October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1225509] New: AUDIT-FIND: 4Pane: predictable /tmp path in PreviewPopup::DisplayImage
by bugzilla_noreply＠suse.com 27 Nov '24

27 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1225509 Bug ID: 1225509 Summary: AUDIT-FIND: 4Pane: predictable /tmp path in PreviewPopup::DisplayImage Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- 4Pane uses predictable /tmp paths in PreviewPopup::DisplayImage() > 2054 pngfilepath = "/tmp/" + fn.GetName() + ".png"; > 2055 if (SvgToPng(filepath, pngfilepath, handle)) > 2056 image = wxImage(pngfilepath); > 2057 wxRemoveFile(pngfilepath); If fs.protected_symlinks=1, an unprivileged user can prevent 4Pane from displaying previews for SVG images. If fs.protected_symlinks=0, an unprivileged user can overwrite arbitrary world-readable files owned by the 4Pane user. Steps to reproduce: nobody@localhost:/tmp> ln -s /home/user/somefile foo.png # ... wait until the user previews a file named foo.svg # somefile will be overwritten An attacker can pre-create symlinks for the names of all existing SVG files on the system to increase the likelihood of triggering the bug. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232668] New: displaylink driver uses wrong ethernet module cdc_ncm instead of r8152
by bugzilla_noreply＠suse.com 26 Nov '24

26 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232668 Bug ID: 1232668 Summary: displaylink driver uses wrong ethernet module cdc_ncm instead of r8152 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Drivers Assignee: kernel-bugs(a)suse.de Reporter: cookie170(a)web.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The Lenovo USB-C Hybrid Dock (40AF) comes with a Realtek chip for the ethernet connection: r8152 and as far as I can see the displaylink.rules assume, the correct driver for ethernet were cdc_ncm. But no: There is a special r8152 driver, which seems to be included in the kernel. cdc_ncm does not work well with this chip. Suspend leads to crash which causes strange network effects in LAN. See this file: https://build.opensuse.org/projects/X11:XOrg/packages/displaylink-driver/fi… Discussion see here: https://forums.opensuse.org/t/realtek-r8152-build-with-dkms-fails/179813 The displaylink driver is provided by X11:Xorg repo https://download.opensuse.org/repositories/X11:/XOrg/ Workaround: - Download r8152 from github, make, sudo depmod -a, sudo make install. Copy the udev-rules file from downloaded archive to /etc/udev/rules.d. The ethernet connection will work, until the next kernel update. I've no idea why dkms fails with r8152, I've described my efforts in the openSUSE forum, as linked above. I'm a user. It's simply my assumption that the rules file were the culprit. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1231347] New: javapackages-tools should require which
by bugzilla_noreply＠suse.com 26 Nov '24

26 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231347 Bug ID: 1231347 Summary: javapackages-tools should require which Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Java Assignee: java-maintainers(a)suse.de Reporter: dmueller(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- $ grep which /usr/share/java-utils/java-functions JAVACMD=$(which java 2>/dev/null || :) local cmd=$(which xmvn-resolve 2>/dev/null || :) this is sourced by tomcat, and it fails to start if which is not found. it should require which (either javapackage-tools or tomcat) -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1231821] New: Regression: winegcc requires absolute library path
by bugzilla_noreply＠suse.com 26 Nov '24

26 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1231821 Bug ID: 1231821 Summary: Regression: winegcc requires absolute library path Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: aleithner(a)level101.at QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Using winegcc from wine-devel currently requires setting the -L flag to be able to link Winelib DLLs. E.g., it is required to include -L/usr/lib64/wine/i386-unix when compiling and linking a 32-bit Winelib DLL. Building Wine from source on my machine yields a winegcc which knows where Wine's libraries and archives are located (making -L unnecessary). It was hinted that specifying -L explicitly should not be needed on the Wine developer's mailing list. For context and reference, see the Wine Developer's mailing list thread [1] where I have asked about this originally. [1]: https://list.winehq.org/mailman3/hyperkitty/list/wine-devel@winehq.org/thre… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232545] New: VUL-0: CVE-2024-42460,CVE-2024-42461,CVE-2024-42459: python-pytest-html: elliptic: Multiple vulnerabilities fixed in elliptic version 6.5.7
by bugzilla_noreply＠suse.com 25 Nov '24

25 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232545 Bug ID: 1232545 Summary: VUL-0: CVE-2024-42460,CVE-2024-42461,CVE-2024-42459: python-pytest-html: elliptic: Multiple vulnerabilities fixed in elliptic version 6.5.7 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/416168/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-42459:5.3:(AV:N/AC:L/PR:N/UI:N/ S:U/C:L/I:N/A:N) CVSSv3.1:SUSE:CVE-2024-42460:5.3:(AV:N/AC:L/PR:N/UI:N/ S:U/C:L/I:N/A:N) CVSSv3.1:SUSE:CVE-2024-42461:5.3:(AV:N/AC:L/PR:N/UI:N/ S:U/C:L/I:N/A:N) Severity: Normal Priority: P5 - None Component: Security Assignee: daniel.garcia(a)suse.com Reporter: gianluca.gabrielli(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232538 Target Milestone: --- Found By: --- Blocker: --- CVE-2024-42459: In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended. CVE-2024-42460: In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero. CVE-2024-42461: In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. The upstream fix for all the above mentioned CVEs is accb61e [0] and was part of version 6.5.7. References: https://github.com/indutny/elliptic/pull/317 [0] https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b3389310… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1232548] New: VUL-0: CVE-2024-42460,CVE-2024-42461,CVE-2024-42459: deepin-manual: elliptic: Multiple vulnerabilities fixed in elliptic version 6.5.7
by bugzilla_noreply＠suse.com 25 Nov '24

25 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232548 https://bugzilla.suse.com/show_bug.cgi?id=1232548#c1 Bug ID: 1232548 Summary: VUL-0: CVE-2024-42460,CVE-2024-42461,CVE-2024-42459: deepin-manual: elliptic: Multiple vulnerabilities fixed in elliptic version 6.5.7 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/416168/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-42459:5.3:(AV:N/AC:L/PR:N/UI:N/ S:U/C:L/I:N/A:N) CVSSv3.1:SUSE:CVE-2024-42460:5.3:(AV:N/AC:L/PR:N/UI:N/ S:U/C:L/I:N/A:N) CVSSv3.1:SUSE:CVE-2024-42461:5.3:(AV:N/AC:L/PR:N/UI:N/ S:U/C:L/I:N/A:N) Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: gianluca.gabrielli(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232538 Target Milestone: --- Found By: --- Blocker: --- --- Comment #1 from Gianluca Gabrielli <gianluca.gabrielli(a)suse.com> --- CVE-2024-42459: In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended. CVE-2024-42460: In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero. CVE-2024-42461: In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. The upstream fix for all the above mentioned CVEs is accb61e [0] and was part of version 6.5.7. References: https://github.com/indutny/elliptic/pull/317 [0] https://github.com/indutny/elliptic/commit/accb61e9c1a005e5c8ff96a8b3389310… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1230023] New: ProtonVPN-gui not working (problem with credentials)
by bugzilla_noreply＠suse.com 25 Nov '24

25 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1230023 Bug ID: 1230023 Summary: ProtonVPN-gui not working (problem with credentials) Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: zb4ng(a)arcor.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The Package ProtonVPN-gui that I installed with Yast doesn't work with openSUSE LEAP: I made a support request with ProtonVPN and they replied that ProtonVPN doesn't support openSUSE at all. The following is my original request with bug description: I'm using openSUSE Leap 15.6 with NetworkManager and I want to try the free version of ProtonVPN, so I installed it via the YaST SoftwareManagement, which is the usual way on openSUSE. This is the Proton VPN GUI-Client that was installed: Proton VPN: v1.12.0 (library: v3.7.0 / api-client: v0.7.1) However, I can't get it working, since the client demands credentials that I don't seem to have. In more detail this is what happens: I log into the client with my Proton Account. Then I try to connect to some server in the Netherlands. Then I have to enter my root password and afterwards my secrets (I assumed this is the OpenVPN / IKEv2 username/ password, I have also tried the Proton Account password). This is the text of the dialog: Title: "VPN secrets (openvpn) dialog - KDE Daemon" Text = "Authenticate ProtonVPN NL-FREE#299142 - Provide the secrets for the VPN connection 'ProtonVPN NL-FREE#299142': - A password is required:" Whatever I enter here, nothing works, the same dialog keeps popping up. I don't know password I need here other then the ones mentioned above. Moreover, when I shut ProtonVPN down, my internet isn't working anymore and - as I found out - DNS was missing, so I always have to delete the file that is created in the folder "/etc/NetworkManager/system-connections" and reboot. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1213370] New: tesseract-ocr should not be built with experimantal opencl support
by bugzilla_noreply＠suse.com 25 Nov '24

25 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1213370 Bug ID: 1213370 Summary: tesseract-ocr should not be built with experimantal opencl support Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: opensuse(a)titlis.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- opencl in tesseract-ocr is considered experimental, according to this thread (https://groups.google.com/g/tesseract-ocr/c/eIQbsurfSEM/m/mVb_4GF1BgAJ) it is considered just an entry point for possible developers. Their own doucmentantion (https://tesseract-ocr.github.io/tessdoc/TesseractOpenCL.html) states: "Important note: OpenCL support in Tesseract is still considered experimental. There are some major bugs associated with it (see issue 837). Building Tesseract with OpenCL support is not recommended (for any version of Tesseract), unless you are a developer and want to improve the OpenCL code" Please remove the flag "--enable-opencl" from https://build.opensuse.org/package/view_file/openSUSE:Factory/tesseract-ocr… This would also resolve https://bugzilla.opensuse.org/show_bug.cgi?id=1207570 PS: I indeed encounter problems with the opencl code path -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232568] New: arm-none-eabi tools are broken
by bugzilla_noreply＠suse.com 24 Nov '24

24 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1232568 Bug ID: 1232568 Summary: arm-none-eabi tools are broken Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: aaron.w2(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I am running into issues with the arm-none-eabi cross toolchain from the devel:gcc repository. It appears to be missing some key components compared to the official ARM release. For example, the libc_nano/libg_nano components are missing. This is related to Bug 1208585. The nano libraries should be included with the arm-none-eabi tools. The official ARM toolchain can be downloaded at https://developer.arm.com/downloads/-/arm-gnu-toolchain-downloads Note that the latest official release is gcc-13. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1226321] New: HTTPie SSL certificate problems with python-requests 2.32.3 (fine with 2.32.2)
by bugzilla_noreply＠suse.com 24 Nov '24

24 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1226321 Bug ID: 1226321 Summary: HTTPie SSL certificate problems with python-requests 2.32.3 (fine with 2.32.2) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After update of python311-requests to version 2.32.3 HTTPie stopped accepting SSL certificates: ``` https google.com https: error: SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))) while doing a GET request to URL: https://google.com/ ``` Downgrading python311-requests to 2.32.2 from history [1] solves the problem and HTTPie works fine again. IDK if it's a python-requests API change and this should be reported upstream. [1] https://cdn.opensuse.org/history/20240610/tumbleweed/repo/oss/noarch/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2