January 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1120646] VUL-1: CVE-2018-20330: libjpeg-turbo: tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.suse.com/show_bug.cgi?id=1120646 http://bugzilla.suse.com/show_bug.cgi?id=1120646#c2 Petr Gajdos <pgajdos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #2 from Petr Gajdos <pgajdos(a)suse.com> --- Thanks for the analysis. TW/libjpeg-turbo submitted into TW. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1114388] yast get error while update time with ntp server like pool.ntp.org
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.suse.com/show_bug.cgi?id=1114388 http://bugzilla.suse.com/show_bug.cgi?id=1114388#c5 Josef Reidinger <jreidinger(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jreidinger(a)suse.com --- Comment #5 from Josef Reidinger <jreidinger(a)suse.com> --- (In reply to David Diaz from comment #4) > Hi Igor. > > Sadly, I could not reproduce the described issue. However, I am not sure to > be doing the right actions. Could you please give us the steps that you are > following? > > Also, could you attach the file generated by the `save_y2logs` command? It > contains other files that bring us more detailed information such as the > versions of packages. > > With the attached log file, what I see suspicious is: > > > 2018-11-06 15:56:25 <1> lnxvrx53(27015) [Ruby] modules/NtpClient.rb:157 Running ont time sync with pool.ntp.org > 2018-11-06 15:56:26 <3> lnxvrx53(27015) [bash] > ShellCommand.cc(shellcommand):78 2018-11-06T11:56:26Z chronyd version 3.4 > starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP -SCFILTER +SIGND +ASYNCDNS > +SECHASH +IPV6 -DEBUG) > > 2018-11-06 15:56:26 <3> lnxvrx53(27015) [bash] ShellCommand.cc(shellcommand):78 2018-11-06T11:56:26Z Fatal error : Another chronyd may already be running (pid=27214), check /var/run/chrony/chronyd.pid > > 2018-11-06 15:56:26 <1> lnxvrx53(27015) [Ruby] modules/NtpClient.rb:168 'one-time chrony for pool.ntp.org' returned {"exit"=>1, "stderr"=>"2018-11-06T11:56:26Z chronyd version 3.4 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP -SCFILTER +SIGND +ASYNCDNS +SECHASH +IPV6 -DEBUG)\n2018-11-06T11:56:26Z Fatal error : Another chronyd may already be running (pid=27214), check /var/run/chrony/chronyd.pid\n", "stdout"=>""} > > Thank you so much for your report and collaboration. well, that log line basically say that chronyd already running. So we cannot do one time sync, as daemon is already running and syncing time. This is different to ntp daemon, which allows such big steps in time. So basically we should not do one time sync if chronyd running. Only possibility is instead call chronyc with burst param, which will send multiple request to adapt time more quickly. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1059638] New: backintime: crontab not found
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1059638 Bug ID: 1059638 Summary: backintime: crontab not found Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: c.buhtz(a)posteo.jp QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0 Build Identifier: (I am new to OpenSuse) Using a fresh tumbleweed and installed backintime* version 1.1.20-1.3. Starting backintime on KDE it brings up the first-start-config-dialog. I have to create a "snapshot" (a backup job). I do and click on OK. But then I got the error "no crontab found". And the dialog doesn't close. There is no way to get out of the dialog. It doesn't matter if snapshot-schedule is deactivated or not. I tried "crontab -e" on a terminal. I have no right to do that! Only "sudo crontab -e" is working. What is wrong here? Shouldn't crontab work for normal users, too? Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1059861] New: crontab -e not for users
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1059861 Bug ID: 1059861 Summary: crontab -e not for users Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: c.buhtz(a)posteo.jp QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I install tumbleweed with KDE and the default settings two times. My problem is reproducable. "crontab -e" is not allowed for normal user, only for root. See the bash user@localhost:~> ls -l /usr/bin/crontab -rwsr-x--- 1 root root 55872 Aug 29 12:00 /usr/bin/crontab user@localhost:~> crontab -e bash: /usr/bin/crontab: Permission denied The report is related to https://bugzilla.opensuse.org/show_bug.cgi?id=1059638 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1011815] [Build 20161121] Console messages writes over any tty selected, e.g. YaST configuration page in terminal
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.suse.com/show_bug.cgi?id=1011815 Tomas Hehejik <thehejik(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugzilla.suse.com/sh | |ow_bug.cgi?id=1119382 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1114388] yast get error while update time with ntp server like pool.ntp.org
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.suse.com/show_bug.cgi?id=1114388 http://bugzilla.suse.com/show_bug.cgi?id=1114388#c4 David Diaz <dgonzalez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dgonzalez(a)suse.com Flags| |needinfo?(virex(a)mail.ru) --- Comment #4 from David Diaz <dgonzalez(a)suse.com> --- Hi Igor. Sadly, I could not reproduce the described issue. However, I am not sure to be doing the right actions. Could you please give us the steps that you are following? Also, could you attach the file generated by the `save_y2logs` command? It contains other files that bring us more detailed information such as the versions of packages. With the attached log file, what I see suspicious is: > 2018-11-06 15:56:25 <1> lnxvrx53(27015) [Ruby] modules/NtpClient.rb:157 Running ont time sync with pool.ntp.org 2018-11-06 15:56:26 <3> lnxvrx53(27015) [bash] ShellCommand.cc(shellcommand):78 2018-11-06T11:56:26Z chronyd version 3.4 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP -SCFILTER +SIGND +ASYNCDNS +SECHASH +IPV6 -DEBUG) > 2018-11-06 15:56:26 <3> lnxvrx53(27015) [bash] ShellCommand.cc(shellcommand):78 2018-11-06T11:56:26Z Fatal error : Another chronyd may already be running (pid=27214), check /var/run/chrony/chronyd.pid > 2018-11-06 15:56:26 <1> lnxvrx53(27015) [Ruby] modules/NtpClient.rb:168 'one-time chrony for pool.ntp.org' returned {"exit"=>1, "stderr"=>"2018-11-06T11:56:26Z chronyd version 3.4 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP -SCFILTER +SIGND +ASYNCDNS +SECHASH +IPV6 -DEBUG)\n2018-11-06T11:56:26Z Fatal error : Another chronyd may already be running (pid=27214), check /var/run/chrony/chronyd.pid\n", "stdout"=>""} Thank you so much for your report and collaboration. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 953130] New: zypper up "checking for file conflicts" takes 3.5 cpu-minutes for 32 packages
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.opensuse.org/show_bug.cgi?id=953130 Bug ID: 953130 Summary: zypper up "checking for file conflicts" takes 3.5 cpu-minutes for 32 packages Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.1 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: koenig(a)linux.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:41.0) Gecko/20100101 Firefox/41.0 Build Identifier: just run "zypper up" again, and for 32 RPMs the Checking for file conflicts: ..................................<48%>===========================================[|] took > 3.5 minutes cpu time (mostly at the 48% 'location'. that sucks! comparing even a huge list of files shouldn't take that long -- maybe do some intelligent sorting/indexing of filename lists ?! this is the update summary from zypper, more details on request: Reading installed packages... The following 13 NEW packages are going to be installed: crash-kmp-default-7.1.3_k4.1.12_1-4.14 crash-kmp-xen-7.1.3_k4.1.12_1-4.14 hdjmod-kmp-xen-1.28_k4.1.12_1-23.17 kernel-default-4.1.12-1.1 kernel-default-devel-4.1.12-1.1 kernel-devel-4.1.12-1.1 kernel-pv-devel-4.1.12-1.1 kernel-source-4.1.12-1.1 kernel-syms-4.1.12-1.1 kernel-xen-4.1.12-1.1 kernel-xen-devel-4.1.12-1.1 lttng-modules-kmp-default-2.7.0_k4.1.12_1-1.6 xen-kmp-default-4.5.1_10_k4.1.12_1-1.4 The following 19 packages are going to be upgraded: crash install-initrd-openSUSE kernel-macros lttng-modules package-translations virtualbox virtualbox-guest-kmp-default virtualbox-guest-tools virtualbox-guest-x11 virtualbox-host-kmp-default virtualbox-qt xen xen-doc-html xen-libs xen-tools yast2-kdump yast2-ntp-client yast2-storage yast2-storage-devel 19 packages to upgrade, 13 new. Overall download size: 251.4 MiB. Already cached: 0 B. After the operation, additional 980.8 MiB will be used. Continue? [y/n/? shows all options] (y): Reproducible: Always Actual Results: takes too much time, too slow Expected Results: should be *much* faster ;-) you ask, I'll provide... -- You are receiving this mail because: You are on the CC list for the bug.

1 35

[Bug 1120395] New: Bootproblems with btrfs!
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1120395 Bug ID: 1120395 Summary: Bootproblems with btrfs! Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: thmkik(a)tutanota.de QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Created attachment 793442 --> http://bugzilla.opensuse.org/attachment.cgi?id=793442&action=edit fdisk I had issus with btrfs which i solved through a fresh installation. It was two month ago, so the problems dissapear untill last week. I installed /root and /home on my old partitions: / 130 gb, /home 331. During the installation the system created form the old /home an extended partition. /home 280, /btrfs 400, swap 7, and a boot partition. Since last week, the system boots only sometimes i think each second try it is booted otherwise it shows starts: A start job is running for uuid. Now i found out, that /sda2 and /sda5 had the same UUID only the subid is different. And the bootmenue, suddenly shows a new entry: Opensuse leap (on /sda2) And the put the two partitions together: for example kde schows vor root 170 gb (130 + 40 ) On yast i found out under the partitioner for btrfs: /sda2 /* /sda5 / Some told me it looks like a raid, but i didnŽt make one. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1120650] New: VirtualBox 6.0.0 and later require changes to permissions
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1120650 Bug ID: 1120650 Summary: VirtualBox 6.0.0 and later require changes to permissions Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: Larry.Finger(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Oracle has changed the permissions required to run VirtualBox v6.0.0 and later. With this version, /usr/lib/virtualbox/VirtualBox no longer needs to be suid; however, a new executable /usr/lib/virtualbox/VirtualBoxVM does need to be suid. Rolling out this change may be difficult in that older versions of VB need the current setup. Is there any way to specify different versions of the permissions package in the build? Please be aware that I plan to wait for VB v6.0.2 before pushing the new version. I would expect that change to happen sometime in the next month. Once the new version is rolled out to TW/Factory, I will then introduce it to Leap 15.0. As is customary, Leap 42.3 will not get this update. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1120652] New: VUL-1: CVE-2018-20348: libpff: denial of service in libpff_item_tree_create_node in libpff_item_tree.c
by bugzilla_noreply＠novell.com 03 Jan '19

03 Jan '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1120652 Bug ID: 1120652 Summary: VUL-1: CVE-2018-20348: libpff: denial of service in libpff_item_tree_create_node in libpff_item_tree.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/221688/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-20348 libpff_item_tree_create_node in libpff_item_tree.c in libpff before experimental-20180714 allows attackers to cause a denial of service (infinite recursion) via a crafted file, related to libfdata_tree_get_node_value in libfdata_tree.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20348 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-20348.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20348 http://www.cvedetails.com/cve/CVE-2018-20348/ https://github.com/libyal/libpff/issues/48 -- You are receiving this mail because: You are on the CC list for the bug.

1 1