February 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 989493] New: mlocate security: normal user must be added to group nobody; wrong man page info about --require-visibility FLAG
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=989493 Bug ID: 989493 Summary: mlocate security: normal user must be added to group nobody; wrong man page info about --require-visibility FLAG Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: x86-64 OS: openSUSE 42.1 Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: studio(a)anchev.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The man page of update db says (excerpt): --------------- -l, --require-visibility FLAG Set the “require file visibility before reporting it” flag in the generated database to FLAG. If FLAG is 0 or no, or if the database file is readable by "others" or it is not owned by nobody, locate(1) outputs the database entries even if the user running locate(1) could not have read the directory necessary to find out the file described by the database entry. If FLAG is 1 or yes (the default), locate(1) checks the permissions of parent directories of each entry before reporting it to the invoking user. To make the file existence truly hidden from other users, the database group is set to nobody and the database permissions prohibit reading the database by users using other means than locate(1), which is set-gid nobody. Note that the visibility flag is checked only if the database is owned by nobody and it is not readable by "others". --------------- I made the following experiment: - Run updatedb as root with no extra options (supposing by default it will use flag 1 as per man page) - Checked the permission of the db file (it was 644) - Run "locate root" as normal user - I can see the contents of /root (which means the man page is wrong and by default flag is 0) - chown nobody: /var/lib/mlocate/mlocate.db - Run "locate root" as normal user - again I can see the contents of /root - chmod 640 /var/lib/mlocate/mlocate.db (as according to the documentation that is required in order the flag 1 to be respected) - same result Then I tried explicitly to run "updatedb -l 1" as root and I see that it recreates the db file but this time the permissions are 640. So even when owned by nobody a normal user cannot use the locate command: > locate root locate: can not open `/var/lib/mlocate/mlocate.db': Permission denied After adding my user to group nobody I was able to run "locate root" without seeing the files in "/root". This whole thing means that: 1. The man page is not correct as the default is FLAG 0 (insecure), not 1 (secure) 2. One is forced to use the first approach (adding each user to group nobody). I don't know what are the security implications of this but it doesn't sound as something normal, right? 3. The script /etc/cron.daily/mlocate.cron needs to be modified somehow in order to use explicitly FLAG 1 (is that possible?) -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 956262] New: cobbler dependencies.
by bugzilla_noreply＠novell.com 11 Jul '19

11 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=956262 Bug ID: 956262 Summary: cobbler dependencies. Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: osynge(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- The applications: cobbler-2.6.6-3.8.noarch cobbler-web-2.6.6-3.8.noarch Are separately packaged hence "cobbler" should not depend on apache. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1017824] New: clementine switched to another sound card between songs
by bugzilla_noreply＠novell.com 08 Jul '19

08 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=1017824 Bug ID: 1017824 Summary: clementine switched to another sound card between songs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 708254 --> http://bugzilla.suse.com/attachment.cgi?id=708254&action=edit alsa-info I have two sound cards: * HDA-Intel -- in the notebook * FiiO DigiHug -- over USB I use the latter for sound output when I am in a docking station. On the Playback tab in pavucontrol, I set Clementine to play through DigiHug. In the past month or so, sometimes the output is switched to the internal audio (Intel HDA) when Clementine changes from one song to another. So this seems to be a regression. -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 935339] New: gpgme fails to cleanly uninstall: install-info: No such file or directory for /usr/share/info/gpgme.info.gz
by bugzilla_noreply＠novell.com 05 Jul '19

05 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=935339 Bug ID: 935339 Summary: gpgme fails to cleanly uninstall: install-info: No such file or directory for /usr/share/info/gpgme.info.gz Classification: openSUSE Product: openSUSE Factory Version: 201505* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: gp(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Uninstalling gpgme, I get the following: 1 package to remove. After the operation, 355.3 KiB will be freed. Continue? [y/n/? shows all options] (y): y (1/1) Removing gpgme-1.5.5-1.1 .........................................................................................................[done] Additional rpm output: install-info: No such file or directory for /usr/share/info/gpgme.info.gz warning: %postun(gpgme-1.5.5-1.1.x86_64) scriptlet failed, exit status 1 # rpm -ql gpgme | grep info /usr/share/info/gpgme.info-1.gz /usr/share/info/gpgme.info-2.gz /usr/share/info/gpgme.info.gz This looks similar to bug #929415 and may have the same fix? -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1016755] New: VUL-0: CVE-2016-5303: php5-pear-Horde_Text_Filter: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in HordeGroupware and Horde G...
by bugzilla_noreply＠novell.com 04 Jul '19

04 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=1016755 Bug ID: 1016755 Summary: VUL-0: CVE-2016-5303: php5-pear-Horde_Text_Filter: Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in HordeGroupware and Horde G... Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: lang(a)b1-systems.de Reporter: meissner(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- CVE-2016-5303 Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5303 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-5303.html https://github.com/horde/horde/commit/4d8176d1e9ef5cbd2b3fcacd9b9a4c8e482fb… https://github.com/horde/horde/commit/30d5506c20d26efbb9942fbdc6f981a0bd333… http://marc.info/?l=horde-announce&m=147319089526753&w=2 http://marc.info/?l=horde-announce&m=147319066126665&w=2 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 925561] New: NetworkManager should provide a way to designate any connection as a mobile data connection
by bugzilla_noreply＠novell.com 03 Jul '19

03 Jul '19

http://bugzilla.opensuse.org/show_bug.cgi?id=925561 Bug ID: 925561 Summary: NetworkManager should provide a way to designate any connection as a mobile data connection Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: x86-64 OS: openSUSE 13.2 Status: NEW Severity: Enhancement Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: jrhodes(a)redpointsoftware.com.au QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Apper has an option in it's settings regarding when to automatically download and install updates. Under this setting there's an option "unless I am on a mobile data connection", which supposedly ensures that Apper doesn't download software updates while connected to a mobile (or metered) network. Unfortunately there doesn't appear to be any way in NetworkManager to designate a wireless or wired connection as being a mobile connection, i.e. a connection provided by a wireless hotspot or USB tethered phone. I'd really like to set Apper to automatically download and install updates as soon as they are available (I'm running on openSUSE Tumbleweed, which I believe is just Factory now?), but I can't do this because I occasionally have my laptop connected to my 4G hotspot, and I don't want to risk having packages download over 4G. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1004625] New: nm-applet exits on startup under libappindicator
by bugzilla_noreply＠novell.com 03 Jul '19

03 Jul '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1004625 Bug ID: 1004625 Summary: nm-applet exits on startup under libappindicator Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: simonf.lees(a)suse.com QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- Tested with the version from openSUSE:Tumbleweed GNOME:Next and git master nm-applet exits immediately under appindicator based desktops without printing anything but is fine on xembed desktops like IceWM. Upstream bugreport https://bugzilla.gnome.org/show_bug.cgi?id=772910 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1002017] New: Gnome crashes and restarts on its own intermittently
by bugzilla_noreply＠novell.com 03 Jul '19

03 Jul '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1002017 Bug ID: 1002017 Summary: Gnome crashes and restarts on its own intermittently Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE 13.2 Status: NEW Severity: Critical Priority: P5 - None Component: GNOME Assignee: bnc-team-gnome(a)forge.provo.novell.com Reporter: tfbielawski(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:49.0) Gecko/20100101 Firefox/49.0 Build Identifier: Problem: Gnome crashes intermittently. Thus far, I have only noticed it while browsing with any browser. Currently I am using Chromium and Firefox. I cannot duplicate the crash intentionally, however, it happens every time I browse the Internet using Chrome or Firefox at some point or another. Effects: The system freezes for a few seconds, typically less than one minute, before crashing. When it freezes, I have no control with keyboard or with pointer or by touchscreen. After a moment, the entire system unfreezes. Immediately afterward, Gnome's dash and top boar vanish then reappear two or three times. The browser will vanish, then the screen will go completely blank. Finally, everything returns to normal function and control. All windows are open and Gnome is running. A secondary effect is that Gnome dash and top bar will simply vanish, then reappear two to three times without affecting the window I am working in (except that the window will shift left when Gnome dash vanishes). Computer: Dell Latittude 3148 (2-in-1) RAM: 4GB Processor: Intel Core i-3 1.9mhz OS: Tumbleweed DE: Gnome 3.22 Extensions: Dash to Dock, Top Icons Plus, User Themes Shell Theme: Numix Frost Icon Theme: Numix Square Reproducible: Sometimes Steps to Reproduce: 1. Start computer and log in 2. Start browsing with Gnome or Firefox 3. It will happen within a few minutes of starting the browser, but not by my control. Actual Results: I cannot intentionally reproduce it, but it happens frequently enough to observe it. Gnome always restarts after it has crashed and returns to normal. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 914681] New: jing doesn't find Saxon extension
by bugzilla_noreply＠novell.com 01 Jul '19

01 Jul '19

http://bugzilla.suse.com/show_bug.cgi?id=914681 Bug ID: 914681 Summary: jing doesn't find Saxon extension Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: thomas.schraitle(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The jing package is used to validate an XML document with a RNG schema. When installing the jing package and running it without any options, you get: ----------------- $ rpm -q jing jing-20091111-19.1.3.noarch $ jing /usr/bin/build-classpath: error: Could not find saxon Java extension for this JVM /usr/bin/build-classpath: error: Some specified jars were not found Jing version 20091111 usage: java com.thaiopensource.relaxng.util.Driver [-i] [-c] [-s] [-t] [-C catalogFile] [-e encoding] RNGFile XMLFile... RELAX NG is a schema language for XML See http://relaxng.org/ for more information. ----------------- After investigating it, the respective line is this: BASE_JARS="jing xerces-j2 xml-commons-apis saxon xml-commons-resolver" This contains the list of all JAR files which is used by jing. However, "saxon" doesn't exist anymore, it should be "saxon6". The above line should be therefor look like this: BASE_JARS="jing xerces-j2 xml-commons-apis saxon6 xml-commons-resolver" -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 941235] New: Upgrading to python-virtualenv-12.0.7-2.1 fails: cpio: rename
by bugzilla_noreply＠novell.com 01 Jul '19

01 Jul '19

http://bugzilla.opensuse.org/show_bug.cgi?id=941235 Bug ID: 941235 Summary: Upgrading to python-virtualenv-12.0.7-2.1 fails: cpio: rename Classification: openSUSE Product: openSUSE Factory Version: 201505* Hardware: All OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: robert.munteanu(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When upgrading to Tumbleweed 20150807 I get the following error: (1/1) Installing: python-virtualenv-12.0.7-2.1 ...............................................................................[error] Installation of python-virtualenv-12.0.7-2.1 failed: Error: Subprocess failed. Error: RPM failed: error: unpacking of archive failed on file /usr/lib/python2.7/site-packages/virtualenv-1 2.0.7-py2.7.egg-info: cpio: rename error: python-virtualenv-12.0.7-2.1.noarch: install failed error: python-virtualenv-12.0.7-1.3.noarch: erase skipped Installed version is $ rpm -q python-virtualenv python-virtualenv-12.0.7-1.3.noarch -- You are receiving this mail because: You are on the CC list for the bug.

1 3