May 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 901968] VUL-0: CVE-2014-3566: serf: libserf: supports insecure SSL protocol versions
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

1 0

[Bug 902476] tor: disable SSL3 (POODLE)
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

1 0

[Bug 894370] VUL-0: MozillaFirefox 32/31.1 security release
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

1 0

[Bug 848783] New: glibc / known bug: "options rotate" in /etc/resolv.conf causes DNS name reolution FAIL with IPv6 resolver addresses; patch available
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

https://bugzilla.novell.com/show_bug.cgi?id=848783 https://bugzilla.novell.com/show_bug.cgi?id=848783#c0 Summary: glibc / known bug: "options rotate" in /etc/resolv.conf causes DNS name reolution FAIL with IPv6 resolver addresses; patch available Classification: openSUSE Product: openSUSE 12.3 Version: Final Platform: All OS/Version: openSUSE 12.3 Status: NEW Severity: Major Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: darx+opensuse(a)sent.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:25.0) Gecko/20100101 Firefox/25.0 on uname -a Linux darxdev.int 3.7.10-1.16-xen #1 SMP Fri May 31 20:21:23 UTC 2013 (97c14ba) x86_64 x86_64 x86_64 GNU/Linux with rpm -qa | grep -i glibc | sort glibc-2.17-4.7.1.x86_64 glibc-32bit-2.17-4.7.1.x86_64 glibc-debuginfo-2.17-4.7.1.x86_64 glibc-devel-2.17-4.7.1.x86_64 glibc-devel-static-2.17-4.7.1.x86_64 glibc-extra-2.17-4.7.1.x86_64 glibc-i18ndata-2.17-4.7.1.noarch glibc-info-2.17-4.7.1.noarch glibc-locale-2.17-4.7.1.x86_64 glibc-utils-2.17-4.7.1.x86_64 linux-glibc-devel-3.7.1-2.1.3.noarch with either IPv4 resolvers cat /etc/resolv.conf nameserver 8.8.8.8 nameserver 8.8.4.4 or IPv6 resolvers cat /etc/resolv.conf nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844 'svn co' works as expected; in both cases: S="www.nlnetlabs.nl" T="svn/nsd/tags/NSD_4_0_0_REL/tpkg/manual" svn co http://$S/$T test ... Checked out revision 4089. next, adding "options rotate" to resolv.conf, with IPv4 rolvers, cat /etc/resolv.conf nameserver 8.8.8.8 nameserver 8.8.4.4 options rotate 'svn co' still works, svn co http://$S/$T test ... Checked out revision 4089. but with IPv6, FAILS cat /etc/resolv.conf nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844 options rotate svn co http://$S/$T test ... svn: E670002: Unable to connect to a repository at URL 'http://www.nlnetlabs.nl/svn/nsd/tags/NSD_4_0_0_REL/tpkg/manual' svn: E670002: Name or service not known note, using numeric IP for SVN still works, svn co http://[2001:7b8:206:1::1]/$T test ... Checked out revision 4089. this appears to be due to a glibc bug, https://bugzilla.redhat.com/show_bug.cgi?id=841787 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627531 https://bugzilla.redhat.com/show_bug.cgi?id=804630 https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/915272 1st link has a patch, but for an different version of glibc, and on redhat Reproducible: Always Steps to Reproduce: 1. 2. 3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 30

[Bug 864716] New: AUDIT-0: libKF5Auth4.x86_64: W: suse-dbus-unauthorized-service /etc/dbus-1/system.d/org.kde.kf5auth.conf
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

https://bugzilla.novell.com/show_bug.cgi?id=864716 https://bugzilla.novell.com/show_bug.cgi?id=864716#c0 Summary: AUDIT-0: libKF5Auth4.x86_64: W: suse-dbus-unauthorized-service /etc/dbus-1/system.d/org.kde.kf5auth.conf Classification: openSUSE Product: openSUSE Factory Version: 13.2 Milestone 0 Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Security AssignedTo: security-team(a)suse.de ReportedBy: hrvoje.senjan(a)gmail.com QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.91 Safari/537.36 SUSE/33.0.1750.91 Source can be found at KDE:Frameworks5/kauth. As with kinit package, code is just ported to Qt5/KF5. org.kde.kf5auth.conf was renamed from org.kde.auth.conf so it can be co-installed with kdelibs4 package(s) Thus - asking for whitelist =) Thanks! Reproducible: Always -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 83

[Bug 785121] network/bind: VUL-0: CVE-2012-5166: bind: Specially crafted RDATA causes bind to stop working
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

http://bugzilla.suse.com/show_bug.cgi?id=785121 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Alias| |CVE-2012-5166 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 802278] New: Update to OpenStack 2012.2.3 (including security fixes)
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

https://bugzilla.novell.com/show_bug.cgi?id=802278 https://bugzilla.novell.com/show_bug.cgi?id=802278#c0 Summary: Update to OpenStack 2012.2.3 (including security fixes) Classification: openSUSE Product: openSUSE 12.3 Version: RC 1 Platform: Other OS/Version: Other Status: NEEDINFO Severity: Normal Priority: P5 - None Component: Other AssignedTo: bnc-team-screening(a)forge.provo.novell.com ReportedBy: vuntz(a)suse.com QAContact: qa-bugs(a)suse.de InfoProvider: maintenance(a)opensuse.org Found By: --- Blocker: --- I'd like to update the following packages in 12.3: openstack-cinder, openstack-dashboard, openstack-glance, openstack-keystone, openstack-nova, openstack-quantum, openstack-swift. This is an update to the 2012.2.3 release which only contains bug fixes, as well as three security fixes (in nova, glance and keystone): https://lists.launchpad.net/openstack/msg20515.html https://lists.launchpad.net/openstack/msg20517.html https://lists.launchpad.net/openstack/msg20689.html (note that the packages have a 2012.2.4+git version; that's because we package from git, which is now tracking 2012.2.4) At the same time, we should update openstack-quickstart (to make it work in 12.3) and python-django_openstack_auth (contains compatibility fixes for 12.3). Here are links to the diffs: https://build.opensuse.org/package/rdiff?opackage=openstack-cinder&oproject… https://build.opensuse.org/package/rdiff?opackage=openstack-dashboard&oproj… https://build.opensuse.org/package/rdiff?opackage=openstack-glance&oproject… https://build.opensuse.org/package/rdiff?opackage=openstack-keystone&oproje… https://build.opensuse.org/package/rdiff?opackage=openstack-nova&oproject=o… https://build.opensuse.org/package/rdiff?opackage=openstack-quantum&oprojec… https://build.opensuse.org/package/rdiff?opackage=openstack-swift&oproject=… https://build.opensuse.org/package/rdiff?opackage=openstack-quickstart&opro… https://build.opensuse.org/package/rdiff?opackage=python-django_openstack_a… -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 17

[Bug 785121] New: network/bind: VUL-0: CVE-2012-5166: bind: Specially crafted RDATA causes bind to stop working
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

https://bugzilla.novell.com/show_bug.cgi?id=785121 https://bugzilla.novell.com/show_bug.cgi?id=785121#c0 Summary: network/bind: VUL-0: CVE-2012-5166: bind: Specially crafted RDATA causes bind to stop working Classification: openSUSE Product: openSUSE.org Version: unspecified Platform: Other URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012 -5166 OS/Version: Other Status: NEW Keywords: security_vulnerability Severity: Critical Priority: P5 - None Component: 3rd party software AssignedTo: ug(a)suse.com ReportedBy: bernhard.schmidt(a)lrz-muenchen.de QAContact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- A nameserver can be locked up if it can be induced to load a specially crafted combination of resource records. CVE: CVE-2012-5166 Document Version: 2.0 Posting date: 9 October 2012 Program Impacted: BIND Versions affected: 9.2.x -> 9.6.x, 9.4-ESV->9.4-ESV-R5-P1, 9.6-ESV->9.6-ESV-R7-P3, 9.7.0->9.7.6-P3, 9.8.0->9.8.3-P3, 9.9.0->9.9.1-P3 Severity: Critical Exploitable: Remotely Please update to 9.9.1-P4 There is already #784602 for SuSE shipped packages (also not yet fixed) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 4

[Bug 757783] New: clone() with CLONE_NEWPID leaks kernel memory
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

https://bugzilla.novell.com/show_bug.cgi?id=757783 https://bugzilla.novell.com/show_bug.cgi?id=757783#c0 Summary: clone() with CLONE_NEWPID leaks kernel memory Classification: openSUSE Product: openSUSE 12.1 Version: Final Platform: x86-64 OS/Version: openSUSE 12.1 Status: NEW Severity: Critical Priority: P5 - None Component: Kernel AssignedTo: kernel-maintainers(a)forge.provo.novell.com ReportedBy: ccrssaa(a)karelia.ru QAContact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:11.0) Gecko/20120312 Firefox/11.0 SeaMonkey/2.8 Server with vsftpd running started to die in agony with kswapd eating 100% cpu after upgrading to openSUSE 12.1. Turned out that vsftpd isolates each process using CLONE_NEWPID and 3.1.9-1.4 kernel does not free pid_namespace slabs. Reproducible: Always Steps to Reproduce: 1. test.c: #include <stdio.h> #include <errno.h> #include <signal.h> #include <sched.h> #include <linux/sched.h> #include <unistd.h> #include <sys/syscall.h> int main(int argc, char *argv[]) { int i, ret; for (i = 0; i < 10000; i++) { if (0 == (ret = syscall(__NR_clone, CLONE_NEWPID | CLONE_NEWIPC | CLONE_NEWNET | SIGCHLD, NULL))) return 0; if (-1 == ret) { perror("clone"); break; } } return 0; } simulates vsftpd sysdeputil.c 2. gcc -Wall test.c 3. run ./a.out as root Actual Results: # cat /proc/slabinfo | grep namespace pid_namespace 0 0 2112 3 2 : tunables 24 12 8 : slabdata 0 0 0 user_namespace 0 0 1072 7 2 : tunables 24 12 8 : slabdata 0 0 0 net_namespace 0 0 2560 3 2 : tunables 24 12 8 : slabdata 0 0 0 # ./a.out # sleep 60 # cat /proc/slabinfo | grep namespace pid_namespace 10000 10002 2112 3 2 : tunables 24 12 8 : slabdata 3334 3334 0 user_namespace 0 0 1072 7 2 : tunables 24 12 8 : slabdata 0 0 0 net_namespace 0 0 2560 3 2 : tunables 24 12 8 : slabdata 0 0 0 net_namespace slabs are freed but pid_namespace stays forever. Expected Results: # ./a.out # sleep 60 # cat /proc/slabinfo | grep namespace pid_namespace 0 0 2112 3 2 : tunables 24 12 8 : slabdata 0 0 0 net_namespace 0 0 2944 2 2 : tunables 24 12 8 : slabdata 0 0 0 TWIMC: switched from vsftpd to proftpd as a workaround. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 57

[Bug 715172] New: Review request for connman DBUS and polkit service files
by bugzilla_noreply＠novell.com 01 May '19

01 May '19

https://bugzilla.novell.com/show_bug.cgi?id=715172 https://bugzilla.novell.com/show_bug.cgi?id=715172#c0 Summary: Review request for connman DBUS and polkit service files Classification: openSUSE Product: openSUSE 12.1 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Major Priority: P5 - None Component: Network AssignedTo: security-team(a)suse.de ReportedBy: mvyskocil(a)suse.com QAContact: qa(a)suse.de CC: vbotka(a)suse.com Found By: --- Blocker: --- I would like to push Connection Manager (connman) to openSUSE Factory. It's the alternative of NetworkManager written by Intel for Moblin. It installs two DBUS service files and one for polkit /etc/dbus-1/system.d/connman.conf /etc/dbus-1/system.d/connman-nmcompat.conf /usr/share/polkit-1/actions/net.connman.policy Package is in home:mvyskocil:connman connman https://build.opensuse.org/package/show?package=connman&project=home%3Amvys… -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

1 11