April 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 972678] New: KDE:Qt/python-pyside: Bug - Installation of this breaks software "opensesame"
by bugzilla_noreply＠novell.com 28 Feb '23

28 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=972678 Bug ID: 972678 Summary: KDE:Qt/python-pyside: Bug - Installation of this breaks software "opensesame" Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Bugzilla Assignee: dmueller(a)suse.com Reporter: patrickmurphy221(a)gmail.com QA Contact: novbugzilla-bugs(a)forge.provo.novell.com Found By: --- Blocker: --- - Overview Tumbleweed zypper dup requests installation of python-pyside, but installing it breaks the program "opensesame". - More detail Installed OpenSUSE Tumbleweed (snapshot 2016-03-18). Installed package "opensesame" (psychology experiment builder, homepage: http://osdoc.cogsci.nl/) from OpenSUSE Science repository (https://build.opensuse.org/project/show/science) It works fine. When I do a "zypper dup" (March 23rd or 24th), the package "python-pyside" is installed (requested by the distribution; not a dependency of opensesame) and it breaks opensesame. Trying to run opensesame gives this error instead of launching the program: python: siplib.c:8551: sip_api_can_convert_to_type: Assertion `td == ((void *)0) || (((td)->td_flags & 0x0007) == 0x0000) || (((td)->td_flags & 0x0007) == 0x0002)' failed. Aborted (core dumped) Uninstalling python-pyside makes opensesame work again (but "zypper dup" continues to request that I install python-pyside). This does not seem to be specific to the OpenSUSE Science repository, since downloading the opensesame python source from its official website and running that gives the exact same result. - To reproduce 1. Install opensesame, from OpenSUSE Science repo or from source. 2. Install python-pyside (as requested by zypper dup). Reversing the order has same effect. Happens on Tumbleweed. In the past I've run opensesame on Leap without problems, but I don't think it ever requested installation of python-pyside, so breakage would not be expected. (First time submitting a bug; apologies if I didn't include the right detail or use the right format.) -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1040812] New: KDE:Qt5/libqt5-qtbase: Bug: KDE:Qt5 has been upgraded to QT 5.9, publishing is OFF
by bugzilla_noreply＠novell.com 28 Feb '23

28 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1040812 Bug ID: 1040812 Summary: KDE:Qt5/libqt5-qtbase: Bug: KDE:Qt5 has been upgraded to QT 5.9, publishing is OFF Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: hrvoje.senjan(a)gmail.com Reporter: Mathias.Homann(a)opensuse.org QA Contact: opensuse-communityscreening(a)forge.provo.novell.com Found By: --- Blocker: --- Again KDE:Qt5 has been up- or downgraded, this time to Qt 5.9, but publishing is OFF, so AGAIN all repositories that build using Qt5 are broken. FIX ASAP. -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1173619] New: VUL-0: unbound: LPE from unbound to root
by bugzilla_noreply＠suse.com 27 Feb '23

27 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1173619 Bug ID: 1173619 Summary: VUL-0: unbound: LPE from unbound to root Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: darin(a)darins.net Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- via security(a)suse.de: I believe to have found a configuration issue in the Unbound package. Or, depending on how you look at it, in the Unbound server itself. 1. Before starting the Unbound server, systemd routinely runs unbound-anchor. From 'systemctl cat unbound': ExecStartPre=/usr/bin/sudo -u unbound /usr/sbin/unbound-anchor -a /var/lib/unbound/root.key -c /etc/unbound/icannbundle.pem As you can see this process is run as user unbound. 2. The Unbound server writes a pid file before dropping privileges, i.e. as root. It then chown's the file in a second step. 'grep username /etc/unbound/unbound.conf': username: "unbound" And from the Unbound source: https://github.com/NLnetLabs/unbound/blob/2a90e8fa1e22aa75d1cf67a1f71ebbf3f… As you can see in the source, Unbound doesn't check if there is already a symbolic link in place of the pid file. 3. openSUSE configures Unbound to create the pid file in a directory owned by the unbound user. 'grep pidfile /etc/unbound/unbound.conf': pidfile: "/var/run/unbound/unbound.pid" 'cat /usr/lib/tmpfiles.d/unbound.conf': D /run/unbound 0755 unbound unbound - 4. unbound-anchor is a nice little "do-one-thing-and-do-it-right" tool. But if it is compromised, and as it has write permission in the pid file directory and reliably runs before the server, an attacker could easily gain full root privileges by just creating a symbolic link /run/unbound/unbound.pid. 5. IMHO this would be best fixed in openSUSE by creating a root owned /run/unbound directory, or changing the pid file path to /run/unbound.pid or something like that. I think this would have the added advantage that openSUSE could ship and maybe enforce the Unbound AppArmor profile used in Debian and Ubuntu: https://gitlab.com/apparmor/apparmor-profiles/-/blob/master/ubuntu/20.04/us… With the current openSUSE setup there is the problem that if AppArmor filters CAP_DAC_OVERRIDE, Unbound has no permission to create a pid file in /run/unbound anymore. If you have questions please don't hesitate to contact me. Thanks for taking a look. Kind regards, Detlef -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1181471] New: libcurl hangs in a __poll below curl_easy_cleanup
by bugzilla_noreply＠suse.com 27 Feb '23

27 Feb '23

https://bugzilla.suse.com/show_bug.cgi?id=1181471 Bug ID: 1181471 Summary: libcurl hangs in a __poll below curl_easy_cleanup Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: ma(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi Predro, a puzzle for the curl maintainers. I'm lost how to further investigate it. Maybe you've got an idea: [https://github.com/openSUSE/zypper/issues/364] - 'Proot' is used to chroot into an openSUSE TW system. This might be the reason, at least ZYPP never received a similar issue report, neither on aarch64 nor on any other architecture. From within the system, libzypp (via libcurl) is able to connect to e.g. download. opensuse.org (the log shows a successful head request). But when closing the connection libcurl reproducible hangs below a call to curl_easy_cleanup (for 20+ minutes before killing zypper). A stacktrace created by libzypp shows curl_easy_cleanup staying in a call to poll: > [bt]: (0) /lib64/libc.so.6 : __poll+0xec [0x7f8a71618c] > [bt]: (1) /usr/lib64/libcurl.so.4 : +0x5e088 [0x7f8a54f088] > [bt]: (2) /usr/lib64/libcurl.so.4 : +0x6024c [0x7f8a55124c] > [bt]: (3) /usr/lib64/libcurl.so.4 : +0x47240 [0x7f8a538240] > [bt]: (4) /usr/lib64/libcurl.so.4 : +0x4740c [0x7f8a53840c] > [bt]: (5) /usr/lib64/libcurl.so.4 : +0x1a3c4 [0x7f8a50b3c4] > [bt]: (6) /usr/lib64/libcurl.so.4 : +0x6e7d0 [0x7f8a55f7d0] > [bt]: (7) /usr/lib64/libcurl.so.4 : curl_easy_cleanup+0x40 [0x7f8a506db0] > [bt]: (8) /usr/lib64/libzypp.so.1722 : zypp::media::MediaCurl::disconnectFrom()+0x2c [0x7f8ada0bdc] > [bt]: (9) /usr/lib64/libzypp.so.1722 : zypp::media::MediaHandler::disconnect()+0x34 [0x7f8ad8bab4] The same is seen in the strace log: > https://github.com/openSUSE/zypper/files/5856500/zypper.strace.log.zip > (search for 'Releasing media http<http://download.opensuse.org' After writing the log line libzypp calls curl_easy_cleanup. Then you see just an endless loop of ppoll calls. Any idea/hint how to circumvent this is welcome. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1184608] New: mono-core depends on mono-devel
by bugzilla_noreply＠suse.com 21 Feb '23

21 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1184608 Bug ID: 1184608 Summary: mono-core depends on mono-devel Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Mono Assignee: bnc-team-mono(a)forge.provo.novell.com Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- when trying to delete mono-devel Failed dependencies: mono(netstandard) = 2.0.0.0 is needed by (installed) mono-core-6.12.0-1.3.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1174051] New: opensuse-community.org links not working
by bugzilla_noreply＠suse.com 19 Feb '23

19 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1174051 Bug ID: 1174051 Summary: opensuse-community.org links not working Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Wiki Assignee: suse-beta(a)cboltz.de Reporter: e-dimas(a)yandex.ru QA Contact: adrian.schroeter(a)suse.com Found By: --- Blocker: --- I am trying to install codecs using "opensuse-community.org" But links to "KDE Codecs", "GNOME Codecs", "NVIDIA Graphics Card Driver" do not work. I use the browser Firefox. If you enter "https://opensuse-community.org/codecs-kde.ymp" in the address bar, the installation of codecs starts. Please fix the links "1 Click Install". -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1174184] New: mozilla/firefox78: Bug
by bugzilla_noreply＠suse.com 19 Feb '23

19 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1174184 Bug ID: 1174184 Summary: mozilla/firefox78: Bug Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: x86-64 OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: 3rd party software Assignee: wolfgang(a)rosenauer.org Reporter: bauglir(a)fsfe.org QA Contact: bnc-team-screening(a)forge.provo.novell.com Found By: --- Blocker: --- Created attachment 839753 --> http://bugzilla.opensuse.org/attachment.cgi?id=839753&action=edit Error message openSuSE Leap 15.2: After upgrading to latest Firefox 78.0.2 version, current profile opens once and then it starts showing an error window with attatched message. There's no problem opening new profiles, just opening old profiles. -- You are receiving this mail because: You are on the CC list for the bug.

1 57

[Bug 1175850] New: MicroOS Desktop can't reboot?
by bugzilla_noreply＠suse.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1175850 Bug ID: 1175850 Summary: MicroOS Desktop can't reboot? Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: MicroOS Assignee: kubic-bugs(a)opensuse.org Reporter: mike(a)flingtoad.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- On a default install of MicroOS Desktop (KDE) (ALPHA) 20200824-0, there is no obvious way to reboot the machine after install packaged with transactional-update. Here's what I've tried. 1. 'transactional-update reboot' (notifies rebootmgrctl that a reboot is requested, but 'rebootmgrctl status' seems to be waiting for the scheduled maintenance time. 2. 'rebootmgrctl reboot now' does not seem to do anything. 3. 'rebootmgrctl reboot fast' does not seem to do anything. 4. Click "Leave" -> "Restart" from KDE menu does not seem to do anything. 5. Click "Leave" -> "Shutdown" from KDE menu does not seem to do anything. 6. Click "Leave" -> "Shutdown" from KDE menu does not seem to do anything. 7. 'systemctl reboot' drops to a non-graphical target with login prompt, but doesn't continue with a reboot. 8. 'shutdown -r now' drops to a non-graphical target with login prompt, but doesn't continue with a reboot. 9. 'shutdown -h now' complains about not being able to unmount /etc, but eventually does halt. 10. 'systemctl reboot' to drop to term and the ctrl-alt-delete several times does eventually reboot >From what I can tell, 4-6 only happen when running the X session for KDE. If you run the Wayland session, 4-6 work but the others still don't. I haven't tried Wayland (Full). Other notes and observations: 1. I don't think the X session is starting the org.kde.ksmserver, but it does get started for Wayland. 2. I'm using full-disk encryption. 3. No matter how I exit the KDE session, it never saved my display configuration. I have to reconfigure the displays each time. Perhaps another bug report for this one. -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1165830] New: [TRACKER] grand distro cleanup
by bugzilla_noreply＠novell.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1165830 Bug ID: 1165830 Summary: [TRACKER] grand distro cleanup Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: lnussel(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- track efforts to clean up the distro like /usr move /etc cleanup dependency cleanup -- You are receiving this mail because: You are on the CC list for the bug.

2 21

[Bug 1167519] New: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim
by bugzilla_noreply＠novell.com 15 Feb '23

15 Feb '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1167519 Bug ID: 1167519 Summary: VUL-1: CVE-2020-10870: zim: creates temporary directories with predictable names, enabling malicious users to prevent other users from being able to start Zim Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/255622/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: luke(a)ljones.dev Reporter: wolfgang.frisch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2020-10870 Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10870 https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/1028 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10870 -- You are receiving this mail because: You are on the CC list for the bug.

2 2