May 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1174450] Can't run Discord in Plasma Wayland session
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

https://bugzilla.suse.com/show_bug.cgi?id=1174450 Nathaniel Graham <pointedstick(a)zoho.com> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugzilla.suse.com/s | |how_bug.cgi?id=1185740 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185631] New: VUL-0: exim: 21Nails - Multiple vulnerabilities in Exim
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185631 Bug ID: 1185631 Summary: VUL-0: exim: 21Nails - Multiple vulnerabilities in Exim Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: rfrohl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- oss-security: Qualys Security Advisory 21Nails: Multiple vulnerabilities in Exim ======================================================================== Contents ======================================================================== Summary Local vulnerabilities - CVE-2020-28007: Link attack in Exim's log directory - CVE-2020-28008: Assorted attacks in Exim's spool directory - CVE-2020-28014: Arbitrary file creation and clobbering - CVE-2021-27216: Arbitrary file deletion - CVE-2020-28011: Heap buffer overflow in queue_run() - CVE-2020-28010: Heap out-of-bounds write in main() - CVE-2020-28013: Heap buffer overflow in parse_fix_phrase() - CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase() - CVE-2020-28015: New-line injection into spool header file (local) - CVE-2020-28012: Missing close-on-exec flag for privileged pipe - CVE-2020-28009: Integer overflow in get_stdinput() Remote vulnerabilities - CVE-2020-28017: Integer overflow in receive_add_recipient() - CVE-2020-28020: Integer overflow in receive_msg() - CVE-2020-28023: Out-of-bounds read in smtp_setup_msg() - CVE-2020-28021: New-line injection into spool header file (remote) - CVE-2020-28022: Heap out-of-bounds read and write in extract_option() - CVE-2020-28026: Line truncation and injection in spool_read_header() - CVE-2020-28019: Failure to reset function pointer after BDAT error - CVE-2020-28024: Heap buffer underflow in smtp_ungetc() - CVE-2020-28018: Use-after-free in tls-openssl.c - CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash() Acknowledgments Timeline ======================================================================== Summary ======================================================================== We recently audited central parts of the Exim mail server (https://en.wikipedia.org/wiki/Exim) and discovered 21 vulnerabilities (from CVE-2020-28007 to CVE-2020-28026, plus CVE-2021-27216): 11 local vulnerabilities, and 10 remote vulnerabilities. Unless otherwise noted, all versions of Exim are affected since at least the beginning of its Git history, in 2004. We have not tried to exploit all of these vulnerabilities, but we successfully exploited 4 LPEs (Local Privilege Escalations) and 3 RCEs (Remote Code Executions): - CVE-2020-28007 (LPE, from user "exim" to root); - CVE-2020-28008 (LPE, from user "exim" to root); - CVE-2020-28015 (LPE, from any user to root); - CVE-2020-28012 (LPE, from any user to root, if allow_filter is true); - CVE-2020-28020 (unauthenticated RCE as "exim", in Exim < 4.92); - CVE-2020-28018 (unauthenticated RCE as "exim", in 4.90 <= Exim < 4.94, if TLS encryption is provided by OpenSSL); - CVE-2020-28021 (authenticated RCE, as root); - CVE-2020-28017 is also exploitable (unauthenticated RCE as "exim"), but requires more than 25GB of memory in the default configuration. We will not publish our exploits for now; instead, we encourage other security researchers to write and publish their own exploits: - This advisory contains sufficient information to develop reliable exploits for these vulnerabilities; in fact, we believe that better exploitation methods exist. - We hope that more security researchers will look into Exim's code and report their findings; indeed, we discovered several of these vulnerabilities while working on our exploits. - We will answer (to the best of our abilities) any questions regarding these vulnerabilities and exploits on the public "oss-security" list (https://oss-security.openwall.org/wiki/mailing-lists/oss-security). Last-minute note: as explained in the Timeline, we developed a minimal set of patches for these vulnerabilities; for reference and comparison, it is attached to this advisory and is also available at https://www.qualys.com/research/security-advisories/. https://seclists.org/oss-sec/2021/q2/93 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1173693] exim de-installation reports errors
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1173693 http://bugzilla.opensuse.org/show_bug.cgi?id=1173693#c4 --- Comment #4 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1173693) was mentioned in https://build.opensuse.org/request/show/891096 15.2 / exim https://build.opensuse.org/request/show/891098 Backports:SLE-15-SP1 / exim -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1171877] New: exim %pretrans fails - /bin/sh not found
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1171877 Bug ID: 1171877 Summary: exim %pretrans fails - /bin/sh not found Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: poeml(a)cmdline.net Reporter: suse-beta(a)cboltz.de QA Contact: qa-bugs(a)suse.de CC: wullinger(a)rz.uni-kiel.de Found By: --- Blocker: --- I have a package that collects AppArmor profiles from various packages, and found the following in https://build.opensuse.org/public/build/home:cboltz/openSUSE_Factory/x86_64… ... [ 15s] [754/755] cumulate os-autoinst-4.6.1589459603.638a25e2-1.1 [ 15s] [755/755] cumulate openQA-worker-4.6.1589385688.c7582131b-1.1 [ 15s] now installing cumulated packages [ 15s] error: failed to exec scriptlet interpreter /bin/sh: No such file or directory [ 15s] error: %pretrans(exim-4.93.0.4-5.1.x86_64) scriptlet failed, exit status 127 [ 15s] Preparing... ################################ [ 15s] Updating / installing... [ 15s] system-user-root-20190513-1.6 ################################ ... Note the two lines starting with "error:" - it seems the exim package needs /bin/sh for its %pretrans script, but it's not available (yet?). -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1171490] VUL-0: CVE-2020-12783: exim: out-of-bounds read in the SPA authenticator which could lead to SPA/NTLM authentication bypass
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1171490 http://bugzilla.opensuse.org/show_bug.cgi?id=1171490#c3 --- Comment #3 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1171490) was mentioned in https://build.opensuse.org/request/show/891096 15.2 / exim https://build.opensuse.org/request/show/891098 Backports:SLE-15-SP1 / exim -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1160726] New: Installation of exim-4.93.0.4-1.1.x86_64 failed
by bugzilla_noreply＠novell.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1160726 Bug ID: 1160726 Summary: Installation of exim-4.93.0.4-1.1.x86_64 failed Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: schwab(a)linux-m68k.org QA Contact: qa-bugs(a)suse.de CC: poeml(a)cmdline.net, wullinger(a)rz.uni-kiel.de Found By: --- Blocker: --- (260/389) Installing: exim-4.93.0.4-1.1.x86_64 ..........................[error] Installation of exim-4.93.0.4-1.1.x86_64 failed: Error: Subprocess failed. Error: RPM failed: error: unpacking of archive failed on file /usr/share/doc/packages/exim/doc/cve-2019-13917: cpio: File from package already exists as a directory in system error: exim-4.93.0.4-1.1.x86_64: install failed error: exim-4.92.2-1.1.x86_64: erase skipped -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1142207] VUL-0: CVE-2019-13917: exim: OVE-20190718-0006
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1142207 http://bugzilla.opensuse.org/show_bug.cgi?id=1142207#c5 --- Comment #5 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1142207) was mentioned in https://build.opensuse.org/request/show/891098 Backports:SLE-15-SP1 / exim -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1079832] New: VUL-0: CVE-2018-6789: exim: Buffer overflow in an utility function
by bugzilla_noreply＠novell.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1079832 Bug ID: 1079832 Summary: VUL-0: CVE-2018-6789: exim: Buffer overflow in an utility function Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/199626/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: jsegitz(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- Heiko Schlittermann: CVE-2018-6789 Exim 4.90 and earlier =================================== There is a buffer overflow in an utility function, if some pre-conditions are met. Using a handcrafted message, remote code execution seems to be possible. A patch exists already and is being tested. Currently we're unsure about the severity, we *believe*, an exploit is difficult. A mitigation isn't known. Next steps: * t0: Distros will get access to our "security" non-public git repo (based on the SSH keys known to us) * t0 +7d: Patch will be published on the official public git repo t0 will be around 2018-02-08. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6789 http://seclists.org/oss-sec/2018/q1/133 https://exim.org/security/CVE-2018-6789.txt -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1185601] Black screen / no screen output after upgrading from 5.11 to 5.12
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185601 http://bugzilla.opensuse.org/show_bug.cgi?id=1185601#c19 Fritz Hudnut <non.space.1(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |non.space.1(a)gmail.com --- Comment #19 from Fritz Hudnut <non.space.1(a)gmail.com> --- I'm re-posting this over here, as I have posted this "upstream" piggy-backing onto what might be similar issues with recent zypper upgrades . . . Bugzilla wasn't accepting my log in . . . so I'm commenting here . . . to report issues with the upgrade, wiping ability to boot into any linux distros. To Freedesktop/Github: I'm adding my issues with recent upgrade to two versions of OpenSUSE on two different Mac computers, TW & Leap 15.3 . . . after basic "zypper dup -l" it appears that grub menu is wiped and the computer's booted to a white screen. One was a laptop '09 MacBookPro, but the other is '12 Mac Pro with external display. In both cases I couldn't get to a TTY from the whiteness, but I can boot the systems via SuperGrub2, and then, in messing around with "grub2-mkconfig" the desktop will boot into one option of my multi-boot linux installs . . . but as with ubuntu and grub, it only boots itself, no grub menu with the 5 or 6 linux options will show up. So far my Gecko installs have not been affected . . . more or less current, so I believe she has it running 5.12??? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1185716] chromium fails to build with GCC11
by bugzilla_noreply＠suse.com 06 May '21

06 May '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1185716 http://bugzilla.opensuse.org/show_bug.cgi?id=1185716#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1185716) was mentioned in https://build.opensuse.org/request/show/891089 Factory / chromium -- You are receiving this mail because: You are on the CC list for the bug.

1 0