September 2017 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1033296] New: AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1033296 Bug ID: 1033296 Summary: AUDIT-0: kwalletmanager5: new DBus service org.kde.kcontrol.kcmkwallet5 Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: lbeltrame(a)kde.org Found By: --- Blocker: --- It's come to the attention of the security team that the package KDE:Applications/kwalletmanager5 slipped into openSUSE:Factory and openSUSE:Leap 42.{1,2} without going through a proper DBus/polkit review. It is against policy to override the rpmlint messages for DBus/polkit via rpmlintrc. It seems this was already reviewed in bug 849739. The service obviously got renamed from kcmwallet to kcmwallet5. But maybe there's more to it. -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 930392] xf86-video-intel fails to build with GCC5
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

1 0

[Bug 1032717] New: VUL-0: backintime: usage of deprecated unix-process polkit authorization subject opens a race condition during authorization
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1032717 Bug ID: 1032717 Summary: VUL-0: backintime: usage of deprecated unix-process polkit authorization subject opens a race condition during authorization Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: masterpatricko(a)gmail.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: hrvoje.senjan(a)gmail.com, matthias.gerstner(a)suse.com Found By: --- Blocker: --- backintime includes a DBus service helper 'qt/serviceHelper.py'. This helper uses polkit to authorize some of its APIs, they should only be accessible through entering the root password. The helper program uses the deprecated "unix-process" authorization subject for this purpose, however. This polkit authorization method is known to be affected by a "time of check, time of use" race condition: https://www.freedesktop.org/software/polkit/docs/latest/PolkitUnixProcess.h… https://github.com/Kabot/Unix-Privilege-Escalation-Exploits-Pack/blob/maste… To exploit this issue an attacker needs to be able to replace the PID of process that requests an affected polkit privilege by a root owned process, just in time for polkitd to assume that the requesting process was privileged and no further password entry is required. In the worst case this could allow a regular user to add udev rules to the system that run commands in the context of the regular user, once a certain udev event occurs. I don't think it is easily possible to gain root privileges this way. This is because the serviceHelper wraps the udev commands in a sudo call running as the user owning the requesting process. The determination of this identity is done in a different, more secure way. I've proposed a fix to upstream that changes the authorization mechanism to "system-bus-name" which is considered safe and not affected by the described race condition: https://github.com/bit-team/backintime/commit/7f208dc547f569b689c888103e3b5… This issue was discovered by Sebastian Krahmer of the SUSE security team. -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1036659] PackageKit deletes KDE:Extra repo gpg key
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1036659 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|maint:planned:update |maint:planned:update |ibs:running:5383:important |ibs:running:5383:important | |ibs:running:5554:moderate | |ibs:running:5553:moderate -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1056999] VUL-0: CVE-2017-12797: mpg123: Integer overflow in the INT123_parse_new_id3 function
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.suse.com/show_bug.cgi?id=1056999 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1053959] scrolling does not work in firefox 55
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1053959 http://bugzilla.opensuse.org/show_bug.cgi?id=1053959#c11 --- Comment #11 from Yunhe Guo <guoyunhebrave(a)gmail.com> --- About the inactive window scrolling problem, my description to reproduce it: 1. Open Firefox window and another application window with scroll bar, like a PDF reader. 2. When focus on Firefox window, you move mouse on the other application window and scroll mouse wheel, PDF pages was scrolled. 3. When focus on the other window, you move mouse on Firefox window and scroll mouse wheel, Firefox web page won't be scrolled. (But in official Mozilla builds, it should do.) When you use Firefox for a long time, may one or two hours, you will found scroll bar suddenly doesn't work with mouse wheel but still work with touch pad. This is the most annoying issue. I can reproduce this on two different computers, both installed with openSUSE Tumbleweed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1053959] scrolling does not work in firefox 55
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1053959 http://bugzilla.opensuse.org/show_bug.cgi?id=1053959#c10 Yunhe Guo <guoyunhebrave(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |guoyunhebrave(a)gmail.com --- Comment #10 from Yunhe Guo <guoyunhebrave(a)gmail.com> --- I can confirm this on openSUSE Tumbleweed with KDE. Both Firefox 54 and 55 are affected. I have also tested Mozilla's official builds of Firefox 54 and 55. They do not have this problem. So it is probably a packaging issue. Most likely, related to kmozillahelper. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1041278] New: GCC 7: pocl fails to build
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1041278 Bug ID: 1041278 Summary: GCC 7: pocl fails to build Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Blocks: 1030236 Found By: --- Blocker: --- Since the update of gcc to version 7, openSUSE:Factory/pocl fails to build See a complete log file at https://build.opensuse.org/package/live_build_log/openSUSE:Factory/pocl/sta… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1027690] Build cycle: cargo, rust
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.novell.com/show_bug.cgi?id=1027690 http://bugzilla.novell.com/show_bug.cgi?id=1027690#c4 Luke Jones <luke.nukem.jones(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #4 from Luke Jones <luke.nukem.jones(a)gmail.com> --- Build cycle should have been fixed by including prebuilt cargo binaries with the rust compiler build package. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1041272] New: GCC 7: qxmledit fails to build
by bugzilla_noreply＠novell.com 04 Sep '17

04 Sep '17

http://bugzilla.opensuse.org/show_bug.cgi?id=1041272 Bug ID: 1041272 Summary: GCC 7: qxmledit fails to build Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Blocks: 1030236 Found By: --- Blocker: --- Since the update of gcc to version 7, openSUSE:Factory/qxmledit fails to build See a complete log file at https://build.opensuse.org/package/live_build_log/openSUSE:Factory/qxmledit… -- You are receiving this mail because: You are on the CC list for the bug.

1 2