February 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 994084] New: Tracker bug: make packages own their symlinks in /etc/alternatives/*
by bugzilla_noreply＠novell.com 07 Apr '22

07 Apr '22

http://bugzilla.suse.com/show_bug.cgi?id=994084 Bug ID: 994084 Summary: Tracker bug: make packages own their symlinks in /etc/alternatives/* Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: vcuadradojuan(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is a tracker bug for making all packages using update-alternatives own their symlinks at `/etc/alternatives/*`. Problem: Currently there is a mix of owned and not owned files by packages in `/etc/alternatives/*` (just look at `rpm -qf /etc/alternatives/*`). Currently there seems to be a sizeable chunk of packages not declaring `%ghost %_sysconfdir/alternatives/<binary>`, as specified at [1]. Also, see discussion on opensuse-factory m-l [2]. Once the mass bug filling for the issue is done, I will wait until 1 October for maintainers to action on the bugs, and afterwards I will start fixing each package by hand. Cheers, [1] https://en.opensuse.org/openSUSE:Packaging_Multiple_Version_guidelines [2] https://lists.opensuse.org/opensuse-factory/2016-08/msg00218.html -- You are receiving this mail because: You are on the CC list for the bug.

2 37

[Bug 931978] New: VUL-0: CVE-2014-9721: zeromq: protocol downgrade attack on sockets using the ZMTP v3 protocol
by bugzilla_noreply＠novell.com 07 Apr '22

07 Apr '22

http://bugzilla.suse.com/show_bug.cgi?id=931978 Bug ID: 931978 Summary: VUL-0: CVE-2014-9721: zeromq: protocol downgrade attack on sockets using the ZMTP v3 protocol Classification: openSUSE Product: openSUSE Distribution Version: 13.2 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: tchvatal(a)suse.com Reporter: abergmann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- rh#1221666 ------------------------------------- It was discovered that zeromq, a lightweight messaging kernel, is susceptible to a protocol downgrade attack on sockets using the ZMTP v3 protocol. This could allow remote attackers to bypass ZMTP v3 security mechanisms by sending ZMTP v2 or earlier headers. CVE request: http://openwall.com/lists/oss-security/2015/05/07/8 Upstream bug report: https://github.com/zeromq/libzmq/issues/1273 Upstream fix: https://github.com/zeromq/zeromq4-x/commit/b6e3e0f601e2c1ec1f3aac880ed6a3fe… ------------------------------------- References: https://bugzilla.redhat.com/show_bug.cgi?id=1221666 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9721 http://seclists.org/oss-sec/2015/q2/515 http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9721.html -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 953735] New: Change libqt5-creator name to qt5-creator
by bugzilla_noreply＠novell.com 03 Apr '22

03 Apr '22

http://bugzilla.opensuse.org/show_bug.cgi?id=953735 Bug ID: 953735 Summary: Change libqt5-creator name to qt5-creator Classification: openSUSE Product: openSUSE Tumbleweed Version: 2015* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: ronisbr(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi! In Tumbleweed, I have been using the package qt-creator to develop Qt applications for a long time. I have always complained about the old version, since qt-creator is 3.2.2 and the newest version available is 3.5.1. However, it turns out that the newest version is already available in Tumbleweed (and in Leap) under the name libqt5-creator. Is there any good reason to name the package as libqt5-creator? I think this is very confusing. Since it has a lib* in the name, I did not even look at the description, so I was using a very old version all the time. Thus, I am wondering if it is possible to change the name of libqt5-creator to qt5-creator or something else. -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1014929] New: GNOME:Apps/gnucash-docs: Bug
by bugzilla_noreply＠novell.com 01 Apr '22

01 Apr '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1014929 Bug ID: 1014929 Summary: GNOME:Apps/gnucash-docs: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: openSUSE 42.2 Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: adrian.klaver(a)gmail.com QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- Need to add a dependency for yelp to package. Covers the case where the package is being installed on system that is not using GNOME as its desktop, eg using KDE. Without yelp you get the following message when trying to open the GnuCash Help: "GnuCash could not find the files for the help documentation. " even though gnucash-docs is installed. -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 924591] New: Apache2 doesn't start with faulty config, prob from yast
by bugzilla_noreply＠novell.com 14 Mar '22

14 Mar '22

http://bugzilla.opensuse.org/show_bug.cgi?id=924591 Bug ID: 924591 Summary: Apache2 doesn't start with faulty config, prob from yast Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: armv7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: volker3204(a)paradise.net.nz QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Running yast http-server module, making basically no changes to get basic config. No vhosts, ssl, etc. Btw a server name can't be entered, the value is going to /dev/null. Starting apache gives: Mar 27 14:37:35 cubie start_apache2[9361]: Module "authz_default" is not installed, ignoring. Mar 27 14:37:35 cubie start_apache2[9361]: Check the APACHE_MODULES setting in /etc/sysconfig/apache2. Mar 27 14:37:35 cubie start_apache2[9361]: AH00526: Syntax error on line 10 of /etc/apache2/mod_status.conf: Mar 27 14:37:35 cubie start_apache2[9361]: Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration Mar 27 14:37:36 cubie start_apache2[9378]: Module "authz_default" is not installed, ignoring. Mar 27 14:37:36 cubie start_apache2[9378]: Check the APACHE_MODULES setting in /etc/sysconfig/apache2. Mar 27 14:37:36 cubie start_apache2[9378]: AH00526: Syntax error on line 10 of /etc/apache2/mod_status.conf: Mar 27 14:37:36 cubie start_apache2[9378]: Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration Mar 27 14:37:36 cubie systemd[1]: Failed to start The Apache Webserver. In the yast http-server server-modules tab authz_default is listed with a description of "unknown", i.e. none. The module does not exist on disk! Editing /etc/sysconfig/apache2 adding authz_core to APACHE_MODULES makes authz_core also be shown with a description of "unknown". systemctl restart apache2 is now successful. This bnc:835484#6 basically says yast http-server module is foobared, so it's probably best to uninstall it. -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 918705] New: alpine locking failure (against procmail) leads to mail corruption
by bugzilla_noreply＠novell.com 11 Mar '22

11 Mar '22

http://bugzilla.suse.com/show_bug.cgi?id=918705 Bug ID: 918705 Summary: alpine locking failure (against procmail) leads to mail corruption Classification: openSUSE Product: openSUSE Factory Version: 201502* Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: gp(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is something I started to see a bit ago, and since it now happened twice today I figured I'd report it. When I obtain mail via fetchmail, using procmail as the delivery agent, occasionally I get corrupted mails like the following (in mbox format): ==== snip ==== >From gp Thu Feb 19 18:56:54 2015 Mime-Version: 1.0 Date: Thu, 19 Feb 2015 18:56:00 +0100 Subject: AW: Re: Your help needed: Fwd: Comment opportunity: Software Status: RO X-Status: X-Keywords: X-UID: 9310 definedstorage Subject: AW: Re: Your help needed: Fwd: Comment opportunity: Software definedstorage References: <54E302D90200006F00158C8B(a)suse.com> <54E2D72A0200002B000A1B55(a)suse.com> <54E339FA0200006F00158DBD(a)suse.com> <54E2D7DE0200002B000A1B68(a)suse.com> <alpine.LSU.2.11.1502191739290.2252(a)ghan.fvgr> In-Reply-To: <alpine.LSU.2.11.1502191739290.2252(a)ghan.fvgr> Message-ID: <54E623B70200006F001594A6(a)suse.com> From: ... To: "Gerald Pfeifer" <gp(a)suse.com> ==== snap ==== This does not happen daily, and I believe it happens especially when I have been offline for several hours and a few dozen e-mails are delivered at once (though this specific case was not that). The same configuration had been working for years without ever showing this problem, and it looks like looking on the Alpine side (or procmail, though less likely I guess, since it essentially only reads :0 INBOX ) -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1017682] New: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1017682 Bug ID: 1017682 Summary: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE3 Assignee: anixx(a)opensuse.org Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2016/q4/786 =============================================== Hi As reported by "Skylake" in the Debian bugtracker[1], UnRTF is prone to stack-based buffer overflows in various cmd_* functions. I've found a Stack-based buffer overflow in unrtf 0.21.9, which affects three functions including: cmd_expand, cmd_emboss and cmd_engrave. # convert.c static int cmd_expand (Word *w, int align, char has_param, int param) { char str[10]; if (has_param) { sprintf(str, "%d", param/4); // Overflow, 9-digit negative value triggers the bug if (!param) attr_pop(ATTR_EXPAND); else attr_push(ATTR_EXPAND, str); } return FALSE; } Apparently writing a negative integer to the buffer can trigger the overflow (Minus sign needs an extra byte). * How to trigger the bug * $ echo "\expnd-400000000" > poc $ unrtf poc A preliminary patch can be found in the Debian bugtracker, but it is not yet finalized. Could you assign (a?) CVE as needed? Does one CVE suffice here, since same class of issue in various cmd_* functions from one reporter? Whilest, at least in Debian, unrtf is compiled with FORTIFY_SOURCE=2 and the buffer overflows are detected, at least if any exposed application uses unrtf to process untrusted input, this might lead to a denial-of-service. [1] https://bugs.debian.org/849705 Regards, Salvatore =============================================== https://software.opensuse.org/package/unrtf TW: KDE:KDE3: 0.21.5 42.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 42.1: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 13.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 906594] New: Apper showing wrong package description
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=906594 Bug ID: 906594 Summary: Apper showing wrong package description Classification: openSUSE Product: openSUSE Factory Version: NO 13.2 BUGS!! Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE4 Applications Assignee: kde-maintainers(a)suse.de Reporter: erwin.vandevelde(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Apper shows the package's description when clicking on it, but only for the first package you click on this is done correctly. Apper shows the same description again and again for each other package you click on. Versions: apper 0.9.1-2.1 -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 942751] New: python3 test / missing __main__ module
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=942751 Bug ID: 942751 Summary: python3 test / missing __main__ module Classification: openSUSE Product: openSUSE Factory Version: 201505* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: myemailu(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When running python 3 -m test the output is: Traceback (most recent call last): File "/usr/lib64/python3.4/runpy.py", line 170, in _run_module_as_main "__main__", mod_spec) File "/usr/lib64/python3.4/runpy.py", line 85, in _run_code exec(code, run_globals) File "/usr/lib64/python3.4/_import_failed/test.py", line 21, in <module> Please file a bug on the SUSE Bugzilla.""".format(__name__)) ImportError: Module '__main__' is not installed. It is supposed to be part of python3 distribution, but missing from failed import map. Please file a bug on the SUSE Bugzilla. I'm using python3 on Tumbleweed rpm -qi python3 Name : python3 Version : 3.4.3 Release : 4.1 Architecture: x86_64 Install Date: Mi 29 Jul 2015 22:03:48 CEST Group : Development/Languages/Python Size : 2996719 License : Python-2.0 Signature : RSA/SHA256, Di 28 Jul 2015 11:49:27 CEST, Key ID b88b2fd43dbdc284 Source RPM : python3-3.4.3-4.1.src.rpm Build Date : Di 28 Jul 2015 11:49:14 CEST Build Host : build75 Relocations : (not relocatable) Packager : http://bugs.opensuse.org Vendor : openSUSE URL : http://www.python.org/ Summary : Python3 Interpreter -- You are receiving this mail because: You are on the CC list for the bug.

2 26

[Bug 997614] New: python's platform.linux_distribution() doesn't understand /etc/os-release
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=997614 Bug ID: 997614 Summary: python's platform.linux_distribution() doesn't understand /etc/os-release Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: tserong(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- > cat /etc/SuSE-release cat: /etc/SuSE-release: No such file or directory > cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20160831" ID=opensuse ID_LIKE="suse" VERSION_ID="20160831" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:tumbleweed:20160831" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" > python -c 'import platform ; print platform.linux_distribution()' ('', '', '') That's odd. Python doesn't know what distro we're running on. But, on an earlier Tumbleweed release: > cat /etc/SuSE-release openSUSE 20160701 (x86_64) VERSION = 20160701 CODENAME = Tumbleweed # /etc/SuSE-release is deprecated and will be removed in the future, use /etc/os-release instead > cat /etc/os-release NAME=openSUSE VERSION="Tumbleweed" VERSION_ID="20160701" PRETTY_NAME="openSUSE Tumbleweed (20160701) (x86_64)" ID=opensuse ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:opensuse:20160701" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" ID_LIKE="suse" > python -c 'import platform ; print platform.linux_distribution()' ('openSUSE ', '20160701', 'x86_64') Turns out the file matching in /usr/lib64/python2.7/platform.py (line 323+) is looking for files named /(\w+)[-_](release|version)/, so it picks up "os-release", and decides _distname is "os", which *isn't* in _supported_dists (_supported_dists includes "SuSE", "debian", "fedora", etc. but no generic "os"). So, as we apparently no longer ship SuSE-release, and there's no other release-like files to parse, and we end up with platform.linux_distribution() having no idea what's going on. -- You are receiving this mail because: You are on the CC list for the bug.

2 34