January 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1017683] /var/run should not be separate filesystem from /run
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1017683 http://bugzilla.suse.com/show_bug.cgi?id=1017683#c1 Imobach Gonzalez Sosa <igonzalezsosa(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |igonzalezsosa(a)suse.com Flags| |needinfo?(shundhammer@suse. | |com) --- Comment #1 from Imobach Gonzalez Sosa <igonzalezsosa(a)suse.com> --- Stefan, what's your POV about this? Thanks in advance! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 909418] when ejecting DVD using hardware button, system thinks DVD is still mounted
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=909418 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:3794:moderate |obs:running:6106:moderate |obs:running:6106:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 953807] An encrypted tmp directory is mounted with wrong permissions
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=953807 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:3794:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017902] New: VUL-0: pcsc-lite: use-after-free and double-free [CWE-415, CWE-416]
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017902 Bug ID: 1017902 Summary: VUL-0: pcsc-lite: use-after-free and double-free [CWE-415, CWE-416] Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q1/18 =================================================== Vendor: Muscle Affected Versions: PCSC-Lite >= 1.6.0, < 1.8.20 Description: PCSC-Lite[1] is a middleware to access a smart card using the SCard API (PC/SC). It can be used with GnuPG, OpenSC and others for hardware like the Nitrokey and Yubikey. These software use a client library (libpcsclite) which communicate with a daemon (pcscd) that actually accesses the hardware. The SCardReleaseContext function normally releases resources associated with the given handle (including "cardsList") and clients should cease using this handle. A malicious client can however make the daemon invoke SCardReleaseContext and continue issuing other commands that use "cardsList", resulting in a use-after-free. When SCardReleaseContext is invoked multiple times, it additionally results in a double-free of "cardsList". The issue allows a local attacker to cause a Denial of Service, but can potentially result in Privilege Escalation since the daemon is running as root while any local user can connect to the Unix socket. Fixed by patch "SCardReleaseContext: prevent use-after-free of cardsList"[2] which is released with hpcsc-lite 1.8.20 on 30 December 2016[3]. Credit: This issue was discovered and fixed by Peter Wu (peter () lekensteyn nl). Additional information: The issue is confirmed for: Arch Linux (1.8.18-1) CentOS 7 (1.8.8-6.el7) Debian Jessie (1.8.13-1) using the PoC from https://lekensteyn.nl/files/pcscd-doublefree-poc.py $ python pcscd-doublefree-poc.py run/pcscd.comm [*] Sending SCARD_RELEASE_CONTEXT [*] Request succeeded, possible vulnerable [*] Sending SCARD_RELEASE_CONTEXT (2) [+] Daemon crashed, it is vulnerable! $ sbin/pcscd --foreground --debug ... 00000167 winscard_svc.c:337:ContextThread() Authorized PC/SC client 00000011 winscard_svc.c:341:ContextThread() Thread is started: dwClientID=6, threadContext @0x610000007f40 00000009 winscard_svc.c:359:ContextThread() Received command: RELEASE_CONTEXT from client 6 00000008 winscard.c:226:SCardReleaseContext() Releasing Context: 0x0 00000008 winscard_svc.c:470:ContextThread() RELEASE_CONTEXT rv=0x0 for client 6 00000088 winscard_svc.c:359:ContextThread() Received command: RELEASE_CONTEXT from client 6 00000012 winscard.c:226:SCardReleaseContext() Releasing Context: 0x0 ================================================================= ==11540==ERROR: AddressSanitizer: heap-use-after-free on address 0x60300000d728 at pc 0x000000410490 bp 0x7f34ab4dd920 sp 0x7f34ab4dd910 READ of size 8 at 0x60300000d728 thread T2 #0 0x41048f in list_clear src/simclist.c:634 #1 0x4108ba in list_destroy src/simclist.c:303 #2 0x41843e in MSGRemoveContext src/winscard_svc.c:884 #3 0x4194f3 in ContextThread src/winscard_svc.c:468 ... [1]: https://pcsclite.alioth.debian.org/ [2]: https://anonscm.debian.org/cgit/pcsclite/PCSC.git/commit/?id=697fe05967af7e… [3]: http://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-201612… =================================================== https://software.opensuse.org/package/pcsc-lite TW: 1.8.8 42.2: 1.8.17 42.1: 1.8.14 13.2: 1.8.11 also, all versions are affected. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1008725] chromium fails to load h264
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1008725 http://bugzilla.suse.com/show_bug.cgi?id=1008725#c23 George Anchev <studio(a)anchev.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo? --- Comment #23 from George Anchev <studio(a)anchev.net> --- Created attachment 708317 --> http://bugzilla.suse.com/attachment.cgi?id=708317&action=edit ffmpeg-3.1 is installed > Since I can't reproduce the problem on any of the test machines you have to > ahve repository mismatch or you didn't switch all libraries properly to > their respective packman counterparts. ffmpeg-3.1 is installed (see the other screenshot). Please share your configuration. Here are my repos listed: zypper lr -d # | Alias | Name | Enabled | GPG Check | Refresh | Priority | Type | URI | Service ---+-------------------------------------+-----------------------------------------+---------+-----------+---------+----------+--------+--------------------------------------------------------------------------------------------+-------- 1 | Google_Chrome | Google Chrome | Yes | (r ) Yes | Yes | 99 | rpm-md | http://dl.google.com/linux/rpm/stable/x86_64 | 2 | RawTherapee | RawTherapee | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.opensuse.org/repositories/home:/rawtherapee/openSUSE_Leap_4… | 3 | download.nvidia.com-leap | nVidia Graphics Drivers | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.nvidia.com/opensuse/leap/42.1 | 4 | download.opensuse.org-non-oss | Main Repository (NON-OSS) | Yes | (r ) Yes | Yes | 99 | yast2 | http://download.opensuse.org/distribution/leap/42.1/repo/non-oss/ | 5 | download.opensuse.org-non-oss_1 | Update Repository (Non-Oss) | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.opensuse.org/update/leap/42.1/non-oss/ | 6 | download.opensuse.org-oss | Main Repository (OSS) | Yes | (r ) Yes | Yes | 99 | yast2 | http://download.opensuse.org/distribution/leap/42.1/repo/oss/ | 7 | download.opensuse.org-oss_1 | Main Update Repository | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.opensuse.org/update/leap/42.1/oss | 8 | ftp.gwdg.de-suse | Packman Repository | Yes | (r ) Yes | Yes | 99 | rpm-md | http://packman.inode.at/suse/openSUSE_Leap_42.1/ | 9 | google-chrome | google-chrome | Yes | (r ) Yes | Yes | 99 | rpm-md | http://dl.google.com/linux/chrome/rpm/stable/x86_64 | 10 | http-download.opensuse.org-1f4f3a68 | KDE:Extra | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.opensuse.org/repositories/KDE:/Extra/openSUSE_Leap_42.1/ | 11 | http-download.opensuse.org-22fcdb31 | devel:languages:python | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.opensuse.org/repositories/devel:/languages:/python/openSUSE… | 12 | http-download.opensuse.org-7bd1a2b3 | X11:Utilities (for redshift) | No | ---- | Yes | 99 | rpm-md | http://download.opensuse.org/repositories/X11:/Utilities/openSUSE_Leap_42.1/ | 13 | http-download.opensuse.org-d346fc1e | multimedia:color_management | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.opensuse.org/repositories/multimedia:/color_management/open… | 14 | repo-debug | openSUSE-Leap-42.1-Debug | No | ---- | Yes | 99 | NONE | http://download.opensuse.org/debug/distribution/leap/42.1/repo/oss/ | 15 | repo-debug-non-oss | openSUSE-Leap-42.1-Debug-Non-Oss | No | ---- | Yes | 99 | NONE | http://download.opensuse.org/debug/distribution/leap/42.1/repo/non-oss/ | 16 | repo-debug-update | openSUSE-Leap-42.1-Update-Debug | No | ---- | Yes | 99 | NONE | http://download.opensuse.org/debug/update/leap/42.1/oss | 17 | repo-debug-update-non-oss | openSUSE-Leap-42.1-Update-Debug-Non-Oss | No | ---- | Yes | 99 | NONE | http://download.opensuse.org/debug/update/leap/42.1/non-oss/ | 18 | repo-source | openSUSE-Leap-42.1-Source | No | ---- | Yes | 99 | NONE | http://download.opensuse.org/source/distribution/leap/42.1/repo/oss/ | 19 | repo-update | openSUSE-Leap-42.1-Update | Yes | (r ) Yes | Yes | 99 | rpm-md | http://download.opensuse.org/update/leap/42.1/oss/ | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1008725] chromium fails to load h264
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1008725 http://bugzilla.suse.com/show_bug.cgi?id=1008725#c22 --- Comment #22 from George Anchev <studio(a)anchev.net> --- Created attachment 708315 --> http://bugzilla.suse.com/attachment.cgi?id=708315&action=edit chromium-ffmpegsumo (In reply to Tomáš Chvátal from comment #21) > There is no chromium-ffmpeg or chromium-ffmpegsumo. It is now using system > ffmpeg. Thus if you use ffmpeg libraries from 42.1 then you have the support > for vp8 and similar codecs, if you have libraries from packman you have > support for everything. There is chromium-ffmpegsumo (see screenshot). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017900] New: Placement setting for window actions and behavior is not honored
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017900 Bug ID: 1017900 Summary: Placement setting for window actions and behavior is not honored Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: x86-64 OS: openSUSE 42.2 Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: rafjaimes(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- In KDE Plasma Workspace settings (Configure Desktop): "Window Management" -> "Advanced" tab -> Placement: Under Mouse is selected When new windows are opened, they open in seemingly random places. For example, I will use KRunner on one monitor and type in "konsole" to launch a konsole, and it opens on the other monitor. On Leap 42.1 previously, the window would open wherever the mouse currently is, which is the expected behavior. This is on a fresh install and up to date openSUSE 42.2 Leap install. KDE Plasma Version 5.8.3 KDE Frameworks Version 5.26.0 Qt Version: 5.6.1 Kernel Version: 4.4.36-8-default OS Type: 64-bit Processor: Intel Xeon E3-1245 v5 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1017898] New: deleted tumbleweed package shows up on software search page
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1017898 Bug ID: 1017898 Summary: deleted tumbleweed package shows up on software search page Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Software Portal Assignee: benji(a)opensuse.org Reporter: martin.wilck(a)suse.com QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- Search for "hamster-time-tracker" on software.opensuse.org still shows an "official release" package, although that package has been deleted from TW a year ago (https://build.opensuse.org/request/show/343851) > https://software.opensuse.org/package/hamster-time-tracker?search_ term=hamster-time-tracker Attempting to install the package from the displayed links fails though, because the package isn't present in the factory repos any more. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017758] [yast2/bootloader]: Make it possible to obtain a bootloader ISO
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1017758 http://bugzilla.suse.com/show_bug.cgi?id=1017758#c3 Richard Bos <richard.bos(a)xs4all.nl> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #3 from Richard Bos <richard.bos(a)xs4all.nl> --- OK. I'll set the status to 'resolve' in that case. "having a separate script would make more sense to me". The advantage of having the button, or something similar makes the user aware that certain functionality exists. It would be really nice to be obtain a rescue boot ISO, via an one click button... I thought that grub2-mkrescue would do the trick, but that only provides a grub environment ISO. Thanks for support. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1008725] chromium fails to load h264
by bugzilla_noreply＠novell.com 03 Jan '17

03 Jan '17

http://bugzilla.suse.com/show_bug.cgi?id=1008725 http://bugzilla.suse.com/show_bug.cgi?id=1008725#c21 Tomáš Chvátal <tchvatal(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution|--- |FIXED --- Comment #21 from Tomáš Chvátal <tchvatal(a)suse.com> --- (In reply to George Anchev from comment #20) > (In reply to Tomáš Chvátal from comment #19) > > > > This looks like you have messed up repositories on your system. Since I am > > running the same thing and it works just fine. > > > > Try something like 'zypper dup --from packman' where packman is the name of > > packman repository you added. If not working please use forums to get help > > on how to set it up properly. > > Sorry to reopen but: > > I don't think I have messed up anything. There is simply no such package > called chromium-ffmpeg any more: > > http://packman.inode.at/suse/openSUSE_Leap_42.1/Essentials/x86_64/ > > I am running chromium 55.0.2883.75-99.2 installed from Leap 42.1 Update > repo. I also notice that chromium-ffmpegsumo's version is older > 54.0.2840.100-91.1 on the same repo. That version mismatch has nothing to do > with packman, right? > > So how are you running it? Maybe it is not the "same thing" as I simply find > no way to play the vimeo videos. There is no chromium-ffmpeg or chromium-ffmpegsumo. It is now using system ffmpeg. Thus if you use ffmpeg libraries from 42.1 then you have the support for vp8 and similar codecs, if you have libraries from packman you have support for everything. Since I can't reproduce the problem on any of the test machines you have to ahve repository mismatch or you didn't switch all libraries properly to their respective packman counterparts. -- You are receiving this mail because: You are on the CC list for the bug.

1 0