August 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1160171] New: Blender failed to launch (symbol lookup error: undefine symbol)
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1160171 Bug ID: 1160171 Summary: Blender failed to launch (symbol lookup error: undefine symbol) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: andythe_great(a)pm.me QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- kakake@linux-gsde:~> blender blender: symbol lookup error: /usr/lib64/libOpenColorIO.so.1: undefined symbol: _ZN4YAML6detail9node_data12empty_scalarB5cxx11E Try executing Blender in terminal result in this message. I did sudo zypper clean sudo zypper ref sudo zypper rm -u blender sudo zypper in blender reboot still same problem. The question was also ask here: https://forums.opensuse.org/showthread.php/538693-Blender-failed-to-launch-… Blender 2.81-2.1-x86_64 from vendor openSUSE Operating System: openSUSE Tumbleweed 20200103 KDE Plasma Version: 5.17.4 KDE Frameworks Version: 5.65.0 Qt Version: 5.13.1 Kernel Version: 5.3.12-2-default OS Type: 64-bit Processors: 8 × Intel® Core™ i7-3770 CPU @ 3.40GHz Memory: 7.5 GiB of RAM -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1027942] New: virt-manager: Missing upstream bug fixes
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1027942 Bug ID: 1027942 Summary: virt-manager: Missing upstream bug fixes Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Tools Assignee: virt-bugs(a)suse.de Reporter: carnold(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- There are upstream patches fixing bugs needed for this version of virt-manager. -- You are receiving this mail because: You are on the CC list for the bug.

2 37

[Bug 1170161] New: AUDIT-FIND: enlightenment: enlightenment_system: _store_mount_verify() follows symlinks in /media/$user
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1170161 Bug ID: 1170161 Summary: AUDIT-FIND: enlightenment: enlightenment_system: _store_mount_verify() follows symlinks in /media/$user Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: simonf.lees(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: matthias.gerstner(a)suse.com, security-team(a)suse.de Blocks: 1169238 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1169238 This function rejects relative path components in the target mount path, unlike its sibbling function described in b). However, it is unaware of symlinks. Furthermore it makes sure that /media/$user and /media/$user/sub are existing and are owned by the $uid:$gid of the unprivileged user. - by placing a symlink in /media/$user/sub the setuid-root binary can be tricked to create attacker owned directories in arbitrary locations. This can quite likely lead to full root access by creating user owned directories e.g. beneath /etc that are then used by other privileged programs. - if the attacker wins a race condition he can also cause the setuid-root binary to pass ownership of arbitrary existing directories to himself. The `_store_mount_verify()` functions performs a single `stat()` call on the target mount path. Only if it exists and is not owned by the unprivileged user, the execution is aborted. Therefore if the attacker places a suitable symlink in the target path just after this `stat()` is performed by the setuid-root binary, the following `_mkdir()` invocation will `mkdir()` and `chown()` the path components nonetheless. This allows full root system access by gaining ownership of e.g. /etc or /root. To fix this I suggest not to pass ownership of /media/$user or of any sub-directories to the unprivileged user. If /media/$user is user controlled then the mount operation should be rejected. -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1170162] New: AUDIT-FIND: enlightenment: enlightenment_system: _store_umount_verify(): does not protect against shell metacharacters and relative path components
by bugzilla_noreply＠novell.com 05 Jul '22

05 Jul '22

http://bugzilla.suse.com/show_bug.cgi?id=1170162 Bug ID: 1170162 Summary: AUDIT-FIND: enlightenment: enlightenment_system: _store_umount_verify(): does not protect against shell metacharacters and relative path components Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: simonf.lees(a)suse.com Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Blocks: 1169238 Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1169238 This function tries to make sure that the user can only unmount his own mounts below /media/$user. It also rejects backslashes in the path. However it does not reject relative path components or shell characters. - this allows a regular user to unmount arbitrary file systems by passing paths like "/media/$user/../../tmp. - since the unmount is performed by calling the `umount` utility via "/bin/sh", shell metacharacters will be interpreted. Passing a path like '/media/testuser/$(date)' will cause the setuid-root program to execute the `date` program as root. This leads to full code execution as root. The only requirement is that a directory of the same name exists. Spaces are also allowed in the path, therefore even complex commands can be executed as root. I recommend to reject relative path components and shell metacharacters in this function to fix the issue. -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1155688] New: openh264 needs a later flatpak version
by bugzilla_noreply＠novell.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1155688 Bug ID: 1155688 Summary: openh264 needs a later flatpak version Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: All OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: tech4patton(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Current version in repo is 1.2.3 which is considered the "old stable". Latest version of that branch is 1.2.5 which is needed to support new features. https://github.com/flatpak/flatpak/releases/tag/1.2.5 The main feature is the support for allowing the use of extra_data for runtimes (as opposed to only for apps) which is used by the new org.freedesktop.Platform.openh264 extension. Here is what happens when I update flatpak apps ---------------------------------------------------------------------- > flatpak update Looking for updates… ID Arch Branch Op Remote Download 1. [✗] org.freedesktop.Platform.openh264 x86_64 19.08 i flathub < 593.4 kB 2. [✓] com.spotify.Client x86_64 stable u flathub 115.0 MB / 126.4 MB Warning: org.freedesktop.Platform.openh264 needs a later flatpak version Changes complete. -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1036208] New: GNOME:Factory/libostree: remount service not loaded on install
by bugzilla_noreply＠novell.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1036208 Bug ID: 1036208 Summary: GNOME:Factory/libostree: remount service not loaded on install Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: os.gnome.maintainers(a)gmail.com Reporter: sebix+novell.com(a)sebix.at QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- During my todays zypper dup run, I got this output: ( 72/408) Installing: libostree-2017.3-1.1.x86_64 ......................................................................................................[done] Additional rpm output: Failed to disable unit: No such file or directory Failed to stop ostree-remount.service.service: Unit ostree-remount.service.service not loaded. Is this a bug? The file is there: > find /usr/lib/systemd/ -name "*ostree*" /usr/lib/systemd/system/ostree-prepare-root.service /usr/lib/systemd/system/ostree-remount.service -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1084811] New: E-sata hotplugging stopped working since kernel 4.15
by bugzilla_noreply＠novell.com 03 Jul '22

03 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1084811 Bug ID: 1084811 Summary: E-sata hotplugging stopped working since kernel 4.15 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Factory Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-maintainers(a)forge.provo.novell.com Reporter: attila.schler(a)atskler.net QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I have noticed that on my Dell E6520 notebook the e-sata hotplugging stopped working since kernel 4.15. Currently I can observe this problem with kernel: 4.15.7-1.6-x86_64 4.16.0-rc4-4.g7a5941a-x86-64 The e-sata cable is OK, and an e-sata device can be used with kernel 4.15 if it is turned on and plugged in before powering on my notebook. (The e-sata hotplugging works well with the Leap kernel 4.12.14-lp150.5.3-x86_64.) ___ (I’m not an advanced user, but I’m ready to follow detailed instructions.) -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1118564] New: flatpak: upgrade to version 1.0.5
by bugzilla_noreply＠novell.com 30 Jun '22

30 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1118564 Bug ID: 1118564 Summary: flatpak: upgrade to version 1.0.5 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: mpdesouza(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- openSUSE Leap 15 comes with an older flatpak version, and as result one cannot install VLC app from flathub, because it need at least version 1.0.5. By installing the flatpak package from tumbleweed (version 1.0.5) in Leap 15 works out of the box, without issues, and making possible to install VLC. As there isn't any hard dependency from flatpak regarding different library versions between Leap 15 and Tumbleweed, it would be easy to update the current version of flatpak in Leap 15. -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1028460] New: grub2 ignores active_devices
by bugzilla_noreply＠novell.com 30 Jun '22

30 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1028460 Bug ID: 1028460 Summary: grub2 ignores active_devices Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: S/390-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: rw(a)suse.de Reporter: bg(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- after doing the latest update, I found that /boot/zipl/active_devices.txt was emptied. Even after copying the old data in there, the newly generated initrd ignores active_devices.txt which results in an unbootable system. -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1146427] New: VUL-1: CVE-2019-14751: python-nltk: Natural Language Toolkit (NLTK) prior to version 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash)
by bugzilla_noreply＠novell.com 29 Jun '22

29 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1146427 Bug ID: 1146427 Summary: VUL-1: CVE-2019-14751: python-nltk: Natural Language Toolkit (NLTK) prior to version 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/240518/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: wolfgang.frisch(a)suse.com QA Contact: security-team(a)suse.de CC: sleep_walker(a)opensuse.org Found By: Security Response Team Blocker: --- CVE-2019-14751 Natural Language Toolkit (NLTK) prior to version 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14751 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-14751.html -- You are receiving this mail because: You are on the CC list for the bug.

2 1