January 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1011137] New: VUL-0: libdwarf: negation overflow in dwarf_leb.c
by bugzilla_noreply＠novell.com 28 Aug '19

28 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1011137 Bug ID: 1011137 Summary: VUL-0: libdwarf: negation overflow in dwarf_leb.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Reference: http://seclists.org/oss-sec/2016/q4/471 =================================================== Description: libdwarf is a library to consume and produce DWARF debug information. A fuzz with the Undefined Behavior Sanitizer shows a negation that cannot be represented as long long. The complete UBSan output: # dwarfdump $FILE dwarf_leb.c:306:19: runtime error: negation of -9223372036854775808 cannot be represented in type 'Dwarf_Signed' (aka 'long long'); cast to an unsigned type to negate this value to itself Affected version: 20161021 Fixed version: N/A Commit fix: https://sourceforge.net/p/libdwarf/code/ci/4f19e1050cd8e9ddf2cb6caa061ff2fe… Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00050-libdwarf-negate-itself Timeline: 2016-11-11: bug discovered and reported to upstream 2016-11-11: upstream released a patch 2016-11-19: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2016/11/19/libdwarf-negation-overflow-in-dwarf… -- Agostino Sarubbo Gentoo Linux Developer =================================================== By the way, https://software.opensuse.org/package/libdwarf : libdwarf is in official repo for 42.1 and TW and not for 42.2. What's the logic here? -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 987720] New: Egypt (Africa/Cairo) DST cancelled, 2016f timezone release
by bugzilla_noreply＠novell.com 28 Aug '19

28 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=987720 Bug ID: 987720 Summary: Egypt (Africa/Cairo) DST cancelled, 2016f timezone release Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Maintenance Assignee: astieger(a)suse.com Reporter: astieger(a)suse.com QA Contact: qa-bugs(a)suse.de CC: alnovak(a)suse.com, andreas.taschner(a)suse.com, astieger(a)suse.com, brent.griggs(a)suse.com, jake.norris(a)suse.com, jeff.ray(a)suse.com, ntsbugsiebint-bugs(a)forge.provo.novell.com, roger.whittaker(a)suse.com, rosuna(a)suse.com, wpreston(a)suse.com Blocks: 982833 Found By: --- Blocker: --- http://mm.icann.org/pipermail/tz-announce/2016-July/000040.html Customers should avoid installing the PTF or the update already released for SLE 12: http://mm.icann.org/pipermail/tz-announce/2016-July/000040.html > The 2016f release of the tz code and data is available. It reflects the > following changes, which were either circulated on the tz mailing list > or are relatively minor technical or administrative changes: > > Changes affecting future time stamps > > The Egyptian government changed its mind on short notice, and > Africa/Cairo will not introduce DST starting 2016-07-07 after all. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 930173] New: VUL-0: CVE-2015-0847: nbd: incorrect signal handling DoD
by bugzilla_noreply＠novell.com 28 Aug '19

28 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=930173 Bug ID: 930173 Summary: VUL-0: CVE-2015-0847: nbd: incorrect signal handling DoD Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- http://seclists.org/oss-sec/2015/q2/388 CVE-2015-0847 in nbd-server From: Florian Weimer <fw () deneb enyo de> Date: Thu, 07 May 2015 22:45:33 +0200 nbd-server uses signal handlers incorrectly, which leads to a denial of service vulnerability. We have assigned CVE-2015-0847 to this vulnerability. This was first reported to the Debian security team by Tuomas Räsänen, but we did not think this warranted an embargo. More details are available upstream: <http://sourceforge.net/p/nbd/mailman/message/34091218/> -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 902779] New: [Factory] Long boot delay "a start job is running for..."
by bugzilla_noreply＠novell.com 27 Aug '19

27 Aug '19

http://bugzilla.opensuse.org/show_bug.cgi?id=902779 Bug ID: 902779 Summary: [Factory] Long boot delay "a start job is running for..." Classification: openSUSE Product: openSUSE Factory Version: 201410* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: sb56637(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi, My openSUSE Factory installation was taking at least 60 seconds longer than normal to boot. The delay always occurred on every boot. The delay occured before initializing the display manager with a message: "A start job is running for", and it would alternate between four different services: X display manager, Avahi, NetworkManager, and Modem Manager. I tried disabling the Modem Manager service, but it still kept hanging on Avahi and NetworkManager. I eventually tried disabling and later re-enabling the NetworkManager services, and it now boots quickly without hanging. I don't really know why this happened or what I did to fix it. Please let me know what additional information you need to prevent this bug from happening. Thanks a lot! -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1012533] New: rpm debugedit does not support compressed debug info sections
by bugzilla_noreply＠novell.com 26 Aug '19

26 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1012533 Bug ID: 1012533 Summary: rpm debugedit does not support compressed debug info sections Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: rguenther(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When compressed debug info sections are enabled (ELF sections with Z flag) debugedit is no longer able to rewrite DW_AT_comp_dir and thus debuginfo does no longer find debugsource files. Using [-Wl,]--compress-debug-sections=zlib at link time yields such debuginfo sections. This blocks enabling compressed debuginfo sections in Factory. -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 996551] New: Make libldap library to be a symlink to libldap_r library
by bugzilla_noreply＠novell.com 23 Aug '19

23 Aug '19

http://bugzilla.opensuse.org/show_bug.cgi?id=996551 Bug ID: 996551 Summary: Make libldap library to be a symlink to libldap_r library Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: hguo(a)suse.com Reporter: jengelh(a)inai.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When an application uses libraries that cause both libldap or libldap_r to end up in the process image, the libraries sometimes happen to use a different function than expected. The fix is to make /usr/lib64/libldap-2.4.so.2 a symlink to libldap_r-2.4.so.2. More detail: https://bugzilla.redhat.com/show_bug.cgi?id=1370065 This bug is for tracking the same issue in openSUSE. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 934055] New: yast2-network: Do not use .site as default TLD
by bugzilla_noreply＠novell.com 23 Aug '19

23 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=934055 Bug ID: 934055 Summary: yast2-network: Do not use .site as default TLD Classification: openSUSE Product: openSUSE Factory Version: 201505* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: mfilka(a)suse.com Reporter: lnussel(a)suse.com QA Contact: jsrain(a)suse.com Blocks: 923990 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #923990 +++ YaST should not set any domain at all anymore in /etc/hostname. The domain name entry box (eg https://openqa.opensuse.org/tests/67247/modules/yast2_lan/steps/3) should be removed. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 993025] New: do not show the packages that will not get updated in quiet mode
by bugzilla_noreply＠novell.com 18 Aug '19

18 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=993025 Bug ID: 993025 Summary: do not show the packages that will not get updated in quiet mode Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)forge.provo.novell.com Reporter: tchatzimichos(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When using zypper with -q, I see the following message: The following 157 package updates will NOT be installed: <various packages listed here> I would prefer the above not to be shown when in quiet mode, as it spams my logs on my daily auto-update script. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 840485] New: Firefox 24.0/17.0.9esr security release
by bugzilla_noreply＠novell.com 16 Aug '19

16 Aug '19

https://bugzilla.novell.com/show_bug.cgi?id=840485 https://bugzilla.novell.com/show_bug.cgi?id=840485#c0 Summary: Firefox 24.0/17.0.9esr security release Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Firefox AssignedTo: bnc-team-mozilla(a)forge.provo.novell.com ReportedBy: wolfgang(a)rosenauer.org QAContact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: --- Blocker: --- 2013-09-17 is the announced release date for the following Mozilla applications which contain security fixes (as always) (https://wiki.mozilla.org/Releases) Firefox 24.0 Firefox 17.0.9esr xulrunner 17.0.9esr Seamonkey 2.21 Thunderbird 17.0.9esr Thunderbird 24.0 (minimum NSPR 4.10 and NSS 3.15.1 requirements I think already met with last update round) I'll provide updates for openSUSE distributions as usual with one exception where I'd like to get some feedback: Thunderbird will do a big version update to 24.0 for non-esr versions. Since esr and non esr versions were 99,9% identical in the 17.0 series we have the choice to update to 17.0.9esr or 24.0 for released distributions which will only move the major upgrade around 12 weeks so I'm in favor to follow the big update now already. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 46

[Bug 994044] New: Kde-Live net installer is interrupted by screenlock
by bugzilla_noreply＠novell.com 02 Aug '19

02 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=994044 Bug ID: 994044 Summary: Kde-Live net installer is interrupted by screenlock Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Live Medium Assignee: coolo(a)suse.com Reporter: okurz(a)suse.com QA Contact: okurz(a)suse.com Found By: --- Blocker: --- ## observation While conducting an installation from the NET installer on Kde-Live the plasma screenlock kicks in which is especially annoying since the installer will vanish silently in the background upon completion because of boo#993885. ## steps to reproduce * start Kde-Live * call installation from within plasma session * wait * observe screenlock kicks in after some time ## expected result when installer is running the screenlock should never kick in. Alternative: screenlock disabled for the whole live medium which might be an easier approach. ## workaround probably the following should disable the screenlock for the active session ``` setterm blank 0 setterm powerdown 0 xset s 0 0 ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 3