April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1215347] New: VUL-0: CVE-2023-4863: zola: Heap buffer overflow in WebP
by bugzilla_noreply＠suse.com 27 Nov '24

27 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1215347 Bug ID: 1215347 Summary: VUL-0: CVE-2023-4863: zola: Heap buffer overflow in WebP Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/377966/ OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Security Assignee: socvirnyl.estela(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: Andreas.Stieger(a)gmx.de, gianluca.gabrielli(a)suse.com, gmbr3(a)opensuse.org, gnome-bugs(a)suse.de, jengelh(a)inai.de, m.szczepaniak.000(a)gmail.com, martin.sirringhaus(a)suse.com, meissner(a)suse.com, security-team(a)suse.de, wolfgang(a)rosenauer.org, xiaoguang.wang(a)suse.com Depends on: 1215231 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1215231 +++ CVE-2023-4863 The Stable and Extended stable channels has been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. This update includes 1 security fix. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06 Google is aware that an exploit for CVE-2023-4863 exists in the wild. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=1479274 References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-des… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4863 https://bugzilla.redhat.com/show_bug.cgi?id=2238431 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1213370] New: tesseract-ocr should not be built with experimantal opencl support
by bugzilla_noreply＠suse.com 25 Nov '24

25 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1213370 Bug ID: 1213370 Summary: tesseract-ocr should not be built with experimantal opencl support Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: opensuse(a)titlis.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- opencl in tesseract-ocr is considered experimental, according to this thread (https://groups.google.com/g/tesseract-ocr/c/eIQbsurfSEM/m/mVb_4GF1BgAJ) it is considered just an entry point for possible developers. Their own doucmentantion (https://tesseract-ocr.github.io/tessdoc/TesseractOpenCL.html) states: "Important note: OpenCL support in Tesseract is still considered experimental. There are some major bugs associated with it (see issue 837). Building Tesseract with OpenCL support is not recommended (for any version of Tesseract), unless you are a developer and want to improve the OpenCL code" Please remove the flag "--enable-opencl" from https://build.opensuse.org/package/view_file/openSUSE:Factory/tesseract-ocr… This would also resolve https://bugzilla.opensuse.org/show_bug.cgi?id=1207570 PS: I indeed encounter problems with the opencl code path -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1219306] New: [Tracker[ Remove python2 from openSUSE:Factory
by bugzilla_noreply＠suse.com 21 Nov '24

21 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1219306 Bug ID: 1219306 Summary: [Tracker[ Remove python2 from openSUSE:Factory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This bug report serves as parent to file tickets against packages still using python2 (our long-awaited gimp 3 should be coming out in May - let's collect what else is still in need of python2, trying to eliminate these things) -- You are receiving this mail because: You are on the CC list for the bug.

1 26

[Bug 1219405] New: older clang package depends on latest libLLVM
by bugzilla_noreply＠suse.com 19 Nov '24

19 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1219405 Bug ID: 1219405 Summary: older clang package depends on latest libLLVM Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: shung-hsi.yu(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Trying to install older clang will pull in the latest llvm package (libclang13 and libLLVM17): > $ zypper install clang16 # (latest is clang17 at the moment) > > The following 11 NEW packages are going to be installed: > clang16 libLLVM16 libLLVM17 libclang-cpp16 libclang-cpp17 libclang13 > libedit0 libmpdec3 libpython3_11-1_0 python311-base update-alternatives The problem is likely that c-index-test-16 is incorrectly linked to /lib64/libclang.so.13 that is created from the latest llvm package (llvm17 at the moment), and that ends up making it linked to both the latest llvm shared library (libLLVM.so.17 from llvm17) as well as one in the corresponding package (libLLVM.so.16 from llvm16). > $ ldd /usr/bin/c-index-test-16.0.6 > linux-vdso.so.1 (0x00007ffce2336000) > libclang.so.13 => /lib64/libclang.so.13 (0x00007fb21ca18000) > libclang-cpp.so.16 => /lib64/libclang-cpp.so.16 (0x00007fb218800000) > libxml2.so.2 => /lib64/libxml2.so.2 (0x00007fb218690000) > libLLVM.so.16 => /lib64/libLLVM.so.16 (0x00007fb211200000) > libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fb210e00000) > libc.so.6 => /lib64/libc.so.6 (0x00007fb210a00000) > libclang-cpp.so.17 => /lib64/libclang-cpp.so.17 (0x00007fb20c800000) > libLLVM.so.17 => /lib64/libLLVM.so.17 (0x00007fb205200000) > libm.so.6 => /lib64/libm.so.6 (0x00007fb21c92f000) > /lib64/ld-linux-x86-64.so.2 (0x00007fb21cb11000) > libz.so.1 => /lib64/glibc-hwcaps/x86-64-v3/libz.so.1.3 (0x00007fb218676000) > liblzma.so.5 => /lib64/glibc-hwcaps/x86-64-v3/liblzma.so.5.4.5 (0x00007fb21863d000) > libedit.so.0 => /lib64/libedit.so.0 (0x00007fb218601000) > libtinfo.so.6 => /lib64/libtinfo.so.6 (0x00007fb2111c5000) > libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fb2111a0000) c-index-test-16.0.6 thus will segfault when ran > #0 0x00007fccc253d319 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/lib64/libLLVM.so.17+0x3b3d319) > #1 0x00007fccc253aed2 llvm::sys::RunSignalHandlers() (/lib64/libLLVM.so.17+0x3b3aed2) > #2 0x00007fccc253db9b (/lib64/libLLVM.so.17+0x3b3db9b) > #3 0x00007fccca23f190 __restore_rt (/lib64/libc.so.6+0x3f190) > #4 0x00007fccc724587a (/lib64/libclang-cpp.so.17+0x124587a) > #5 0x00007fccca2414e1 __cxa_finalize (/lib64/libc.so.6+0x414e1) > #6 0x00007fccc719c0f7 (/lib64/libclang-cpp.so.17+0x119c0f7) > Segmentation fault (core dumped) -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1219879] New: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0
by bugzilla_noreply＠suse.com 18 Nov '24

18 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1219879 Bug ID: 1219879 Summary: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: otto.hollmann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This bug collects the challenges and packages that need to be adapted before removing OpenSSL 1.1.1 and OpenSSL 1.0.0 OpenSSL 1.1.1 (package openssl1_1) is EOL since 11th September 2023. OpenSSL 1.0.0 (package openssl1_0_0) is EOL since 31th December 2019. Therefore, it makes sense to get rid of them and we are going to remove them from Factory in the near future. Unfortunately some packages still rely/depend on these old OpenSSL versions. If we would like to keep these packages, they must be adapted to use OpenSSL 3. Currently these packages are usually hardcoded to use specific openssl package, e.g.: > BuildRequires: libopenssl-1_1-devel The preferred way is to use our meta package > BuildRequires: libopenssl or > BuildRequires: libopenssl-devel that will always pull respective packages with the default OpenSSL version (at the moment libopenssl3 or libopenssl-3-devel). Migration guide can be found here: https://www.openssl.org/docs/man3.0/man7/migration_guide.html List of packages that are using old OpenSSL: dd_rescue EternalTerminal fdo-client libredfish libzrtpcpp python -- You are receiving this mail because: You are on the CC list for the bug.

1 22

[Bug 1221183] New: Upgrade problems with clang-cpp
by bugzilla_noreply＠suse.com 18 Nov '24

18 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1221183 Bug ID: 1221183 Summary: Upgrade problems with clang-cpp Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Linux Status: NEW Severity: Normal Priority: P5 - None Component: Upgrade Problems Assignee: screening-team-bugs(a)suse.de Reporter: franz.sirl-obs(a)lauterbach.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Hi, during a "zypper --releasever=15.6 dup" upgrade from a fully up-to-date 15.5 installation I got the following messages: Checking for file conflicts: ...................................................................................................................................................................[error] Detected 4 file conflicts: File /usr/bin/clang-cpp from install of clang17-17.0.6-150600.1.13.x86_64 (Main Repository) conflicts with file from install of clang13-13.0.1-bp156.7.42.x86_64 (Main Repository) File /usr/bin/clang-cpp from install of clang17-17.0.6-150600.1.13.x86_64 (Main Repository) conflicts with file from package clang11-11.0.1-150300.3.6.1.x86_64 (@System) File /usr/bin/clang-cpp from install of clang17-17.0.6-150600.1.13.x86_64 (Main Repository) conflicts with file from package clang15-15.0.7-150500.4.4.1.x86_64 (@System) File /usr/bin/clang-cpp from install of clang17-17.0.6-150600.1.13.x86_64 (Main Repository) conflicts with file from package clang7-7.0.1-150100.3.22.2.x86_64 (@System) File conflicts happen when two packages attempt to install files with the same name but different contents. If you continue, conflicting files will be replaced losing the previous content. Continue? [yes/no] (no): yes Even though this is mostly harmless, it disturbs the upgrade experience and probably can be easily fixed by backporting the clang-cpp/update-alternatives change from clang17 to the other clang versions that are part of Leap. regards, Franz -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1215403] New: SDDM default display-manager cannot login to X11 desktop
by bugzilla_noreply＠suse.com 16 Nov '24

16 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1215403 Bug ID: 1215403 Summary: SDDM default display-manager cannot login to X11 desktop Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: ajbudge(a)errichel.co.uk QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- With TW as OS and KDE desktop, when running SDDM as default-displaymanager after boot login will only work with Plasma (Wayland) desktop. Selecting X11 and logging in goes dark and then after a few seconds returns to login screen. journal gives me:- Sep 16 09:22:04 HP-Z640-1 sddm-helper[2134]: Starting X11 session: "" "/usr/etc/X11/xdm/Xsession \"/usr/bin/startplasma-x11\"" Sep 16 09:22:04 HP-Z640-1 sddm[1851]: Session started false Sep 16 09:22:04 HP-Z640-1 sddm-helper[2134]: [PAM] Closing session Sep 16 09:22:04 HP-Z640-1 sddm-helper[2134]: [PAM] Ended. Sep 16 09:22:04 HP-Z640-1 sddm[1851]: Auth: sddm-helper exited with 2 and there is nothing in /etc/sddm.conf.d> or /.local/share/sddm> cat xorg-session.log (nothing here) -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1213139] New: [Build 20230706] openQA test fails in consoletest_setup: vmalloc error in kernel
by bugzilla_noreply＠suse.com 15 Nov '24

15 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1213139 Bug ID: 1213139 Summary: [Build 20230706] openQA test fails in consoletest_setup: vmalloc error in kernel Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3412937/modules/cons oletest_setup/steps/52 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes Randomly (currently every ~4th run), the test fails because systemd-vconsole-setup fails to complete. The kernel spits out an allocation failure: [ 519.853569] systemd-vconsol: vmalloc error: size 0, page order 9, failed to allocate pages, mode:0xcc2(GFP_KERNEL|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0 [ 519.854619] CPU: 0 PID: 11361 Comm: systemd-vconsol Not tainted 6.3.9-1-default #1 openSUSE Tumbleweed 4b767630dbc263131e96e89ef291fd4fd2951892 [ 519.855385] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 [ 519.855860] Call Trace: [ 519.856047] <TASK> [ 519.856208] dump_stack_lvl+0x47/0x60 [ 519.856455] warn_alloc+0x13a/0x1b0 [ 519.856693] ? __alloc_pages+0x32d/0x350 [ 519.857009] __vmalloc_node_range+0x631/0x8b0 [ 519.857343] ? con_font_op+0x193/0x430 [ 519.857593] kvmalloc_node+0xa6/0xd0 [ 519.857857] ? con_font_op+0x193/0x430 [ 519.858105] con_font_op+0x193/0x430 [ 519.858346] ? __pfx_bpf_lsm_capable+0x10/0x10 [ 519.858631] ? security_capable+0x44/0x70 [ 519.858891] vt_ioctl+0x834/0x1380 [ 519.859126] tty_ioctl+0x4b1/0x870 [ 519.859355] __x64_sys_ioctl+0x94/0xd0 [ 519.859601] do_syscall_64+0x60/0x90 [ 519.859871] ? exc_page_fault+0x6e/0x150 [ 519.860129] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 519.860447] RIP: 0033:0x7f1144d0c2cf [ 519.860710] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 519.861757] RSP: 002b:00007ffe520b5af0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 519.862201] RAX: ffffffffffffffda RBX: 00007ffe520b5c10 RCX: 00007f1144d0c2cf [ 519.862843] RDX: 00007ffe520b5bf0 RSI: 0000000000004b72 RDI: 0000000000000003 [ 519.863463] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 519.864093] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000008 [ 519.864705] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 [ 519.865317] </TASK> [ 519.865681] Mem-Info: [ 519.866038] active_anon:34752 inactive_anon:94983 isolated_anon:0 active_file:120769 inactive_file:114642 isolated_file:0 unevictable:3088 dirty:1160 writeback:0 slab_reclaimable:23978 slab_unreclaimable:21653 mapped:30383 shmem:4200 pagetables:3497 sec_pagetables:0 bounce:0 kernel_misc_reclaimable:0 free:66953 free_pcp:198 free_cma:0 [ 519.881932] Node 0 active_anon:139008kB inactive_anon:379932kB active_file:483076kB inactive_file:458568kB unevictable:12352kB isolated(anon):0kB isolated(file):0kB mapped:121532kB dirty:4640kB writeback:0kB shmem:16800kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 61440kB writeback_tmp:0kB kernel_stack:8040kB pagetables:13988kB sec_pagetables:0kB all_unreclaimable? no [ 519.893364] Node 0 DMA free:8220kB boost:0kB min:328kB low:408kB high:488kB reserved_highatomic:0KB active_anon:32kB inactive_anon:1908kB active_file:1564kB inactive_file:2136kB unevictable:0kB writepending:0kB present:15000kB managed:14364kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 519.903019] lowmem_reserve[]: 0 1889 1889 1889 1889 [ 519.905153] Node 0 DMA32 free:259592kB boost:0kB min:44724kB low:55904kB high:67084kB reserved_highatomic:16384KB active_anon:138976kB inactive_anon:378024kB active_file:481512kB inactive_file:456432kB unevictable:12352kB writepending:4640kB present:2076960kB managed:1966804kB mlocked:16kB bounce:0kB free_pcp:792kB local_pcp:792kB free_cma:0kB [ 519.915738] lowmem_reserve[]: 0 0 0 0 0 [ 519.917815] Node 0 DMA: 31*4kB (UME) 13*8kB (UME) 10*16kB (UM) 21*32kB (UME) 20*64kB (UM) 10*128kB (UME) 2*256kB (UE) 2*512kB (UE) 1*1024kB (E) 1*2048kB (E) 0*4096kB = 8228kB [ 519.920264] Node 0 DMA32: 20402*4kB (UMEH) 7366*8kB (UMEH) 2957*16kB (UMEH) 1109*32kB (UMEH) 359*64kB (UMEH) 66*128kB (UMEH) 11*256kB (MH) 4*512kB (MH) 0*1024kB 0*2048kB 0*4096kB = 259624kB [ 519.922145] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 519.923229] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 519.924415] 262294 total pagecache pages [ 519.925139] 22685 pages in swap cache [ 519.925777] Free swap = 1663652kB [ 519.926439] Total swap = 2097148kB [ 519.927082] 522990 pages RAM [ 519.927676] 0 pages HighMem/MovableOnly [ 519.928332] 27698 pages reserved [ 519.929181] 0 pages cma reserved [ 519.929828] 0 pages hwpoisoned If the system was actually out of RAM, I'd expect it to fail earlier in random places already. ## Observation openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-upgrade_Leap_15.2_cryptlvm@uefi fails in [consoletest_setup](https://openqa.opensuse.org/tests/3412937/modules/consol… ## Test suite description Upgrade scenario with cryptlvm for Leap 15.2 Set QEMUVGA=virtio due to bsc#1210555 ## Reproducible Fails since (at least) Build [20230401](https://openqa.opensuse.org/tests/3205451) ## Expected result Last good: (unknown) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1212937] New: Kernel panic when booting up tumbleweed 20230629
by bugzilla_noreply＠suse.com 15 Nov '24

15 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1212937 Bug ID: 1212937 Summary: Kernel panic when booting up tumbleweed 20230629 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: dheidler(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 867932 --> https://bugzilla.suse.com/attachment.cgi?id=867932&action=edit screenshot When I booted my tw system today, I ran into a kernel panic. Kernel: Linux 6.3.9-1-default Architecture: x86-64 Hardware Vendor: Lenovo Hardware Model: ThinkPad T14s Gen 2a The issue happened once and after a reboot I was able to boot up fine. The standby issue with the laptop hanging up on resume and eventually rebooting automatically is back again and sadly reproducible always. Not sure if that could be related. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1214060] New: html2ps conversion fails with perl >= 5.26
by bugzilla_noreply＠suse.com 14 Nov '24

14 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1214060 Bug ID: 1214060 Summary: html2ps conversion fails with perl >= 5.26 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: christophe(a)krop.fr QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Affected: Tumbleweed, Leap, SLE 15 html2ps -f <file> fails with this error: Unimplemented: POSIX::tmpnam(): use File::Temp instead at /usr/bin/html2ps line 498. We're apparently having an old version in openSUSE (some distro have 1.0b7) and it needs patching. Debian has a collection of improvements and fixes: https://salsa.debian.org/debian/html2ps/-/tree/master/debian/patches The important one for this report is perl-deprecation.patch -- You are receiving this mail because: You are on the CC list for the bug.

1 7