June 2018 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1036969] New: VUL-1: libmad: assertion failure in layer3.c
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036969 Bug ID: 1036969 Summary: VUL-1: libmad: assertion failure in layer3.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723246 --> http://bugzilla.opensuse.org/attachment.cgi?id=723246&action=edit 00213-libmad-heapoverflow-mad_layer_III_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-assertion-failure-in-layer3-… ================================================ Description: libmad stays for “M”peg “A”udio “D”ecoder library. The same testcase provided in the article: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) is able to show an assertion failure if libmad was compiled with debug (–enable-debugging). The complete output of the failure: # madplay -v -i -o raw:out $FILE madplay: /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2633: mad_layer_III: Assertion `stream->md_len + md_len - si.main_data_begin <= MAD_BUFFER_MDLEN' failed. Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00213-libmad-heapoverflow-mad_l… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. ================================================ (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1036968] New: VUL-1: libmad: heap-based buffer overflow in mad_layer_III (layer3.c)
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036968 Bug ID: 1036968 Summary: VUL-1: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723245 --> http://bugzilla.opensuse.org/attachment.cgi?id=723245&action=edit 00213-libmad-heapoverflow-mad_layer_III_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-i… ====================================================== Description: libmad stays for “M”peg “A”udio “D”ecoder library. There is an heap overflow discovered through madplay. The complete ASan output: # madplay -v -i -o raw:out $FILE ==14773==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61e00000fa87 at pc 0x0000004bc8ec bp 0x7ffcda3263d0 sp 0x7ffcda325b80 WRITE of size 2060 at 0x61e00000fa87 thread T0 #0 0x4bc8eb in __asan_memcpy /tmp/portage/sys-devel/llvm-3.9.1-r1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413 #1 0x7f37ddfa397d in mad_layer_III /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2635:2 #2 0x7f37ddf6784d in mad_frame_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/frame.c:453:7 #3 0x7f37ddf8c4e4 in run_sync /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:404:11 #4 0x7f37ddf8ac59 in mad_decoder_run /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:557:12 #5 0x5277a1 in decode /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1862:12 #6 0x5277a1 in play_one /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1951 #7 0x5277a1 in play_all /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2041 #8 0x5215a2 in player_run /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2768:14 #9 0x50c46c in main /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/madplay.c:816:7 #10 0x7f37dce4f78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #11 0x41aa78 in _init (/usr/bin/madplay+0x41aa78) Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00213-libmad-heapoverflow-mad_l… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libmad: heap-based buffer overflow in mad_layer_III (layer3.c) ====================================================== (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1036967] New: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c)
by bugzilla_noreply＠novell.com 27 Jul '22

27 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036967 Bug ID: 1036967 Summary: VUL-1: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 723244 --> http://bugzilla.opensuse.org/attachment.cgi?id=723244&action=edit 00211-libmad-heapoverflow-mad_bit_skip_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/30/libmad-heap-based-buffer-overflow-i… =========================================================== Description: libmad stays for “M”peg “A”udio “D”ecoder library. There is an heap overflow discovered through madplay. The complete ASan output: # madplay -v -i -o raw:out $FILE ==12603==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61200000c09f at pc 0x7f72d6aa05c0 bp 0x7fff03e32040 sp 0x7fff03e32038 READ of size 1 at 0x61200000c09f thread T0 #0 0x7f72d6aa05bf in mad_bit_skip /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/bit.c:130:21 #1 0x7f72d6b032ad in III_huffdecode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:953:3 #2 0x7f72d6b032ad in III_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2403 #3 0x7f72d6af1a8e in mad_layer_III /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/layer3.c:2648:13 #4 0x7f72d6ab584d in mad_frame_decode /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/frame.c:453:7 #5 0x7f72d6ada4e4 in run_sync /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:404:11 #6 0x7f72d6ad8c59 in mad_decoder_run /tmp/portage/media-libs/libmad-0.15.1b-r8/work/libmad-0.15.1b/decoder.c:557:12 #7 0x5277a1 in decode /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1862:12 #8 0x5277a1 in play_one /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:1951 #9 0x5277a1 in play_all /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2041 #10 0x5215a2 in player_run /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/player.c:2768:14 #11 0x50c46c in main /tmp/portage/media-sound/madplay-0.15.2b-r1/work/madplay-0.15.2b/madplay.c:816:7 #12 0x7f72d599d78f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #13 0x41aa78 in _init (/usr/bin/madplay+0x41aa78) Affected version: 0.15.1b Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00211-libmad-heapoverflow-mad_b… Timeline: 2017-01-01: bug discovered and reported to upstream 2017-04-30: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libmad: heap-based buffer overflow in mad_bit_skip (bit.c) =========================================================== (open-)SUSE: https://software.opensuse.org/package/libmad 0.15.1b (TW, 42.{1,2}, multimedia:libs repo) -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1084717] New: The Leap 15.0 installation procedure creates a 500 MB EFI partition
by bugzilla_noreply＠novell.com 19 Jul '22

19 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1084717 Bug ID: 1084717 Summary: The Leap 15.0 installation procedure creates a 500 MB EFI partition Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: bugrprt21882(a)online.de QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Executing a default "fresh" Leap 15.0 installation (Build 153) results in a 500 MB EFI partition being created. Attempting to change the EFI partition size to something less than 256 MB results in an error message indicating that, "the partition size is much too small" being raised. -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1041090] New: trackerbug: packages do not build reproducibly from unsorted input
by bugzilla_noreply＠novell.com 18 Jul '22

18 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1041090 Bug ID: 1041090 Summary: trackerbug: packages do not build reproducibly from unsorted input Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE 13.2 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bwiedemann(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: Development Blocker: --- See also https://reproducible-builds.org/docs/stable-inputs/ When linking .o files in random filesystem order the linker will vary the ordering of functions and apply varying optimizations resulting in binaries that differ on every build and thus trigger rebuilds of depending packages and are published to mirrors and users when actually nothing really changed. -- You are receiving this mail because: You are on the CC list for the bug.

2 15

[Bug 1048177] New: hplip device manager (hp-toolbox) stalls trying to start/stop printer
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1048177 Bug ID: 1048177 Summary: hplip device manager (hp-toolbox) stalls trying to start/stop printer Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: Printing Assignee: jsmeix(a)suse.com Reporter: martin.wilck(a)suse.com QA Contact: jsmeix(a)suse.com Found By: --- Blocker: --- hplip-3.17.4-1.1.x86_64 Trying to stop/start printer using hp-toolbox tab "Printer Control", the Qt GUI starts hanging. "cupsd" is seen in top with 75% CPU. strace shows that hp-toolbox is constantly trying to send commands via the cups socket and gets "HTTP/1.1 401 Unauthorized" errors. > 21127 14:56:41.581250 sendto(20, "POST /admin/ HTTP/1.1\r\nAuthorization: Basic cm9vdDo=\r\nContent-Length: 154\r\nContent-Type: application/ipp\r\nHost: localhost:0\r\nUser-Agent: CUPS/2.2.3 (Linux 4.11.8-1-default; x86_64) IPP/2.0\r\nExpect: 100-continue\r\n\r\n", 214, 0, NULL, 0) = 214 > 21127 14:56:41.581272 sendto(20, "\2\0\0\20\0\0\0\1\1G\0\22attributes-charset\0\5utf-8H\0\33attributes-natural-language\0\5en-usE\0\vprinter-uri\0\"ipp://localhost/printers/ENVY_5530B\0\24requesting-user-name\0\4root\3", 154, 0, NULL, 0) = 154 > 21127 14:56:41.581419 recvfrom(20, "HTTP/1.1 401 Unauthorized\r\nConnection: close\r\nContent-Language: en_US\r\nContent-Length: 521\r\nContent-Type: text/html; charset=utf-8\r\nDate: Tue, 11 Jul 2017 12:56:41 GMT\r\nWWW-Authenticate: Basic realm=\"CUPS\", trc=\"y\"\r\nAccept-Encoding: gzip, deflate, identity"..., 2048, 0, NULL, NULL) = 879 > ... > 21127 14:56:41.581972 sendto(20, "POST /admin/ HTTP/1.1\r\nAuthorization: Basic cm9vdDo=\r\nContent-Length: 154\r\nContent-Type: application/ipp\r\nHost: localhost:0\r\nUser-Agent: CUPS/2.2.3 (Linux 4.11.8-1-default; x86_64) IPP/2.0\r\nExpect: 100-continue\r\n\r\n", 214, 0, NULL, 0) = 214 > 21127 14:56:41.581992 sendto(20, "\2\0\0\20\0\0\0\1\1G\0\22attributes-charset\0\5utf-8H\0\33attributes-natural-language\0\5en-usE\0\vprinter-uri\0\"ipp://localhost/printers/ENVY_5530B\0\24requesting-user-name\0\4root\3", 154, 0, NULL, 0) = 154 > 21127 14:56:41.582132 recvfrom(20, "HTTP/1.1 401 Unauthorized\r\nConnection: close\r\nContent-Language: en_US\r\nContent-Length: 521\r\nContent-Type: text/html; charset=utf-8\r\nDate: Tue, 11 Jul 2017 12:56:41 GMT\r\nWWW-Authenticate: Basic realm=\"CUPS\", trc=\"y\"\r\nAccept-Encoding: gzip, deflate, identity"..., 2048, 0, NULL, NULL) = 879 This is a default cups setup, no special permissions configured. cupsd.conf: # All printer operations require a printer operator to authenticate... <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs> AuthType Default Require user @SYSTEM Order deny,allow </Limit> So it's not surprising that the permission isn't granted, but it's wrong to keep trying. -- You are receiving this mail because: You are on the CC list for the bug.

2 9

[Bug 1036463] New: Please take over /usr/lib/modules-load.d/sg.conf
by bugzilla_noreply＠novell.com 14 Jul '22

14 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1036463 Bug ID: 1036463 Summary: Please take over /usr/lib/modules-load.d/sg.conf Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: fbui(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi kernel maintainers, Currently systemd package ships the following file: $ cat /usr/lib/modules-load.d/sg.conf # load sg module at boot time sg I don't know if it's still needed but if so it doesn't seem appropriate to ship it through systemd since it seems to be a workaround for a missing driver dependency or something similar. Would you take this file over ? Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

2 94

[Bug 1068678] New: Package rsyslog requires package system-user-news
by bugzilla_noreply＠novell.com 07 Jul '22

07 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1068678 Bug ID: 1068678 Summary: Package rsyslog requires package system-user-news Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: freek(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When installing rsyslog in Tumbleweed there are warning messages that the user news is not present (chown: invalid user: 'news:news'). Unless rsyslog is changed to not using news, the package should require the package "system-user-news". -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1027942] New: virt-manager: Missing upstream bug fixes
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1027942 Bug ID: 1027942 Summary: virt-manager: Missing upstream bug fixes Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Tools Assignee: virt-bugs(a)suse.de Reporter: carnold(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There are upstream patches fixing bugs needed for this version of virt-manager. -- You are receiving this mail because: You are on the CC list for the bug.

2 37

[Bug 1036208] New: GNOME:Factory/libostree: remount service not loaded on install
by bugzilla_noreply＠novell.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036208 Bug ID: 1036208 Summary: GNOME:Factory/libostree: remount service not loaded on install Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: sebix+novell.com(a)sebix.at QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- During my todays zypper dup run, I got this output: ( 72/408) Installing: libostree-2017.3-1.1.x86_64 ......................................................................................................[done] Additional rpm output: Failed to disable unit: No such file or directory Failed to stop ostree-remount.service.service: Unit ostree-remount.service.service not loaded. Is this a bug? The file is there: > find /usr/lib/systemd/ -name "*ostree*" /usr/lib/systemd/system/ostree-prepare-root.service /usr/lib/systemd/system/ostree-remount.service -- You are receiving this mail because: You are on the CC list for the bug.

2 4