May 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1132060] VUL-1: CVE-2019-11007: GraphicsMagick,ImageMagick: a heap-based buffer over-read in the ReadMNGImage function of coders/png.c allows attackers to cause a denial of service or information disclosure
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1132060 http://bugzilla.suse.com/show_bug.cgi?id=1132060#c16 --- Comment #16 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2019:1331-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1122033,1130330,1131317,1132054,1132060 CVE References: CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-9956 Sources used: openSUSE Leap 15.0 (src): ImageMagick-7.0.7.34-lp150.2.29.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132054] VUL-0: CVE-2019-11008: GraphicsMagick,ImageMagick: a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c allows remote attackers to cause DOS or other unspecified impact
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1132054 http://bugzilla.suse.com/show_bug.cgi?id=1132054#c17 --- Comment #17 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2019:1331-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1122033,1130330,1131317,1132054,1132060 CVE References: CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-9956 Sources used: openSUSE Leap 15.0 (src): ImageMagick-7.0.7.34-lp150.2.29.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133313] VUL-0: chromium: multiple security fixes in 74.0.3729.108
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133313 http://bugzilla.suse.com/show_bug.cgi?id=1133313#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2019:1325-1: An update that fixes 19 vulnerabilities is now available. Category: security (important) Bug References: 1133313 CVE References: CVE-2019-5805,CVE-2019-5806,CVE-2019-5807,CVE-2019-5808,CVE-2019-5809,CVE-2019-5810,CVE-2019-5811,CVE-2019-5812,CVE-2019-5813,CVE-2019-5814,CVE-2019-5815,CVE-2019-5816,CVE-2019-5817,CVE-2019-5818,CVE-2019-5819,CVE-2019-5820,CVE-2019-5821,CVE-2019-5822,CVE-2019-5823 Sources used: openSUSE Leap 15.0 (src): chromium-74.0.3729.108-lp150.209.2 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133313] VUL-0: chromium: multiple security fixes in 74.0.3729.108
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133313 http://bugzilla.suse.com/show_bug.cgi?id=1133313#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2019:1324-1: An update that fixes 16 vulnerabilities is now available. Category: security (important) Bug References: 1133313 CVE References: CVE-2019-5805,CVE-2019-5806,CVE-2019-5807,CVE-2019-5808,CVE-2019-5809,CVE-2019-5810,CVE-2019-5811,CVE-2019-5813,CVE-2019-5814,CVE-2019-5815,CVE-2019-5818,CVE-2019-5819,CVE-2019-5820,CVE-2019-5821,CVE-2019-5822,CVE-2019-5823 Sources used: openSUSE Leap 42.3 (src): chromium-74.0.3729.108-208.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133181] putty: Xresources support broken, no X11 support
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133181 http://bugzilla.suse.com/show_bug.cgi?id=1133181#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-RU-2019:1328-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1133181 CVE References: Sources used: openSUSE Leap 15.0 (src): putty-0.71-lp150.12.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134128] New: qt3 packman update brakes KDE3 widget style in personal settings
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134128 Bug ID: 1134128 Summary: qt3 packman update brakes KDE3 widget style in personal settings Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: 64bit OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: bismarel(a)hotmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0 Build Identifier: update qt3 version 3.3.8c-lp150.155.7 from packman broke KDE3 widget style in personal settings Only option i could select was cde, motif, ms windows and platinum if i remember wel . And configuration was blanked . KDE3 Konqueror filemanager looks like old windows 98 Went back to 3.3.8c-lp150.151.1 from KDE3 Build. And put a lock . Everything is back to normal now . Reproducible: Always Steps to Reproduce: 1.install qt3-3.3.8c-lp150.151.1 update (from packman ) 2.Brakes KDE3 widget style in personal settings 3.revert back to qt3-3.3.8c-lp150.151.1 (from KDE3 Build ) Actual Results: Only option i can select is cde, motif, ms windows and platinum . And configuration is blanked . KDE3 Konqueror file manager looks like old windows 98 No Plastik style ( Style that i use ) -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1130883] Update Plasma to 5.12.8
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1130883 http://bugzilla.suse.com/show_bug.cgi?id=1130883#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-RU-2019:1323-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1108019,1130883 CVE References: Sources used: openSUSE Backports SLE-15 (src): breeze-5.12.8-bp150.3.3.1, breeze4-style-5.12.8-bp150.3.3.1, discover-5.12.8-bp150.7.1, drkonqi5-5.12.8-bp150.3.3.1, kauth-5.45.0-bp150.11.1, kcm_sddm-5.12.8-bp150.3.3.1, kcoreaddons-5.45.0-bp150.3.8.1, kinfocenter5-5.12.8-bp150.8.1, kscreen5-5.12.8-bp150.7.1, kscreenlocker-5.12.8-bp150.7.1, kwin5-5.12.8-bp150.10.1, libkscreen2-5.12.8-bp150.3.3.1, plasma-nm5-5.12.8-bp150.8.1, plasma-vault-5.12.8-bp150.3.3.1, plasma5-addons-5.12.8-bp150.7.1, plasma5-desktop-5.12.8-bp150.8.1, plasma5-sdk-5.12.8-bp150.3.3.1, plasma5-workspace-5.12.8-bp150.7.1, polkit-kde-agent-5-5.12.8-bp150.3.3.1, systemsettings5-5.12.8-bp150.3.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1108019] networkmanager state not connected
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1108019 http://bugzilla.suse.com/show_bug.cgi?id=1108019#c11 --- Comment #11 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-RU-2019:1323-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1108019,1130883 CVE References: Sources used: openSUSE Backports SLE-15 (src): breeze-5.12.8-bp150.3.3.1, breeze4-style-5.12.8-bp150.3.3.1, discover-5.12.8-bp150.7.1, drkonqi5-5.12.8-bp150.3.3.1, kauth-5.45.0-bp150.11.1, kcm_sddm-5.12.8-bp150.3.3.1, kcoreaddons-5.45.0-bp150.3.8.1, kinfocenter5-5.12.8-bp150.8.1, kscreen5-5.12.8-bp150.7.1, kscreenlocker-5.12.8-bp150.7.1, kwin5-5.12.8-bp150.10.1, libkscreen2-5.12.8-bp150.3.3.1, plasma-nm5-5.12.8-bp150.8.1, plasma-vault-5.12.8-bp150.3.3.1, plasma5-addons-5.12.8-bp150.7.1, plasma5-desktop-5.12.8-bp150.8.1, plasma5-sdk-5.12.8-bp150.3.3.1, plasma5-workspace-5.12.8-bp150.7.1, polkit-kde-agent-5-5.12.8-bp150.3.3.1, systemsettings5-5.12.8-bp150.3.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133876] Processes, starteted by autostart (Xfce , KDE ) are after logout still running
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1133876 http://bugzilla.opensuse.org/show_bug.cgi?id=1133876#c2 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |vinz(a)vinzv.de --- Comment #2 from Takashi Iwai <tiwai(a)suse.com> --- Yes, looks so. I checked Leap 15.1 with the latest XFCE package in OBS X11:xfce, and the problem could be reproduced. Maurizio, could you check TW system whether it shows the same problem? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134079] New: webrtc, cannot create RTCPeerConnection
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134079 Bug ID: 1134079 Summary: webrtc, cannot create RTCPeerConnection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Firefox Assignee: bnc-team-mozilla(a)forge.provo.novell.com Reporter: epistemepromeneur(a)free.fr QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- opensuse 15.0 Firefox 66.0.3 from http://download.opensuse.org/repositories/mozilla/openSUSE_Leap_15.0/ i go to https://appr.tc/ i click on "join" then i got an error message "cannot create RTCPeerConnection" webcam and mic icon are well in the firefox title bar. i send a report upstream. see it: https://bugzilla.mozilla.org/show_bug.cgi?id=1548211 mozilla team says there is no problem with a mozilla build. this is a problem with the opensuse build. i checked there is no problem with a mozilla build by downloading FF 66.0.3 from mozilla site mozilla.org opensuse 15.1 FF 60.0.1 esr no problem -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1133876] Processes, starteted by autostart (Xfce , KDE ) are after logout still running
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1133876 http://bugzilla.opensuse.org/show_bug.cgi?id=1133876#c1 Maurizio Galli <maurizio.galli(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maurizio.galli(a)gmail.com, | |tiwai(a)suse.com Assignee|bnc-team-xfce(a)forge.provo.n |tiwai(a)suse.com |ovell.com | --- Comment #1 from Maurizio Galli <maurizio.galli(a)gmail.com> --- @Takashi: could this be related to boo#1122206? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1130883] Update Plasma to 5.12.8
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1130883 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:10039:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1108019] networkmanager state not connected
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1108019 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:10039:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133696] New: Libre Office has lost the menu under XFCE on Leap 15.1
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1133696 Bug ID: 1133696 Summary: Libre Office has lost the menu under XFCE on Leap 15.1 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: LibreOffice Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: carlos.e.r(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Libre Office has lost the menu under XFCE on Leap 15.1 Beta, making it unusable. I can get it back launching it this way: SAL_USE_VCLPLUGIN=gen soffice but the look and feel is horrible. -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1070872] bcm2835-sdhost Raspberry Pi 3 SD Card errors
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1070872 Remco Beekmans <remcodb(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|remcodb(a)gmail.com | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1006973] terminfo setting 'rxvt-unicode-256color' in /etc/DIR_COLORS is missing
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1006973 http://bugzilla.opensuse.org/show_bug.cgi?id=1006973#c2 Michael Pujos <pujos.michael(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pujos.michael(a)gmail.com --- Comment #2 from Michael Pujos <pujos.michael(a)gmail.com> --- Still a problem as of today and it took me forever to understand why rxvt-unicode-256color would not use color with ls. Please update /etc/DIR_COLORS with more TERM entries, to add more terminals supporting color and especially 256 color, such as rxvt-unicode-256color A good starting point is the list defined at the end of this file: https://raw.github.com/trapd00r/LS_COLORS/master/LS_COLORS -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134110] New: apache-commons-parent pulls in a load of java packages
by bugzilla_noreply＠novell.com 04 May '19

04 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134110 Bug ID: 1134110 Summary: apache-commons-parent pulls in a load of java packages Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Apache Assignee: bnc-team-apache(a)forge.provo.novell.com Reporter: opensuse(a)trummer.xyz QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The latest TW upgrade from 20190428 to 20190430 upgrades the 'apache-commons-parent' package. This new package wants to pull in a whole bunch of java packages - trying to upgrade just 'apache-commons-parent' lists these: ################################ ant aopalliance apache-commons-cli apache-commons-codec apache-commons-collections apache-commons-compress apache-commons-configuration apache-commons-io apache-commons-lang apache-commons-lang3 apache-pdfbox aqute-bndlib atinject avalon-framework avalon-logkit bsf bsh2 cal10n cdi-api cglib felix-utils geronimo-annotation-1_0-api geronimo-jms-1_1-api glassfish-el-api glassfish-servlet-api google-guice guava20 hamcrest-core hawtjni-runtime httpcomponents-client httpcomponents-core icu4j jansi jansi-native java-12-openjdk java-12-openjdk-devel java-12-openjdk-headless javamail jboss-interceptors-1.2-api jcl-over-slf4j jdom jsoup jsr-305 junit log4j maven-antrun-plugin maven-archiver maven-artifact maven-artifact-manager maven-artifact-transfer maven-assembly-plugin maven-common-artifact-filters maven-compiler-plugin maven-dependency-tree maven-doxia-core maven-doxia-logging-api maven-doxia-module-apt maven-doxia-module-fml maven-doxia-module-fo maven-doxia-module-markdown maven-doxia-module-xdoc maven-doxia-module-xhtml maven-doxia-sink-api maven-doxia-sitetools maven-file-management maven-filtering maven-jar-plugin maven-lib maven-model maven-plugin-annotations maven-plugin-build-helper maven-plugin-bundle maven-plugin-registry maven-profile maven-project maven-reporting-api maven-reporting-impl maven-resolver-api maven-resolver-connector-basic maven-resolver-impl maven-resolver-spi maven-resolver-transport-wagon maven-resolver-util maven-shared-incremental maven-shared-io maven-shared-utils maven-surefire maven-surefire-plugin maven-wagon-file maven-wagon-http maven-wagon-http-shared maven-wagon-provider-api objectweb-asm oro osgi-annotation osgi-compendium osgi-core parboiled pegdown plexus-archiver plexus-build-api plexus-cipher plexus-classworlds plexus-compiler plexus-containers-component-annotations plexus-containers-container-default plexus-i18n plexus-interpolation plexus-io plexus-languages plexus-sec-dispatcher plexus-utils plexus-velocity qdox servletapi4 sisu-inject sisu-plexus slf4j velocity werken-xpath xalan-j2 xbean xerces-j2 xml-commons-resolver xmlgraphics-batik xmlgraphics-batik-css xmlgraphics-commons xmlgraphics-fop xmlunit xz-java ################################ which makes 130 new packages in total, which looks like a packaging mistake to me. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1029527] zypper outputs the message: "warning: Unsupported version of key: V3"
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1029527 http://bugzilla.suse.com/show_bug.cgi?id=1029527#c13 --- Comment #13 from Přemysl Vrba <vrbap(a)email.cz> --- Created attachment 804175 --> http://bugzilla.suse.com/attachment.cgi?id=804175&action=edit Zypper log with one V3 error Hi, there is a zypper.log from zypper dup action executed on my computer. I have to apologize, there is no end of this log. It was showed by tail -f in another console, but when i close zypper, zypper.log file wasn't in /var/log directory, but only a compressed copy. But there is no tail in this copy. Only one V3 error is at the very end of this file. And now, everything is away, partition is merged with its mirror. There were three of this error, all of them were identical. Second was for package xkill, third for package desktop-file-utils. (alevt, xmag, xclipboard.... all yast2-abc packages...) Preema -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1125035] [osc build] botches Boolean (rich) Dependencies
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1125035 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |obs:running:10163:moderate -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132060] VUL-1: CVE-2019-11007: GraphicsMagick,ImageMagick: a heap-based buffer over-read in the ReadMNGImage function of coders/png.c allows attackers to cause a denial of service or information disclosure
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1132060 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:10088:moderate |obs:running:10088:moderate |obs:running:10098:moderate |ibs:running:10857:moderate |ibs:running:10857:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132054] VUL-0: CVE-2019-11008: GraphicsMagick,ImageMagick: a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c allows remote attackers to cause DOS or other unspecified impact
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1132054 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:10088:moderate |obs:running:10088:moderate |obs:running:10098:moderate |obs:running:10143:moderate |obs:running:10143:moderate |obs:running:10144:moderate |obs:running:10144:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134040] VUL-1: CVE-2019-11627: gpg-key2ps: Shell injection vulnerability in UIDs rendering
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1134040 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |obs:running:10158:moderate -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1131762] lxc: update to 3.x
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1131762 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|obs:running:10047:important |obs:running:10047:important |obs:running:10104:important | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133597] Alpine fails to create initial encripted paswword store
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133597 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |obs:running:10159:moderate -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1023711] Continuous stable update tracker for openSUSE Leap 42.1
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1023711 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11122:important -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133486] Elan touchpad floods /var/log/messages and /var/log/warn
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133486 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11121:important | |ibs:running:11116:important -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1063638] btrfs balance renders system unresponsive and eventually even kills WiFi when quota is enabled - review I/O scheduling parameters of btrfsmaintenance
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1063638 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11122:important | |ibs:running:11117:important -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1070872] bcm2835-sdhost Raspberry Pi 3 SD Card errors
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1070872 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11121:important | |ibs:running:11122:important | |ibs:running:11117:important | |ibs:running:11116:important -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133135] LTO: java-1_8_0-openjdk build fails
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133135 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11126:important | |ibs:running:11127:important -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1112547] [Build 319.3] [Build 319.3] undefined method modify_masquerade error during the second stage
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1112547 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:8978:moderate |ibs:running:11091:moderate |ibs:running:11091:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1125035] [osc build] botches Boolean (rich) Dependencies
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1125035 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|ibs:running:10860:moderate | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134072] VUL-1: CVE-2019-11638: gnu-recutils: NULL pointer dereference in the function rec_field_name_equal_p
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1134072 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134100] New: [doc] 18.2.1 Creating a Root CA
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134100 Bug ID: 1134100 Summary: [doc] 18.2.1 Creating a Root CA Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Documentation Assignee: fs(a)suse.com Reporter: dvcroft(a)arb.com QA Contact: fs(a)suse.com Found By: --- Blocker: --- 18.2.1 Creating a Root CA https://doc.opensuse.org/documentation/leap/security/html/book.security/cha… The module described does not seem to exist and other pages cite that the module has not been re-written. (https://forums.opensuse.org/showthread.php/531653-YAST-CA-not-available-any…!) Is this documentation in need of correction, or will the release sometime in the future make it helpful? Is there a planned date for having some sort of CA management available? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1125035] [osc build] botches Boolean (rich) Dependencies
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1125035 http://bugzilla.suse.com/show_bug.cgi?id=1125035#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2019:1150-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1125035 CVE References: Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): obs-service-format_spec_file-20190312-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132060] VUL-1: CVE-2019-11007: GraphicsMagick,ImageMagick: a heap-based buffer over-read in the ReadMNGImage function of coders/png.c allows attackers to cause a denial of service or information disclosure
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1132060 http://bugzilla.suse.com/show_bug.cgi?id=1132060#c15 --- Comment #15 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2019:1320-1: An update that solves 13 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1106989,1106996,1107609,1120381,1122033,1124365,1124366,1124368,1128649,1130330,1131317,1132053,1132054,1132060 CVE References: CVE-2018-16412,CVE-2018-16413,CVE-2018-16644,CVE-2018-20467,CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-11009,CVE-2019-7175,CVE-2019-7395,CVE-2019-7397,CVE-2019-7398,CVE-2019-9956 Sources used: openSUSE Leap 42.3 (src): ImageMagick-6.8.8.1-82.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132054] VUL-0: CVE-2019-11008: GraphicsMagick,ImageMagick: a heap-based buffer overflow in the function WriteXWDImage of coders/xwd.c allows remote attackers to cause DOS or other unspecified impact
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1132054 http://bugzilla.suse.com/show_bug.cgi?id=1132054#c16 --- Comment #16 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2019:1320-1: An update that solves 13 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1106989,1106996,1107609,1120381,1122033,1124365,1124366,1124368,1128649,1130330,1131317,1132053,1132054,1132060 CVE References: CVE-2018-16412,CVE-2018-16413,CVE-2018-16644,CVE-2018-20467,CVE-2019-10650,CVE-2019-11007,CVE-2019-11008,CVE-2019-11009,CVE-2019-7175,CVE-2019-7395,CVE-2019-7397,CVE-2019-7398,CVE-2019-9956 Sources used: openSUSE Leap 42.3 (src): ImageMagick-6.8.8.1-82.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1128045] New: please consider dropping CONFIG_DEVKMEM
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1128045 Bug ID: 1128045 Summary: please consider dropping CONFIG_DEVKMEM Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Linux Status: NEW Severity: Enhancement Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: eppers(a)posteo.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- It is cool the kernel is built with STRICT_DEVMEM and IO_STRICT_DEVMEM, but why DEVKMEM? I think this is a surprising choice for a production kernel. Could you please confirm CONFIG_DEVKMEM is still needed for something? If there is no concrete use case, I would suggest to disable it. This also seems to be what the rest of the distro universe is doing. Best regards Ed -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1125768] New: go1.10 not built for armv7, which prevent docker images to be built
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1125768 Bug ID: 1125768 Summary: go1.10 not built for armv7, which prevent docker images to be built Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: armv7 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: guillaume.gardet(a)arm.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- go1.10 (used by go package) is not built for armv7, which leads to go uninstallable for armv7 on Leap 15.1 armv7, and we get the following unresolvable for docker image: "Nothing provides skopeo needed by kiwi-image-docker-requires, nothing provides umoci needed by kiwi-image-docker-requires" SR already available to enable build of go1.10 on %arm: https://build.opensuse.org/request/show/677107 The update must go through SLE. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1121397] GCC 9: go{1.4,1.9,1.10,1.11} build fails
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1121397 http://bugzilla.suse.com/show_bug.cgi?id=1121397#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-SU-2019:1149-1: An update that solves one vulnerability and has two fixes is now available. Category: security (moderate) Bug References: 1121397,1125768,974800 CVE References: CVE-2019-6486 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): go1.10-1.10.8-1.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133579] Package wrong URL prevents successful installation - LEAP 15
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133579 http://bugzilla.suse.com/show_bug.cgi?id=1133579#c4 --- Comment #4 from Tony Su <tonysu(a)su-networking.com> --- This was a default 15.1 install with Online Repositories enabled(of course required) to install the LXQt Desktop -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132651] New: Error: Cannot check free space in basic directory / (device /dev/sda1), cannot start installation.
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1132651 Bug ID: 1132651 Summary: Error: Cannot check free space in basic directory / (device /dev/sda1), cannot start installation. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: per(a)computer.org QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- sda1 has a jfs filesystem. I thought installing on pre-formatted file systems was still supported. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1130131] conflict for providers of libgcc_s1 >= 7.4.0+r266845-lp150.3.3.1 needed by gcc7
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1130131 http://bugzilla.suse.com/show_bug.cgi?id=1130131#c4 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #4 from Marcus Meissner <meissner(a)suse.com> --- I hope this is fixed now again. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1133082] AUDIT-0: fwupd: updating build to 1.2.7 needs new polkit privileges
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1133082 http://bugzilla.suse.com/show_bug.cgi?id=1133082#c14 --- Comment #14 from Maurizio Galli <maurizio.galli(a)gmail.com> --- I updated my build to 1.2.8 here: https://build.opensuse.org/package/show/home:mauriziogalli:branches:Base:Sy… Full build log here: https://build.opensuse.org/build/home:mauriziogalli:branches:Base:System/op… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1132943] Kernel 5.0.8: xhci_hcd and thunderbolt modules are crashing
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1132943 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11121:important | |ibs:running:11116:important -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1108199] [Build 20180910] autoyast profile doesn't validate when cloning system
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

1 0

[Bug 1131442] Backport request: Kernel commit 80690a276f hda/realtek - Add quirk for Tuxedo XC 1509
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.suse.com/show_bug.cgi?id=1131442 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11121:important | |ibs:running:11116:important -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134074] New: VUL-1: CVE-2019-11640: gnu-recutils: heap-based buffer overflow in the function rec_fex_parse_str_simple
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134074 Bug ID: 1134074 Summary: VUL-1: CVE-2019-11640: gnu-recutils: heap-based buffer overflow in the function rec_fex_parse_str_simple Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: --- Blocker: --- CVE-2019-11640: An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in librec.a. References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134073] New: VUL-1: CVE-2019-11639: gnu-recutils: stack-based buffer overflow in the function rec_type_check_enum
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134073 Bug ID: 1134073 Summary: VUL-1: CVE-2019-11639: gnu-recutils: stack-based buffer overflow in the function rec_type_check_enum Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: --- Blocker: --- CVE-2019-11639: An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in librec.a. References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134072] New: VUL-1: CVE-2019-11638: gnu-recutils: NULL pointer dereference in the function rec_field_name_equal_p
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134072 Bug ID: 1134072 Summary: VUL-1: CVE-2019-11638: gnu-recutils: NULL pointer dereference in the function rec_field_name_equal_p Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: --- Blocker: --- CVE-2019-11638: An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c in librec.a, leading to a crash. References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1134071] New: VUL-1: CVE-2019-11637: gnu-recutils: NULL pointer dereference in the function rec_rset_get_props
by bugzilla_noreply＠novell.com 03 May '19

03 May '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1134071 Bug ID: 1134071 Summary: VUL-1: CVE-2019-11637: gnu-recutils: NULL pointer dereference in the function rec_rset_get_props Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/231888/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-11637: An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_rset_get_props at rec-rset.c in librec.a, leading to a crash. References: https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutil… -- You are receiving this mail because: You are on the CC list for the bug.

1 0