May 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1037255] VUL-1: CVE-2017-8419: lame: denial of service (stack-based buffer overflow or heap-based buffer overflow) via a crafted file
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.suse.com/show_bug.cgi?id=1037255 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1037278] New: Broken translations Kpatience
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1037278 Bug ID: 1037278 Summary: Broken translations Kpatience Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Linux Status: NEW Severity: Minor Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: fbourdonnec(a)chez.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723535 --> http://bugzilla.opensuse.org/attachment.cgi?id=723535&action=edit happy mix of 16.08 17.04 version Hello During April, some translations updates (french i10n) occurred on KDE. The last one (not anymore since two weeks) made a total mess in Kpatience translations (or not). All gone french. How can you do/allow that........................... well... by allowing yast updater to mess with repositories perhaps ? I'm using this repository, priority 99 http://download.opensuse.org/repositories/KDE:/Applications/KDE_Frameworks5… priority 105 http://download.opensuse.org/distribution/leap/42.2/repo/oss/ Forcing libkdegames & libkf5kdegames from 16.08.2 to 17.04.0 breaks kpat : kpat: /usr/lib64/libQt5Core.so.5: version `Qt_5.8' not found (required by /usr/lib64/libKF5KDEGames.so.7) Unfortunatly, adding this repo does not provide libQt5Core Qt_5.8 : http://download.opensuse.org/repositories/KDE:/Qt58/openSUSE_Leap_42.2/src/ And what Yast updater SHOULD probably HAVE NEVER DONE : installing some 17.04 kde parts, like i10n (see attachment) So, trivial error in i10n or package mess ??? -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1021636] firefox-esr 45.6.0 and 45.7.0 fail to show https://www.google.com and other sites
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.suse.com/show_bug.cgi?id=1021636 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:4602:important |ibs:running:4602:important |ibs:running:4603:important |ibs:running:4603:important |ibs:running:4604:important |ibs:running:4604:important | |maint:running:63559:importa | |nt -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1037273] New: VUL-0: CVE-2017-8421: binutils: libbfd: leak vulnerability in objdump via a crafted PE-file
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1037273 Bug ID: 1037273 Summary: VUL-0: CVE-2017-8421: binutils: libbfd: leak vulnerability in objdump via a crafted PE-file Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723532 --> http://bugzilla.opensuse.org/attachment.cgi?id=723532&action=edit CVE-2017-8421_reproducer Ref: https://nvd.nist.gov/vuln/detail/CVE-2017-8421 =================================================== Description The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this. =================================================== Hyperlink [1] https://sourceware.org/bugzilla/show_bug.cgi?id=21440 [2] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=39ff1b79f687b65f… (see https://sourceware.org/bugzilla/show_bug.cgi?id=21440#c2) (open-)SUSE: https://software.opensuse.org/package/binutils 2.28 (TW, official repo) 2.26.1 (42.{1,2}, official repo) -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1037255] VUL-1: CVE-2017-8419: lame: denial of service (stack-based buffer overflow or heap-based buffer overflow) via a crafted file
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.suse.com/show_bug.cgi?id=1037255 Olaf Hering <ohering(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|ohering(a)suse.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1037255] New: VUL-1: CVE-2017-8419: lame: denial of service (stack-based buffer overflow or heap-based buffer overflow) via a crafted file
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1037255 Bug ID: 1037255 Summary: VUL-1: CVE-2017-8419: lame: denial of service (stack-based buffer overflow or heap-based buffer overflow) via a crafted file Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723519 --> http://bugzilla.opensuse.org/attachment.cgi?id=723519&action=edit CVE-2017-8419_reproducer Ref: https://nvd.nist.gov/vuln/detail/CVE-2017-8419 ==================================================== Description LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a denial of service (stack-based buffer overflow or heap-based buffer overflow) or possibly have unspecified other impact via a crafted file, as demonstrated by mishandling of num_channels. ==================================================== Hyperlink [1] https://sourceforge.net/p/lame/bugs/458/ [2] Reproducer: https://sourceforge.net/p/lame/bugs/458/attachment/lame_stack_corruption_po… (open-)SUSE: https://software.opensuse.org/package/lame 3.99.5 (TW, 42.{1,2}, hardware:sdr repo, multimedia:libs repo, and multimedia:musescore2 repo for TW only) -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1037265] New: -+Vivaldi Browser crashes after update, broken
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1037265 Bug ID: 1037265 Summary: -+Vivaldi Browser crashes after update, broken Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce(a)forge.provo.novell.com Reporter: eionmac(a)btinternet.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- After update of Kernel Vivaldi did not work. Removed, re-downloaded (dependences Ok) from Packman repository. No start. Vivaldi removed and redownloaded as RPM from Vivaldi site. When attempted to load, error report that 'RPM broken', much data flashed by eyes. Error reproducable. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1036998] Intel Centrino Advanced-N 6235 detects wifi nets but cannot connect
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1036998 http://bugzilla.opensuse.org/show_bug.cgi?id=1036998#c7 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Kernel |Network Assignee|kernel-maintainers(a)forge.pr |bnc-team-screening(a)forge.pr |ovo.novell.com |ovo.novell.com --- Comment #7 from Takashi Iwai <tiwai(a)suse.com> --- Reassigned to Network, where people have better clue. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1036998] Intel Centrino Advanced-N 6235 detects wifi nets but cannot connect
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1036998 http://bugzilla.opensuse.org/show_bug.cgi?id=1036998#c6 --- Comment #6 from Eli Wapniarski <eliwap(a)gmail.com> --- Created attachment 723526 --> http://bugzilla.opensuse.org/attachment.cgi?id=723526&action=edit Journalclt output when trying to connect to wifi network here is the journalctl output while trying to connect to a wifi network. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1036998] Intel Centrino Advanced-N 6235 detects wifi nets but cannot connect
by bugzilla_noreply＠novell.com 02 May '17

02 May '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1036998 http://bugzilla.opensuse.org/show_bug.cgi?id=1036998#c5 --- Comment #5 from Takashi Iwai <tiwai(a)suse.com> --- Through a quick look, I see no obvious errors, so it's hard to say whether it's a kernel problem. Since the hardware can detect the WiFi, the driver is more-or-less working. How does it fail when you try to connect? Is it via NetworkManager, right? If so, could you give the relevant log? -- You are receiving this mail because: You are on the CC list for the bug.

1 0