July 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1116658] Crash of Writer opening any document having "invalid" python file in home directory
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1116658 https://bugzilla.suse.com/show_bug.cgi?id=1116658#c41 --- Comment #41 from Ednilson Miura <emiura(a)suse.com> --- (In reply to Matej Cepl from comment #40) > (In reply to Ednilson Miura from comment #38) > > Hello, while testing SUSE:Maintenance:19058:243906 (libreoffice/sled12sp5) I > > cannot reproduce the issue by simply placing foobar.py on $PWD and calling > > oorwriter, but I can if I set PYTHONPATH (it is not set on sled12sp5) to > > $(pwd). However, oowriter still crashing even after update if the variable > > is set. What is the correct way to validate this fix? > > The file cannot be called foobar. See comment 4, it must be abc.py (or few > other names of the standard library module names). > > Don��t fiddle with $PYTHONPATH it should be reproducible with the default > (i.e., unset) variable. Yes, yes, sorry, I properly used abc.py to reproduce the issue. However, SLE12SP5 does not seem to have $PYTHONPATH set, so it wont reproduce the issue as is. May I consider it as "not reproduceable" (i.e not an issue), since it requires the variable to be set manually? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1177182] New: Don't use DES as default password encryption
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1177182 Bug ID: 1177182 Summary: Don't use DES as default password encryption Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- If (/usr)/etc/login.defs does not specify ENCRYPT_METHOD, it defaults to DES. This means that if the file is deleted, not readable (typo) or something unrelated in YaST throws an exception (boo#1176714), passwords in /etc/shadow are trivially reversible. At this point we've used something else in the system provided login.defs for ages, so changing the default in the packages reading and applying those files (upstream?) should be safe. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1187971] [Build 20210701] Upgrading 42.3 using KDE Live runs into timeout
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187971 https://bugzilla.suse.com/show_bug.cgi?id=1187971#c2 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fvogt(a)suse.com --- Comment #2 from Fabian Vogt <fvogt(a)suse.com> --- From a quick glance, this looks like the bug where YaST does "rm -rf /run" is back... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1116658] Crash of Writer opening any document having "invalid" python file in home directory
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1116658 https://bugzilla.suse.com/show_bug.cgi?id=1116658#c40 --- Comment #40 from Matej Cepl <mcepl(a)suse.com> --- (In reply to Ednilson Miura from comment #38) > Hello, while testing SUSE:Maintenance:19058:243906 (libreoffice/sled12sp5) I > cannot reproduce the issue by simply placing foobar.py on $PWD and calling > oorwriter, but I can if I set PYTHONPATH (it is not set on sled12sp5) to > $(pwd). However, oowriter still crashing even after update if the variable > is set. What is the correct way to validate this fix? The file cannot be called foobar. See comment 4, it must be abc.py (or few other names of the standard library module names). Don��t fiddle with $PYTHONPATH it should be reproducible with the default (i.e., unset) variable. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187214] Leap 15.3: sle_version is not set
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187214 https://bugzilla.suse.com/show_bug.cgi?id=1187214#c15 Martin Wilck <martin.wilck(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(lnussel(a)suse.com) --- Comment #15 from Martin Wilck <martin.wilck(a)suse.com> --- (In reply to Michael Schr�der from comment #12) > The macro can't be in rpm-config-SUSE for SLE. That's exactly why we had to move it to the release package. Can you repeat the rationale here? > That leaves us with adding it to the release file. Who's responsible for > that package? Ludwig? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187018] [systemd248] various yast modules failing test suite
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187018 https://bugzilla.suse.com/show_bug.cgi?id=1187018#c12 --- Comment #12 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2021:2231-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1187018 CVE References: JIRA References: Sources used: SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): yast2-4.3.63-3.8.1 SUSE Linux Enterprise Installer 15-SP3 (src): yast2-4.3.63-3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187967] VUL-1: CVE-2021-36083: kimageformats: stack-based buffer overflow in XCFImageFormat::loadTileRLE
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187967 https://bugzilla.suse.com/show_bug.cgi?id=1187967#c1 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |fvogt(a)suse.com Resolution|--- |INVALID --- Comment #1 from Fabian Vogt <fvogt(a)suse.com> --- Already fixed some months ago: https://build.opensuse.org/request/show/890024 (Also in 15.3) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187967] New: VUL-1: CVE-2021-36083: kimageformats: stack-based buffer overflow in XCFImageFormat::loadTileRLE
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1187967 Bug ID: 1187967 Summary: VUL-1: CVE-2021-36083: kimageformats: stack-based buffer overflow in XCFImageFormat::loadTileRLE Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other URL: https://smash.suse.de/issue/303335/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-36083 KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-36083 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33742 https://github.com/google/oss-fuzz-vulns/blob/main/vulns/kimageformats/OSV-… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36083 https://invent.kde.org/frameworks/kimageformats/commit/297ed9a2fe339bfe3691… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1116658] Crash of Writer opening any document having "invalid" python file in home directory
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1116658 https://bugzilla.suse.com/show_bug.cgi?id=1116658#c39 Mark�ta Machov� <mmachova(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mmachova(a)suse.com --- Comment #39 from Mark�ta Machov� <mmachova(a)suse.com> --- Hi, just writing that the SLE-12-SP5 "inconvenience" is not being ignored, I am consulting it with some other people. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187925] any tpm2 command kills tpm2-abrmd service
by bugzilla_noreply＠suse.com 02 Jul '21

02 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187925 https://bugzilla.suse.com/show_bug.cgi?id=1187925#c4 --- Comment #4 from Alberto Planas Dominguez <aplanas(a)suse.com> --- (In reply to Johannes Segitz from comment #3) > do you have the AVC that is caused by this? I think that this is the one: type=AVC msg=audit(1625227411.946:131): avc: denied { read write } for pid=640 comm="dbus-daemon" path="socket:[26271]" dev="sockfs" ino=26271 scontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=0 There could be more. Reading some docs I managed to get this disabling the nonaudit rules with "semodule -DB" -- You are receiving this mail because: You are on the CC list for the bug.

1 0