November 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1065563] AUDIT-0: Review of package kcm-sddm (polkit-untracked-privilege , suse-dbus-unauthorized-service)
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1065563 http://bugzilla.suse.com/show_bug.cgi?id=1065563#c1 Sebastian Krahmer <krahmer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |krahmer(a)suse.com --- Comment #1 from Sebastian Krahmer <krahmer(a)suse.com> --- Please paste the exact build error, so we see the rpmlint messages for the exact DBUS configs and service names that need to be whitelisted. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1043401] create repository form crypto currencies
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1043401 http://bugzilla.suse.com/show_bug.cgi?id=1043401#c9 Martin Pluskal <mpluskal(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mpluskal(a)suse.com |bnc-team-screening(a)forge.pr | |ovo.novell.com --- Comment #9 from Martin Pluskal <mpluskal(a)suse.com> --- (In reply to Stanislav Brabec from comment #8) > Reopening to solve remaining issues with duplicities. > > Real *coin* matches that needs merge: > bitcoin (recent version in network) => merge systemd integration and maybe > more > dogecoin (2015 version in network) => probably drop in network > namecoin (2014 version in network) => probably drop in network > > Other matches to solve: > hidapi > libargtable2 > libdb-5_1 > libdb-5_3 > peerunity > uthash > > False matches (backports only): > go > libsodium I would want to have package I maintain bitcoin and possibly others to be in Factory, current network:cryptocurrencies/bitcoin is not acceptable and network:cryptocurrencies is not whitelisted devel project, so count me out of this. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1063305] Conflict apr-devel libapr1-devel
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1063305 http://bugzilla.suse.com/show_bug.cgi?id=1063305#c3 Martin Pluskal <mpluskal(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #3 from Martin Pluskal <mpluskal(a)suse.com> --- Fixed in Factory -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1064980] VUL-0: CVE-2016-10517: redis: POST and Host: strings lack a check that allows "Cross Protocol Scripting"
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1064980 http://bugzilla.suse.com/show_bug.cgi?id=1064980#c2 Martin Pluskal <mpluskal(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #2 from Martin Pluskal <mpluskal(a)suse.com> --- (In reply to Andreas Stieger from comment #1) > Martin did the 3.2.7 bump. Could you add the CVE to the changelog and > trigger the updates? Submitted for Factory, for Leap and Backports each has different version, but upon reviewing changes I would probably go for version bump to Factory version for Leap and Backports - most of changes are bugfixes anyways. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1065787] LibreOffice Calc formula function language english without chance to alter.
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1065787 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|bnc-team-screening(a)forge.pr |tchvatal(a)suse.com |ovo.novell.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1065847] libesd0 missing from openSUSE Tumbleweed software repository
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1065847 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|bnc-team-screening(a)forge.pr |factory-repo-checker@kulow. |ovo.novell.com |org -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1065951] New: systemd service Type=forking and PIDFile privilege escalation
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1065951 Bug ID: 1065951 Summary: systemd service Type=forking and PIDFile privilege escalation Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: All OS: openSUSE 42.3 Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wullinger(a)rz.uni-kiel.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 746593 --> http://bugzilla.suse.com/attachment.cgi?id=746593&action=edit Example service code When creating a systemd service with Type=forking and PIDFile=, there seems to be a privilege escalation that makes it possible to have the service manager kill an arbitrary (maybe privileged) process with information from a non-privileged process. Example: Define a service as follows, where $TARGET_PID is the PID of a root owned process. /opt/test/escalator forks and writes the specified PID into a file. # /etc/systemd/system/escalator.service [Service] Type=forking PIDFile=/run/escalator/pid ExecStart=/opt/test/escalator $TARGET_PID RuntimeDirectory=escalator User=nobody Group=nogroup If one starts such a unit, systemd will notice if the specified target PID is not a direct descendent of the service manager: systemd[1]: escalator.service: Supervising process $TARGET_PID which is not our child. We'll most likely not notice when it exits. It will, however, kill the target PID on when the unprivileged unit is stopped. The target PID may be running with higher privileges than the stopped unit, it seems possible to have systemd kill arbitrary processes with information from a non-privileged process. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1065671] gnuhealth: 3.2.6 maintenance release
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1065671 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:7358:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1062808] gkrellm cpufreq plugin, cpufreqplugin does not start
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1062808 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:7414:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1061742] openSUSE GNOME: sle-classic applications menu handles right click like left click and has favorites at top
by bugzilla_noreply＠novell.com 01 Nov '17

01 Nov '17

http://bugzilla.suse.com/show_bug.cgi?id=1061742 http://bugzilla.suse.com/show_bug.cgi?id=1061742#c9 xiaoguang wang <xwang(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(xwang(a)suse.com) | --- Comment #9 from xiaoguang wang <xwang(a)suse.com> --- I'm going to enable gnome-shell-add-app-to-desktop.patch on openSUSE. -- You are receiving this mail because: You are on the CC list for the bug.

1 0