March 2016 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 968941] New: VUL-0: CVE-2016-2561: phpMyAdmin: multiple XSS vulnerabilities (PMASA-2016-12)
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.suse.com/show_bug.cgi?id=968941 Bug ID: 968941 Summary: VUL-0: CVE-2016-2561: phpMyAdmin: multiple XSS vulnerabilities (PMASA-2016-12) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: astieger(a)suse.com, lang(a)b1-systems.de Found By: Security Response Team Blocker: --- https://www.phpmyadmin.net/security/PMASA-2016-12/ Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page. References: https://bugzilla.redhat.com/show_bug.cgi?id=1313224 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2561 https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d36… https://github.com/phpmyadmin/phpmyadmin/commit/bcd4ce8cba1272fca52f2331c08… https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7… https://github.com/phpmyadmin/phpmyadmin/commit/f33a42f1da9db943a67bda7d29f… https://www.phpmyadmin.net/security/PMASA-2016-12/ https://github.com/phpmyadmin/phpmyadmin/commit/cc55f44a4a90147a007dee1aefa… https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cf… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 968938] New: VUL-0: CVE-2016-2560: phpMyAdmin: multiple XSS vulnerabilities PMASA-2016-11
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.suse.com/show_bug.cgi?id=968938 Bug ID: 968938 Summary: VUL-0: CVE-2016-2560: phpMyAdmin: multiple XSS vulnerabilities PMASA-2016-11 Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: astieger(a)suse.com, lang(a)b1-systems.de Found By: Security Response Team Blocker: --- rh#1313221 / CVE-2016-2560 Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Host HTTP header, related to libraries/Config.class.php; 2 crafted JSON data, related to file_echo.php; 3 a crafted SQL query, related to js/FUNCTIONs.js; 4 the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or 5 the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page. References: https://bugzilla.redhat.com/show_bug.cgi?id=1313221 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2560 https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729… https://github.com/phpmyadmin/phpmyadmin/commit/ab1283e8366c97a155d4e9ae586… https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea5… https://www.phpmyadmin.net/security/PMASA-2016-11/ https://github.com/phpmyadmin/phpmyadmin/commit/c842a0de9288033d25404d1d6eb… https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 968928] New: VUL-0: CVE-2016-2562: phpMyAdmin: The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before4.5.5.1 does not ver...
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.suse.com/show_bug.cgi?id=968928 Bug ID: 968928 Summary: VUL-0: CVE-2016-2562: phpMyAdmin: The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before4.5.5.1 does not ver... Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: astieger(a)suse.com, lang(a)b1-systems.de Found By: Security Response Team Blocker: --- CVE-2016-2562 The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2562 https://github.com/phpmyadmin/phpmyadmin/commit/e42b7e3aedd29dd0f7a48575f20… https://www.phpmyadmin.net/security/PMASA-2016-13/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 968940] New: VUL-0: CVE-2016-2559: phpMyAdmin: Cross-site scripting (XSS) vulnerability in the format function inlibraries/sql-parser/src/Utils/Er...
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.suse.com/show_bug.cgi?id=968940 Bug ID: 968940 Summary: VUL-0: CVE-2016-2559: phpMyAdmin: Cross-site scripting (XSS) vulnerability in the format function inlibraries/sql-parser/src/Utils/Er... Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: chris(a)computersalat.de Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: astieger(a)suse.com, lang(a)b1-systems.de Found By: Security Response Team Blocker: --- https://www.phpmyadmin.net/security/PMASA-2016-10/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2559 Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query. CVE-2016-2559 was assigned to this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2559 https://github.com/phpmyadmin/phpmyadmin/commit/3a6a9a807d99371ee126635e1a5… https://www.phpmyadmin.net/security/PMASA-2016-10/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 968644] QEMU crashes with virtio GPU and spice
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.suse.com/show_bug.cgi?id=968644 Andreas Färber <afaerber(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cbosdonnat(a)suse.com Assignee|afaerber(a)suse.com |lma(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 955280] session not restored after logout/login
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.novell.com/show_bug.cgi?id=955280 http://bugzilla.novell.com/show_bug.cgi?id=955280#c22 Wolfgang Bauer <wbauer(a)tmo.at> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #22 from Wolfgang Bauer <wbauer(a)tmo.at> --- The update has been released, session saving/restoring should work reliable for KF5 applications now too... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 957006] dolphin hangs when opening a folder containing a symbolic link to a special file
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.novell.com/show_bug.cgi?id=957006 http://bugzilla.novell.com/show_bug.cgi?id=957006#c8 Wolfgang Bauer <wbauer(a)tmo.at> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #8 from Wolfgang Bauer <wbauer(a)tmo.at> --- The update has been released. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 968889] New: Black KDE screen after the latest update
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.suse.com/show_bug.cgi?id=968889 Bug ID: 968889 Summary: Black KDE screen after the latest update Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: silviu_marin-caea(a)otpbank.ro QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- After applying latest updates (2016-03-01), KDE does not start properly anymore, it's just a black screen after login. I even tried reinstalling the whole machine and applying updates, then creating a new user. It's reproducible. Here's what happens after login: https://youtu.be/zAlZciuglsA -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 968877] New: After update on 1/3/2016 LEAP plasma hangs on splash screen
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.opensuse.org/show_bug.cgi?id=968877 Bug ID: 968877 Summary: After update on 1/3/2016 LEAP plasma hangs on splash screen Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: x86-64 OS: openSUSE 42.1 Status: NEW Severity: Major Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: george(a)grundleborg.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- After running a 'zypper up' on 2016-03-01 and rebooting, plasma hangs on the splash screen indefinitely. This means it is not possible to use the machine. Running OpenSUSE LEAP 42.1. Other notes: - After the update, the shutdown dialog immediately does not work. - I was able to launch kwin and plasma-shell manually from another tty but when trying to launch any KF5 application I get errors along the lines of the following: dolphin: relocation error: /usr/lib64/libKF5XmlGui.so.5: symbol _ZN15QGuiApplication35setFallbackSessionManagementEnabledEb, version Qt_5 not defined in file libQt5Gui.so.5 with link time reference This bug can be reproduced on a fresh user account. Please see next comment for the packages installed by the update which breaks plasma. Suggesting high priority as this bug has rendered the machines affected inoperable as the plasma shell does not load. It has been reported at least 4 times in the space of a few minutes in #suse this morning. -- You are receiving this mail because: You are on the CC list for the bug.

1 26

[Bug 955801] New: libzypp sends X-ZYpp-AnonymousId to third party mirrors and repositories
by bugzilla_noreply＠novell.com 01 Mar '16

01 Mar '16

http://bugzilla.opensuse.org/show_bug.cgi?id=955801 Bug ID: 955801 Summary: libzypp sends X-ZYpp-AnonymousId to third party mirrors and repositories Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)forge.provo.novell.com Reporter: astieger(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- /var/lib/zypp/AnonymousId contains a per-installation unique identifier which is sent as the X-ZYpp-AnonymousId header (boo#431571) This header is sent to hosts other than download.opensuse.org following a 301 redirect from mirrorbrain. As mirror hosts have no use and no business for this information, it must not be sent there. -- You are receiving this mail because: You are on the CC list for the bug.

1 2