September 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1017682] New: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1017682 Bug ID: 1017682 Summary: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE3 Assignee: anixx(a)opensuse.org Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2016/q4/786 =============================================== Hi As reported by "Skylake" in the Debian bugtracker[1], UnRTF is prone to stack-based buffer overflows in various cmd_* functions. I've found a Stack-based buffer overflow in unrtf 0.21.9, which affects three functions including: cmd_expand, cmd_emboss and cmd_engrave. # convert.c static int cmd_expand (Word *w, int align, char has_param, int param) { char str[10]; if (has_param) { sprintf(str, "%d", param/4); // Overflow, 9-digit negative value triggers the bug if (!param) attr_pop(ATTR_EXPAND); else attr_push(ATTR_EXPAND, str); } return FALSE; } Apparently writing a negative integer to the buffer can trigger the overflow (Minus sign needs an extra byte). * How to trigger the bug * $ echo "\expnd-400000000" > poc $ unrtf poc A preliminary patch can be found in the Debian bugtracker, but it is not yet finalized. Could you assign (a?) CVE as needed? Does one CVE suffice here, since same class of issue in various cmd_* functions from one reporter? Whilest, at least in Debian, unrtf is compiled with FORTIFY_SOURCE=2 and the buffer overflows are detected, at least if any exposed application uses unrtf to process untrusted input, this might lead to a denial-of-service. [1] https://bugs.debian.org/849705 Regards, Salvatore =============================================== https://software.opensuse.org/package/unrtf TW: KDE:KDE3: 0.21.5 42.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 42.1: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 13.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 906594] New: Apper showing wrong package description
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=906594 Bug ID: 906594 Summary: Apper showing wrong package description Classification: openSUSE Product: openSUSE Factory Version: NO 13.2 BUGS!! Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE4 Applications Assignee: kde-maintainers(a)suse.de Reporter: erwin.vandevelde(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Apper shows the package's description when clicking on it, but only for the first package you click on this is done correctly. Apper shows the same description again and again for each other package you click on. Versions: apper 0.9.1-2.1 -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1040164] New: Missing link to libpython3.6.so
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1040164 Bug ID: 1040164 Summary: Missing link to libpython3.6.so Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: asn(a)cryptomilk.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When python applications look for the python library I often do it using: python3 Python 3.6.1 (default, Mar 23 2017, 13:04:44) [GCC] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from distutils import sysconfig >>> sysconfig.get_python_lib(standard_lib=True) '/usr/lib/python3.6' >>> sysconfig.get_config_var('LIBPL') '/usr/lib64/python3.6/config-3.6m-x86_64-linux-gnu' >>> For this case there is a symlink in python2: /usr/lib64/python2.7/config/libpython2.7.so -> ../../libpython2.7.so This symlink doesn't exist for python3. ll /usr/lib64/python3.6/config-3.6m-x86_64-linux-gnu total 156 -rw-r--r-- 1 root root 68870 Mar 31 16:02 Makefile -rw-r--r-- 1 root root 15296 Mar 31 16:02 Setup -rw-r--r-- 1 root root 327 Mar 31 16:02 Setup.config -rw-r--r-- 1 root root 41 Mar 31 16:02 Setup.local -rw-r--r-- 1 root root 3302 Mar 31 16:02 config.c -rw-r--r-- 1 root root 1621 Mar 31 16:02 config.c.in -rw-r--r-- 1 root root 7122 Mar 31 16:02 install-sh -rw-r--r-- 1 root root 7521 Mar 31 16:02 makesetup -rw-r--r-- 1 root root 2036 Mar 31 16:02 python-config.py -rw-r--r-- 1 root root 32928 Mar 31 16:02 python.o Please add the symlink to libpypthon3.6.so. Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

2 32

[Bug 1055478] New: python-cryptography fails to build with OpenSSL 1.1
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1055478 Bug ID: 1055478 Summary: python-cryptography fails to build with OpenSSL 1.1 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: jmatejek(a)suse.com Reporter: vcizek(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1042629 Found By: --- Blocker: --- The package fails to build with OpenSSL 1.1. We need to migrate Factory to OpenSSL 1.1 as it will become the default on SLE-15. For more information see the blocker bug. Currently testing in staging project: https://build.opensuse.org/project/show/openSUSE:Factory:Staging:SSL11 Fails with: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… -- You are receiving this mail because: You are on the CC list for the bug.

2 14

[Bug 1042670] New: Python and python3 fail to build with openssl-1.1
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1042670 Bug ID: 1042670 Summary: Python and python3 fail to build with openssl-1.1 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: jmatejek(a)suse.com Reporter: tchvatal(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1042629 Found By: --- Blocker: --- The package fails to build with openssl-1.1. For more information see the blocker bug. Currently tested in Staging:I https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… -- You are receiving this mail because: You are on the CC list for the bug.

2 48

[Bug 942751] New: python3 test / missing __main__ module
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=942751 Bug ID: 942751 Summary: python3 test / missing __main__ module Classification: openSUSE Product: openSUSE Factory Version: 201505* Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: myemailu(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When running python 3 -m test the output is: Traceback (most recent call last): File "/usr/lib64/python3.4/runpy.py", line 170, in _run_module_as_main "__main__", mod_spec) File "/usr/lib64/python3.4/runpy.py", line 85, in _run_code exec(code, run_globals) File "/usr/lib64/python3.4/_import_failed/test.py", line 21, in <module> Please file a bug on the SUSE Bugzilla.""".format(__name__)) ImportError: Module '__main__' is not installed. It is supposed to be part of python3 distribution, but missing from failed import map. Please file a bug on the SUSE Bugzilla. I'm using python3 on Tumbleweed rpm -qi python3 Name : python3 Version : 3.4.3 Release : 4.1 Architecture: x86_64 Install Date: Mi 29 Jul 2015 22:03:48 CEST Group : Development/Languages/Python Size : 2996719 License : Python-2.0 Signature : RSA/SHA256, Di 28 Jul 2015 11:49:27 CEST, Key ID b88b2fd43dbdc284 Source RPM : python3-3.4.3-4.1.src.rpm Build Date : Di 28 Jul 2015 11:49:14 CEST Build Host : build75 Relocations : (not relocatable) Packager : http://bugs.opensuse.org Vendor : openSUSE URL : http://www.python.org/ Summary : Python3 Interpreter -- You are receiving this mail because: You are on the CC list for the bug.

2 26

[Bug 1029902] New: Fatal Python error: failed to get random numbers to initialize Python3
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1029902 Bug ID: 1029902 Summary: Fatal Python error: failed to get random numbers to initialize Python3 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: ohering(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Several packages in packman fail since a few days: [ 53s] + cd Photini-2016.12.0 [ 53s] + python3 setup.py build [ 53s] Fatal Python error: failed to get random numbers to initialize Python It happens to work in 'graphics', but not in Packman. strace shows: 1337 13:17:06.361953 getrandom(0x7f9d23bbd770, 24, 0) = -1 ENOSYS (Function not implemented) 1337 13:17:06.362176 write(2, "Fatal Python error: failed to get random numbers to initialize Python\n", 70) = 70 Leap does this, and succeeds: 1283 13:17:05.902494 open("/dev/urandom", O_RDONLY|O_CLOEXEC) = 3 -- You are receiving this mail because: You are on the CC list for the bug.

2 36

[Bug 997614] New: python's platform.linux_distribution() doesn't understand /etc/os-release
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=997614 Bug ID: 997614 Summary: python's platform.linux_distribution() doesn't understand /etc/os-release Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: tserong(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- > cat /etc/SuSE-release cat: /etc/SuSE-release: No such file or directory > cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20160831" ID=opensuse ID_LIKE="suse" VERSION_ID="20160831" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:tumbleweed:20160831" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" > python -c 'import platform ; print platform.linux_distribution()' ('', '', '') That's odd. Python doesn't know what distro we're running on. But, on an earlier Tumbleweed release: > cat /etc/SuSE-release openSUSE 20160701 (x86_64) VERSION = 20160701 CODENAME = Tumbleweed # /etc/SuSE-release is deprecated and will be removed in the future, use /etc/os-release instead > cat /etc/os-release NAME=openSUSE VERSION="Tumbleweed" VERSION_ID="20160701" PRETTY_NAME="openSUSE Tumbleweed (20160701) (x86_64)" ID=opensuse ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:opensuse:20160701" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" ID_LIKE="suse" > python -c 'import platform ; print platform.linux_distribution()' ('openSUSE ', '20160701', 'x86_64') Turns out the file matching in /usr/lib64/python2.7/platform.py (line 323+) is looking for files named /(\w+)[-_](release|version)/, so it picks up "os-release", and decides _distname is "os", which *isn't* in _supported_dists (_supported_dists includes "SuSE", "debian", "fedora", etc. but no generic "os"). So, as we apparently no longer ship SuSE-release, and there's no other release-like files to parse, and we end up with platform.linux_distribution() having no idea what's going on. -- You are receiving this mail because: You are on the CC list for the bug.

2 34

[Bug 917759] New: osc fails with a python exception
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=917759 Bug ID: 917759 Summary: osc fails with a python exception Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: BuildService Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: lmb(a)suse.com QA Contact: adrian(a)suse.com Found By: --- Blocker: --- This is about the latest osc client on Factory (osc-0.150.1-158.1.noarch) used on the internal build service instance: # iosc rdiff Devel:Storage:1.0 _product SUSE:SLE-12:Update:Products:Cloud5 Traceback (most recent call last): File "/usr/bin/osc", line 26, in <module> r = babysitter.run(osccli) File "/usr/lib/python2.7/site-packages/osc/babysitter.py", line 61, in run return prg.main(argv) File "/usr/lib/python2.7/site-packages/osc/cmdln.py", line 343, in main return self.cmd(args) File "/usr/lib/python2.7/site-packages/osc/cmdln.py", line 366, in cmd retval = self.onecmd(argv) File "/usr/lib/python2.7/site-packages/osc/cmdln.py", line 500, in onecmd return self._dispatch_cmd(handler, argv) File "/usr/lib/python2.7/site-packages/osc/cmdln.py", line 1230, in _dispatch_cmd return handler(argv[0], opts, *args) File "/usr/lib/python2.7/site-packages/osc/commandline.py", line 3593, in do_rdiff expand=not opts.unexpand) File "/usr/lib/python2.7/site-packages/osc/core.py", line 4488, in server_diff_noex unified, missingok, meta, expand) File "/usr/lib/python2.7/site-packages/osc/core.py", line 4477, in server_diff f = http_POST(u) File "/usr/lib/python2.7/site-packages/osc/core.py", line 3201, in http_POST def http_POST(*args, **kwargs): return http_request('POST', *args, **kwargs) File "/usr/lib/python2.7/site-packages/osc/core.py", line 3144, in http_request install_opener(conf._build_opener(url)) File "/usr/lib/python2.7/site-packages/osc/conf.py", line 507, in _build_opener from . import oscssl File "/usr/lib/python2.7/site-packages/osc/oscssl.py", line 8, in <module> import M2Crypto.httpslib File "/usr/lib64/python2.7/site-packages/M2Crypto/__init__.py", line 24, in <module> import ASN1 File "/usr/lib64/python2.7/site-packages/M2Crypto/ASN1.py", line 12, in <module> import BIO File "/usr/lib64/python2.7/site-packages/M2Crypto/BIO.py", line 221, in <module> class CipherStream(BIO): File "/usr/lib64/python2.7/site-packages/M2Crypto/BIO.py", line 227, in CipherStream SALT_LEN = m2.PKCS5_SALT_LEN AttributeError: 'module' object has no attribute 'PKCS5_SALT_LEN' Most invocations fail like that for me, including "osc up", submitreq, etc, making it completely unusable for me. -- You are receiving this mail because: You are on the CC list for the bug.

2 21

[Bug 1057496] New: devel:languages:python/python-six: egg-info can't be unpacked, cpio rename
by bugzilla_noreply＠novell.com 16 Feb '22

16 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1057496 Bug ID: 1057496 Summary: devel:languages:python/python-six: egg-info can't be unpacked, cpio rename Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: All OS: openSUSE Factory Status: NEW Severity: Critical Priority: P5 - None Component: 3rd party software Assignee: jmatejek(a)suse.com Reporter: i(a)marguerite.su QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- happened on latest TW, message: Installation of python2-six-1.10.0-4.2.noarch failed: Error: Subprocess failed. Error: RPM failed: error: unpacking of archive failed on file /usr/lib/python2.7/site-packages/six-1.10.0-py2.7.egg-info: cpio rename error: python2-six-1.10.0-4.2.noarch: install failed This same message occurs at installing python2-six and python2-PyYAML, so it's a common issue. This issue will cause those packages not installed onto the system. As python2-six is a system essential package, please take a look and fix ASAP. A little hint: I upgraded several tumbleweed on different servers. And I remembered I saw messages complain that egg-info is a directory. Marguerite -- You are receiving this mail because: You are on the CC list for the bug.

2 3