September 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1193873] New: VUL-0: CVE-2020-36428: matio: heap-based buffer overflow in ReadInt32DataDouble
by bugzilla_noreply＠suse.com 08 Dec '22

08 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1193873 Bug ID: 1193873 Summary: VUL-0: CVE-2020-36428: matio: heap-based buffer overflow in ReadInt32DataDouble Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/304604/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: badshah400(a)gmail.com Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). References: https://bugzilla.redhat.com/show_bug.cgi?id=1985239 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36428 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21421 https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2020-799… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36428 http://www.cvedetails.com/cve/CVE-2020-36428/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1193874] New: VUL-0: CVE-2021-36977: matio: heap-based buffer overflow in H5MM_memcpy()
by bugzilla_noreply＠suse.com 08 Dec '22

08 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1193874 Bug ID: 1193874 Summary: VUL-0: CVE-2021-36977: matio: heap-based buffer overflow in H5MM_memcpy() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/304598/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: badshah400(a)gmail.com Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry). References: https://bugzilla.redhat.com/show_bug.cgi?id=1984613 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-36977 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36977 https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2021-440… -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1203519] New: floating shutdown problem on pinebook pro
by bugzilla_noreply＠suse.com 08 Dec '22

08 Dec '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203519 Bug ID: 1203519 Summary: floating shutdown problem on pinebook pro Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: werwolf131313(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- intermittent shutdown problem on pinebook pro, the problem is expressed as follows: after the laptop is turned off (it doesn��t matter by the button in the menu or via sudo systemctl shutdown), a regular shutdown occurs, the service stop log is visible and everything is as it should be, BUT, after the screen goes blank, the board remains on. this can be checked if you try to turn it on, pressing the button does not work. only a long press of the power key (to completely turn off) for 7-10 seconds, and a second press (to turn it on) allows you to turn on the pinebook. the problem is not observed in other distributions (tried on manjaro, armbian, gentoo) and is specific to opensuse. in my case, the installation differs from the typical one in that the operating system is installed on a microsd card (due to the death of emmc), can this affect? but in other distributions, even installed on the same microsd card, the problem is not observed. I'm using opensuse tumbleweed installed from the openSUSE-Tumbleweed-ARM-KDE-pinebookpro.aarch64.raw.xz image. at the moment there are all the latest updates, but the problem has existed for quite a long time. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1173926] New: osc lbl terrible slow
by bugzilla_noreply＠suse.com 07 Dec '22

07 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1173926 Bug ID: 1173926 Summary: osc lbl terrible slow Classification: Internal Novell Products Product: openSUSE Build Service Version: master Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: osc Assignee: adrian.schroeter(a)suse.com Reporter: marco.strigl(a)suse.com QA Contact: adrian.schroeter(a)suse.com Found By: --- Blocker: --- With big build logs, doing osc lbl takes a long time: $ time isc lbl > /dev/null real 0m34.623s user 0m34.507s sys 0m0.069s $ time cat /var/tmp/build-root/standard-x86_64/.build.log > /dev/null real 0m0.315s user 0m0.001s sys 0m0.079s -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1160446] New: osc (or obs) creates wrong submit request
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1160446 Bug ID: 1160446 Summary: osc (or obs) creates wrong submit request Classification: Internal Novell Products Product: openSUSE Build Service Version: master Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: osc Assignee: adrian(a)suse.com Reporter: snwint(a)suse.com QA Contact: adrian(a)suse.com Found By: --- Blocker: --- 'osc sr -r N ...' does not work correctly (specifying a release). Compare # osc sr -r 1227 openSUSE.org:system:install:head installation-images SUSE:SLE-15-SP1:Update https://build.suse.de/request/show/208898 (wrong) with (copying revision 1227 to another project and submitting that) https://build.suse.de/request/show/208900 (ok) The bad part is that osc in both cases shows the same diff - see the build.suse.de pages but the actual submission is different - see the changelog diff. Despite '-r' the latest version is submitted. -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1156501] New: Regression: can not use OSC without kwallet
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1156501 Bug ID: 1156501 Summary: Regression: can not use OSC without kwallet Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Factory Status: NEW Keywords: dogfood Severity: Critical Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: werner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: fabian(a)ritter-vogt.de, tchvatal(a)suse.com Found By: --- Blocker: --- Latest Tumbleweed cause that osc triggers the start of kwalletd5 and this leads to an error | Error when attempting to decrypt the wallet kdewallet using GPG. If you're | using a SmartCard, please ensure it's inserted then try again. | | GPG error was Inappropriate ioctl for device That is I can not set my passphrase anymore. I'm not using KDE, I'm a fvwm2+lsxession user. Without passphrase I can not work on my Tumblweed workstation anymore hence this is critical -- You are receiving this mail because: You are on the CC list for the bug.

2 34

[Bug 1155953] New: osc v0.166 broke my osc vc use case
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1155953 Bug ID: 1155953 Summary: osc v0.166 broke my osc vc use case Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: brogers(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I use the following: osc vc --file=$package.changes.proposed $package where $package is in this case qemu or qemu-linux-user (see qemu package sources if you want context, in particular the update_git.sh script. In this specific instance, I working on this IBS project/package: https://build.suse.de/package/show/home:bfrogers:branches:Devel:Virt:SLE-15…) The file passed has content I want automatically added to qemu.changes or qemu-linux-user.changes. This command no longer works as before, instead I am left with a new file: $package.changes.proposed.changes, which is wrong. -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1154972] New: release osc 0.166.0^
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1154972 Bug ID: 1154972 Summary: release osc 0.166.0^ Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: marco.strigl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- New version of osc for the following distributions: openSUSE Tumbleweed openSUSE Leap 15.1 SLES 15 SLES 15.1 0.166.0 - New password handling backend. Supported password stores: * Plaintext password * Obfuscated password * python-keyring (kwallet, secret store) * gnome-keyring * no store at all (ask for the password every time - Refactor initial setup of osc (to select password store) - fix decoding on osc lbl (boo#1137477) - fix breakage of submitting complete branches back as an submit request that contain packages without a change. - fix error with plugins and osc -h - various decoding improvements - Transfer the name of the input file to vc instead of the content (obs-build/vc will do the rest and open the file). - support appimage builds - new command browse. (opens a browser opening the project or package) - new option --incoming for osc rq and osc review to only show only incoming reqeusts for a project. -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1144211] New: [TRACKERBUG] update osc to version 0.165.3
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1144211 Bug ID: 1144211 Summary: [TRACKERBUG] update osc to version 0.165.3 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: marco.strigl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- 0.165.4 - allow optional fork when creating a maintenance request - fix RPMError fallback - fix local caching for all package formats - fix appname for trusted cert store - osc -h does not break anymore when using plugins -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1142662] New: [TRACKERBUG] update osc to version 0.165.3
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1142662 Bug ID: 1142662 Summary: [TRACKERBUG] update osc to version 0.165.3 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: marco.strigl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- important fixes: - fixed broken TLS certificate handling (boo#1142518, CVE-2019-3685) - switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing old behavior results in non working osc diff, ci and rq on packages -- You are receiving this mail because: You are on the CC list for the bug.

2 10