November 2018 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1114434] VUL-0: CVE-2018-18820: icecast: buffer overflow in url-auth
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1114434 Karol Babioch <kbabioch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-0: CVE-2018-18820: |VUL-0: CVE-2018-18820: |icecast: [buffer overflow |icecast: buffer overflow in |in url-auth] |url-auth -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1114434] VUL-0: CVE-2018-18820: icecast: [buffer overflow in url-auth]
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1114434 Karol Babioch <kbabioch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-1: CVE-2018-18820: |VUL-0: CVE-2018-18820: |icecast: [buffer overflow |icecast: [buffer overflow |in url-auth] |in url-auth] -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1114434] VUL-1: CVE-2018-18820: icecast: [buffer overflow in url-auth]
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1114434 Karol Babioch <kbabioch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-1: CVE-2018-18820: |VUL-1: CVE-2018-18820: |[buffer overflow in |icecast: [buffer overflow |url-auth] |in url-auth] -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1112920] [Build 20181022] openQA test fails in start_install as plasma5-desktop package not built for ppc64 (BE)
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1112920 http://bugzilla.suse.com/show_bug.cgi?id=1112920#c18 Michel Normand <normand(a)linux.vnet.ibm.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(normand(a)linux.vne | |t.ibm.com) | --- Comment #18 from Michel Normand <normand(a)linux.vnet.ibm.com> --- (In reply to Fabian Vogt from comment #16) > Upstream requested a test with Qt 5.12. > > Can you try with binaries from KDE:Qt:5.12 built against ppc64? Does it mean I have to build all 68 packages of this project (1) for ppc64 in OBS (in my own branch) ? and then try to build also in OBS KDE:Frameworks5 the plasma5-desktop using previous created repo ? (1) https://build.opensuse.org/project/show/KDE:Qt:5.12 (2) https://build.opensuse.org/package/show/KDE:Frameworks5/plasma5-desktop -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1114383] chkstat is not always called after Zypper has installed packages
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1114383 http://bugzilla.suse.com/show_bug.cgi?id=1114383#c3 --- Comment #3 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to fvogt(a)suse.com from comment #2) > This is not the case anymore, now kcheckpass is just a normal binary without > any special capabilities. If kcheckpass no longer needs setuid root then we should remove it from the permissions package, too. It's only because the location of kcheckpass changed that 'chkstat' doesn't reapply setuid permissions to it. > Manually adding suid/sgid permissions to a system binary is not something > accounted for in the package and it shouldn't need to be. Otherwise every > package shipping a binary would need to call %set_permissions. Every package shipping a *setuid* binary actually needs to call %set_permissions as is also documented in [1]. [1]: https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#.25set_pe… The question remains why the user can no longer unlock after the `zypper dup` as explained in comment 0 then. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1110412] Color Emoji support is disabled by Noto Emoji (monochrome) and DejaVu fonts
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1110412 http://bugzilla.suse.com/show_bug.cgi?id=1110412#c9 --- Comment #9 from Petr Gajdos <pgajdos(a)suse.com> --- Also note, that there should be a possibility to use fontforge script to remove smiley code points from DejaVu font if really necessary. Not sure about correctness of this solution, though. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1110412] Color Emoji support is disabled by Noto Emoji (monochrome) and DejaVu fonts
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1110412 http://bugzilla.suse.com/show_bug.cgi?id=1110412#c8 --- Comment #8 from Petr Gajdos <pgajdos(a)suse.com> --- Apologize, I just do not understand why a program do not use a font returned by `fc-match emoji`. Removing a font from a preference lists for monospace/sans/sans-serif feels more like a workaround to me, but I am probably missing something. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1112920] [Build 20181022] openQA test fails in start_install as plasma5-desktop package not built for ppc64 (BE)
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1112920 http://bugzilla.suse.com/show_bug.cgi?id=1112920#c17 Dominique Leuenberger <dimstar(a)opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(dimstar@opensuse. | |org) | --- Comment #17 from Dominique Leuenberger <dimstar(a)opensuse.org> --- (In reply to Michel Normand from comment #15) > Dominique, > is there a way to bypass this plasma5-desktop package build failure in OBS > for the creation of the TW ppc64 dvd iso ? > (like reducing the content of the DVD by removing kde related packages) > https://build.opensuse.org/package/live_build_log/openSUSE:Factory:PowerPC/ > 000product:openSUSE-dvd5-dvd-ppc64/images/local > > We do not have openqa snapshots for PowerPC (ppc64, ppc64le) since 20181022 > because of this bug. And anyway openqa ppc64 are already failing for kde > tests > https://openqa.opensuse.org/group_overview/4 not 'easily': the DVD is calculated based on the pattern rest_dvd, which requires the kde pattern. If the DVD is supposed to be changed, we need to adapt the rest_dvd pattern to no longer require KDE, then this would be ok -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1114383] chkstat is not always called after Zypper has installed packages
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1114383 http://bugzilla.suse.com/show_bug.cgi?id=1114383#c2 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fvogt(a)suse.com Assignee|fabian(a)ritter-vogt.de |security-team(a)suse.de --- Comment #2 from Fabian Vogt <fvogt(a)suse.com> --- In KDE4 days, kcheckpass was setuid root as can be seen in /etc/permissions: # needs setuid root when using shadow via NIS: # #66218 /opt/kde3/bin/kcheckpass root:shadow 4755 /usr/lib/kde4/libexec/kcheckpass root:shadow 4755 /usr/lib64/kde4/libexec/kcheckpass root:shadow 4755 This is not the case anymore, now kcheckpass is just a normal binary without any special capabilities. Manually adding suid/sgid permissions to a system binary is not something accounted for in the package and it shouldn't need to be. Otherwise every package shipping a binary would need to call %set_permissions. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1112920] [Build 20181022] openQA test fails in start_install as plasma5-desktop package not built for ppc64 (BE)
by bugzilla_noreply＠novell.com 02 Nov '18

02 Nov '18

http://bugzilla.suse.com/show_bug.cgi?id=1112920 http://bugzilla.suse.com/show_bug.cgi?id=1112920#c16 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(normand(a)linux.vne | |t.ibm.com) --- Comment #16 from Fabian Vogt <fvogt(a)suse.com> --- Upstream requested a test with Qt 5.12. Can you try with binaries from KDE:Qt:5.12 built against ppc64? -- You are receiving this mail because: You are on the CC list for the bug.

1 0