October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1231594] New: Unable to drag'n'drop since plasma 6.2 update
by bugzilla_noreply＠suse.com 02 Nov '24

02 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231594 Bug ID: 1231594 Summary: Unable to drag'n'drop since plasma 6.2 update Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: pallaswept(a)proton.me QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I am unable to use drag'n'drop in various KDE applications, since updating to plasma 6.2 (or more specifically, since the 20241006 snapshot) I've noticed this in kate, dolphin, and the plasma desktop panels, such as task manager and launcher. Drag'n'drop works for example inside the browser (firefox). I filed bugs with KDE, they are unable to replicate, and have requested that I report this bug here. Upstream bugs: https://bugs.kde.org/show_bug.cgi?id=494581 https://bugs.kde.org/show_bug.cgi?id=494582 https://bugs.kde.org/show_bug.cgi?id=494520 https://bugs.kde.org/show_bug.cgi?id=494622 Video: (more available from links above, including with a new user account) https://bugsfiles.kde.org/attachment.cgi?id=174721 Thanks for any help you could give with this. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1231928] New: SDDM on external screen is not functional
by bugzilla_noreply＠suse.com 02 Nov '24

02 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231928 Bug ID: 1231928 Summary: SDDM on external screen is not functional Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: slawek(a)lach.art.pl QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- SDDM on external screen is not functional. Only password input/edit and show virtual keyboard appear. When typed password and press enter everything on external screen gets disabled. Window on internal screen works. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1232244] New: AUDIT-0: xfce4-power-manager: New PolKit rules added
by bugzilla_noreply＠suse.com 02 Nov '24

02 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232244 Bug ID: 1232244 Summary: AUDIT-0: xfce4-power-manager: New PolKit rules added Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: manfred.h(a)gmx.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 878186 --> https://bugzilla.suse.com/attachment.cgi?id=878186&action=edit Full build log xfce4-power-manager-4.19.3 has added polkit rules [ 43s] RPMLINT report: [ 43s] =============== [ 44s] xfce4-power-manager.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.xfce.power.xfce4-pm-helper (auth_admin:auth_admin:yes) [ 44s] The package allows unprivileged users to carry out privileged operations [ 44s] without authentication. This could cause security problems if not done [ 44s] carefully. If the package is intended for inclusion in any SUSE product please [ 44s] open a bug report to request review of the package by the security team. [ 44s] Please refer to [ 44s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 44s] more information. [ 44s] [ 44s] (none): E: badness 10000 exceeds threshold 1000, aborting. OBS repo: https://build.opensuse.org/package/show/home:manfred-h:X11:xfce:4.19/xfce4-… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1231270] New: RPi Zero 2 - SD-Device not found
by bugzilla_noreply＠suse.com 02 Nov '24

02 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231270 Bug ID: 1231270 Summary: RPi Zero 2 - SD-Device not found Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: kasimir_(a)outlook.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 877723 --> https://bugzilla.suse.com/attachment.cgi?id=877723&action=edit Screenshot of the error I tried the current image [1] on a RPi Zero 2 and found that the SD card reader is not found. See image in the attachment. PS: How can I display the boot messages on the serial interface? It didn't work with "earlycon=pl011,0x20201000,115200n8" or "earlycon=pl011,0x3f201000,115200n8" or "earlycon=uart8250,mmio32,0xfe215040" [1]https://download.opensuse.org/ports/aarch64/tumbleweed/appliances/openSUS… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1229057] New: createrepo_c - man8 link for createrepo.8.gz to createrepo_c.8.gz fails due to spurious '\' in file
by bugzilla_noreply＠suse.com 01 Nov '24

01 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1229057 Bug ID: 1229057 Summary: createrepo_c - man8 link for createrepo.8.gz to createrepo_c.8.gz fails due to spurious '\' in file Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: drankinatty(a)suddenlinkmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- createrepo_c includes the man page accessible through "man createrepo_c" and through the traditional name "man createrepo", e.g. /usr/share/man/man8/createrepo.8.gz /usr/share/man/man8/createrepo_c.8.gz The contents of createrepo.8.gz contain an additional '\' escaping the underscore that breaks this functionality. The contents are: $ zcat /usr/share/man/man8/createrepo.8.gz .so man8/createrepo\_c.8 Attempting to access the man page through "man createrepo" results in: $ man createrepo man: can't resolve man8/createrepo\_c.8 No manual entry for createrepo Possibly, man page is not installed, try online at: https://manpages.opensuse.org/createrepo Removing the '\' allows it to work normally. Thanks to Georg Pfuetzenreuter via openSUSE Users <users(a)lists.opensuse.org> for the investigation. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1232536] New: bpftrace: ERROR: Error attaching probe: 'kprobe:swap_readpage'
by bugzilla_noreply＠suse.com 01 Nov '24

01 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232536 Bug ID: 1232536 Summary: bpftrace: ERROR: Error attaching probe: 'kprobe:swap_readpage' Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: petr.vorel(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- bpftrace tests on Tumbleweed fails on # echo -e "\ninterval:s:5 { exit(); }" | cat /usr/share/bpftrace/tools/swapin.bt - | bpftrace - stdin:1-16: WARNING: swap_readpage is not traceable (either non-existing, inlined, or marked as "notrace"); attaching to it will likely fail Attaching 3 probes... cannot attach kprobe, Invalid argument ERROR: Error attaching probe: 'kprobe:swap_readpage' echo $? 255 # bpftrace --info System OS: Linux 6.11.5-1-default #1 SMP PREEMPT_DYNAMIC Wed Oct 23 04:27:11 UTC 2024 (b4e3aa9) Arch: x86_64 Build version: v0.21.2 LLVM: 18.1.8 unsafe probe: no bfd: no liblldb (DWARF support): yes libsystemd (systemd notify support): no Kernel helpers probe_read: yes probe_read_str: yes probe_read_user: yes probe_read_user_str: yes probe_read_kernel: yes probe_read_kernel_str: yes get_current_cgroup_id: yes send_signal: yes override_return: no get_boot_ns: yes dpath: yes skboutput: yes get_tai_ns: yes get_func_ip: yes jiffies64: yes for_each_map_elem: yes Kernel features Instruction limit: 1000000 Loop support: yes btf: yes module btf: yes map batch: yes uprobe refcount (depends on Build:bcc bpf_attach_uprobe refcount): yes Map types hash: yes percpu hash: yes array: yes percpu array: yes stack_trace: yes perf_event_array: yes ringbuf: yes Probe types kprobe: yes tracepoint: yes perf_event: yes kfunc: yes kprobe_multi: yes uprobe_multi: yes raw_tp_special: yes iter: yes Running the same test on Debian with kernel 6.11.5, and with these different build options it pass: LLVM: 18.1.8 bfd: no liblldb (DWARF support): yes -- You are receiving this mail because: You are on the CC list for the bug.

1 24

[Bug 1230090] New: VUL-0: CVE-2024-45305: watchexec: gix-path: gix-path uses local config across repos when it is the highest scope
by bugzilla_noreply＠suse.com 01 Nov '24

01 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1230090 Bug ID: 1230090 Summary: VUL-0: CVE-2024-45305: watchexec: gix-path: gix-path uses local config across repos when it is the highest scope Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other URL: https://smash.suse.de/issue/419537/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: david.anes(a)suse.com Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de CC: danilo.spinella(a)suse.com Blocks: 1230079 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1230079 +++ gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope. It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected. This issue has been addressed in release version 0.10.10. All users are advised to upgrade. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45305 https://www.cve.org/CVERecord?id=CVE-2024-45305 https://git-scm.com/docs/git-config#SCOPES https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232231] New: AUDIT-0: mousepad: New PolKit rules added
by bugzilla_noreply＠suse.com 01 Nov '24

01 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232231 Bug ID: 1232231 Summary: AUDIT-0: mousepad: New PolKit rules added Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: manfred.h(a)gmx.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 878180 --> https://bugzilla.suse.com/attachment.cgi?id=878180&action=edit Full build log mousepad update 0.6.3 has added polkit rules [ 31s] RPMLINT report: [ 31s] =============== [ 32s] ============================ rpmlint session starts ============================ [ 32s] rpmlint: 2.6.1 [ 32s] mousepad.x86_64: E: polkit-untracked-privilege (Badness: 10) org.xfce.mousepad (no:auth_admin:auth_admin) [ 32s] The polkit action is not listed in the polkit-default-privs profiles which [ 32s] makes it harder for admins to find. Furthermore improper polkit authorization [ 32s] checks can easily introduce security issues. If the package is intended for [ 32s] inclusion in any SUSE product please open a bug report to request review of [ 32s] the package by the security team. Please refer to [ 32s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 32s] more information. OBS repo: https://build.opensuse.org/package/show/X11:xfce/mousepad -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232696] New: YaST2 says im using systemd-boot but im not, crashes
by bugzilla_noreply＠suse.com 01 Nov '24

01 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232696 Bug ID: 1232696 Summary: YaST2 says im using systemd-boot but im not, crashes Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: jokingam(a)tuta.io QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0 Build Identifier: I changed bootloader to systemd-boot, it still uses grub2 and now crashes when i go to Bootloader options, and says i cannot go back to grub2. Reproducible: Always Steps to Reproduce: 1. Open YaST2 bootloader options 2. Have systemd-boot 3. Go into Bootloader Options Actual Results: Chrashed Expected Results: Work -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232608] New: VUL-0: CVE-2024-50602: audacity: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 01 Nov '24

01 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232608 Bug ID: 1232608 Summary: VUL-0: CVE-2024-50602: audacity: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: davejplater(a)gmail.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 5