December 2018 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1112421] VUL-0: CVE-2018-3143: mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.suse.com/show_bug.cgi?id=1112421 http://bugzilla.suse.com/show_bug.cgi?id=1112421#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2018:3972-1: An update that solves 10 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1013882,1101676,1101677,1101678,1103342,1112368,1112397,1112417,1112421,1112432,1116686 CVE References: CVE-2016-9843,CVE-2018-3058,CVE-2018-3063,CVE-2018-3064,CVE-2018-3066,CVE-2018-3143,CVE-2018-3156,CVE-2018-3174,CVE-2018-3251,CVE-2018-3282 Sources used: SUSE Linux Enterprise Server 12-LTSS (src): mariadb-10.0.37-20.49.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1112417] VUL-0: CVE-2018-3156: mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.suse.com/show_bug.cgi?id=1112417 http://bugzilla.suse.com/show_bug.cgi?id=1112417#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2018:3972-1: An update that solves 10 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1013882,1101676,1101677,1101678,1103342,1112368,1112397,1112417,1112421,1112432,1116686 CVE References: CVE-2016-9843,CVE-2018-3058,CVE-2018-3063,CVE-2018-3064,CVE-2018-3066,CVE-2018-3143,CVE-2018-3156,CVE-2018-3174,CVE-2018-3251,CVE-2018-3282 Sources used: SUSE Linux Enterprise Server 12-LTSS (src): mariadb-10.0.37-20.49.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1112397] VUL-0: CVE-2018-3251: mysql: InnoDB unspecified vulnerability (CPU Oct 2018)
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.suse.com/show_bug.cgi?id=1112397 http://bugzilla.suse.com/show_bug.cgi?id=1112397#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2018:3972-1: An update that solves 10 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1013882,1101676,1101677,1101678,1103342,1112368,1112397,1112417,1112421,1112432,1116686 CVE References: CVE-2016-9843,CVE-2018-3058,CVE-2018-3063,CVE-2018-3064,CVE-2018-3066,CVE-2018-3143,CVE-2018-3156,CVE-2018-3174,CVE-2018-3251,CVE-2018-3282 Sources used: SUSE Linux Enterprise Server 12-LTSS (src): mariadb-10.0.37-20.49.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1118212] New: Misbehaving SATA device leaks kernel memory pages to unprivileged user
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.novell.com/show_bug.cgi?id=1118212 Bug ID: 1118212 Summary: Misbehaving SATA device leaks kernel memory pages to unprivileged user Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: hnch(a)gmx.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.110 Safari/537.36 Build Identifier: I own a SATA controller that employs an onboard port multiplier. If no SATA devices are attached, instead the port multiplier's config memory is presented as only SATA device. Its capacity is reported erroneously (100MiB) and read accesses beyond its actual size (~80KiB) return random kernel memory pages. Please find attached: - Screenshot showing kernel version and user's group membership. - dmesg output - Partial hex dumps of the device in question (/dev/sdb) for 2 different boots (cold boot and with X running) - different binwalks (with cold boot, X running and warm boot) Reproducible: Always Steps to Reproduce: 1. usermod -a -G disk user 2. hexdump -C /dev/sdX 3. binwalk /dev/sdX Actual Results: Kernel memory is leaked. Expected Results: No read beyond actual capacity, only error messages, or zeroed blocks. SATA controller in question https://twitter.com/hennichodernich/status/1069691086954749953 -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1062816] New: plasma-vault requires fusermount 2.9.7
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1062816 Bug ID: 1062816 Summary: plasma-vault requires fusermount 2.9.7 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: pablofabian.wagnerboian(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Overview: Recent KDE plasma update to 5.11 brings plasma-vault encrypted "containers". When trying to create one you can choose from two encryption systems: cryfs or encfs, both of them requires fusermount version 2.9.7 (opensuse tumbleweed version: 2.9.5). So, you can create the vault. Steps to reproduce: 1) Install plasma-vault plasmoid. 2) Add the desktop plasmoid. 3) Try to create a vault, choose encfs (cryfs isn't available in opensuse). 4) Check the requirements below: you will see "Incorrect installed version. Needed version: 2.9.7" (Sorry if it isn't the exact string, I've my laptop language set to Spanish). The "Next" button will be grayed out. Actual results: Can't create a vault because fusermount version doesn't meet the requirements. Needed: 2.9.7, installed: 2.9.5. Expected results: fusermount should meet the requirements (upgrade fuse to 2.9.7?). -- You are receiving this mail because: You are on the CC list for the bug.

1 21

[Bug 1108560] AMDGPU regression, multi-head not working on 4.18, 4.19RC3, but does on 4.16
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.suse.com/show_bug.cgi?id=1108560 http://bugzilla.suse.com/show_bug.cgi?id=1108560#c9 --- Comment #9 from Dave Johnson <dave(a)locochino.com> --- This is fixed for me in the current stable version of 4.19, thank you all -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1118375] New: Please include proper dependencies in ntpd.service against time-sync.target
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1118375 Bug ID: 1118375 Summary: Please include proper dependencies in ntpd.service against time-sync.target Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi, It would be great if ntpd.service would stop relying on /etc/insserv.conf (which is obsolete and subject to future removal) and instead would include proper dependencies directly. For this purpose, it would mean adding the 2 following dependencies in the service unit file: [Unit] ... Wants=time-sync.target Before=time-sync.target Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1113907] need whitelist for libcryptsetup2-devel
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1113907 http://bugzilla.opensuse.org/show_bug.cgi?id=1113907#c6 Ludwig Nussel <lnussel(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(lnussel(a)suse.com) | --- Comment #6 from Ludwig Nussel <lnussel(a)suse.com> --- build fixed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1117355] libgcrypt runs selfcheck including hmac based binary verifcation outside fips mode. breaks keepassxc
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.suse.com/show_bug.cgi?id=1117355 Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pmonrealgonzalez(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1052837] Dependency Before=nss-lookup.target dropped
by bugzilla_noreply＠novell.com 04 Dec '18

04 Dec '18

http://bugzilla.suse.com/show_bug.cgi?id=1052837 http://bugzilla.suse.com/show_bug.cgi?id=1052837#c27 Ludwig Nussel <lnussel(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(lnussel(a)suse.com) | --- Comment #27 from Ludwig Nussel <lnussel(a)suse.com> --- Sorry for the late reply. I agree that systemd-insserv-generator should be dropped going forward (SP level update and TW). It seems to be a predecessor of sysv-generator with additional code to actually parse insserv.conf. The latter should be superfluous nowadays. Note some service files need to be fixed. lwresd.service lacks the Before=nss-lookup.target, nfs.service has no relation to remote_fs etc. That was papered over with this generator so far. -- You are receiving this mail because: You are on the CC list for the bug.

1 0