July 2018 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1100359] New: VUL-1: CVE-2018-13304: ffmpeg: Improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger anassertion failure
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1100359 Bug ID: 1100359 Summary: VUL-1: CVE-2018-13304: ffmpeg: Improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger anassertion failure Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/209619/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: jsegitz(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-13304 In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studio_profile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to error_resilience.c, h263dec.c, and mpeg4videodec.c. No maintainer, would you please take this one? References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13304 https://github.com/FFmpeg/FFmpeg/commit/bd27a9364ca274ca97f1df6d984e88a0700… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1097626] guile-git: test suite fails on i586
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.suse.com/show_bug.cgi?id=1097626 http://bugzilla.suse.com/show_bug.cgi?id=1097626#c2 Jonathan Brielmaier <jbrielmaier(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #2 from Jonathan Brielmaier <jbrielmaier(a)suse.com> --- Resolved with version 1.0.3 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1100358] New: VUL-1: CVE-2018-13303: ffmpeg: missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function may trigger a NULL pointer dereference
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1100358 Bug ID: 1100358 Summary: VUL-1: CVE-2018-13303: ffmpeg: missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function may trigger a NULL pointer dereference Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/209618/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: jsegitz(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-13303 In FFmpeg 4.0.1, a missing check for failure of a call to init_get_bits8() in the avpriv_ac3_parse_header function in libavcodec/ac3_parser.c may trigger a NULL pointer dereference while converting a crafted AVI file to MPEG4, leading to a denial of service. No maintainer, would you please take this one? References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13303 https://github.com/FFmpeg/FFmpeg/commit/00e8181bd97c834fe60751b0c511d4bb978… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1098630] openvswitch error: session-c1.scope: Failed to add PIDs to scope's control group: No such process
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.suse.com/show_bug.cgi?id=1098630 http://bugzilla.suse.com/show_bug.cgi?id=1098630#c26 --- Comment #26 from Franck Bui <fbui(a)suse.com> --- Looking at the logs, there's an error before the one reported by David: ... Jun 21 07:31:39 virt kernel: Netfilter messages via NETLINK v0.30. Jun 21 07:31:39 virt kernel: ip_set: protocol 6 Jun 21 07:32:03 virt runuser[2667]: pam_systemd(runuser:session): Failed to create session: Connection timed out ... Apparently there's something wrong when pam_systemd try to communicate with logind in order to create the session. logind seems to be stuck and the D-Bus timeout expired. I'll see if I can reproduce the issue. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1098630] openvswitch error: session-c1.scope: Failed to add PIDs to scope's control group: No such process
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.suse.com/show_bug.cgi?id=1098630 http://bugzilla.suse.com/show_bug.cgi?id=1098630#c25 --- Comment #25 from Franck Bui <fbui(a)suse.com> --- That said, systemd isn't supposed to fail starting the systemd user instance even if it's useless. So this need to be investigated. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1098630] openvswitch error: session-c1.scope: Failed to add PIDs to scope's control group: No such process
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.suse.com/show_bug.cgi?id=1098630 Franck Bui <fbui(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(markos.chandras@s | |use.com) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1098630] openvswitch error: session-c1.scope: Failed to add PIDs to scope's control group: No such process
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.suse.com/show_bug.cgi?id=1098630 http://bugzilla.suse.com/show_bug.cgi?id=1098630#c24 --- Comment #24 from Franck Bui <fbui(a)suse.com> --- So Markos, what's the point of creating a user session ? I suspect openvswitch doesn't need to do that and if it's the case, the use of "runuser" is inappropriate according to runuser() man page: If the PAM session is not required then recommended solution is to use setpriv(1) command. But I think using User= should be better. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1017175] New: With Kernel 4.4: crash of sddm and it seems of the X server (repeatable)
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1017175 Bug ID: 1017175 Summary: With Kernel 4.4: crash of sddm and it seems of the X server (repeatable) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: x86-64 OS: openSUSE 42.2 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: stakanov(a)freenet.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Laptop X201 Lenovo (not brandnew hardware). After update to 42.2 - when starting the system sddm shows user selection. 1st selection problem free. When selecting change user: a) if I click explicitly on the "Plus" symbol of sddm then a new sddm window opens and I can select that user. The users starts and I can from there select a third etc. b) if I just click on "change user" without selecting the "plus" explicitly, sddm crashes immediately. And the current user crashes too. It seems the the session is still running but that the desktop is reduced to a 1 mm wide stripe on the left side of the screen, no interaction is possible. A hard reset is necessary as all tty are now black and unresponsive. This is repeatable to 100%. c) if you do as in a) and you have several users open, then following applies: The use of ctrl+alt+F7,8,9 (etc) to select another user will result in immediate crash of sddm and all other open sessions. The rest is like in b). Repeatable to 100% - always. This is clearly kernel dependent: if you use instead the kernel from kernel stable (currently kernel 4.9) then all this does not happen any more. So the kernel 4.4 from the standard 42.2 breaks something on this system. If you are interested to find the reasons and guide me: I have both kernel versions installed and can switch easily. Starting the machine with the 4.4 is giving the results as of above. Repeatable. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1074021] New: flamerobin: error while loading shared libraries: libboost_thread.so.1.64.0: cannot open shared object file: No such file or directory
by bugzilla_noreply＠novell.com 06 Jul '18

06 Jul '18

http://bugzilla.opensuse.org/show_bug.cgi?id=1074021 Bug ID: 1074021 Summary: flamerobin: error while loading shared libraries: libboost_thread.so.1.64.0: cannot open shared object file: No such file or directory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: atom86(a)live.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Just installed Tumbleweed and then used Yast to install the package "Flamerobin". When I run it, I get the following error: flamerobin: error while loading shared libraries: libboost_thread.so.1.64.0: cannot open shared object file: No such file or directory -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1100328] New: need review of new libvirt polkit rules
by bugzilla_noreply＠novell.com 05 Jul '18

05 Jul '18

http://bugzilla.suse.com/show_bug.cgi?id=1100328 Bug ID: 1100328 Summary: need review of new libvirt polkit rules Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jfehlig(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I'm working on updating Factory to libvirt 4.5.0, which contains new nwfilter-related polkit rules. Test builds of libvirt 4.5.0 fail with [ 349s] libvirt-daemon.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.libvirt.api.connect.search-nwfilter-bindings (yes:yes:yes) [ 349s] libvirt-daemon.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.libvirt.api.nwfilter.binding-getattr (yes:yes:yes) [ 349s] libvirt-daemon.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.libvirt.api.nwfilter.binding-read (yes:yes:yes) [ 349s] The package allows unprivileged users to carry out privileged operations [ 349s] without authentication. This could cause security problems if not done [ 349s] carefully. If the package is intended for inclusion in any SUSE product please [ 349s] open a bug report to request review of the package by the security team [ 349s] [ 349s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.libvirt.api.nwfilter.binding-create (no:no:no) [ 349s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.libvirt.api.nwfilter.binding-delete (no:no:no) [ 349s] The privilege is not listed in /etc/polkit-default-privs.* which makes it [ 349s] harder for admins to find. If the package is intended for inclusion in any [ 349s] SUSE product please open a bug report to request review of the package by the [ 349s] security team Beyond opening this bug I'm not sure what is required on my part so please let me know if I have an actionable item :-). Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

1 2