June 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1027448] New: Please use key release event for bracket completion plugin
by bugzilla_noreply＠novell.com 15 Dec '21

15 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1027448 Bug ID: 1027448 Summary: Please use key release event for bracket completion plugin Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: bnc-team-gnome(a)forge.provo.novell.com Reporter: hillwoodroc(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 715892 --> http://bugzilla.opensuse.org/attachment.cgi?id=715892&action=edit bracketcompletion: use key release event to work with input method From: bgo#778737 https://bugzilla.gnome.org/show_bug.cgi?id=778737 Some user reported that ibus-libpinyin/ibus-pinyin doesn't work with gedit plugin bracket completion. I tried to modify the gedit plugin code, it seems work now. Please review it, thanks! How to reproduce it: 1. Switch to C/C++ mode, press "(", bracket completion works. 2. Switch input method to "Intelligent Pinyin" or "Pinyin", it doesn't work. -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1098245] New: gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used
by bugzilla_noreply＠novell.com 14 Dec '21

14 Dec '21

http://bugzilla.suse.com/show_bug.cgi?id=1098245 Bug ID: 1098245 Summary: gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: Linux Status: NEW Severity: Minor Priority: P5 - None Component: GNOME Assignee: bnc-team-gnome(a)forge.provo.novell.com Reporter: jmader2(a)gmu.edu QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- starting `gnome-session` there is the console message, gnome-keyring-daemon: insufficient process capabilities, unsecure memory might get used I am currently working around this with, setcap cap_ipc_lock=+ep /usr/bin/gnome-keyring-daemon -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1002875] New: plymouth boot splash not working in tumbleweed
by bugzilla_noreply＠novell.com 12 Dec '21

12 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1002875 Bug ID: 1002875 Summary: plymouth boot splash not working in tumbleweed Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: cristian_anita(a)yahoo.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi All, I recently made a fresh install of Tumbleweed 20160924 and plymouth splash screen does not appear at startup (only blinking cursor between grub2 and sddm) and shutdown (only some message about watchdog). plymouth-0.9.2-2.4 plymouth-branding-openSUSE-13.3-4.3 grub2-2.02~beta3-11.1 Same with latest TW update (20161003) Regards, Cristian ANITA -- You are receiving this mail because: You are on the CC list for the bug.

2 111

[Bug 1137058] New: Desktop item editor adds junk
by bugzilla_noreply＠novell.com 06 Dec '21

06 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1137058 Bug ID: 1137058 Summary: Desktop item editor adds junk Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce(a)forge.provo.novell.com Reporter: mistresssilvara(a)hotmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When using the build-in XFCE editor to create a new .desktop file, after entering data, and leaving the "Comment" field blank, it gets populated with a long garbage string. It turned out it comes from the "" entry in the desktop_translations.mo file. Steps to reproduce: 1. Right-click the XFCE desktop and select "Create new launcher..." 2. Enter the name, "Test", and the command, "true" 3. Click OK 4. Mouse over the new launcher and see its tooltip. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 972787] New: [gpg-agent] Rework agent startup for DM sessions.
by bugzilla_noreply＠novell.com 01 Dec '21

01 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=972787 Bug ID: 972787 Summary: [gpg-agent] Rework agent startup for DM sessions. Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE 42.1 Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: eich(a)suse.com QA Contact: qa-bugs(a)suse.de CC: astieger(a)suse.com, meissner(a)suse.com, premysl.janouch(a)suse.com, werner(a)suse.com, xorg-maintainer-bugs(a)forge.provo.novell.com Found By: Development Blocker: --- The gpg-agent for a user session is started by the script /etc/X11/xdm/sys.xsession. An openSUSE user pointed out to me that the socket handling of the gpg-agent has changed with gpg 2.1 - now neither a env file is written (the option --write-env-file is ignored) nor nor does anything use the env variable GPG_AGENT_INFO. Instead today a standard socket is used in $HOME/.gnupg/S.gpg-agent. Also check: https://gnupg.org/faq/whats-new-in-2.1.html If NFS mounted homes are desired, it can be handled as described in: https://wiki.gnupg.org/NFS This requires reworking of the gpg-agent startup (and possibly also of the ssh-agent) in sys.xsession. Any takers? -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1099755] New: /etc/hosts.allow /etc/hosts.deny not support ssh
by bugzilla_noreply＠novell.com 01 Dec '21

01 Dec '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1099755 Bug ID: 1099755 Summary: /etc/hosts.allow /etc/hosts.deny not support ssh Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Factory Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: simon(a)becherer.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- wrong security feeling, because text of file /etc/hosts.allow is wrong. written is: # /etc/hosts.allow # See 'man tcpd' and 'man 5 hosts_access' for a detailed description # of /etc/hosts.allow and /etc/hosts.deny. # # short overview about daemons and servers that are built with # tcp_wrappers support: #. # package name | daemon path | token # ---------------------------------------------------------------------------- # ssh, openssh | /usr/sbin/sshd | sshd, sshd-fwd-x11, sshd-fwd-<port> # quota | /usr/sbin/rpc.rquotad | rquotad # tftpd | /usr/sbin/in.tftpd | in.tftpd # portmap | /sbin/portmap | portmap at least toke sshd to allow and deny will not work any more on actual systems (tumbleweed). (maybe others tokens also affected) so user (as i) with low background knowlidge will feel secure if they make settings like: sshd : ALL : deny sshd : 127.0.0.1 : allow sshd : 192.168.0.30 : allow but the system ignores this. -> leading text and maybe manpage has to be changed! -> or if this 2 files host.allow / hosts.deny ar complete obsolete, do not install it at all. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1087860] New: wine repeatedly asks to install wine-mono even though the package wine-mono was installed
by bugzilla_noreply＠novell.com 29 Nov '21

29 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1087860 Bug ID: 1087860 Summary: wine repeatedly asks to install wine-mono even though the package wine-mono was installed Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: http://lord.arch/tests/737/modules/wine/steps/26 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: meissner(a)suse.com Reporter: okurz(a)suse.com QA Contact: okurz(a)suse.com Found By: --- Blocker: --- ## Observation After installing packages "wine" and "wine-mono" explicitly on openSUSE Leap build 184.1 and calling wine on even a trivial Windows program a dialog pops up to download and install a "wine-mono" package which should be there already. This can now also be reproduced in an openQA test: scenario opensuse-15.0-DVD-x86_64-wine@64bit in [wine](http://lord.arch.suse.de/tests/737/modules/wine/steps/26) ## Reproducible Every time on a clean installation of wine on openSUSE Leap 15.0 and I think just the same on openSUSE Tumbleweed. Might also be on openSUSE Leap 42.3 but I am not sure about this. ## Expected result There should be no question for wine-mono installation if the system package is alread installed OR a better description of the system package describing what it is actually used for. I think the problem is that even if someone would answer "yes" to the question to install the internal (non-openSUSE) wine-mono package the next time the question pops up again but I'm not 100% sure on this. ## Further details Always latest result in this scenario: [latest](http://lord.arch/tests/latest?arch=x86_64&test=wine&machine=64bit&flavor=DVD&version=15.0&distri=opensuse) -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1095670] New: Problem with suid pgms on Leap-15.0
by bugzilla_noreply＠novell.com 24 Nov '21

24 Nov '21

http://bugzilla.suse.com/show_bug.cgi?id=1095670 Bug ID: 1095670 Summary: Problem with suid pgms on Leap-15.0 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dmarkh(a)cfl.rr.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I am upgrading an older SuSE-13.2 box to Leap. I have done a fresh Leap-15.0 install and ported over the source code that we ran on the 13.2 box. It builds fine but I am having an issue. The program is/has to be an suid pgm. It also uses fork/execvpe/wait to execute some external scripts. And that is where my problem lies. The user is a member of several groups but these group memberships seem to disappear when these external scripts are executed. For instance the user is a member of the cdrom group so he can eject and work with a DVD. I have created a simple example script and source for a pgm that execvpe's that script which shows my problem. test.sh script: #!/bin/sh whoami id test.c pgm source: #define _GNU_SOURCE #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> int main() { char *path = getenv("PATH"); char pathenv[strlen(path) + sizeof("PATH=")]; sprintf(pathenv, "PATH=%s", path); char *envp[] = {pathenv, NULL}; char *tests[] = {"./test.sh", NULL}; execvpe(tests[0], tests, envp); } #cc test.c #/a.out markh uid=5076(markh) gid=100(users) groups=100(users),19(floppy),200(lcrs),484(tape),485(lp),488(disk),489(dialout),490(cdrom) Then as root: #chown root ./a.out #chgrp root ./a.out #chmod +s ./a.out Then as user #./a.out markh uid=5076(markh) gid=100(users) groups=100(users) Once the pgm is owned by root and suid, I lose all my group memberships for some unknown reason. It is not proper to me. This all works fine on 13.2 but does not on Leap 15 or Leap 42.3. Is there some security setting somewhere that broke this? -- You are receiving this mail because: You are on the CC list for the bug.

2 19

[Bug 1139098] New: VUL-0: CVE-2018-18838: netdata: Log Injection
by bugzilla_noreply＠novell.com 24 Nov '21

24 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1139098 Bug ID: 1139098 Summary: VUL-0: CVE-2018-18838: netdata: Log Injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/235366/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-18838 An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18838 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18838.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18838 https://www.red4sec.com/cve/netdata_log_injection.txt https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b1… https://github.com/netdata/netdata/pull/4521 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1139095] New: VUL-0: CVE-2018-18837: netdata: HTTP Header Injection
by bugzilla_noreply＠novell.com 24 Nov '21

24 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1139095 Bug ID: 1139095 Summary: VUL-0: CVE-2018-18837: netdata: HTTP Header Injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/235365/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-18837 An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18837 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18837.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18837 https://www.red4sec.com/cve/netdata_header_injection.txt https://github.com/netdata/netdata/pull/4521 https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b1… https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec9… -- You are receiving this mail because: You are on the CC list for the bug.

2 4