May 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1041443] New: Raspberry Pi 3: zypper unclear conflict resolution problem message
by bugzilla_noreply＠novell.com 10 Aug '22

10 Aug '22

http://bugzilla.suse.com/show_bug.cgi?id=1041443 Bug ID: 1041443 Summary: Raspberry Pi 3: zypper unclear conflict resolution problem message Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)forge.provo.novell.com Reporter: jeroen.forums.opensuse.org(a)pluimers.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 726808 --> http://bugzilla.suse.com/attachment.cgi?id=726808&action=edit part of zypper.solverTestCase files # Steps leading into this 1. Install Tumbleweed on Raspberry Pi 3 from https://web.archive.org/web/20170526140155/http://download.opensuse.org/rep… 2. On 20170525 perform `zypper --versbose refresh --force` and `zypper dist-upgrade` 3. On 20170528 perform `zypper dist-upgrade --no-allow-vendor-change` Expected: succeed Actual: ``` # zypper dist-upgrade --no-allow-vendor-change Loading repository data... Reading installed packages... Computing distribution upgrade... Problem: problem with installed package kernel-default-4.4.68-7.1.aarch64 Solution 1: keep obsolete kernel-default-4.4.68-7.1.aarch64 Choose the above solution using '1' or cancel using 'c' [1/c] (c): ``` Two important points: 1. Basically both the 1 and c will abort the upgrade so there is no way to perform `--no-allow-vendor-change` upgrades any more. 2. The reason for the "problem" is not revealed so it is unclear to get out of 1. Details: https://gist.github.com/jpluimers/a9ed0802d4314ba3bd662663c2b219a9 which has all the zypper.solverTestCase files -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1036969] New: VUL-1: libmad: assertion failure in layer3.c
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036969 Bug ID: 1036969 Summary: VUL-1: libmad: assertion failure in layer3.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723246 --> http://bugzilla.opensuse.org/attachment.cgi?id=723246&action=edit 00213-libmad-heapoverflow-mad_layer_III_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-… ================================================ Description: libmad stays for “M”peg “A”udio “D”ecoder library. The same testcase provided in the article: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) is able to show an assertion failure if libmad was compiled with debug (–enable-debugging). The complete output of the failure: # madplay -v -i -o raw:out $FILE madplay: /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2633: mad_layer_III: Assertion `stream->md_len + md_len - si.main_data_begin <= MAD_BUFFER_MDLEN' failed. Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00213-libmad-heapoverflow-mad_l… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. ================================================ (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1036968] New: VUL-1: libmad: heap-based buffer overflow in mad_layer_III (layer3.c)
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036968 Bug ID: 1036968 Summary: VUL-1: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723245 --> http://bugzilla.opensuse.org/attachment.cgi?id=723245&action=edit 00213-libmad-heapoverflow-mad_layer_III_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-i… ====================================================== Description: libmad stays for “M”peg “A”udio “D”ecoder library. There is an heap overflow discovered through madplay. The complete ASan output: # madplay -v -i -o raw:out $FILE ==14773==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e00000fa87 at pc 0x0000004bc8ec bp 0x7ffcda3263d0 sp 0x7ffcda325b80 WRITE of size 2060 at 0x61e00000fa87 thread T0 #0 0x4bc8eb in __asan_memcpy /tmp/portage/sys-devel/llvm-3.9.1-r1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413 #1 0x7f37ddfa397d in mad_layer_III /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2635:2 #2 0x7f37ddf6784d in mad_frame_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/frame.c:453:7 #3 0x7f37ddf8c4e4 in run_sync /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:404:11 #4 0x7f37ddf8ac59 in mad_decoder_run /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:557:12 #5 0x5277a1 in decode /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1862:12 #6 0x5277a1 in play_one /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1951 #7 0x5277a1 in play_all /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2041 #8 0x5215a2 in player_run /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2768:14 #9 0x50c46c in main /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/madplay.c:816:7 #10 0x7f37dce4f78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #11 0x41aa78 in _init (/usr/bin/madplay+0x41aa78) Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00213-libmad-heapoverflow-mad_l… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) ====================================================== (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1036967] New: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c)
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036967 Bug ID: 1036967 Summary: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723244 --> http://bugzilla.opensuse.org/attachment.cgi?id=723244&action=edit 00211-libmad-heapoverflow-mad_bit_skip_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-i… =========================================================== Description: libmad stays for “M”peg “A”udio “D”ecoder library. There is an heap overflow discovered through madplay. The complete ASan output: # madplay -v -i -o raw:out $FILE ==12603==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000c09f at pc 0x7f72d6aa05c0 bp 0x7fff03e32040 sp 0x7fff03e32038 READ of size 1 at 0x61200000c09f thread T0 #0 0x7f72d6aa05bf in mad_bit_skip /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/bit.c:130:21 #1 0x7f72d6b032ad in III_huffdecode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:953:3 #2 0x7f72d6b032ad in III_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2403 #3 0x7f72d6af1a8e in mad_layer_III /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2648:13 #4 0x7f72d6ab584d in mad_frame_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/frame.c:453:7 #5 0x7f72d6ada4e4 in run_sync /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:404:11 #6 0x7f72d6ad8c59 in mad_decoder_run /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:557:12 #7 0x5277a1 in decode /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1862:12 #8 0x5277a1 in play_one /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1951 #9 0x5277a1 in play_all /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2041 #10 0x5215a2 in player_run /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2768:14 #11 0x50c46c in main /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/madplay.c:816:7 #12 0x7f72d599d78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #13 0x41aa78 in _init (/usr/bin/madplay+0x41aa78) Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00211-libmad-heapoverflow-mad_b… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) =========================================================== (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1041090] New: trackerbug: packages do not build reproducibly from unsorted input
by bugzilla_noreply＠novell.com 18 Jul '22

18 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1041090 Bug ID: 1041090 Summary: trackerbug: packages do not build reproducibly from unsorted input Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bwiedemann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Development Blocker: --- See also https://reproducible-builds.org/docs/stable-inputs/ When linking .o files in random filesystem order the linker will vary the ordering of functions and apply varying optimizations resulting in binaries that differ on every build and thus trigger rebuilds of depending packages and are published to mirrors and users when actually nothing really changed. -- You are receiving this mail because: You are on the CC list for the bug.

2 15

[Bug 1036463] New: Please take over /usr/lib/modules-load.d/sg.conf
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1036463 Bug ID: 1036463 Summary: Please take over /usr/lib/modules-load.d/sg.conf Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi kernel maintainers, Currently systemd package ships the following file: $ cat /usr/lib/modules-load.d/sg.conf # load sg module at boot time sg I don't know if it's still needed but if so it doesn't seem appropriate to ship it through systemd since it seems to be a workaround for a missing driver dependency or something similar. Would you take this file over ? Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

2 94

[Bug 1027942] New: virt-manager: Missing upstream bug fixes
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1027942 Bug ID: 1027942 Summary: virt-manager: Missing upstream bug fixes Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Tools Assignee: virt-bugs(a)suse.de Reporter: carnold(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There are upstream patches fixing bugs needed for this version of virt-manager. -- You are receiving this mail because: You are on the CC list for the bug.

2 37

[Bug 1036208] New: GNOME:Factory/libostree: remount service not loaded on install
by bugzilla_noreply＠novell.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036208 Bug ID: 1036208 Summary: GNOME:Factory/libostree: remount service not loaded on install Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: sebix+novell.com(a)sebix.at QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- During my todays zypper dup run, I got this output: ( 72/408) Installing: libostree-2017.3-1.1.x86_64 ......................................................................................................[done] Additional rpm output: Failed to disable unit: No such file or directory Failed to stop ostree-remount.service.service: Unit ostree-remount.service.service not loaded. Is this a bug? The file is there: > find /usr/lib/systemd/ -name "*ostree*" /usr/lib/systemd/system/ostree-prepare-root.service /usr/lib/systemd/system/ostree-remount.service -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1028460] New: grub2 ignores active_devices
by bugzilla_noreply＠novell.com 30 Jun '22

30 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1028460 Bug ID: 1028460 Summary: grub2 ignores active_devices Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: S/390-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: rw(a)suse.de Reporter: bg(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- after doing the latest update, I found that /boot/zipl/active_devices.txt was emptied. Even after copying the old data in there, the newly generated initrd ignores active_devices.txt which results in an unbootable system. -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 925275] New: NVIDIA Driver not installable
by bugzilla_noreply＠novell.com 15 Jun '22

15 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=925275 Bug ID: 925275 Summary: NVIDIA Driver not installable Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: fbernasek(a)netscape.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 629479 --> http://bugzilla.opensuse.org/attachment.cgi?id=629479&action=edit nvidia driver install log install opensuse tumbleweed 20150329 no problems. after reboot i like to install the NVIDIA-346.47 or 349.12 with booth the same problem can't install the driver. now i update with the kernel from the kernel:stable repositories the same problem. 20150328 the same problem -- You are receiving this mail because: You are on the CC list for the bug.

2 3