September 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1057146] VUL-0: CVE-2017-14136: opencv: out-of-bounds write error in the function FillColorRow1 in utils.cpp
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1057146 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1054390] New: VUL-0: CVE-2017-12927: cacti: XSS in methodparameter in spikekill.php.
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1054390 Bug ID: 1054390 Summary: VUL-0: CVE-2017-12927: cacti: XSS in methodparameter in spikekill.php. Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: liedke(a)rz.uni-mannheim.de Reporter: astieger(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12927 https://github.com/Cacti/cacti/commit/a032ce0be6a4ea47862c594e40a619ac8de1e… https://github.com/Cacti/cacti/issues/907 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1054742] New: VUL-0: CVE-2017-12978: cacti: lib/html.php in Cacti before 1.1.18 has XSS via the title field of anexternal link added by an authenticated user.
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1054742 Bug ID: 1054742 Summary: VUL-0: CVE-2017-12978: cacti: lib/html.php in Cacti before 1.1.18 has XSS via the title field of anexternal link added by an authenticated user. Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: liedke(a)rz.uni-mannheim.de Reporter: meissner(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Security Response Team Blocker: --- CVE-2017-12978 lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12978 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12978 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1057142] Bootloader module shows error message on RPi1 (armv6l)
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1057142 http://bugzilla.suse.com/show_bug.cgi?id=1057142#c3 --- Comment #3 from Freek de Kruijf <freek(a)opensuse.org> --- (In reply to Freek de Kruijf from comment #2) > This is quite unclear. The section about known issues does not specify how > to set these parameters and mkimage is an unknown command and zypper se > mkimage does not show a package to install. I found the package u-boot-tools which contains this application. Executing the mentioned mkimage comand line on the original boot.script produced a new boot.scr which was different from the original one. Rebooting the system with this new generated boot.scr did not succeed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1055821] [Build 20170824] openQA test fails in yast2_ntpclient - "/usr/sbin/sntp: No such file or directory"
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1055821 http://bugzilla.suse.com/show_bug.cgi?id=1055821#c9 --- Comment #9 from Bernhard Wiedemann <bwiedemann(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1055821) was mentioned in https://build.opensuse.org/request/show/521546 Factory / ntpsec -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1049997] system:install:head/patterns-base: pattern minimal_base not available
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1049997 http://bugzilla.suse.com/show_bug.cgi?id=1049997#c6 --- Comment #6 from Bernhard Wiedemann <bwiedemann(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1049997) was mentioned in https://build.opensuse.org/request/show/521542 Factory / mkosi -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1055821] [Build 20170824] openQA test fails in yast2_ntpclient - "/usr/sbin/sntp: No such file or directory"
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1055821 http://bugzilla.suse.com/show_bug.cgi?id=1055821#c8 Tomáš Chvátal <tchvatal(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CONFIRMED |RESOLVED Resolution|--- |FIXED --- Comment #8 from Tomáš Chvátal <tchvatal(a)suse.com> --- (In reply to Reinhard Max from comment #7) > (In reply to Knut Alejandro Anderssen González from comment #5) > > Reinhard could you take a look, it's currently a regression, It seems that > > we will need to adjust it to use ntpdig instead of sntp. > > Then it will work with ntpsec and break with ntp. > > Do we really need a third ntp implementation on Factory, given that we > already have ntp and chrony? If someone wants to maintain stuff in openSUSE they are free to do so as long as they do not cause an overzealous burden on the others. As the bug is fixed now in my followup ntpsesc submission I don't think we need to care about the bug anymore, it was just overlooked by me I had higher version provides than the old ntp. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017667] building perl-Mail-Sendmail sends mail to root
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1017667 http://bugzilla.suse.com/show_bug.cgi?id=1017667#c2 --- Comment #2 from Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> --- Only Factory affected. Updated to version 0.80, disabled sending test emails when building and dropped the patch that modified the address of the mail server to those of the root user. See sr#521498. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1043785] Machinery not installable (since rubygem-haml has been updated)
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1043785 http://bugzilla.suse.com/show_bug.cgi?id=1043785#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2017:2352-1: An update that has three recommended fixes can now be installed. Category: recommended (low) Bug References: 1043785,1052877,1055250 CVE References: Sources used: SUSE Linux Enterprise Module for Advanced Systems Management 12 (src): machinery-1.23.0-55.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1057142] Bootloader module shows error message on RPi1 (armv6l)
by bugzilla_noreply＠novell.com 05 Sep '17

05 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1057142 http://bugzilla.suse.com/show_bug.cgi?id=1057142#c2 --- Comment #2 from Freek de Kruijf <freek(a)opensuse.org> --- (In reply to Ladislav Slezák from comment #1) > Unfortunately RPi1 is not supported by YaST. YaST supports only aarch64 EFI > based boards. > > On RPi1 you have configure booting manually. You can find some booting hints > at > https://en.opensuse.org/HCL: > Raspberry_Pi#Installing_the_openSUSE_Tumbleweed_image This is quite unclear. The section about known issues does not specify how to set these parameters and mkimage is an unknown command and zypper se mkimage does not show a package to install. -- You are receiving this mail because: You are on the CC list for the bug.

1 0