January 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1001133] New: VUL-1: CVE-2016-7511: libdwarf: Integer Overflow
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=1001133 Bug ID: 1001133 Summary: VUL-1: CVE-2016-7511: libdwarf: Integer Overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- https://www.prevanders.net/libdwarf-20160923.tar.gz bugxml/data.txt id: DW201609-002 cve: CVE-2016-7511 datereported: 20160918 reportedby: Shi Ji (@Puzzor) vulnerability: libdwarf 20160613 Integer Overflow product: libdwarf description: In dwarf_get_size_of_val() with fuzzed DWARF data we get a SEGV. <pre> See https://sourceforge.net/p/libdwarf/bugs/3/ </pre> <pre> ==6825== ERROR: AddressSanitizer: SEGV on unknown address 0x0583903c (pc 0xb61f1a98 sp 0xbfa388b4 bp 0xbfa38d08 T0) AddressSanitizer can not provide additional info. #1 0xb61e3c0b (/usr/lib/i386-linux-gnu/libasan.so.0+0xdc0b) #2 0x80a21b1 in _dwarf_get_size_of_val /home/fuzzing/fuzzing/dwarf-20160613/libdwarf/dwarf_util.c:210 #3 0x8054214 in _dwarf_next_die_info_ptr /home/fuzzing/fuzzing/dwarf-20160613/libdwarf/dwarf_die_deliv.c:1340 #4 0x80557a5 in dwarf_child /home/fuzzing/fuzzing/dwarf-20160613/libdwarf/dwarf_die_deliv.c:1640 #5 0x804b23f in get_die_and_siblings /home/fuzzing/fuzzing/dwarf-20160613/dwarfexample/./simplereader.c:573 </pre> _dwarf_make_CU_Context() is insufficiently cautious about the length of a CU being absurd. Unclear as yet if this is the problem but it is a problem and is fixed for next release. datefixed: references: regressiontests/DW201609-002/DW201609-002-poc gitfixid: 3767305debcba8bd7e1c483ae48c509d25399252 tarrelease: endrec: References: https://www.prevanders.net/dwarf.html#releases -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1001132] New: VUL-1: CVE-2016-7510: libdwarf: Out-of-bounds read in read_line_table_program
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=1001132 Bug ID: 1001132 Summary: VUL-1: CVE-2016-7510: libdwarf: Out-of-bounds read in read_line_table_program Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- https://www.prevanders.net/libdwarf-20160923.tar.gz bugxml/data.txt id: DW201609-003 cve: CVE-2016-7410 datereported: 20160913 reportedby: https://marc.info/?l=oss-security&m=147391785920048&w=2 vulnerability: libdwarf 20160613 heap-buffer-overflow product: libdwarf description: With AddressSanitizer, we found a Heap-Buffer-overflow in the latest release version of dwarfdump. The crash output is as follows: <pre> See also: https://marc.info/?l=oss-security&m=147378394815872&w=2 The testcase poc is from this web page. </pre> <pre> ==17411==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf3808904 at pc 0x80a6f76 bp 0xffb95e78 sp 0xffb95a5c READ of size 4 at 0xf3808904 thread T0 ==17411==WARNING: Trying to symbolize code, but external symbolizer is not initialized! #0 0x80a6f75 in __interceptor_memcpy ??:? #1 0x8426c3b in _dwarf_read_loc_section /home/starlab/fuzzing/dwarf-20160613/libdwarf/./dwarf_loc.c:919 #2 0x84250e2 in _dwarf_get_loclist_count /home/starlab/fuzzing/dwarf-20160613/libdwarf/./dwarf_loc.c:970 #3 0x8438826 in dwarf_get_loclist_c /home/starlab/fuzzing/dwarf-20160613/libdwarf/./dwarf_loc2.c:551 #4 0x81a1be8 in get_location_list /home/starlab/fuzzing/dwarf-20160613/dwarfdump/print_die.c:3523 #5 0x816e1a2 in print_attribute </pre> _dwarf_get_loclist_header_start() is not cautious about values in the header being absurdly large. Unclear as yet if this is the problem but it is a potential problem (fixed for next release). <pre> Address Sanitizer in gcc reproduces the report. In _dwarf_read_loc_section() the simple calculation of loc_section_end was wrong, so end-of section was incorrect for the local reads. With that fixed we get DW_DLE_READ_LITTLEENDIAN_ERROR when libdwarf attempts to read off end of section. id: DW201609-003 cve: CVE-2016-7410 datereported: 20160913 reportedby: https://marc.info/?l=oss-security&m=147391785920048&w=2 vulnerability: libdwarf 20160613 heap-buffer-overflow product: libdwarf description: With AddressSanitizer, we found a Heap-Buffer-overflow in the latest release version of dwarfdump. The crash output is as follows: <pre> See also: https://marc.info/?l=oss-security&m=147378394815872&w=2 The testcase poc is from this web page. </pre> <pre> ==17411==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf3808904 at pc 0x80a6f76 bp 0xffb95e78 sp 0xffb95a5c READ of size 4 at 0xf3808904 thread T0 ==17411==WARNING: Trying to symbolize code, but external symbolizer is not initialized! #0 0x80a6f75 in __interceptor_memcpy ??:? #1 0x8426c3b in _dwarf_read_loc_section /home/starlab/fuzzing/dwarf-20160613/libdwarf/./dwarf_loc.c:919 #2 0x84250e2 in _dwarf_get_loclist_count /home/starlab/fuzzing/dwarf-20160613/libdwarf/./dwarf_loc.c:970 #3 0x8438826 in dwarf_get_loclist_c /home/starlab/fuzzing/dwarf-20160613/libdwarf/./dwarf_loc2.c:551 #4 0x81a1be8 in get_location_list /home/starlab/fuzzing/dwarf-20160613/dwarfdump/print_die.c:3523 #5 0x816e1a2 in print_attribute </pre> _dwarf_get_loclist_header_start() is not cautious about values in the header being absurdly large. Unclear as yet if this is the problem but it is a potential problem (fixed for next release). <pre> Address Sanitizer in gcc reproduces the report. In _dwarf_read_loc_section() the simple calculation of loc_section_end was wrong, so end-of section was incorrect for the local reads. With that fixed we get DW_DLE_READ_LITTLEENDIAN_ERROR when libdwarf attempts to read off end of section. </pre> datefixed: references: regressiontests/DW201609-003/poc gitfixid: 3767305debcba8bd7e1c483ae48c509d25399252 tarrelease: endrec: References: https://www.prevanders.net/dwarf.html#releases https://bugzilla.redhat.com/show_bug.cgi?id=1378718 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7510 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 995367] New: Leap 42.2 ppc64le net install failure linuxrc or bad repo
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=995367 Bug ID: 995367 Summary: Leap 42.2 ppc64le net install failure linuxrc or bad repo Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: PowerPC-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: normand(a)linux.vnet.ibm.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Created attachment 689327 --> http://bugzilla.suse.com/attachment.cgi?id=689327&action=edit abanc_net_install_leap42_2_failure.log Leap 42.2 ppc64le net install failure linuxrc or bad repo I tried install of Leap 42.2 ppc64le using the net iso Build0112 from (1) Using the default setup, linuxrc is failing with "Please make sure your installation medium is available" as per (2) the failing repo is (3) Looking at the linuxrc.log the failure is a missing repo/content file. If I choose ...repo/oss in place of .../repo then the failure reported in linuxrc.log is a missing repo/oss/config I do not know from those data if the problem is a bad repo or an error in linuxrc (1) http://download.opensuse.org/ports/ppc/distribution/leap/42.2-Current/iso/ (2) linuxrc reporting bad installation medium === ... ending DHCP request to eth3... ok, ip = 9.101.18.90/24 Please make sure your installation medium is available. Choose the URL to retry. 0) <-- Back <-- 1) ftp://9.101.18.1/pub/linux/opensuse/42.2/ppc64le/os/ 2) http://download.opensuse.org/ports/ppc/distribution/leap/42.2/r 3) Enter another URL > === (3) http://download.opensuse.org/ports/ppc/distribution/leap/42.2/repo === -- You are receiving this mail because: You are on the CC list for the bug.

1 26

[Bug 991850] New: YaST2 > Software Manager tries to access skipped remository
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=991850 Bug ID: 991850 Summary: YaST2 > Software Manager tries to access skipped remository Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: openSUSE 42.1 Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: opensuse.lietuviu.kalba(a)gmail.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Sometimes some custom repositories are not available. Then YaST2 Software manager is reading */repodata/repomd.xml for long time and fails, and ask user what to do; if user selects to Skip this repository, YaST2 still will try to access this repository (at stage of creating/updating catch for accesible repositories)! And YaST2 will again ask in same dialog what to do! I suppose, that YaST2 must remember, that used skipped repository, and not to try access it again. Tested and reproducible in openSUSE 13.2 and Leap 42.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 989493] New: mlocate security: normal user must be added to group nobody; wrong man page info about --require-visibility FLAG
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=989493 Bug ID: 989493 Summary: mlocate security: normal user must be added to group nobody; wrong man page info about --require-visibility FLAG Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: x86-64 OS: openSUSE 42.1 Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: studio(a)anchev.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The man page of update db says (excerpt): --------------- -l, --require-visibility FLAG Set the “require file visibility before reporting it” flag in the generated database to FLAG. If FLAG is 0 or no, or if the database file is readable by "others" or it is not owned by nobody, locate(1) outputs the database entries even if the user running locate(1) could not have read the directory necessary to find out the file described by the database entry. If FLAG is 1 or yes (the default), locate(1) checks the permissions of parent directories of each entry before reporting it to the invoking user. To make the file existence truly hidden from other users, the database group is set to nobody and the database permissions prohibit reading the database by users using other means than locate(1), which is set-gid nobody. Note that the visibility flag is checked only if the database is owned by nobody and it is not readable by "others". --------------- I made the following experiment: - Run updatedb as root with no extra options (supposing by default it will use flag 1 as per man page) - Checked the permission of the db file (it was 644) - Run "locate root" as normal user - I can see the contents of /root (which means the man page is wrong and by default flag is 0) - chown nobody: /var/lib/mlocate/mlocate.db - Run "locate root" as normal user - again I can see the contents of /root - chmod 640 /var/lib/mlocate/mlocate.db (as according to the documentation that is required in order the flag 1 to be respected) - same result Then I tried explicitly to run "updatedb -l 1" as root and I see that it recreates the db file but this time the permissions are 640. So even when owned by nobody a normal user cannot use the locate command: > locate root locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied After adding my user to group nobody I was able to run "locate root" without seeing the files in "/root". This whole thing means that: 1. The man page is not correct as the default is FLAG 0 (insecure), not 1 (secure) 2. One is forced to use the first approach (adding each user to group nobody). I don't know what are the security implications of this but it doesn't sound as something normal, right? 3. The script /etc/cron.daily/mlocate.cron needs to be modified somehow in order to use explicitly FLAG 1 (is that possible?) -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 956262] New: cobbler dependencies.
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=956262 Bug ID: 956262 Summary: cobbler dependencies. Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: osynge(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- The applications: cobbler-2.6.6-3.8.noarch cobbler-web-2.6.6-3.8.noarch Are separately packaged hence "cobbler" should not depend on apache. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1017824] New: clementine switched to another sound card between songs
by bugzilla_noreply＠novell.com 08 Jul '19

08 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=1017824 Bug ID: 1017824 Summary: clementine switched to another sound card between songs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 708254 --> http://bugzilla.suse.com/attachment.cgi?id=708254&action=edit alsa-info I have two sound cards: * HDA-Intel -- in the notebook * FiiO DigiHug -- over USB I use the latter for sound output when I am in a docking station. On the Playback tab in pavucontrol, I set Clementine to play through DigiHug. In the past month or so, sometimes the output is switched to the internal audio (Intel HDA) when Clementine changes from one song to another. So this seems to be a regression. -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 935339] New: gpgme fails to cleanly uninstall: install-info: No such file or directory for /usr/share/info/gpgme.info.gz
by bugzilla_noreply＠novell.com 05 Jul '19

05 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=935339 Bug ID: 935339 Summary: gpgme fails to cleanly uninstall: install-info: No such file or directory for /usr/share/info/gpgme.info.gz Classification: openSUSE Product: openSUSE Factory Version: 201505* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: gp(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Uninstalling gpgme, I get the following: 1 package to remove. After the operation, 355.3 KiB will be freed. Continue? [y/n/? shows all options] (y): y (1/1) Removing gpgme-1.5.5-1.1 .........................................................................................................[done] Additional rpm output: install-info: No such file or directory for /usr/share/info/gpgme.info.gz warning: %postun(gpgme-1.5.5-1.1.x86_64) scriptlet failed, exit status 1 # rpm -ql gpgme | grep info /usr/share/info/gpgme.info-1.gz /usr/share/info/gpgme.info-2.gz /usr/share/info/gpgme.info.gz This looks similar to bug #929415 and may have the same fix? -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1016755] New: VUL-0: CVE-2016-5303: php5-pear-Horde_Text_Filter: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in HordeGroupware and Horde G...
by bugzilla_noreply＠novell.com 04 Jul '19

04 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=1016755 Bug ID: 1016755 Summary: VUL-0: CVE-2016-5303: php5-pear-Horde_Text_Filter: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in HordeGroupware and Horde G... Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: lang(a)b1-systems.de Reporter: meissner(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- CVE-2016-5303 Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5303 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5303.html https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb… https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333… http://marc.info/?l=horde-announce&m=147319089526753&w=2 http://marc.info/?l=horde-announce&m=147319066126665&w=2 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 925561] New: NetworkManager should provide a way to designate any connection as a mobile data connection
by bugzilla_noreply＠novell.com 03 Jul '19

03 Jul '19

http://bugzilla.opensuse.org/show_bug.cgi?id=925561 Bug ID: 925561 Summary: NetworkManager should provide a way to designate any connection as a mobile data connection Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: x86-64 OS: openSUSE 13.2 Status: NEW Severity: Enhancement Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: jrhodes(a)redpointsoftware.com.au QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Apper has an option in it's settings regarding when to automatically download and install updates. Under this setting there's an option "unless I am on a mobile data connection", which supposedly ensures that Apper doesn't download software updates while connected to a mobile (or metered) network. Unfortunately there doesn't appear to be any way in NetworkManager to designate a wireless or wired connection as being a mobile connection, i.e. a connection provided by a wireless hotspot or USB tethered phone. I'd really like to set Apper to automatically download and install updates as soon as they are available (I'm running on openSUSE Tumbleweed, which I believe is just Factory now?), but I can't do this because I occasionally have my laptop connected to my 4G hotspot, and I don't want to risk having packages download over 4G. -- You are receiving this mail because: You are on the CC list for the bug.

1 2