February 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1013206] New: [Build 20161129] live installer does not check for password simplicity
by bugzilla_noreply＠novell.com 14 Nov '18

14 Nov '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1013206 Bug ID: 1013206 Summary: [Build 20161129] live installer does not check for password simplicity Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: http://openqa.opensuse.org/tests/312496/modules/user_s ettings/steps/2 OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Live Medium Assignee: coolo(a)suse.com Reporter: okurz(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- ## Observation yast installer in scenario opensuse-Tumbleweed-KDE-Live-x86_64-kde-live_installation@64bit [user_settings](http://openqa.opensuse.org/tests/312496/modules/user_setting… does not show an expected dialog noticing that the password might be too simple. ## Reproducible Fails every time in this scenario ## Expected result Compare to the dialog showing up in https://openqa.opensuse.org/tests/312409#step/user_settings/3 The password used is the same in both cases. ## Further details Always latest result in this scenario: [latest](http://openqa.opensuse.org/tests/latest?flavor=KDE-Live&arch=x86_64… -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 940837] New: bash completion does not expand variables
by bugzilla_noreply＠novell.com 12 Nov '18

12 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=940837 Bug ID: 940837 Summary: bash completion does not expand variables Classification: openSUSE Product: openSUSE Factory Version: 201505* Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: ohering(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- # export SCRATCH_AREA=/dev/shm # ls $SCR<tab> this expands to # ls \$SCRATCH_AREA/ used to expand to # ls $SCRATCH_AREA -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 867041] New: fontforge segfaults if both libpng12-0 and libpng15-15 are installed
by bugzilla_noreply＠novell.com 12 Nov '18

12 Nov '18

https://bugzilla.novell.com/show_bug.cgi?id=867041 https://bugzilla.novell.com/show_bug.cgi?id=867041#c0 Summary: fontforge segfaults if both libpng12-0 and libpng15-15 are installed Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: Other OS/Version: openSUSE 12.3 Status: NEW Severity: Critical Priority: P5 - None Component: X11 Applications AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: wl(a)gnu.org QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux i686; rv:27.0) Gecko/20100101 Firefox/27.0 [fontforge 20120731-2.1.2] [libpng12-0 1.2.50-3.1.1] [libpng15-15 1.5.13-3.1.1] Calling fontforge gives Copyright (c) 2000-2012 by George Williams. Executable based on sources from 14:57 GMT 31-Jul-2012. Library based on sources from 14:57 GMT 31-Jul-2012. Application was compiled with png.h from libpng-1.5.13 Application is running with png.c from libpng-1.2.50 Incompatible libpng version in application and library Segmentation Fault Recompiling fontforge from the original sources fixed this issue for me. Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 12

[Bug 927616] New: ad-hoc mode not working
by bugzilla_noreply＠novell.com 08 Nov '18

08 Nov '18

http://bugzilla.opensuse.org/show_bug.cgi?id=927616 Bug ID: 927616 Summary: ad-hoc mode not working Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: armv7 OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: wicked-maintainers(a)suse.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Development Blocker: --- When preparing a presentation for hackweek, I was blocked by problems to get the WLAN up. To workaround bug 927615 I configured ad-hoc mode using yast2 lan. This did not result in a working network. systemctl status wicked showed wicked: wrong WIRELESS_MODE value (Ad-hoc) In the end, I had to use iwconfig + ifconfig directly which did working after some trying. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 954370] New: Pillow: import Image does not work
by bugzilla_noreply＠novell.com 05 Nov '18

05 Nov '18

http://bugzilla.opensuse.org/show_bug.cgi?id=954370 Bug ID: 954370 Summary: Pillow: import Image does not work Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: All OS: openSUSE 42.1 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dhall(a)wustl.edu QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0 Build Identifier: The spec file for python-Pillow creates PIL.pth in an effort to have backwards compatibility with PIL This does not actually create a backwards-compatible installation; if you run import Image, no file formats are found that can be used for reading or saving images. Reproducible: Always Steps to Reproduce: 1. run the command below > python -c 'import Image; print Image.__file__; Image.preinit(); print Image.EXTENSION' Actual Results: /usr/lib64/python2.7/site-packages/PIL/Image.pyc {} Expected Results: /usr/lib64/python2.7/site-packages/PIL/Image.pyc {'.png': 'PNG', '.gif': 'GIF', '.ppm': 'PPM', '.bmp': 'BMP', '.pbm': 'PPM', '.pgm': 'PPM', '.jpe': 'JPEG', '.jfif': 'JPEG', '.jpg': 'JPEG', '.tif': 'TIFF', '.jpeg': 'JPEG', '.tiff': 'TIFF'} running: > python -c 'from PIL import Image; print Image.__file__; Image.preinit(); print Image.EXTENSION' gives the expected results. This is no surprise since that is what is supported by Pillow. "import Image" is not supported by Pillow, but openSUSE feigns support that doesn't work at all. This breaks certain programs the first 'import Image' and only on ImportError look to 'from PIL import Image' If you want to support 'import Image', Ubuntu 12.04 appears to have a working method; creating PILCompat that does this > cat /usr/lib/python2.7/dist-packages/PILcompat.pth PILcompat > cat /usr/lib/python2.7/dist-packages/PILcompat/Image.py from PIL.Image import * -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 900558] New: Impossible to boot in single user mode with root mounted read only
by bugzilla_noreply＠novell.com 03 Nov '18

03 Nov '18

http://bugzilla.opensuse.org/show_bug.cgi?id=900558 Bug ID: 900558 Summary: Impossible to boot in single user mode with root mounted read only Classification: openSUSE Product: openSUSE 13.1 Version: Final Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: archie(a)dellroad.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I have a 13.1 system with all the latest updates as of today and it is spitting out the UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY message for the root filesystem, and then booting normally with root mounted root read-write. First of all, I would expect it to not boot normally in this case, but whatever. Anyway, when I try to do what it says, it's impossible! Here's why: even though I reboot with "single ro" on the boot line and it does in fact go into single user mode, it still mounts root read-write (after complaining of the same fsck errors). Since the 1980's single user mode has always left root mounted read-only so you can run fsck if needed, and you can always remount it read-write if you want. Why did this change? Of course "mount -o remount,ro /" doesn't work. Because root is mounted read-write and it's impossible to get the system to boot with root mounted read-only, then even in single user mode, it's impossible to run fsck and fix the problem. So it's impossible to resolve this problem without the use of a rescue disk. Please fix, this is a bad dead-end people can fall into. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 995960] New: xfdesktop's menu lacks 'Other' applications
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.opensuse.org/show_bug.cgi?id=995960 Bug ID: 995960 Summary: xfdesktop's menu lacks 'Other' applications Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce(a)forge.provo.novell.com Reporter: christoph.wickert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 689813 --> http://bugzilla.opensuse.org/attachment.cgi?id=689813&action=edit Screenshots of the menus. xfce4-panel on the right, xfdesktop on the left. Menu entries that don't fit into one of the groups like 'Internet' or 'Multimedia' should show up in the 'Other' submenu. This menu is only shown in xfce4-panel's applications menu but not in xfdesktop's right-click menu. AFAICS both use the same menu file, so both menus should be consistent. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 995961] New: 'Other' group disappears from xfce4-panel's applications menu
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.opensuse.org/show_bug.cgi?id=995961 Bug ID: 995961 Summary: 'Other' group disappears from xfce4-panel's applications menu Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce(a)forge.provo.novell.com Reporter: christoph.wickert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The application menu from xfce4-panel is buggy: Menu entries that don't fit into one of the groups like 'Internet' or 'Multimedia' should show up in the 'Other' submenu. For some reason, this menu disappears quite often. Restarting the panel with 'xfce4-panel -r' fixes the issue. Site note: The menu from xfdesktop does not show the 'Other' group at all (bug 995960). -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1012389] New: xfce4-terminal immediately becomes zombie
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1012389 Bug ID: 1012389 Summary: xfce4-terminal immediately becomes zombie Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce(a)forge.provo.novell.com Reporter: christoph.wickert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- After upgrading to Leap 42.2, xfce4-terminal becomes a zombie immediately after launched. Reproducibility: Always Hot to reproduce: 1. Launch xfce4-terminal 2. Run 'ps aux | grep Z' in that terminal. Result: You will see that the very xfce4-terminal you are using is a zombie. 'kill' or 'kill -9' don't work, so we use pstree to find the zombie's parent. It's another xfce4-terminal instance which responds to signals fine. Expected result: xfce4-terminal should not be a zombie. Not sure if there should be two instances of it. Affected packages xfce4-terminal-0.6.3-4.16.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 926323] New: VUL-1: CVE-2015-1821,CVE-2015-1822, 2015-1853: chrony: multiple vulnerabilities
by bugzilla_noreply＠novell.com 30 Oct '18

30 Oct '18

http://bugzilla.suse.com/show_bug.cgi?id=926323 Bug ID: 926323 Summary: VUL-1: CVE-2015-1821,CVE-2015-1822, 2015-1853: chrony: multiple vulnerabilities Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: opensuse-communityscreening(a)forge.provo.novell.com Reporter: astieger(a)suse.com QA Contact: opensuse-communityscreening(a)forge.provo.novell.com CC: david.bahi(a)emc.com, mkudlvasr(a)novell.com, mrueckert(a)suse.com Found By: Security Response Team Blocker: --- Reported against network:time chrony, not in openSUSE or SLE. Does not have a designated maintainer, CC project maintainers and recent updaters. CVE-2015-1821 chrony: Heap out of bound write in address filter =============================================================== https://bugzilla.redhat.com/show_bug.cgi?id=1209632 Miroslav Lichvar of Red Hat reports: When NTP or cmdmon access is configured (from chrony.conf or over authenticated cmdmon) with a subnet size that is not divisible by 4 and address that has nonzero bits in the 4-bit subnet remainder (e.g. f0::/3), the TableNode array index is calculated incorrectly and it may write past the array. CVE-2015-1822 chrony: uninitialized pointer in cmdmon reply slots ================================================================= https://bugzilla.redhat.com/show_bug.cgi?id=1209632 Miroslav Lichvar of Red Hat reports: The last pointer in the list of allocated reply slots that are used to save authenticated cmdmon replies is not initialized. This one was actually found couple months ago and it's already fixed in git, but only recently I realized it could have security implications. An authenticated attacker can allocate and deallocate memory with other commands (e.g. allow/deny) and can force allocation of new reply slots by making new requests and not acknowledging previous replies, and then let chronyd write a reply to an invalid memory. CVE-2015-1853 chrony: authentication doesn't protect symmetric associations against DoS attacks =============================================================================================== https://bugzilla.redhat.com/show_bug.cgi?id=1209572 Miroslav Lichvar of Red Hat reports: An attacker knowing that NTP hosts A and B are peering with each other (symmetric association) can send a packet to host A with source address of B which will set the NTP state variables on A to the values sent by the attacker. Host A will then send on its next poll to B a packet with originate timestamp that doesn't match the transmit timestamp of B and the packet will be dropped. If the attacker does this periodically for both hosts, they won't be able to synchronize to each other. This is a known denial-of-service attack, described at [1]. According to the document the NTP authentication is supposed to protect symmetric associations against this attack, but that doesn't seem to be the case. The state variables are updated even when authentication fails and the peers are sending packets with originate timestamps that don't match the transmit timestamps on the receiving side. This seems to be a very old problem, it's in the oldest ntp version I could find (xntp3.3wy). It's also in the NTPv3 (RFC 1305) and NTPv4 (RFC 5905) specifications, so other NTP implementations with support for symmetric associations and authentication may be vulnerable too. For authentication using symmetric keys it should be sufficient to move the code updating the state variables after the MAC is validated (TEST5). For autokey that's not enough, it seems the attacker can still reset the protocol with crypto-NAK or CRYPTO_ASSOC messages and possibly other ways. I'm not sure if this can be fixed for autokey in general. [1] https://www.eecis.udel.edu/~mills/onwire.html -- You are receiving this mail because: You are on the CC list for the bug.

1 3