March 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1220571] New: [META] Packages failing because GCC 14+ treats some warnings as errors
by bugzilla_noreply＠suse.com 26 Jul '24

26 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220571 Bug ID: 1220571 Summary: [META] Packages failing because GCC 14+ treats some warnings as errors Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mjambor(a)suse.com Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- GCC 14 treats the following situations, which were only warnings before, as errors: -Werror=implicit-int -Werror=implicit-function-declaration -Werror=declaration-missing-parameter-type -Werror=return-mismatch -Werror=int-conversion -Werror=incompatible-pointer-types More details about all of these cases together with the most common ways of addressing them and some associated pitfalls is available at https://gcc.gnu.org/gcc-14/porting_to.html For the record, clang has taken a similar step since clang 16, see for example https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16 The preferred method of dealing with these issues is of course fixing the code. Other distributions have shared patches from their porting efforts on relevant upstream mailing lists and bug trackers, Gentoo and RedHat are perhaps most active in this regard, so you can have a look at what they did for their packages at: - https://bugs.gentoo.org/showdependencytree.cgi?id=870412&hide_resolved=0 - https://gitlab.com/fweimer-rh/fedora-modernc/ In case there is for some reason not possible to fix the code, or at least to fix it in time for adoption of GCC 14, it is possible to turn these back to warnings by adding to the compiler options one of the following: -std=gnu89, -std=c89, or -fpermissive. (Especially if you use -fpermissive as a temporary workaround with intention to fix the underlying issues later, I'd suggest leaving the particular bug opened until it is done so.) -- You are receiving this mail because: You are on the CC list for the bug.

1 94

[Bug 1216537] New: xdg-utils perl requirement
by bugzilla_noreply＠suse.com 25 Jul '24

25 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1216537 Bug ID: 1216537 Summary: xdg-utils perl requirement Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: simonf.lees(a)suse.com Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de CC: jslaby(a)suse.com Target Milestone: --- Found By: --- Blocker: --- xdg-utils requires perl via /usr/bin/xdg-screensaver. On minimal systems we'd like to avoid any extra script interpreters. Any chance to avoid using perl there? -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1218640] New: The libxkbregistry-devel-32bit package is missing
by bugzilla_noreply＠suse.com 25 Jul '24

25 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1218640 Bug ID: 1218640 Summary: The libxkbregistry-devel-32bit package is missing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: fgouget(a)codeweavers.com QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The libxkbregistry-devel-32bit package is missing: suset-64:~ # zypper install libxkbregistry-devel-32bit Loading repository data... Reading installed packages... Package 'libxkbregistry-devel-32bit' not found. Resolving package dependencies... Nothing to do. Wine uses this package to run 32-bit Windows applications when using Wayland for the graphics layer. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1221006] New: GCC 14: linux-atm package fails
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221006 Bug ID: 1221006 Summary: GCC 14: linux-atm package fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: michal.jires(a)suse.com QA Contact: qa-bugs(a)suse.de CC: jbohac(a)suse.com Blocks: 1220571 Target Milestone: --- Found By: --- Blocker: --- Building linux-atm with GCC 14 fails here: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… Due to (exhaustive list of errors): 100 | fprintf(stderr,"internal error: len %d %% %d\n",req.length, conn.c: In function ‘accept_conn’: conn.c:414:57: error: passing argument 3 of ‘accept’ from incompatible pointer type [-Wincompatible-pointer-types] 414 | fd = accept(conn->fd, (struct sockaddr *)&addr, &len); | ^~~~ | | | size_t * {aka long unsigned int *} In file included from ../../src/include/atm.h:10, from conn.c:42: /usr/include/sys/socket.h:307:42: note: expected ‘socklen_t * restrict’ {aka ‘unsigned int * restrict’} but argument is of type ‘size_t *’ {aka ‘long unsigned int *’} 307 | socklen_t *__restrict __addr_len); | ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~ See the meta bug#1220571 for more info. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1220103] New: parcellite locks up when 'clear option is selected from the toolbar popup menu
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220103 Bug ID: 1220103 Summary: parcellite locks up when 'clear option is selected from the toolbar popup menu Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- parcellite-1.2.1-bp155.3.13.x86_64 When the 'clear' option is selected from parcellite toolbar popup menu a dialog with two buttons is displayed. It does not react to mouse clicks not keyboard input, and blocks further interaction with parcellite. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1217967] New: grub2: verification build issue
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1217967 Bug ID: 1217967 Summary: grub2: verification build issue Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: jlee(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: mchang(a)suse.com Target Milestone: --- Found By: --- Blocker: --- While working on reproducible builds for ALP + openSUSE, I found that our grub2 package produced different results when built locally compared to the official Factory build on OBS. My guess is that it comes from https://github.com/openSUSE/pesign-obs-integration filterdiff 'rpm -qp --qf %{PLATFORM}\n' binaries*/grub2-2.12~rc1-12.1.x86_64.rpm --- rpm -qp --qf %{PLATFORM}\n binaries/grub2-2.12~rc1-12.1.x86_64.rpm +++ rpm -qp --qf %{PLATFORM}\n binaries.nachbau/grub2-2.12~rc1-12.1.x86_64.rpm @@ -1 +1 @@ -x86_64-suse-linux +i386-suse-linux-gnu using https://github.com/bmwiedemann/reproducibleopensuse/blob/master/filterdiff Apart from that, there is the (probably unavoidable) sig itself: --- old /usr/share/grub2/x86_64-efi/grub.efi (hex) +++ new /usr/share/grub2/x86_64-efi/grub.efi (hex) @@ -1,6 +1,6 @@ 00000100 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 |................| 00000110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| -00000120 00 00 00 00 00 00 00 00 00 50 1f 00 70 07 00 00 |.........P..p...| +* 00000130 00 30 1f 00 00 20 00 00 00 00 00 00 00 00 00 00 |.0... ..........| 00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1213659] New: VUL-0: CVE-2023-38496: apptainer: Ineffective privileges drop when requesting container network
by bugzilla_noreply＠suse.com 22 Jul '24

22 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1213659 Bug ID: 1213659 Summary: VUL-0: CVE-2023-38496: apptainer: Ineffective privileges drop when requesting container network Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/373431/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: cgoll(a)suse.com Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Apptainer is an open source container platform. Version 1.2.0-rc.2 introduced an ineffective privilege drop when requesting container network setup, therefore subsequent functions are called with root privileges, the attack surface is rather limited for users but an attacker could possibly craft a starter config to delete any directory on the host filesystems. A security fix has been included in Apptainer 1.2.1. There is no known workaround outside of upgrading to Apptainer 1.2.1. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-38496 https://bugzilla.redhat.com/show_bug.cgi?id=2226582 https://www.cve.org/CVERecord?id=CVE-2023-38496 http://www.cvedetails.com/cve/CVE-2023-38496/ https://github.com/apptainer/apptainer/pull/1523 https://github.com/apptainer/apptainer/pull/1578 https://github.com/apptainer/apptainer/security/advisories/GHSA-mmx5-32m4-w… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1221557] New: flatpak runtime org.kde.Platform 6.6 does not reliably verify SSL certs
by bugzilla_noreply＠suse.com 21 Jul '24

21 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1221557 Bug ID: 1221557 Summary: flatpak runtime org.kde.Platform 6.6 does not reliably verify SSL certs Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Flatpak Assignee: rbrown(a)suse.com Reporter: vortex(a)z-ray.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0 Build Identifier: Hello there this came to my attention as OBS Studio updated their flatpak from 30.0.2 to 30.1.0 where they also changed the used runtime form KDE Platform 6.5 to 6.6. Since that update browser sources and browser docks do no longer work if they are pointing at an HTTPS protected site. While with runtime 6.5 it still works fine (more details below). Browser docks are only available in a X11 session due to bugs under Wayland but also the only one to actually show an error message while browser sources are completely silent and simply keep empty. Beside the steps to reproduce other findings made in the meantime before reporting here. This happens on openSUSE Leap 15.6, openSUSE Tumbleweed, openSUSE Aeon and openSUSE Kalpa. Running the OBS Studio flatpak on virtually any other Linux distribution (Tested Ubuntu 22.04, Fedora 39, Arch Linux) does work just fine. Nevertheless I report the bug for Aeon as Aeon and Kalpa heavily rely on flatpaks and this issue is more imminent for them than for regular Tumbleweed and Leap. Other things I tried was running the OBS Studio 30.1.0 *.dep package from inside a Ubuntu 22.04 distrobox container running on my openSUSE Aeon host. Browser sources and docks worked just fine. Also I ran a Ubuntu 22.04 VM on my openSUSE Aeon host using Gnome Boxes and the flatpak version of OBS Studio, browser sources and docks worked just fine too. Furthermore I build the OBS Studio flatpak locally using fkatpab-builder from inside a openSUSE Tumbleweed distrobox using runtime 6.5 instead of 6.6. That OBS Studio flatpak did worked just fine on my openSUSE Aeon and inside the openSUSE Tumlbeweed distrobox container. Whilst building it with 6.6 was broken again. To build OBS Studio with a different runtime do the following: 1) git clone --recursive https://github.com/obsproject/obs-studio.git 2) Change the content of obs-studio/build-aux/com.obsproject.Studio to ruse runtime 6.5 instead of 6.6 (line 4) 3) flatpak-builder --force-clean --install-deps-from=flathub --user --install --ccache --mirror-screenshots-url=https://dl.flathub.org/media/ build-dir build-aux/com.obsproject.Studio.json --user --install Reproducible: Always Steps to Reproduce: 1. Install OBS Studio flatpak 30.1.0 2. Add a browser dock or a browser source pointing to an https site 3. See nothing or in case of a dock the error: ERR_CERT_AUTHORITY_INVALID URL: https://obsproject.com/browser-source Actual Results: Empty browser source or a browser dock showing ERR_CERT_AUTHORITY_INVALID URL: https://obsproject.com/browser-source Expected Results: Browser sources and docks to work Thsi bug was firstly reported to OBS Studio where we found out it's actually the runtime causeing the issue: https://github.com/obsproject/obs-studio/issues/10385 And reported to KDE where they asked me to better open up the issue directly for openSUSE as other distributions are not affected over here: https://bugs.kde.org/show_bug.cgi?id=483746 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1218581] New: Version of mesa and mesa-drivers different
by bugzilla_noreply＠suse.com 20 Jul '24

20 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1218581 Bug ID: 1218581 Summary: Version of mesa and mesa-drivers different Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: ecsos(a)schirra.net QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Version of mesa and mesa-drivers different. This means that not a single package can be built in the build service that mesa requires. Message in OBS: The build can not begin, because required packages are either missing or not explicitly defined. Build jobs exist for the repository unresolvable: nothing provides Mesa = 22.3.5 needed by Mesa-dri, (got version 23.3.2-lp156.1520.1) -- You are receiving this mail because: You are on the CC list for the bug.

1 7