July 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1173633] New: VUL-1: CVE-2020-14940: tuxguitar: improper configuration of XML parsers might lead to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173633 Bug ID: 1173633 Summary: VUL-1: CVE-2020-14940: tuxguitar: improper configuration of XML parsers might lead to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/262182/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: opensuse.lietuviu.kalba(a)gmail.com Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-14940 An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14940 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-14940.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14940 https://logicaltrust.net/blog/2020/06/tuxguitar.html https://sourceforge.net/p/tuxguitar/bugs/126/ -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1166404] Pan not able to post to any newsgroups
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1166404 http://bugzilla.opensuse.org/show_bug.cgi?id=1166404#c9 --- Comment #9 from Jason Evans <jason.evans(a)suse.com> --- n (In reply to Atri Bhattacharya from comment #8) > There is an unvetted patch here: > https://gitlab.gnome.org/GNOME/pan/-/merge_requests/10 > > I am waiting to see if upstream developers agree with it before I apply the > patch for openSUSE pkgs. In the meantime, is it possible to try a build in OBS with --with-gmime30 --with-gnutl options? See https://gitlab.gnome.org/GNOME/pan/-/issues/114 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173591] New: Build of VMware access to kernel gives issues at interface build time.
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173591 Bug ID: 1173591 Summary: Build of VMware access to kernel gives issues at interface build time. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: dick.waite(a)softwareag.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0 Build Identifier: VMware workstation checks on lodaing it has built 2 interface tasks VMMON, VMNET if it has not then it tries to build them. Ob Leap 15.2 build 692.2 (GA) this fails. On Leap 15.0 and 15.1 this works Okay. Log: 2020-06-28T09:38:09.590+02:00| host-2826| I005: #define PCI_DEVICE_ID_VMWARE_VMXNET3 0x07B0 2020-06-28T09:38:09.590+02:00| host-2826| I005: 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/userif.c: In function ‘VNetCsumCopyDatagram’: 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/userif.c:85:39: error: ‘skb_frag_t {aka const struct bio_vec}’ has no member named ‘page_offset’; did you mean ‘bv_offset’? 2020-06-28T09:38:09.590+02:00| host-2826| I005: # define skb_frag_off(frag) (frag)->page_offset 2020-06-28T09:38:09.590+02:00| host-2826| I005: ^ 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/userif.c:576:43: note: in expansion of macro ‘skb_frag_off’ 2020-06-28T09:38:09.590+02:00| host-2826| I005: tmpCsum = csum_and_copy_to_user(vaddr + skb_frag_off(frag), 2020-06-28T09:38:09.590+02:00| host-2826| I005: ^~~~~~~~~~~~ 2020-06-28T09:38:09.590+02:00| host-2826| I005: make[3]: *** [/usr/src/linux-5.3.18-lp152.19/scripts/Makefile.build:282: /tmp/modconfig-80KC2y/vmnet-only/userif.o] Error 1 2020-06-28T09:38:09.590+02:00| host-2826| I005: make[3]: *** Waiting for unfinished jobs.... 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/hub.o: warning: objtool: .text.__x86_indirect_thunk_rax+0x0: unsupported intra-function call 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/hub.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/driver.o: warning: objtool: .text.__x86_indirect_thunk_r8+0x0: unsupported intra-function call 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/driver.o: warning: objtool: If this is a retpoline, please patch it in with altvmware-2826.log lines 522-549/554 99% Reproducible: Always Steps to Reproduce: 1.build leap 15.2 at 692.2 2.Install VMware Workstation 15-5-6 3.Run VMware Workstation Actual Results: 2020-06-28T09:38:09.590+02:00| host-2826| I005: #define PCI_DEVICE_ID_VMWARE_VMXNET3 0x07B0 2020-06-28T09:38:09.590+02:00| host-2826| I005: 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/userif.c: In function ‘VNetCsumCopyDatagram’: 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/userif.c:85:39: error: ‘skb_frag_t {aka const struct bio_vec}’ has no member named ‘page_offset’; did you mean ‘bv_offset’? 2020-06-28T09:38:09.590+02:00| host-2826| I005: # define skb_frag_off(frag) (frag)->page_offset 2020-06-28T09:38:09.590+02:00| host-2826| I005: ^ 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/userif.c:576:43: note: in expansion of macro ‘skb_frag_off’ 2020-06-28T09:38:09.590+02:00| host-2826| I005: tmpCsum = csum_and_copy_to_user(vaddr + skb_frag_off(frag), 2020-06-28T09:38:09.590+02:00| host-2826| I005: ^~~~~~~~~~~~ 2020-06-28T09:38:09.590+02:00| host-2826| I005: make[3]: *** [/usr/src/linux-5.3.18-lp152.19/scripts/Makefile.build:282: /tmp/modconfig-80KC2y/vmnet-only/userif.o] Error 1 2020-06-28T09:38:09.590+02:00| host-2826| I005: make[3]: *** Waiting for unfinished jobs.... 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/hub.o: warning: objtool: .text.__x86_indirect_thunk_rax+0x0: unsupported intra-function call 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/hub.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/driver.o: warning: objtool: .text.__x86_indirect_thunk_r8+0x0: unsupported intra-function call 2020-06-28T09:38:09.590+02:00| host-2826| I005: /tmp/modconfig-80KC2y/vmnet-only/driver.o: warning: objtool: If this is a retpoline, please patch it in with altvmware-2826.log lines 522-549/554 99% Expected Results: VMware Workstation will run. This was sent my email on the 28th June as my access to Bugzilla had a bug. Without a fix VMware Workstation does not run, so I can not run my virtual machines which work very hard to check my software is working Okay. It is posable depending on this bug SLES15 SP-2 could have the same issues. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1173706] New: problem adding flathub repo on openSUSE 15.2
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173706 Bug ID: 1173706 Summary: problem adding flathub repo on openSUSE 15.2 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: sandro.it(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I did a clean installation of opensuse 15.2 i updated the system and added Packman repo. Later i also added by terminal flathub repo with the following command: flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo but the system responded to me this way: error: While opening repository /var/lib/flatpak/repo: opendir(objects): No such file or directory Searching on google I applied the "solution" that was recommended on reddit, basically make: sudo rm -r /var/lib/flatpak/repo and then run the command again to add the flathub repo. This procedure was actually successful and I was able to install some flatpak applications e.g.: spotify and it works correctly. thank you for your attention -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1172953] New: Adding Flathub repo gives error (Leap 15.2RC)
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1172953 Bug ID: 1172953 Summary: Adding Flathub repo gives error (Leap 15.2RC) Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: sanket.dm(a)outlook.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Flatpak version 1.6.3, openSUSE leap 15.2RC Adding flathub repo with the command ""flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo"" gives an error Error: While opening repository /var/lib/flatpak/repo: opendir(objects): No such file or directory"" A workaroung found is: rm -r /var/lib/flatpak/repo -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1173713] New: GNOME:Factory/NetworkManager: Bug Missing 2 subdirs in %Files
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173713 Bug ID: 1173713 Summary: GNOME:Factory/NetworkManager: Bug Missing 2 subdirs in %Files Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: bruno(a)ioda-net.ch QA Contact: bnc-team-screening(a)forge.provo.novell.com Found By: --- Blocker: --- It would be interesting to have those 2 subdirs added in %files section %dir %{_prefix}/lib/NetworkManager/dispatcher.d/pre-up.d %dir %{_prefix}/lib/NetworkManager/dispatcher.d/pre-down.d rpmlint doesn't complain has they are empty, but available by upstream, so packages that would like to add scripts there doesn't need to build and own those subdir Thanks for your consideration -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173712] New: $releasever in add_on_repositories.xml does not work
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1173712 Bug ID: 1173712 Summary: $releasever in add_on_repositories.xml does not work Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: fabian(a)ritter-vogt.de QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Created attachment 839351 --> http://bugzilla.opensuse.org/attachment.cgi?id=839351&action=edit YaST logs Argon uses a /add_on_products.xml file to enable additional repos during installation: <add_on_products xmlns="http://www.suse.com/1.0/yast2ns" xmlns:config="http://www.suse.com/1.0/configns"> <product_items config:type="list"> <product_item> <name>KQ</name> <check_name config:type="boolean">false</check_name> <url>http://download.opensuse.org/repositories/KDE:/Qt5/openSUSE_Leap_$releasever</url> <ask_user config:type="boolean">false</ask_user> <selected config:type="boolean">true</selected> <priority config:type="integer">50</priority> </product_item> ... </product_items> </add_on_products> The installation fails when the first package from an addon repo is fetched: https://openqa.opensuse.org/tests/1324401#step/await_install/7 The main repos use $releasever as well but seem to work fine, which is a bit strange. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171415] startwm.sh in xrdp always uses GNOME regardless of installed/used window manager
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1171415 http://bugzilla.opensuse.org/show_bug.cgi?id=1171415#c3 Dirk Weber <d_werner(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |d_werner(a)gmx.net --- Comment #3 from Dirk Weber <d_werner(a)gmx.net> --- Thanks for finding this workaround, for me this was a bug blocking the upgrade to Leap 15.2. Just some additional remarks: For Leap 15.2 in xrdp-0.9.13-lp152.2.2 the script /etc/xrdp/startwm.sh in the function wm_start() hard codes the SESSION SESSION="gnome" and after this has a pointless case statement (pointless because the SESSION at this point is always gnome): case $SESSION in sle) ... ;; gnome) ... ;; icewm) ... ;; esac I do not have gnome installed and an xrdp session can not be established probably because no desktop can be started. If I modify the /etc/xrdp/startwm.sh in the function wm_start() and change the SESSION to icewem - which is installed SESSION="icewm" the xrdp connection can be started and I get a functional desktop with icewm. The script startwm.sh in the function pre_start() sources some user configuration files (~/.bash_profile, ~/.bash_login, ~/.profile). A solution would be that if SESSION is set in one of them that this value is not overwritten in start_wm(). In Leap 15.1 if have a file ~/.xsession to select the desktop to be started by the xrdp session. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171854] New: KDE3 katepart syntax highlight xml files need update from TDE git
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1171854 Bug ID: 1171854 Summary: KDE3 katepart syntax highlight xml files need update from TDE git Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: drankinatty(a)suddenlinkmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Created attachment 837947 --> http://bugzilla.opensuse.org/attachment.cgi?id=837947&action=edit Screenshot of 15.1 showing syntax highlight problem Since kde.org pulled the syntax file downloads (for Plasma as well as KDE3), there needs to be an update to the syntax files (kdelibs->katepart->data) for the 15.2 release. Our (openSUSE) syntax files are the June 2014 files. TDE is upstream for the syntax files and have continued to update the files as new CSS/PHP/HTML tags and the like have come out. The git URL for the files is: https://mirror.git.trinitydesktop.org/gitea/TDE/tdelibs/src/branch/master/k… The updated files handle the following example correctly (e.g. the '(...)' serving as as CSS property and value termination) as show in: Example: @media screen and (max-height: 450px) { .sidenav {padding-top: 15px;} .sidenav a {font-size: 18px;} } With our current syntax files syntax highlight break after "450)" for the remainder of the file. For 15.2, just pull the updated set into kdelibs->katepart->data. Simply updating the css.xml, css-php.xml, html.xml and html-php.xml files with the ones from the TDE git repo solves the problem. (I didn't do a one-by-one check, but just replaced those 4 file. openSUSE has the best KDE3 on planet earth, and it is a huge asset -- let's keep it that way. If you want me to create a patch, I can copy all the new files and create a patch -- but I suspect you have a smarter way to go about it. Let me know if yo want me to create one manually. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1153687] Zypper repo name detection broken
by bugzilla_noreply＠suse.com 04 Jul '20

04 Jul '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1153687 http://bugzilla.opensuse.org/show_bug.cgi?id=1153687#c9 --- Comment #9 from Adrian Schröter <adrian.schroeter(a)suse.com> --- concept wise I do not like this approach, since you split free text names where there is no definition. This really works only by accident more or less. The better way would be to replace the entire repository name, based on the official default names as defined in OBS. So I would recommend something like <default_repository_name>openSUSE_Tumbleweed</default_repository_name> Also a <default_obs_url>obs://build.opensuse.org</default_obs_url> may make sense, since in OBS the url syntax is define as obs://$hostname/$project/... And having a hardcoded one breaks at least for SLE already depending on the use case. -- You are receiving this mail because: You are on the CC list for the bug.

1 0