June 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1139094] New: VUL-0: CVE-2018-18836: netdata: JSON injection
by bugzilla_noreply＠novell.com 24 Nov '21

24 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1139094 Bug ID: 1139094 Summary: VUL-0: CVE-2018-18836: netdata: JSON injection Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/235364/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2018-18836 An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18836 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18836.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18836 https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec9… https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b1… https://github.com/netdata/netdata/pull/4521 https://www.red4sec.com/cve/netdata_json_injection.txt https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec9… -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 929755] New: shutter is missing perl(Gnome2) in Tumbleweed
by bugzilla_noreply＠novell.com 21 Nov '21

21 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=929755 Bug ID: 929755 Summary: shutter is missing perl(Gnome2) in Tumbleweed Classification: openSUSE Product: openSUSE Factory Version: 201503* Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: f_koch(a)gmx.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36 Build Identifier: flo@linux-mvsa:~> sudo zypper in shutter Loading repository data... Reading installed packages... Resolving package dependencies... Problem: nothing provides perl(Gnome2) needed by shutter-0.93.1-1.1.noarch Solution 1: do not install shutter-0.93.1-1.1.noarch Solution 2: break shutter-0.93.1-1.1.noarch by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/c] (c): Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1139584] New: LLVM8: inconsistent configuration exposed between cmake and llvm-config
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1139584 Bug ID: 1139584 Summary: LLVM8: inconsistent configuration exposed between cmake and llvm-config Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This issue surfaced while I tried upgrading meson to version 0.51.0 - where a new LLVM test suite has been added The test validates that it makes no difference by what means one would interact with llvm, i.e be it by querying llvm-config or using cmake. Sadly, only openSUSE. said test fails with: [ 621s] meson.build:41:4: ERROR: Assert failed: RTTI information for cmake and config tools disagree And indeed, when inspecting the internas, one gets: > llvm-config --has-rtti YES > grep RTTI /usr/lib64/cmake/llvm/LLVMConfig.cmake set(LLVM_ENABLE_RTTI OFF) So in this case it would actually make a difference to the consumer if they were to use cmake or llvm-config to detect what capabilities our LLVM8 provides. Certainly that is not meant to be like this. -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1133254] New: LTO: llvm[67] build fails
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1133254 Bug ID: 1133254 Summary: LTO: llvm[67] build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails due to: clang-6.0: error: linker command failed with exit code 1 (use -v to see invocation) I would expect the package should use a LTO bootstrap configuration. -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1126907] New: LLVM requires patching to prevent a rustc crash when building Firefox
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1126907 Bug ID: 1126907 Summary: LLVM requires patching to prevent a rustc crash when building Firefox Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: jones_ld(a)protonmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- LLVM 7 has a bug in the discriminator code which causes a crash in rustc when building Firefox (and many other projects). The patches required are here, along with the discussion: https://github.com/rust-lang/rust/issues/57762#issuecomment-456155466 -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1120098] New: Clang 7 packaging is inconsistent
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1120098 Bug ID: 1120098 Summary: Clang 7 packaging is inconsistent Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: aaronpuchert(a)alice-dsl.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- In llvm7.spec, the Clang binaries are renamed: # Fix the clang -> clang-X.Y symlink to work with update-alternatives mv %{buildroot}%{_bindir}/clang-%{_sonum} %{buildroot}%{_bindir}/clang ln -s %{_bindir}/clang-%{_relver} %{buildroot}%{_bindir}/clang-%{_minor} but the installed CMake files (in /usr/lib64/cmake/clang/) aren't changed accordingly. This makes it hard to build software that uses libclang. (I came across this when trying to update include-what-you-use.) The issue is easy to reproduce. Just create a folder with a CMakeLists.txt having just this line: find_package(Clang CONFIG REQUIRED) Then run "cmake ." and there will be an error message like CMake Error at /usr/lib64/cmake/clang/ClangTargets.cmake:296 (message): The imported target "clang" references the file "/usr/bin/clang-7" but this file does not exist. Possible reasons include: [...] Indeed, we have * /usr/bin/clang -> /etc/alternatives/clang -> /usr/bin/clang-7.0.0 * /usr/bin/clang-7.0 -> /usr/bin/clang-7.0.0 but no /usr/bin/clang-7. That is a bit unusual. On the other hand for gcc, we have * /usr/bin/gcc -> /usr/bin/gcc-8 -- You are receiving this mail because: You are on the CC list for the bug.

2 9

[Bug 1119092] New: llvm7: libLLVM is ABI incompatible between GCC and CLANG
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1119092 Bug ID: 1119092 Summary: llvm7: libLLVM is ABI incompatible between GCC and CLANG Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: msrb(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There is a clang-specific optimization in llvm::Optional, which makes code compiled with gcc and clang incompatible with each other. We build libLLVM, libclang, etc using clang, but the rest of the distribution is build using gcc. So anything that links against libLLVM, libclang, etc may be broken. Bug that introduced the clang-only optimization: https://bugs.llvm.org/show_bug.cgi?id=35978 Fix (removing the optimization from everywhere): https://reviews.llvm.org/D50710 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1112730] New: llvm opt-viewer can not find style.css
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1112730 Bug ID: 1112730 Summary: llvm opt-viewer can not find style.css Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: msrb(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Using opt-viewer fails with: FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/style.css' The opt-viewer script is installed in /usr/bin and looks for "style.css" in its own directory, but "style.css" is installed in /usr/share/opt-viewer. LLVM by default installs all opt* tools in /usr/share/opt-viewer, but we move them to /usr/bin to follow our packaging rules. The opt-viewer needs to be patched to find the file. -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1106000] New: llvm-config contains gcc-incompatible flags
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1106000 Bug ID: 1106000 Summary: llvm-config contains gcc-incompatible flags Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: msrb(a)suse.com Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- llvm-config --cflags contains "-Werror=unguarded-availability-new" which makes builds with gcc fail: cc1plus: error: -Werror=unguarded-availability-new: no option -Wunguarded-availability-new -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1092697] New: LLVM build fails on armv7l
by bugzilla_noreply＠novell.com 19 Nov '21

19 Nov '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1092697 Bug ID: 1092697 Summary: LLVM build fails on armv7l Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: msrb(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The llvm4/5/6 build fails on armv7l because it is running out of memory. It is happening during linking of stage1, most likely because of the size of debuginfo. Stage1 should not be built with debuginfo (it is only used to compile the next stage), but it got the "-g" parameter accidentally from %optflags. -- You are receiving this mail because: You are on the CC list for the bug.

2 4