April 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1032017] New: VUL-1: CVE-2017-7378: podofo: heap-based buffer overflow in PoDoFo::PdfPainter::ExpandTabs (PdfPainter.cpp)
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1032017 Bug ID: 1032017 Summary: VUL-1: CVE-2017-7378: podofo: heap-based buffer overflow in PoDoFo::PdfPainter::ExpandTabs (PdfPainter.cpp) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2017/q2/0 ============================================== Description: podofo is a C++ library to work with the PDF file format. A fuzz on it through the podofotxt2pdf command line tool reavealed an heap overflow. This post will be forwarded on the upstream mailing list. The complete ASan output: # podofotxt2pdf $FILE out.pdf ==12524==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000001178 at pc 0x7f44ebaa5c89 bp 0x7ffce55aac90 sp 0x7ffce55aac88 READ of size 2 at 0x607000001178 thread T0 #0 0x7f44ebaa5c88 in PoDoFo::PdfPainter::ExpandTabs(PoDoFo::PdfString const&, long) const /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPainter.cpp:1945:26 #1 0x7f44eba95942 in PoDoFo::PdfPainter::DrawText(double, double, PoDoFo::PdfString const&, long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPainter.cpp:755:31 #2 0x519755 in draw(char*, PoDoFo::PdfDocument*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:94:25 #3 0x51aa52 in init(char const*, char const*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:165:5 #4 0x51c253 in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:212:7 #5 0x7f44e9a3878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #6 0x41ccb8 in _start (/usr/bin/podofotxt2pdf+0x41ccb8) 0x607000001178 is located 0 bytes to the right of 72-byte region [0x607000001130,0x607000001178) allocated by thread T0 here: #0 0x514870 in operator new(unsigned long) /tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.0/work/compiler-rt-4.0.0.src/lib/asan/asan_new_delete.cc:82 #1 0x7f44eb460304 in PoDoFo::PdfRefCountedBuffer::ReallyResize(unsigned long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfRefCountedBuffer.cpp:161:21 #2 0x7f44eb21212d in PoDoFo::PdfRefCountedBuffer::Resize(unsigned long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfRefCountedBuffer.h:307:9 #3 0x7f44eb47a466 in PoDoFo::PdfRefCountedBuffer::PdfRefCountedBuffer(unsigned long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfRefCountedBuffer.h:227:11 #4 0x7f44eb47a466 in PoDoFo::PdfString::Init(char const*, long) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfString.cpp:570 #5 0x7f44eb47c24c in PoDoFo::PdfString::PdfString(char const*, PoDoFo::PdfEncoding const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/base/PdfString.cpp:109:9 #6 0x519718 in draw(char*, PoDoFo::PdfDocument*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:94:43 #7 0x51aa52 in init(char const*, char const*, bool, char const*) /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:165:5 #8 0x51c253 in main /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/tools/podofotxt2pdf/podofotxt2pdf.cpp:212:7 #9 0x7f44e9a3878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/app-text/podofo-0.9.5/work/podofo-0.9.5/src/doc/PdfPainter.cpp:1945:26 in PoDoFo::PdfPainter::ExpandTabs(PoDoFo::PdfString const&, long) const Shadow bytes around the buggy address: 0x0c0e7fff81d0: fa fa 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c0e7fff81e0: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fd fd 0x0c0e7fff81f0: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00 0x0c0e7fff8200: 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 0x0c0e7fff8210: 00 00 00 fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c0e7fff8220: fd fa fa fa fa fa 00 00 00 00 00 00 00 00 00[fa] 0x0c0e7fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0e7fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0e7fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0e7fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0e7fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==12524==ABORTING Affected version: 0.9.5 Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: CVE-2017-7378 Reproducer: https://github.com/asarubbo/poc/blob/master/00248-podofo-heapoverflow-PdfPa… Timeline: 2017-03-31: bug discovered and reported to upstream 2017-03-31: blog post about the issue 2017-03-31: CVE assigned Note: This bug was found with American Fuzzy Lop. Permalink: https://blogs.gentoo.org/ago/2017/03/31/podofo-heap-based-buffer-overflow-i… -- Agostino Sarubbo Gentoo Linux Developer ============================================== -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1017461] btrfs balance renders system unresponsive and eventually even kills WiFi when quota is enabled
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1017461 http://bugzilla.suse.com/show_bug.cgi?id=1017461#c59 --- Comment #59 from Richard Weinberger <richard(a)nod.at> --- So, this issue should now be fixed by the following upstream commit? commit fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 Author: Qu Wenruo <quwenruo(a)cn.fujitsu.com> Date: Wed Feb 15 10:43:03 2017 +0800 btrfs: qgroup: Move half of the qgroup accounting time out of commit trans Just as Filipe pointed out, the most time consuming parts of qgroup are btrfs_qgroup_account_extents() and btrfs_qgroup_prepare_account_extents(). Which both call btrfs_find_all_roots() to get old_roots and new_roots ulist. What makes things worse is, we're calling that expensive btrfs_find_all_roots() at transaction committing time with TRANS_STATE_COMMIT_DOING, which will blocks all incoming transaction. Such behavior is necessary for @new_roots search as current btrfs_find_all_roots() can't do it correctly so we do call it just before switch commit roots. However for @old_roots search, it's not necessary as such search is based on commit_root, so it will always be correct and we can move it out of transaction committing. This patch moves the @old_roots search part out of commit_transaction(), so in theory we can half the time qgroup time consumption at commit_transaction(). But please note that, this won't speedup qgroup overall, the total time consumption is still the same, just reduce the performance stall. Cc: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Qu Wenruo <quwenruo(a)cn.fujitsu.com> Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1028895] blacklist tool versions known to build broken kernels
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1028895 http://bugzilla.suse.com/show_bug.cgi?id=1028895#c1 --- Comment #1 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2017:0907-1: An update that solves 11 vulnerabilities and has 41 fixes is now available. Category: security (important) Bug References: 1007959,1007962,1008842,1011913,1012910,1013994,1015609,1017461,1017641,1018263,1018419,1019163,1019618,1020048,1022785,1023866,1024015,1025235,1025683,1026405,1026462,1026505,1026509,1026692,1026722,1027054,1027066,1027179,1027189,1027190,1027195,1027273,1027565,1027575,1028017,1028041,1028158,1028217,1028325,1028372,1028415,1028819,1028895,1029220,1029986,1030573,1030575,951844,968697,969755,982783,998106 CVE References: CVE-2016-10200,CVE-2016-2117,CVE-2016-9191,CVE-2017-2596,CVE-2017-2636,CVE-2017-6214,CVE-2017-6345,CVE-2017-6346,CVE-2017-6347,CVE-2017-6353,CVE-2017-7184 Sources used: openSUSE Leap 42.2 (src): kernel-debug-4.4.57-18.3.1, kernel-default-4.4.57-18.3.1, kernel-docs-4.4.57-18.3.2, kernel-obs-build-4.4.57-18.3.1, kernel-obs-qa-4.4.57-18.3.1, kernel-source-4.4.57-18.3.1, kernel-syms-4.4.57-18.3.1, kernel-vanilla-4.4.57-18.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017461] btrfs balance renders system unresponsive and eventually even kills WiFi when quota is enabled
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1017461 http://bugzilla.suse.com/show_bug.cgi?id=1017461#c58 --- Comment #58 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2017:0907-1: An update that solves 11 vulnerabilities and has 41 fixes is now available. Category: security (important) Bug References: 1007959,1007962,1008842,1011913,1012910,1013994,1015609,1017461,1017641,1018263,1018419,1019163,1019618,1020048,1022785,1023866,1024015,1025235,1025683,1026405,1026462,1026505,1026509,1026692,1026722,1027054,1027066,1027179,1027189,1027190,1027195,1027273,1027565,1027575,1028017,1028041,1028158,1028217,1028325,1028372,1028415,1028819,1028895,1029220,1029986,1030573,1030575,951844,968697,969755,982783,998106 CVE References: CVE-2016-10200,CVE-2016-2117,CVE-2016-9191,CVE-2017-2596,CVE-2017-2636,CVE-2017-6214,CVE-2017-6345,CVE-2017-6346,CVE-2017-6347,CVE-2017-6353,CVE-2017-7184 Sources used: openSUSE Leap 42.2 (src): kernel-debug-4.4.57-18.3.1, kernel-default-4.4.57-18.3.1, kernel-docs-4.4.57-18.3.2, kernel-obs-build-4.4.57-18.3.1, kernel-obs-qa-4.4.57-18.3.1, kernel-source-4.4.57-18.3.1, kernel-syms-4.4.57-18.3.1, kernel-vanilla-4.4.57-18.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1030118] Dirty COW fix causes some apps to freeze; patch is available in upstream linux
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1030118 http://bugzilla.suse.com/show_bug.cgi?id=1030118#c26 --- Comment #26 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2017:0906-1: An update that solves 15 vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1019851,1020602,1022785,1023377,1025235,1026722,1026914,1027066,1027178,1027179,1027189,1027190,1027565,1028415,1029986,1030118,1030573,968697 CVE References: CVE-2016-10200,CVE-2016-10208,CVE-2016-2117,CVE-2017-2583,CVE-2017-2584,CVE-2017-2596,CVE-2017-2636,CVE-2017-5669,CVE-2017-6214,CVE-2017-6345,CVE-2017-6346,CVE-2017-6347,CVE-2017-6348,CVE-2017-6353,CVE-2017-7184 Sources used: openSUSE Leap 42.1 (src): kernel-debug-4.1.39-53.1, kernel-default-4.1.39-53.1, kernel-docs-4.1.39-53.2, kernel-ec2-4.1.39-53.1, kernel-obs-build-4.1.39-53.1, kernel-obs-qa-4.1.39-53.1, kernel-pae-4.1.39-53.1, kernel-pv-4.1.39-53.1, kernel-source-4.1.39-53.1, kernel-syms-4.1.39-53.1, kernel-vanilla-4.1.39-53.1, kernel-xen-4.1.39-53.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1030194] CPU fan runs in very high speed blowing cold air after resuming from suspend
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1030194 http://bugzilla.suse.com/show_bug.cgi?id=1030194#c6 H. Zeng <zhx(a)cnzhx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WORKSFORME --- Comment #6 from H. Zeng <zhx(a)cnzhx.net> --- This problem seems disappeared. It may be because of the following change of situation: OS (openSUSE Tumbleweed) updated to snapshot 20170324 [1] or 20170328 [2] (before kernel source 4.10.5). I removed the old snapshots using snapper so quickly that I cannot confirm the reason. [1] https://lists.opensuse.org/opensuse-factory/2017-03/msg00821.html [2] https://lists.opensuse.org/opensuse-factory/2017-03/msg00899.html -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1031328] libkleo fails to build with GCC 7
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1031328 http://bugzilla.suse.com/show_bug.cgi?id=1031328#c1 Luca Beltrame <lbeltrame(a)kde.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Luca Beltrame <lbeltrame(a)kde.org> --- Should be fixed upstream, and we will get it automatically when KDE Applications 17.04 enters TW (the beta release is already under review). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1031883] New: “GLIBCXX_3.4.22” not found
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1031883 Bug ID: 1031883 Summary: “GLIBCXX_3.4.22” not found Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: LibreOffice Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: Markus.Elfring(a)web.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I updated some software packages on my Tumbleweed system again. Now I stumble on an error message like the following. elfring@Sonne:~> /usr/bin/orcus-detect /usr/bin/orcus-detect: /usr/local/lib64/libstdc++.so.6: version `GLIBCXX_3.4.22' not found (required by /usr/lib64/liborcus-0.12.so.0) The package “libstdc++ 6.3.1+r245113-1.1” provides “GLIBCXX_3.4.23” at the moment while the package “liborcus 0.12.1-64.4” requires the previous application binary interface as an indirect dependency for software components of “LibreOffice 5.3.2.1-500.1” from the build specification. https://build.opensuse.org/package/view_file/openSUSE:Factory/libreoffice/l… * Are further extensions needed there? * Can the corresponding ABIs be installed in parallel? -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1031332] lldb3_[89] fails to build with GCC 7
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1031332 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |toddrme2178(a)gmail.com Assignee|bnc-team-screening(a)forge.pr |idonmez(a)suse.com |ovo.novell.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1031326] libidn fails to build with GCC 7
by bugzilla_noreply＠novell.com 01 Apr '17

01 Apr '17

http://bugzilla.suse.com/show_bug.cgi?id=1031326 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|bnc-team-screening(a)forge.pr |tchvatal(a)suse.com |ovo.novell.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0