March 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1165420] New: VUL-1: CVE-2020-9546: jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1165420 Bug ID: 1165420 Summary: VUL-1: CVE-2020-9546: jackson-databind: mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfi g (aka shaded hikari-config). Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/254021/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-9546 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config). References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9546 https://github.com/FasterXML/jackson-databind/issues/2631 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546 https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-yo… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1165371] New: installing gimp 2.10
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1165371 Bug ID: 1165371 Summary: installing gimp 2.10 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: 64bit OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: guidocampanella1(a)gmail.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Installing gimp 2.10 it request libmypaint 1.4.so but provided in opensuse 15.1 repos is only 1.5 version -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1154090] gmrun segfaults
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.novell.com/show_bug.cgi?id=1154090 http://bugzilla.novell.com/show_bug.cgi?id=1154090#c1 Dirk Stoecker <opensuse(a)dstoecker.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |UPSTREAM --- Comment #1 from Dirk Stoecker <opensuse(a)dstoecker.de> --- Please report this upstream: https://github.com/rtyler/gmrun -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1143535] VUL-1: CVE-2019-14452: sigil: directory traversal may lead to writing arbitrary files in a ZIP archive entry
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.novell.com/show_bug.cgi?id=1143535 http://bugzilla.novell.com/show_bug.cgi?id=1143535#c2 Dirk Stoecker <opensuse(a)dstoecker.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #2 from Dirk Stoecker <opensuse(a)dstoecker.de> --- Updated to 1.1.0 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1056699] New: SeaMonkey GUI/web page rendering completely broken
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1056699 Bug ID: 1056699 Summary: SeaMonkey GUI/web page rendering completely broken Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: X11 Applications Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: psychonaut(a)nothingisreal.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 739064 --> http://bugzilla.opensuse.org/attachment.cgi?id=739064&action=edit Screenshot showing SeaMonkey shortly after launch Following an update of Tumbleweed yesterday (which included an upgrade of SeaMonkey from 2.46-3.4 to 2.48-1.1), SeaMonkey is no longer usable. When the browser window initially appears, it is completely blank. Widgets (buttons, pull-down menus, the location bar, the progress bar, etc.) do not get drawn until the mouse passes over them or until the entire browser window is manipulated in some way, such as by dragging or lowering. Even then, the widgets tend to flicker or disappear. The rendering of the web page has similar problems -- it doesn't appear at all at first, and when it finally does appear, it is very glitchy. The attached screenshot shows the browser after it has been started and the mouse has been moved over parts of the window. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1161911] zypper in aarch64 reports package not available in repository for Leap 15.2, but it is
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.suse.com/show_bug.cgi?id=1161911 http://bugzilla.suse.com/show_bug.cgi?id=1161911#c10 Michael Andres <ma(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |lnussel(a)suse.com Flags| |needinfo?(lnussel(a)suse.com) --- Comment #10 from Michael Andres <ma(a)suse.com> --- (In reply to Freek de Kruijf from comment #8) > So the real problem is that this autorefesh is set to 0 in the image, which > is correct when 15.2 is released, but when in Alpha or Beta this should be 1. @Ludwig: Not 100% sure which image Freek refers to, but autorefresh should be `on` while the medium is not frozen. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1164737] Radeon R7 Graphics [1002:130f] 15.2 build 581.2 Installer crash with certain combination of integrated graphics and monitor
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.suse.com/show_bug.cgi?id=1164737 http://bugzilla.suse.com/show_bug.cgi?id=1164737#c12 --- Comment #12 from Stefan Dirsch <sndirsch(a)suse.com> --- Hmm. Now I'm completely confused. Hardware information has been from the affected system you initially reported or not? I would have hoped for logs from the installed 15.2 system of build 581.2, since then I would also have seen the kernel information and could have told you if a newer build comes with a newer kernel ... only with an updated kernel it makes sense to test again ... but maybe you no longer have this system avalable. Using supportconfig on a USB stick may work. Not sure I ever have tried this before ... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 972787] [gpg-agent] Rework agent startup for DM sessions.
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.suse.com/show_bug.cgi?id=972787 http://bugzilla.suse.com/show_bug.cgi?id=972787#c21 --- Comment #21 from Dr. Werner Fink <werner(a)suse.com> --- (In reply to Jan Chren from comment #20) > `session-scriptlets.HOWTO` states: > > ``` > Scriptlets should be delivered with packages containing > the services they start. They should not be shipped with > xdm. > ``` > > `rpm -ql xdm` shows: > > ``` > /etc/X11/xdm/scripts/10-gpg-agent > /etc/X11/xdm/scripts/11-ssh-agent > /etc/X11/xdm/scripts/20-dbus > /etc/X11/xdm/scripts/30-console-kit > ``` > > Also, 'gpg-agent' is started by default and there's no documentation on how > to disable it (ie. writing a "master scriptlet", which sets `usegpg` > variable to string `no`). There is a self disabling part in the first few lines /etc/X11/xdm/scripts/10-gpg-agent: ``` # # No gpg-agent if a gpg session is already provided by an other agent. # if test "$usegpg" = yes -a -n "$GNOME_KEYRING_PID" ; then # gnome-keyring provides a gpg agent starting with GNOME 3 if test -d "$GNOME_KEYRING_CONTROL"; then usegpg=no fi fi # # No gpg-agent if a gpg session is already provided by an other agent. # if test "$usegpg" = yes -a -n "$GNOME_KEYRING_PID" ; then case "${WINDOWMANAGER##*/}" in gnome*) # gnome-keyring provides a gpg agent starting with GNOME 3 (the # gnome-version.xml file only exists in GNOME 3) if test -d "$GNOME_KEYRING_CONTROL" -a -f "/usr/share/gnome/gnome-version.xml"; then usegpg=no fi esac fi ``` also you might set in ~/.profile usegpg=no export usegpg -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1164737] Radeon R7 Graphics [1002:130f] 15.2 build 581.2 Installer crash with certain combination of integrated graphics and monitor
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.suse.com/show_bug.cgi?id=1164737 http://bugzilla.suse.com/show_bug.cgi?id=1164737#c11 --- Comment #11 from Walter Zimmer <walter.zimmer(a)dlr.de> --- Sorry for the confusion! The system is indeed 15.1. But that one shows the same symptom (installer crashes, switch afterwards is fine), so I thought the hardware info should still be helpful. So I'll download the 585.1 this evening and try it... Maybe I'll try to copy the supportutils binary on a USB stick and execute on the install system (with startshell=1), since it seems to be a statically linked one. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1160995] New: kscreenlocker_greet dumps core for NIS accounts
by bugzilla_noreply＠novell.com 02 Mar '20

02 Mar '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1160995 Bug ID: 1160995 Summary: kscreenlocker_greet dumps core for NIS accounts Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: All OS: All Status: NEW Severity: Major Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: GCCHelp(a)merckgroup.com QA Contact: qa-bugs(a)suse.de Found By: Customer Blocker: --- Created attachment 827582 --> http://bugzilla.opensuse.org/attachment.cgi?id=827582&action=edit Stack trace of crashed kscreenlocker_greet Screen locker does not work for NIS accounts. If I either manually lock the screen with the KDE controls or simply wait a few minutes until the screen locks itself, it crashes instead. The screen is black with a message telling that the screen locker is no longer working and how to resolve the problem from another console by unlocking it from the command line. I am reproducing the problem with the command /usr/lib64/libexec/kscreenlocker_greet --testing for easier debugging. This results in [...] Segmentation fault (core dumped) It's not related to the NVIDIA driver I am using, because it's exactly the same without, using NOUVEAU instead. Also it does not seem to be a KDE only problem, as I also can reproduce it on other desktops (Gnome, LXDE, XFCE and more). Seems to be related to NIS. It only crashes when logged in with a NIS account. Local accounts don't have this problem. systemd-coredump nicely collects the core dump (can provide this if required) and it also reports the stack trace into SYSLOG (see attachment). Happy to supply more information useful for diagnosis. -- You are receiving this mail because: You are on the CC list for the bug.

1 28