July 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1087860] wine repeatedly asks to install wine-mono even though the package wine-mono was installed
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1087860 https://bugzilla.suse.com/show_bug.cgi?id=1087860#c16 --- Comment #16 from Oliver Kurz <okurz(a)suse.com> --- This is an autogenerated message for openQA integration by the openqa_review script: This bug is still referenced in a failing openQA test: extra_tests_gnome https://openqa.opensuse.org/tests/1757271 To prevent further reminder comments one of the following options should be followed: 1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted 2. The openQA job group is moved to "Released" or "EOL" (End-of-Life) 3. The label in the openQA scenario is removed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187864] Semantic interposition inhibits optimization of shared libraries
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1187864 http://bugzilla.opensuse.org/show_bug.cgi?id=1187864#c2 Richard Biener <rguenther(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jh(a)suse.com --- Comment #2 from Richard Biener <rguenther(a)suse.com> --- (In reply to Aaron Puchert from comment #1) > (In reply to Fabian Vogt from comment #0) > > Using the "-fno-semantic-interposition" compiler option, interprocedural > > optimization can be enabled for exported symbols [...] > The way I see it, -fno-semantic-interposition is justified by the "one > definition rule" in both C and C++. Having different functions with the same > (qualified) name (and signature for C++) is not allowed in a program. There > is still a non-standard "back door": __attribute__((weak)). So if necessary > it's still possible to define overridable functions, but other libraries > can't just override anything they want. It's also kind of on-by-default in > Clang (not literally, but Clang does IPO on default visibility functions) > and on other platforms, so there is hopefully not a lot of software out > there that relies on semantic interposition. I think for GCC the ODR trumps -fsemantic-interposition though GCC applies ODR only to C++. Honza, please correct me if I'm wrong here. So I'm not sure whether -fno-semantic-interposition on its own has any measurable effect on a C++ code base. For C there's no ODR so things are more complicated. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1188022] New: mozilla:Factory/mozjs78: cargo audit, may need to update and re-vendor
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1188022 Bug ID: 1188022 Summary: mozilla:Factory/mozjs78: cargo audit, may need to update and re-vendor Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: wolfgang(a)rosenauer.org Reporter: william.brown(a)suse.com QA Contact: screening-team-bugs(a)suse.de Found By: --- Blocker: --- Hi there, I've recently started a project to scan rust projects with cargo-audit for potential known security issues. The following was found in mozjs78: * RUSTSEC-2021-0067 -> crate: cranelift-codegen, cvss: None, class: ['code-execution', 'memory-corruption', 'memory-exposure'] * RUSTSEC-2020-0060 -> crate: futures-task, cvss: None, class: ['code-execution', 'memory-corruption'] * RUSTSEC-2020-0061 -> crate: futures-task, cvss: None, class: ['denial-of-service'] * RUSTSEC-2020-0059 -> crate: futures-util, cvss: None, class: ['thread-safety'] * RUSTSEC-2020-0146 -> crate: generic-array, cvss: None, class: ['memory-corruption'] * RUSTSEC-2021-0020 -> crate: hyper, cvss: None, class: ['format-injection'] * RUSTSEC-2020-0004 -> crate: lucet-runtime-internals, cvss: None, class: ['memory-corruption', 'memory-exposure'] * RUSTSEC-2020-0082 -> crate: ordered-float, cvss: None, class: [] * RUSTSEC-2021-0013 -> crate: raw-cpuid, cvss: None, class: ['memory-corruption', 'denial-of-service'] * RUSTSEC-2021-0003 -> crate: smallvec, cvss: None, class: ['memory-corruption'] * RUSTSEC-2020-0043 -> crate: ws, cvss: None, class: ['denial-of-service'] Most of these should be able to be resolved with "cargo update" and re-vendoring your vendor.tar. Alternately upstream may have released updates to their Cargo.toml/Cargo.lock that may resolve these on an update. It would be great if you could have a look at these! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1182233] [Build 20210211][glibc2.33] chromium fails to render websites
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1182233 https://bugzilla.suse.com/show_bug.cgi?id=1182233#c15 --- Comment #15 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0973-1: An update that fixes 29 vulnerabilities is now available. Category: security (important) Bug References: 1130395,1158516,1163744,1163766,1182233 CVE References: CVE-2020-16044,CVE-2021-21118,CVE-2021-21119,CVE-2021-21120,CVE-2021-21121,CVE-2021-21122,CVE-2021-21123,CVE-2021-21125,CVE-2021-21126,CVE-2021-21127,CVE-2021-21128,CVE-2021-21129,CVE-2021-21130,CVE-2021-21131,CVE-2021-21132,CVE-2021-21135,CVE-2021-21137,CVE-2021-21140,CVE-2021-21141,CVE-2021-21145,CVE-2021-21146,CVE-2021-21147,CVE-2021-21148,CVE-2021-21149,CVE-2021-21150,CVE-2021-21152,CVE-2021-21153,CVE-2021-21156,CVE-2021-21157 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt5-qtwebengine-5.15.3-lp152.3.3.4 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163766] [Build 20200215] openQA test fails in first_boot with the opensuse-welcome splash screen showing only a big geeko
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1163766 https://bugzilla.suse.com/show_bug.cgi?id=1163766#c22 --- Comment #22 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0973-1: An update that fixes 29 vulnerabilities is now available. Category: security (important) Bug References: 1130395,1158516,1163744,1163766,1182233 CVE References: CVE-2020-16044,CVE-2021-21118,CVE-2021-21119,CVE-2021-21120,CVE-2021-21121,CVE-2021-21122,CVE-2021-21123,CVE-2021-21125,CVE-2021-21126,CVE-2021-21127,CVE-2021-21128,CVE-2021-21129,CVE-2021-21130,CVE-2021-21131,CVE-2021-21132,CVE-2021-21135,CVE-2021-21137,CVE-2021-21140,CVE-2021-21141,CVE-2021-21145,CVE-2021-21146,CVE-2021-21147,CVE-2021-21148,CVE-2021-21149,CVE-2021-21150,CVE-2021-21152,CVE-2021-21153,CVE-2021-21156,CVE-2021-21157 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt5-qtwebengine-5.15.3-lp152.3.3.4 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1163744] QtWebEngine video playback doesn't start (after update to Qt 5.14.1)
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1163744 https://bugzilla.suse.com/show_bug.cgi?id=1163744#c32 --- Comment #32 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0973-1: An update that fixes 29 vulnerabilities is now available. Category: security (important) Bug References: 1130395,1158516,1163744,1163766,1182233 CVE References: CVE-2020-16044,CVE-2021-21118,CVE-2021-21119,CVE-2021-21120,CVE-2021-21121,CVE-2021-21122,CVE-2021-21123,CVE-2021-21125,CVE-2021-21126,CVE-2021-21127,CVE-2021-21128,CVE-2021-21129,CVE-2021-21130,CVE-2021-21131,CVE-2021-21132,CVE-2021-21135,CVE-2021-21137,CVE-2021-21140,CVE-2021-21141,CVE-2021-21145,CVE-2021-21146,CVE-2021-21147,CVE-2021-21148,CVE-2021-21149,CVE-2021-21150,CVE-2021-21152,CVE-2021-21153,CVE-2021-21156,CVE-2021-21157 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt5-qtwebengine-5.15.3-lp152.3.3.4 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1158516] GCC 10: libqt5-qtwebengine build fails
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1158516 https://bugzilla.suse.com/show_bug.cgi?id=1158516#c13 --- Comment #13 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0973-1: An update that fixes 29 vulnerabilities is now available. Category: security (important) Bug References: 1130395,1158516,1163744,1163766,1182233 CVE References: CVE-2020-16044,CVE-2021-21118,CVE-2021-21119,CVE-2021-21120,CVE-2021-21121,CVE-2021-21122,CVE-2021-21123,CVE-2021-21125,CVE-2021-21126,CVE-2021-21127,CVE-2021-21128,CVE-2021-21129,CVE-2021-21130,CVE-2021-21131,CVE-2021-21132,CVE-2021-21135,CVE-2021-21137,CVE-2021-21140,CVE-2021-21141,CVE-2021-21145,CVE-2021-21146,CVE-2021-21147,CVE-2021-21148,CVE-2021-21149,CVE-2021-21150,CVE-2021-21152,CVE-2021-21153,CVE-2021-21156,CVE-2021-21157 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt5-qtwebengine-5.15.3-lp152.3.3.4 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1130395] Valgrind fails to build on armv6 and armv7
by bugzilla_noreply＠suse.com 06 Jul '21

06 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1130395 https://bugzilla.suse.com/show_bug.cgi?id=1130395#c10 Swamp Workflow Management <swamp(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- OS|openSUSE Factory |All --- Comment #10 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0973-1: An update that fixes 29 vulnerabilities is now available. Category: security (important) Bug References: 1130395,1158516,1163744,1163766,1182233 CVE References: CVE-2020-16044,CVE-2021-21118,CVE-2021-21119,CVE-2021-21120,CVE-2021-21121,CVE-2021-21122,CVE-2021-21123,CVE-2021-21125,CVE-2021-21126,CVE-2021-21127,CVE-2021-21128,CVE-2021-21129,CVE-2021-21130,CVE-2021-21131,CVE-2021-21132,CVE-2021-21135,CVE-2021-21137,CVE-2021-21140,CVE-2021-21141,CVE-2021-21145,CVE-2021-21146,CVE-2021-21147,CVE-2021-21148,CVE-2021-21149,CVE-2021-21150,CVE-2021-21152,CVE-2021-21153,CVE-2021-21156,CVE-2021-21157 JIRA References: Sources used: openSUSE Leap 15.2 (src): libqt5-qtwebengine-5.15.3-lp152.3.3.4 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1170723] Segmentation fault in Valgrind in openQA
by bugzilla_noreply＠suse.com 05 Jul '21

05 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1170723 https://bugzilla.suse.com/show_bug.cgi?id=1170723#c3 --- Comment #3 from openQA Review <openqa-review(a)suse.de> --- This is an autogenerated message for openQA integration by the openqa_review script: This bug is still referenced in a failing openQA test: extra_tests_in_textmode https://openqa.opensuse.org/tests/1822808 To prevent further reminder comments one of the following options should be followed: 1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted 2. The openQA job group is moved to "Released" or "EOL" (End-of-Life) 3. The label in the openQA scenario is removed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187864] Semantic interposition inhibits optimization of shared libraries
by bugzilla_noreply＠suse.com 05 Jul '21

05 Jul '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1187864 http://bugzilla.opensuse.org/show_bug.cgi?id=1187864#c1 Aaron Puchert <aaronpuchert(a)alice-dsl.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aaronpuchert(a)alice-dsl.net --- Comment #1 from Aaron Puchert <aaronpuchert(a)alice-dsl.net> --- (In reply to Fabian Vogt from comment #0) > Using the "-fno-semantic-interposition" compiler option, interprocedural > optimization can be enabled for exported symbols [...] The way I see it, -fno-semantic-interposition is justified by the "one definition rule" in both C and C++. Having different functions with the same (qualified) name (and signature for C++) is not allowed in a program. There is still a non-standard "back door": __attribute__((weak)). So if necessary it's still possible to define overridable functions, but other libraries can't just override anything they want. It's also kind of on-by-default in Clang (not literally, but Clang does IPO on default visibility functions) and on other platforms, so there is hopefully not a lot of software out there that relies on semantic interposition. > [...] and the linker option "-Bsymbolic(-functions)" allows symbol > references inside the same object to be resolved directly instead of going > through runtime relocation. [...] > > However, executables have to be built with that in mind (by compiling them > like PIC) to avoid features which rely on interposition, like copy > relocations. The "-fno-direct-access-external-data" option achieves that > FWICT. In the thread where Fangrui Song aka maskray proposed to enable these flags for building Clang [1], the time difference between -Bsymbolic and -Bsymbolic-functions was minor. For Qt it might very well look different though. Address uniqueness is probably not a big issue, but it certainly can be an issue, as the standards guarantee it. So I think we could enable -Bsymbolic-functions on a per-package basis, but probably not globally. Avoiding copy relocations for -Bsymbolic might be too high a price to pay, at least in general. I don't know how common default visibility variables are, and whether they're typically used more often by the library or the program. With modern libraries I'd expect there not be a lot of exported variables, so maybe it just doesn't matter that much. So I'd be in favor of enabling -fno-semantic-interposition by default, but not -Bsymbolic[-functions]. We can enable that where it matters and where we think it's safe. I played with -Bsymbolic in the LLVM build once, but I'm mostly compiling C++ where the compile jobs take so long that the initial relocation processing doesn't change much. (Since we're building LLVM with Clang, we already have IPO for default visibility functions.) [1] https://lore.kernel.org/lkml/20210501235549.vugtjeb7dmd5xell@google.com/ -- You are receiving this mail because: You are on the CC list for the bug.

1 0