf686c00-0xdf688bff] (8192 bytes) [ 1.608414] PM: Checking hibernation image partition /dev/disk/by-id/ata-SAMSUNG_HD160JJ_P_S0DFJ1MLA86492-part1 [ 1.660925] PM: Hibernation image not present or could not be loaded. [ 7.468197] PM: Starting manual resume from disk [ 7.468207] PM: Hibernation image partition 8:1 present [ 7.468209] PM: Looking for hibernation image. [ 7.468527] PM: Image not found (code -22) [ 7.468531] PM: Hibernation image not present or could not be loaded. Last messages from /var/log/messages prior suspend: [90899.598511] PM: Marking nosave pages: [mem 0x000a0000-0x000fffff] [90899.598523] PM: Basic memory bitmaps created [90899.618504] PM: Basic memory bitmaps freed [90919.300928] PM: Marking nosave pages: [mem 0x000a0000-0x000fffff] [90919.300937] PM: Basic memory bitmaps created [90919.319379] PM: Basic memory bitmaps freed [90974.837624] PM: Marking nosave pages: [mem 0x000a0000-0x000fffff] [90974.837633] PM: Basic memory bitmaps created -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 13

[Bug 892251] New: NVidia GLX missing
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=892251 https://bugzilla.novell.com/show_bug.cgi?id=892251#c0 Summary: NVidia GLX missing Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: x86-64 OS/Version: openSUSE 12.3 Status: NEW Severity: Critical Priority: P5 - None Component: X11 3rd Party Driver AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: ManuelStol(a)operamail.com QAContact: sndirsch(a)suse.com Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.21 (KHTML, like Gecko) konqueror/4.13.3 Safari/537.21 The X.org GLX extension is missing for the NVidia proprietary driver 340.32-30.1. .xsession-errors-:0: " Xlib: extension "GLX" missing on display ":0". " NVidia X Server Settings > OpenGL/GLX Information: " Failed to query the GLX server vendor. " Reproducible: Always Steps to Reproduce: 1. Update to openSUSE's nvidia-glG03 version 340.32-30.1 2. Start an application that uses GLX (e.g. Start > Applications > System > NVIDIA X Server Settings: OpenGL/GLX Information) Actual Results: Applications that use GLX, fail to work. In my case, the application hangs and its window screen is black. Expected Results: Applications that use GLX, should work; e.g. they shouldn't hang and show/output their video/graphics. ChangeLog for nvidia-glG03 version 340.32-30.1: " Fri 15 Aug 2014 02:00:00 PM CEST sndirsch(a)suse.com - update-alternatives: get rid again of /usr/lib64/xorg/modules/extensions/libglx.so and ghost entry for /etc/alternatives/libglx.so; it's sufficient to have this in xorg-x11-server package " /usr/lib64/xorg/modules/extensions/libglx.so This libglx.so is a symlink: libglx.so -> libglx.so.340.32 And libglx.so.340.32 does not exists. /etc/alternatives/libglx.so This libglx.so does not exists. The previous NVidia driver 331.89-28.1 worked. (/var/log/zypp/history: 331.59-28.1 was installed on 2014-07-22) N.B.: After finding this bug I used YaST to 'Update unconditionally' all X.org, NVidia and SDL packages. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 10

[Bug 894285] New: thttpd 2.26 available
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=894285 https://bugzilla.novell.com/show_bug.cgi?id=894285#c0 Summary: thttpd 2.26 available Classification: openSUSE Product: openSUSE Factory Version: 201407* Platform: Other OS/Version: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: marcosfrm(a)gmail.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0 After a long period without an official release, thttpd 2.26 is available. http://www.acme.com/software/thttpd/ Please update it in Factory (perhaps 13.1?). It is a very useful minimalist web server. Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 2

[Bug 763923] New: kernel-*-debuginfo packages don't contain vmlinux.debug, crashdump cannot be analyzed.
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=763923 https://bugzilla.novell.com/show_bug.cgi?id=763923#c0 Summary: kernel-*-debuginfo packages don't contain vmlinux.debug, crashdump cannot be analyzed. Classification: openSUSE Product: openSUSE 12.2 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Kernel AssignedTo: kernel-maintainers(a)forge.provo.novell.com ReportedBy: seife(a)novell.slipkontur.de QAContact: qa-bugs(a)suse.de Found By: Third Party Developer/Partner Blocker: --- linux-hyic:/var/crash/2012-05-24-17:33 # ls -l total 182472 -rw-r--r-- 1 root root 190 24. Mai 17:34 README.txt -rw-r--r-- 1 root root 2539450 24. Mai 17:34 System.map-3.4.0-rc6-1-desktop -rw------- 1 root root 178438479 24. Mai 17:34 vmcore -rw-r--r-- 1 root root 5860066 24. Mai 17:34 vmlinux-3.4.0-rc6-1-desktop.gz linux-hyic:/var/crash/2012-05-24-17:33 # crash vmcore -f vmlinux-3.4.0-rc6-1-desktop.gz crash 6.0.5 Copyright (C) 2002-2012 Red Hat, Inc. Copyright (C) 2004, 2005, 2006 IBM Corporation Copyright (C) 1999-2006 Hewlett-Packard Co Copyright (C) 2005, 2006 Fujitsu Limited Copyright (C) 2006, 2007 VA Linux Systems Japan K.K. Copyright (C) 2005 NEC Corporation Copyright (C) 1999, 2002, 2007 Silicon Graphics, Inc. Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc. This program is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Enter "help copying" to see the conditions. This program has absolutely no warranty. Enter "help warranty" for details. crash: /var/tmp/vmlinux-3.4.0-rc6-1-desktop.gz_vsBB0S: no debugging data available crash: vmlinux-3.4.0-rc6-1-desktop.debug: debuginfo file not found crash: either install the appropriate kernel debuginfo package, or copy vmlinux-3.4.0-rc6-1-desktop.debug to this machine linux-hyic:/var/crash/2012-05-24-17:33 # rpm -q kernel-desktop kernel-desktop-debuginfo kernel-desktop-3.4.rc6-1.1.x86_64 kernel-desktop-debuginfo-3.4.rc6-1.1.x86_64 linux-hyic:/var/crash/2012-05-24-17:33 # rpm -ql kernel-desktop-debuginfo|grep vmlinux linux-hyic:/var/crash/2012-05-24-17:33 # Current Factory. Looks like a kernel-*-debuginfo packaging bug. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 9

[Bug 894370] VUL-0: MozillaFirefox 32/31.1 security release
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=894370 https://bugzilla.novell.com/show_bug.cgi?id=894370#c5 --- Comment #5 from Marcus Meissner <meissner(a)suse.com> 2014-09-03 08:20:12 UTC --- MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. ANDROID only: MFSA 2014-71 / CVE-2014-1566: Security researcher Yu Dongsong reported on Firefox for Android that a file: protocol hyperlink could link to a local file in the Firefox profile directory, bypassing access restrictions. This issue was previously addressed in Mozilla Foundation Security Advisory 2014-33 but not completely. This problem allows for profile data, such as cookies, to be copied to the SD card without prompting to the use. This SD card location is world readable leading to a potential information disclosure of files in the Firefox profile through a malicious application. MFSA 2014-70 / CVE-2014-1565: Security researcher Holger Fuhrmannek discovered an out-of-bounds read during the creation of an audio timeline in Web Audio. This results in a crash and could allow for the reading of random memory values. MFSA 2014-69 / CVE-2014-1564: Google security researcher Michal Zalewski discovered that when a malformated GIF image is rendered in certain circumstances, memory is not properly initialized before use. The resulting image then uses this memory during rendering. This could allow for the a script in web content to access this unitialized memory using the <canvas> feature. MFSA 2014-68 / CVE-2014-1563: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a use-after-free during cycle collection. This was found in interactions with the SVG content through the document object model (DOM) with animating SVG content. This leads to a potentially exploitable crash. MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) Christian Holler, Jan de Mooij, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman, and JW Wang reported memory safety problems and crashes that affect Firefox ESR 31 and Firefox 31. (CVE-2014-1553) Gary Kwong, Christian Holler, and David Weir reported memory safety problems and crashes that affect Firefox 31. (CVE-2014-1554) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 0

[Bug 858632] New: Kernel:stable: Symbol kernel-uname-r missing
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=858632 https://bugzilla.novell.com/show_bug.cgi?id=858632#c0 Summary: Kernel:stable: Symbol kernel-uname-r missing Classification: openSUSE Product: openSUSE.org Version: unspecified Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software AssignedTo: mmarek(a)suse.com ReportedBy: opensuse(a)dstoecker.de QAContact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- I try building virtualbox for most recent kernel, which works fine, but installation fails, as the new kernel packages don't provide kernel-uname-r symbol. Is this a bug or has this been replaced and virtualbox package needs to be adopted? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 3

[Bug 890595] New: xscreensaver (5.22) displays a nag-screen to update it
by bugzilla_noreply＠novell.com 03 Sep '14

03 Sep '14

https://bugzilla.novell.com/show_bug.cgi?id=890595 https://bugzilla.novell.com/show_bug.cgi?id=890595#c0 Summary: xscreensaver (5.22) displays a nag-screen to update it Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: x86-64 OS/Version: openSUSE 13.1 Status: NEW Severity: Minor Priority: P5 - None Component: X11 Applications AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: madworm_de.novell(a)spitzenpfeil.org QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created an attachment (id=601256) --> (http://bugzilla.novell.com/attachment.cgi?id=601256) image User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 This is annoying. Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 14