May 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1036979] New: python2-qt4 posttrans fails
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036979 Bug ID: 1036979 Summary: python2-qt4 posttrans fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Output of python2-qt4-4.12-3.1.x86_64.rpm %posttrans script: /var/adm/update-scripts/posttransLsYXyp/python2-qt4-4.12-3.1.x86_64.rpmpbKPGQ: line 6: syntax error: unexpected end of file Warning: python2-qt4-4.12-3.1.x86_64.rpm %posttrans script failed (returned 2) -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1017682] New: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1017682 Bug ID: 1017682 Summary: VUL-0: CVE-2016-10091: UnRTF: stack-based buffer overflows in cmd_* functions Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE3 Assignee: anixx(a)opensuse.org Reporter: mikhail.kasimov(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ref: http://seclists.org/oss-sec/2016/q4/786 =============================================== Hi As reported by "Skylake" in the Debian bugtracker[1], UnRTF is prone to stack-based buffer overflows in various cmd_* functions. I've found a Stack-based buffer overflow in unrtf 0.21.9, which affects three functions including: cmd_expand, cmd_emboss and cmd_engrave. # convert.c static int cmd_expand (Word *w, int align, char has_param, int param) { char str[10]; if (has_param) { sprintf(str, "%d", param/4); // Overflow, 9-digit negative value triggers the bug if (!param) attr_pop(ATTR_EXPAND); else attr_push(ATTR_EXPAND, str); } return FALSE; } Apparently writing a negative integer to the buffer can trigger the overflow (Minus sign needs an extra byte). * How to trigger the bug * $ echo "\expnd-400000000" > poc $ unrtf poc A preliminary patch can be found in the Debian bugtracker, but it is not yet finalized. Could you assign (a?) CVE as needed? Does one CVE suffice here, since same class of issue in various cmd_* functions from one reporter? Whilest, at least in Debian, unrtf is compiled with FORTIFY_SOURCE=2 and the buffer overflows are detected, at least if any exposed application uses unrtf to process untrusted input, this might lead to a denial-of-service. [1] https://bugs.debian.org/849705 Regards, Salvatore =============================================== https://software.opensuse.org/package/unrtf TW: KDE:KDE3: 0.21.5 42.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 42.1: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 13.2: KDE:Extra: 0.21.5 and KDE:KDE3: 0.21.8 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 906594] New: Apper showing wrong package description
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.opensuse.org/show_bug.cgi?id=906594 Bug ID: 906594 Summary: Apper showing wrong package description Classification: openSUSE Product: openSUSE Factory Version: NO 13.2 BUGS!! Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE4 Applications Assignee: kde-maintainers(a)suse.de Reporter: erwin.vandevelde(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Apper shows the package's description when clicking on it, but only for the first package you click on this is done correctly. Apper shows the same description again and again for each other package you click on. Versions: apper 0.9.1-2.1 -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1121852] New: python3-base: LICENSE in wrong directory
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1121852 Bug ID: 1121852 Summary: python3-base: LICENSE in wrong directory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mcepl(a)suse.com Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The default directory for licenses are /usr/share/licenses. That's where users and tools look today for licenses. python3-base changes the default path of %license to /usr/share/doc for no good reason. -- You are receiving this mail because: You are on the CC list for the bug.

2 14

[Bug 1124885] New: GRUB2 doesn't display UFT-8 characters for KIWI-ng generated LiveCD ISO images
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1124885 Bug ID: 1124885 Summary: GRUB2 doesn't display UFT-8 characters for KIWI-ng generated LiveCD ISO images Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: jsrain(a)suse.com Reporter: opensuse.lietuviu.kalba(a)gmail.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Created attachment 796445 --> http://bugzilla.suse.com/attachment.cgi?id=796445&action=edit GRUB2 screen for openSUSE Leap 15.0 based image, generated with KIWI-ng (KIWI v9) I created LiveCD ISO image with KIWI-ng via build service. You can test it by downloading image from http://download.opensuse.org/repositories/home:/embar-:/Lietukas/images/iso/ Configuration can be found at https://build.opensuse.org/package/show/home:embar-:Lietukas/Lietukas_15.0_… Problem: at boot GRUB2 shows UTF-8 characters (į, š, ž) as question mark (?) inside box. See attachment -- You are receiving this mail because: You are on the CC list for the bug.

2 25

[Bug 1170863] New: kiwi build-tests/s390/suse/test-image-vmx/appliance.kiwi does produce a bootable qcow2 image
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1170863 Bug ID: 1170863 Summary: kiwi build-tests/s390/suse/test-image-vmx/appliance.kiwi does produce a bootable qcow2 image Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mikef(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The follow message is displayed when attempting to start the Tumbleweed qcow2 image on a KVM s390x host. # virsh start --console kiwi-image Domain kiwi-image started Connected to domain kiwi-image Escape character is ^] ! I adapted the appliance.kiwi file to build a SLES 15 SP1 qcow2 image. This image also does not boot and displays the following message. # virsh start --console kiwi-image Domain kiwi-image started Connected to domain kiwi-image Escape character is ^] ! No zIPL magic in PT ! -- You are receiving this mail because: You are on the CC list for the bug.

2 32

[Bug 1071941] New: pip installs packages in /usr/lib instead of /usr/local/lib
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1071941 Bug ID: 1071941 Summary: pip installs packages in /usr/lib instead of /usr/local/lib Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: markos.chandras(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hello, /usr/local is meant to be used for packages installed outside of package manager. Such case is 'pip' in which you can install additional python packages. The problem is that openSUSE pip is installing packages in /usr/lib which overrides python packages installed by zypper For example consider the python2-hpack installed using zypper python2-hpack-3.0.0-1.1.noarch it is installed in /usr/lib/python2.7/site-packages/hpack /usr/lib/python2.7/site-packages/hpack-3.0.0-py2.7.egg-info /usr/lib/python2.7/site-packages/hpack-3.0.0-py2.7.egg-info/PKG-INFO ... etc now installing hpack from pip results to > pip2.7 install -I hpack > pip2.7 show hpack|grep Location Location: /usr/lib/python2.7/site-packages As you can see, pip puts the wheel package into the same location that zypper installed it which effectively overwrites it. Consider also the opposite situation where you first install from pip and then from zypper. zypper will overwrite what you had installed from pip. This is quite problematic when you want zypper and pip packages to happily co-exist for development and testing purposes. This behavior is different compared to other distros where they put pip packages in /usr/local in order to keep them separate from the python packages installed by the package manager. For example, here is the same package on Ubuntu Xenial installed with apt-get $ dpkg -L python-hpack /. /usr /usr/lib /usr/lib/python2.7 /usr/lib/python2.7/dist-packages /usr/lib/python2.7/dist-packages/hpack-2.1.0.egg-info ... etc and the one installed by pip > sudo pip2.7 install -I hpack > sudo pip2.7 show hpack|grep Location Location: /usr/local/lib/python2.7/dist-packages As you see both packages can exist on the same system. CentOS also puts pip packages in /usr/local. -- You are receiving this mail because: You are on the CC list for the bug.

2 16

[Bug 1156677] New: python3-kiwi has incompatibility issues with python3-kiwi
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1156677 Bug ID: 1156677 Summary: python3-kiwi has incompatibility issues with python3-kiwi Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: dcassany(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The current last update of kiwi in Leap15.1 does not include python2 support. Since there is no more python2 support for kiwi 9.18.x series the `update-alternatives` dependency that was handling the default kiwi version (py2 or py3) in use is no longer included. The result of that is python2-kiwi and latest python3-kiwi should not coexist both in the system as they have non coordinated and overlapping use of symlink such as `/usr/bin/kiwi` and `/usr/bin/kiwi-ng`. My approach to solve that would be including an `Obsoletes: python2-kiwi` and `Conflicts: python2-kiw` in python3-kiwi package. This way we ensure both versions are not present in the system. @Ludwig would this solution be acceptable to you? -- You are receiving this mail because: You are on the CC list for the bug.

2 17

[Bug 1166139] New: build of six without setuptools leads to pip issues
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1166139 Bug ID: 1166139 Summary: build of six without setuptools leads to pip issues Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: dmueller(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- pip 10.x requires eggs to be build via setuptools, otherwise uninstalling a package leads to: ERROR: Cannot uninstall 'six'. It is a distutils installed project and thus we cannot accurately determine which files belong to it which would lead to only a partial uninstall -- You are receiving this mail because: You are on the CC list for the bug.

2 19

[Bug 1159235] New: devel:kubic:images: raspberry pi2 images don't boot/stops with grub2 prompt
by bugzilla_noreply＠novell.com 17 Feb '22

17 Feb '22

http://bugzilla.suse.com/show_bug.cgi?id=1159235 Bug ID: 1159235 Summary: devel:kubic:images: raspberry pi2 images don't boot/stops with grub2 prompt Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Kubic Assignee: fvogt(a)suse.com Reporter: kukuk(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The raspberry pi2 images from devel:kubic:images don't boot anymore, they stop in a grub2 prompt -- You are receiving this mail because: You are on the CC list for the bug.

2 24