--1594146081.A7DaDaFe0.8471
Date: Tue, 7 Jul 2020 18:21:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1173860

            Bug ID: 1173860
           Summary: kernel-5.3.18-lp152.20.7.1 crash at boot with permissions violation
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: martin.tessun@die-tessuns.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After Updating to the new kernel (5.3.18-lp152.20.7.1) my system does no longer
boot. The kernel "hangs" while flooding the console with page fault issues.

kernel-5.3.18-lp152.19.2 works perfectly fine.

As the issue happens in early stages, I do not have a dump or any logs - just
some "tries" of reading the screen.

System details:
- UEFI
- Secure Boot disabled
- Manufacturer: ASRock
- Product Name: J3455-ITX

BIOS Information
        Vendor: American Megatrends Inc.
        Version: P1.60
        Release Date: 01/16/2018
        Address: 0xF0000
        Runtime Size: 64 kB
        ROM Size: 8192 kB
        Characteristics:
                PCI is supported
                BIOS is upgradeable
                BIOS shadowing is allowed
                Boot from CD is supported
                Selectable boot is supported
                BIOS ROM is socketed
                EDD is supported
                5.25"/1.2 MB floppy services are supported (int 13h)
                3.5"/720 kB floppy services are supported (int 13h)
                3.5"/2.88 MB floppy services are supported (int 13h)
                Print screen service is supported (int 5h)
                8042 keyboard services are supported (int 9h)
                Serial services are supported (int 14h)
                Printer services are supported (int 17h)
                ACPI is supported
                USB legacy is supported
                BIOS boot specification is supported
                Targeted content distribution is supported
                UEFI is supported
        BIOS Revision: 5.12

Unfortunately the system is completely unresponsible so some fragments for the
recurring kernel OOPS:

Fixing recursive fault, but reboot is needed!
BUG: Unable to handle page fault for address: 0x....
#PF: supervisot write access in kernel mode
#PF: error_code(0x0003) - permissions violation
Oops: 0003 [#8635] SMP NOPTI
CPU 0 PID: 495 Comm: systemd-udevd Tainted: ...
Hardware name: To be filled by O.E.M
RIP: 0010:blk_flush_plug_list+0x6c/0xf0

Some dmesg from the working kernel (5.3.18-lp152.19.2):
[    0.000000] microcode: microcode updated early to revision 0x38, date =
2019-01-15
[    0.000000] Linux version 5.3.18-lp152.19-default (geeko@buildhost) (gcc
version 7.5.0 (SUSE Linux)) #1 SMP Tue Jun 9 20:59:24 UTC 2020 (960cb00)
[    0.000000] Command line: BOOT_IMAGE=/vmlinuz-5.3.18-lp152.19-default
root=/dev/mapper/system-root splash=silent resume=/dev/mapper/system-swap quiet
mitigations=auto
[    0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point
registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x008: 'MPX bounds registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x010: 'MPX CSR'
[    0.000000] x86/fpu: xstate_offset[3]:  576, xstate_sizes[3]:   64
[    0.000000] x86/fpu: xstate_offset[4]:  640, xstate_sizes[4]:   64
[    0.000000] x86/fpu: Enabled xstate features 0x1b, context size is 704
bytes, using 'compacted' format.

[...]

[    0.000000] NX (Execute Disable) protection: active
[    0.000000] e820: update [mem 0x643e2018-0x643f2057] usable ==> usable
[    0.000000] e820: update [mem 0x643e2018-0x643f2057] usable ==> usable
[    0.000000] e820: update [mem 0x643d3018-0x643e1057] usable ==> usable
[    0.000000] e820: update [mem 0x643d3018-0x643e1057] usable ==> usable
[    0.000000] extended physical RAM map:

[...]

[    0.000000] efi: EFI v2.50 by American Megatrends
[    0.000000] efi:  TPMFinalLog=0x6d9bd000  ESRT=0x6dd82918  ACPI=0x6d99e000
ACPI 2.0=0x6d99e000  SMBIOS=0x6dc4f000  SMBIOS 3.0=0x6dc4e000
TPMEventLog=0x643f3018
[    0.000000] secureboot: Secure boot disabled
[    0.000000] SMBIOS 3.0.0 present.
[    0.000000] DMI: To Be Filled By O.E.M. To Be Filled By O.E.M./J3455-ITX,
BIOS P1.60 01/16/2018
[    0.000000] tsc: Detected 1497.600 MHz processor
[    0.000029] e820: update [mem 0x00000000-0x00000fff] usable ==> reserved
[    0.000033] e820: remove [mem 0x000a0000-0x000fffff] usable
[    0.000050] last_pfn = 0x480000 max_arch_pfn = 0x400000000
[    0.000056] MTRR default type: uncachable
[    0.000058] MTRR fixed ranges enabled:
[    0.000060]   00000-6FFFF write-back
[    0.000062]   70000-7FFFF uncachable
[    0.000064]   80000-9FFFF write-back
[    0.000065]   A0000-BFFFF uncachable
[    0.000067]   C0000-FFFFF write-protect
[    0.000069] MTRR variable ranges enabled:

[...]

[    0.000179] x86/PAT: Configuration [0-7]: WB  WC  UC- UC  WB  WP  UC- WT
[    0.000255] last_pfn = 0x6f000 max_arch_pfn = 0x400000000
[    0.007627] esrt: Reserving ESRT space from 0x000000006dd82918 to
0x000000006dd82950.
[    0.007646] check: Scanning 1 areas for low memory corruption
[    0.007655] Using GB pages for direct mapping
[    0.007659] BRK [0x2fe001000, 0x2fe001fff] PGTABLE
[    0.007663] BRK [0x2fe002000, 0x2fe002fff] PGTABLE
[    0.007666] BRK [0x2fe003000, 0x2fe003fff] PGTABLE
[    0.007785] BRK [0x2fe004000, 0x2fe004fff] PGTABLE
[    0.008108] BRK [0x2fe005000, 0x2fe005fff] PGTABLE
[    0.008208] BRK [0x2fe006000, 0x2fe006fff] PGTABLE
[    0.008334] BRK [0x2fe007000, 0x2fe007fff] PGTABLE
[    0.008584] BRK [0x2fe008000, 0x2fe008fff] PGTABLE
[    0.008726] BRK [0x2fe009000, 0x2fe009fff] PGTABLE
[    0.008935] BRK [0x2fe00a000, 0x2fe00afff] PGTABLE
[    0.009292] BRK [0x2fe00b000, 0x2fe00bfff] PGTABLE
[    0.009716] secureboot: Secure boot disabled
[    0.009718] RAMDISK: [mem 0x3efc7000-0x3fffafff]
[    0.009734] ACPI: Early table checksum verification disabled

[...]

[    0.010163] No NUMA configuration found
[    0.010165] Faking a node at [mem 0x0000000000000000-0x000000047fffffff]
[    0.010182] NODE_DATA(0) allocated [mem 0x47ffea000-0x47fffffff]
[    0.010286] Zone ranges:
[    0.010288]   DMA      [mem 0x0000000000001000-0x0000000000ffffff]
[    0.010291]   DMA32    [mem 0x0000000001000000-0x00000000ffffffff]
[    0.010293]   Normal   [mem 0x0000000100000000-0x000000047fffffff]
[    0.010295]   Device   empty
[    0.010297] Movable zone start for each node
[    0.010300] Early memory node ranges

[...]

[    0.010816] Zeroed struct page in unavailable ranges: 22339 pages
[    0.010820] Initmem setup node 0 [mem 0x0000000000001000-0x000000047fffffff]
[    0.010824] On node 0 totalpages: 4106429
[    0.010827]   DMA zone: 64 pages used for memmap
[    0.010828]   DMA zone: 21 pages reserved
[    0.010830]   DMA zone: 3996 pages, LIFO batch:0
[    0.011007]   DMA32 zone: 6757 pages used for memmap
[    0.011008]   DMA32 zone: 432417 pages, LIFO batch:63
[    0.039794]   Normal zone: 57344 pages used for memmap
[    0.039795]   Normal zone: 3670016 pages, LIFO batch:63
[    0.041225] Reserving Intel graphics memory at [mem 0x70000000-0x7fffffff]
[    0.041456] ACPI: PM-Timer IO Port: 0x408
[    0.041460] ACPI: Local APIC address 0xfee00000
[    0.041474] ACPI: LAPIC_NMI (acpi_id[0x01] high level lint[0x1])
[    0.041476] ACPI: LAPIC_NMI (acpi_id[0x02] high level lint[0x1])
[    0.041478] ACPI: LAPIC_NMI (acpi_id[0x03] high level lint[0x1])
[    0.041479] ACPI: LAPIC_NMI (acpi_id[0x04] high level lint[0x1])
[    0.041518] IOAPIC[0]: apic_id 1, version 32, address 0xfec00000, GSI 0-119
[    0.041522] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[    0.041525] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 low level)
[    0.041528] ACPI: IRQ0 used by override.
[    0.041530] ACPI: IRQ9 used by override.
[    0.041533] Using ACPI (MADT) for SMP configuration information
[    0.041536] ACPI: HPET id: 0x8086a701 base: 0xfed00000
[    0.041558] smpboot: Allowing 4 CPUs, 0 hotplug CPUs

[...]

[    0.041696] Booting paravirtualized kernel on bare hardware
[    0.041702] clocksource: refined-jiffies: mask: 0xffffffff max_cycles:
0xffffffff, max_idle_ns: 7645519600211568 ns
[    0.300440] setup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:4
nr_node_ids:1
[    0.301012] percpu: Embedded 56 pages/cpu s192512 r8192 d28672 u524288
[    0.301031] pcpu-alloc: s192512 r8192 d28672 u524288 alloc=1*2097152
[    0.301033] pcpu-alloc: [0] 0 1 2 3
[    0.301096] Built 1 zonelists, mobility grouping on.  Total pages: 4042243
[    0.301098] Policy zone: Normal
[    0.301102] Kernel command line: BOOT_IMAGE=/vmlinuz-5.3.18-lp152.19-default
root=/dev/mapper/system-root splash=silent resume=/dev/mapper/system-swap quiet
mitigations=auto

[...]

[    0.412628] Last level iTLB entries: 4KB 48, 2MB 0, 4MB 0
[    0.412630] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
[    0.412637] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user
pointer sanitization
[    0.412640] Spectre V2 : Mitigation: Full generic retpoline
[    0.412641] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on
context switch
[    0.412642] Spectre V2 : Enabling Restricted Speculation for firmware calls
[    0.412645] Spectre V2 : mitigation: Enabling conditional Indirect Branch
Prediction Barrier
[    0.413137] Freeing SMP alternatives memory: 36K
[    0.416087] TSC deadline timer enabled
[    0.416096] smpboot: CPU0: Intel(R) Celeron(R) CPU J3455 @ 1.50GHz (family:
0x6, model: 0x5c, stepping: 0x9)

[...]

[    0.417097] smp: Bringing up secondary CPUs ...
[    0.417097] x86: Booting SMP configuration:
[    0.417097] .... node  #0, CPUs:      #1 #2 #3
[    0.417793] smp: Brought up 1 node, 4 CPUs
[    0.417793] smpboot: Max logical packages: 1
[    0.417793] smpboot: Total of 4 processors activated (11980.80 BogoMIPS)
[    0.533128] node 0 initialised, 3555943 pages in 116ms
[    0.537100] devtmpfs: initialized
[    0.537239] x86/mm: Memory block size: 128MB
[    0.537808] PM: Registering ACPI NVS region [mem 0x6d99e000-0x6d9d4fff]
(225280 bytes)
[    0.537808] PM: Registering ACPI NVS region [mem 0x6e155000-0x6e155fff]
(4096 bytes)
[    0.537808] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff,
max_idle_ns: 7645041785100000 ns
[    0.537808] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.537808] pinctrl core: initialized pinctrl subsystem
[    0.537808] PM: RTC time: 17:35:41, date: 2020-07-07
[    0.541102] NET: Registered protocol family 16


--1594192211.3ff2DC3.15316
Date: Wed, 8 Jul 2020 07:10:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1173873

            Bug ID: 1173873
           Summary: live-add-yast-repos is missing the --refresh option
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Live Medium
          Assignee: fvogt-at-suse.com
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
                CC: afaerber-at-suse.com, dmueller-at-suse.com, fvogt-at-suse.com,
                    lubos.kocman-at-suse.com
          Found By: ---
           Blocker: ---

live-add-yast-repos is missing the --refresh option in Leap 15.2 whereas it is
fine in Tumbleweed. So, JeOS images have the repo added, but auto-refresh is
disabled.

It seems to be due to /etc/YaST2/control.xml file from openSUSE-release
package, which misses the refresh tag.


body:
--1594280244.a0fcb0.32202
Date: Thu, 9 Jul 2020 07:37:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1173926

            Bug ID: 1173926
           Summary: osc lbl terrible slow
    Classification: Internal Novell Products
           Product: openSUSE Build Service
           Version: master
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: osc
          Assignee: adrian.schroeter-at-suse.com
          Reporter: marco.strigl-at-suse.com
        QA Contact: adrian.schroeter-at-suse.com
          Found By: ---
           Blocker: ---

With big build logs, doing osc lbl takes a long time:

$ time isc lbl > /dev/null

real    0m34.623s
user    0m34.507s
sys     0m0.069s

$ time cat /var/tmp/build-root/standard-x86_64/.build.log > /dev/null

real    0m0.315s
user    0m0.001s
sys     0m0.079s

summary: osc lbl terrible slow


--1594305769.3cF88aa4.6961
Date: Thu, 9 Jul 2020 14:42:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1173952

            Bug ID: 1173952
           Summary: VUL-0: armagetron: client-triggered server crash
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: pth-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: christophe-at-krop.fr, security-team-at-suse.de
          Found By: ---
           Blocker: ---

From https://launchpad.net/armagetronad/+milestone/0.2.8.3.5:

Security fix: Remote object creation on the server triggered from clients was
checked too late to make the client message harmless, and on top of that,
crashed if it failed.

Already fixed in Factory and Leap 15.2 without tracking. Leap 15.1 is affected.


--1594337974.dcc0A8660.29614
Date: Thu, 9 Jul 2020 23:39:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1173972

            Bug ID: 1173972
           Summary: gcc 'internal compiler error' building Mesa git - softpipe (swrast) for nine
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: Dieter@nuetzel-hh.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I'm hunting speed regression in Mesa git on Polaris 20 (RX580).

During normal compilation of Mesa git i get the below.
Worked before latest gcc update (compiled Mesa git last on June, 25).

gcc (SUSE Linux) 10.1.1 20200625 [revision
c91e43e9363bd119a695d64505f96539fa451bf2]

mkdir build
cd build
meson ../ --strip --buildtype release -Ddri-drivers= -Dplatforms=drm,x11
-Dgallium-drivers=r600,radeonsi,swrast -Dvulkan-drivers=amd -Dgallium-nine=true
-Dopencl-spirv=true -Dgallium-opencl=standalone -Dglvnd=true -Dgallium-va=true
-Dgallium-xvmc=false -Dgallium-omx=disabled -Dgallium-xa=false

It works without 'swrast' (softpipe) but I do NEED it for 'nine', so I have to
disable 'nine' (delete '-Dgallium-nine=true') to get some things for testing.

../src/gallium/drivers/softpipe/sp_quad_blend.c:247:46: warning: ‘res[3][2]’
may be used uninitialized in this function [-Wmaybe-uninitialized]
  247 |       quadColor[j][2] = ubyte_to_float(res[j][2]);
      |                                        ~~~~~~^~~
../src/gallium/drivers/softpipe/sp_quad_blend.c:248:46: warning: ‘res[3][3]’
may be used uninitialized in this function [-Wmaybe-uninitialized]
  248 |       quadColor[j][3] = ubyte_to_float(res[j][3]);
      |                                        ~~~~~~^~~
[1140/1479] Compiling C object
'src/gallium/driv...oftpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o'
FAILED: src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o
ccache cc -Isrc/gallium/drivers/softpipe/48c2f4b@@softpipe@sta
-Isrc/gallium/drivers/softpipe -I../src/gallium/drivers/softpipe
-Isrc/gallium/auxiliary -I../src/gallium/auxiliary -I../src/gallium/include
-Iinclude -I../include -Isrc -I../src -fvisibility=hidden
-fdiagnostics-color=always -DNDEBUG -pipe -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -std=c99 -O3 -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS
-D__STDC_LIMIT_MACROS '-DPACKAGE_VERSION="20.2.0-devel"'
'-DPACKAGE_BUGREPORT="https://gitlab.freedesktop.org/mesa/mesa/-/issues"'
-DUSE_ELF_TLS -DHAVE_ST_VDPAU -DENABLE_ST_OMX_BELLAGIO=0
-DENABLE_ST_OMX_TIZONIA=0 -DHAVE_X11_PLATFORM -DGLX_INDIRECT_RENDERING
-DGLX_DIRECT_RENDERING -DGLX_USE_DRM -DHAVE_DRM_PLATFORM -DENABLE_SHADER_CACHE
-DHAVE___BUILTIN_BSWAP32 -DHAVE___BUILTIN_BSWAP64 -DHAVE___BUILTIN_CLZ
-DHAVE___BUILTIN_CLZLL -DHAVE___BUILTIN_CTZ -DHAVE___BUILTIN_EXPECT
-DHAVE___BUILTIN_FFS -DHAVE___BUILTIN_FFSLL -DHAVE___BUILTIN_POPCOUNT
-DHAVE___BUILTIN_POPCOUNTLL -DHAVE___BUILTIN_UNREACHABLE
-DHAVE_FUNC_ATTRIBUTE_CONST -DHAVE_FUNC_ATTRIBUTE_FLATTEN
-DHAVE_FUNC_ATTRIBUTE_MALLOC -DHAVE_FUNC_ATTRIBUTE_PURE
-DHAVE_FUNC_ATTRIBUTE_UNUSED -DHAVE_FUNC_ATTRIBUTE_WARN_UNUSED_RESULT
-DHAVE_FUNC_ATTRIBUTE_WEAK -DHAVE_FUNC_ATTRIBUTE_FORMAT
-DHAVE_FUNC_ATTRIBUTE_PACKED -DHAVE_FUNC_ATTRIBUTE_RETURNS_NONNULL
-DHAVE_FUNC_ATTRIBUTE_ALIAS -DHAVE_FUNC_ATTRIBUTE_NORETURN
-DHAVE_FUNC_ATTRIBUTE_VISIBILITY -DHAVE_UINT128 -D_GNU_SOURCE -DUSE_SSE41
-DUSE_GCC_ATOMIC_BUILTINS -DUSE_X86_64_ASM -DMAJOR_IN_SYSMACROS
-DHAVE_LINUX_FUTEX_H -DHAVE_ENDIAN_H -DHAVE_DLFCN_H -DHAVE_EXECINFO_H
-DHAVE_SYS_SHM_H -DHAVE_CET_H -DHAVE_STRTOF -DHAVE_MKOSTEMP -DHAVE_TIMESPEC_GET
-DHAVE_MEMFD_CREATE -DHAVE_RANDOM_R -DHAVE_FLOCK -DHAVE_STRTOK_R
-DHAVE_GETRANDOM -DHAVE_PROGRAM_INVOCATION_NAME -DHAVE_POSIX_MEMALIGN
-DHAVE_DIRENT_D_TYPE -DHAVE_STRTOD_L -DHAVE_DLADDR -DHAVE_DL_ITERATE_PHDR
-DHAVE_ZLIB -DHAVE_ZSTD -DHAVE_PTHREAD -DHAVE_PTHREAD_SETAFFINITY -DHAVE_LIBDRM
-DLLVM_AVAILABLE '-DMESA_LLVM_VERSION_STRING="11.0.0"' -DUSE_LIBGLVND=1
-DHAVE_LIBUNWIND -DHAVE_DRI3 -DHAVE_DRI3_MODIFIERS -DHAVE_LIBSENSORS=1
-Werror=implicit-function-declaration -Werror=missing-prototypes
-Werror=return-type -Werror=empty-body -Werror=incompatible-pointer-types
-Werror=int-conversion -Wimplicit-fallthrough -Wno-missing-field-initializers
-Wno-format-truncation -fno-math-errno -fno-trapping-math -fno-common
-Werror=format -Wformat-security -fPIC -Werror=pointer-arith -Werror=vla -MD
-MQ 'src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o' -MF
'src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o.d' -o
'src/gallium/drivers/softpipe/48c2f4b@@softpipe@sta/sp_tex_sample.c.o' -c
../src/gallium/drivers/softpipe/sp_tex_sample.c
during IPA pass: fnsummary
../src/gallium/drivers/softpipe/sp_tex_sample.c: In function ‘sample_compare’:
../src/gallium/drivers/softpipe/sp_tex_sample.c:3862:1: internal compiler
error: Segmentation fault
 3862 | }
      | ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://bugs.opensuse.org/> for instructions.
[1149/1479] Compiling C++ object
'src/amd/compiler/3c53451@@aco@sta/aco_instruction_selection.cpp.o'
ninja: build stopped: subcommand failed.
1730.927u 92.880s 4:02.30 752.7%        0+0k 14008+2491400io 14pf+0w


--1594374884.aBD0BC61.11361
Date: Fri, 10 Jul 2020 09:54:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1173991

            Bug ID: 1173991
           Summary: Firefox translations not available after reinstalling MozillaFirefox-translations-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: bnc-team-mozilla-at-forge.provo.novell.com
          Reporter: buschmann23-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This might be related to https://bugzilla.opensuse.org/show_bug.cgi?id=1173966

After removing MozillaFirefox-translations-common and reinstalling it to try to
work around the issue from boo#1173966, Firefox only offers English as UI
locale. This happens for old profiles as well as for new ones and also for
completely fresh users.

openSUSE Tumbleweed 20200708
MozillaFirefox-branding-openSUSE-68-2.1.x86_64
MozillaFirefox-78.0.1-1.1.x86_64
MozillaFirefox-translations-common-78.0.1-1.1.x86_64
MozillaFirefox-debuginfo-78.0.1-1.1.x86_64
MozillaFirefox-debugsource-78.0.1-1.1.x86_64

Is there something I can do to investigate this deeper? I already tried firefox
-d gdb, but without relevant information returned.


body:
--1594377961.b14743Bd1.17098
Date: Fri, 10 Jul 2020 10:46:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1173993

            Bug ID: 1173993
           Summary: Scrolling is broken in Firefox 78.0.1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: bnc-team-mozilla-at-forge.provo.novell.com
          Reporter: opensuse-at-trummer.xyz
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Since the update to Firefox 78.0.1 in Tumbleweed, scrolling is broken.

When bringing another window into focus *using the taskbar*, and then switching
back to Firefox with the taskbar, scrolling stops working until you click
anywhere in Firefox' window.

Switching focus by any other means (clicking on another program's window,
switching with alt-tab), scrolling still works. Only when changing focus by the
task bar does the problem appear.

I confirmed it on two different machines, both with TW 20200707

Operating System: openSUSE Tumbleweed 20200707
KDE Plasma Version: 5.19.2
KDE Frameworks Version: 5.71.0
Qt Version: 5.15.0
Kernel Version: 5.7.7-1-default
OS Type: 64-bit

summary: Scrolling is broken in Firefox 78.0.1


body:
--1594431237.D6D42.25599
Date: Sat, 11 Jul 2020 01:33:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174029

            Bug ID: 1174029
           Summary: YaST2 depends on EFI vars
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: da-at-lessconfused.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Many aarch64 systems based on u-boot do not support efivars. This should not be
mandatory.

2020-07-10 21:26:41 <1> install(3207) [agent-system]
SystemAgent.cc(Execute):1156 mkdir /mnt/dev
2020-07-10 21:26:41 <1> install(3207) [Ruby] clients/inst_prepdisk.rb:83 Cmd:
mount -t devtmpfs devtmpfs /mnt/dev
2020-07-10 21:26:42 <1> install(3207) [agent-system]
SystemAgent.cc(Execute):1156 mkdir /mnt/proc
2020-07-10 21:26:42 <1> install(3207) [Ruby] clients/inst_prepdisk.rb:83 Cmd:
mount -t proc proc /mnt/proc
2020-07-10 21:26:42 <1> install(3207) [agent-system]
SystemAgent.cc(Execute):1156 mkdir /mnt/sys
2020-07-10 21:26:42 <1> install(3207) [Ruby] clients/inst_prepdisk.rb:83 Cmd:
mount -t sysfs sysfs /mnt/sys
2020-07-10 21:26:42 <1> install(3207) [Ruby] clients/inst_prepdisk.rb:83 Cmd:
mount -t efivarfs efivarfs /mnt/sys/firmware/efi/efivars
2020-07-10 21:26:42 <3> install(3207) [bash] ShellCommand.cc(shellcommand):78
mount: /mnt/sys/firmware/efi/efivars: unknown filesystem type 'efivarfs'.
2020-07-10 21:26:42 <2> install(3207) [Ruby] yast/builtins.rb:586 tostring
builtin called on wrong type Class
2020-07-10 21:26:42 <3> install(3207) [Ruby] yast/wfm.rb:253 Client
/mounts/mp_0001/usr/share/YaST2/clients/inst_prepdisk.rb failed with
'.target.mount failed' (RuntimeError).
Backtrace:

http://sprunge.us/zFLCa9

summary: YaST2 depends on EFI vars


--1594586541.afbFbF21.7482
Date: Sun, 12 Jul 2020 20:42:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174052

            Bug ID: 1174052
           Summary: apache segfaults when configured with proxy_uwsgi
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Apache
          Assignee: bnc-team-apache-at-forge.provo.novell.com
          Reporter: benoit.monin-at-gmx.fr
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I migrated a server from leap 15.1 to 15.2 and my apache webserver setup now
segfault every time an access in done to an URL served by uwsgi with apache as
a proxy.

I have two different application in python3 served by uwsgi and apache is
configured as a proxy with something similar to :

ProxyPass /foo uwsgi://127.0.0.1:3032/
ProxyPass /bar uwsgi://127.0.0.1:3033/

Every access kills the subprocess answering the request :

[Sun Jul 12 22:25:24.942939 2020] [core:notice] [pid 26079:tid 139767450913024]
AH00052: child pid 26087 exit signal Segmentation fault (11)

This setup was working without error in leap 15.1.


body:
--1594636059.51420.30702
Date: Mon, 13 Jul 2020 10:27:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174075

            Bug ID: 1174075
           Summary: Changing %{_libexecdir} breaks some packages which are misusing the macro
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: callumjfarmer13-at-gmail.com
          Reporter: callumjfarmer13-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This is a bug to log changes regarding the current major change to the rpm
macro %{_libexecdir} which has resulted in many packages breaking where they
explicitly call /usr/lib , in these cases the packages are being changed to use
%{_prefix}/lib. Most changes to individual packages are being completed by
myself.

pkgs: 000package-groups GraphicsMagick Jamulus atheme bcache-tools bluez btrfsmaintenance bumblebee deepin-gettext-tools deepin-music-player deepin-terminal deepin-turbo geeqie gimp ibus-m17n ispell kdeconnect-kde kinput2 mailutils openwsman procmeter rpmrebuild texlive texlive-filesystem virtualbox xfce4-screensaver xfsprogs


--1594669171.Afae0cf30.8548
Date: Mon, 13 Jul 2020 19:39:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174098

            Bug ID: 1174098
           Summary: RTL8402 stops working after hibernate/resume
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-suse.de
          Reporter: ptesarik-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

Created attachment 839647
  --> https://bugzilla.suse.com/attachment.cgi?id=839647&action=edit
Network capture after wakeup

The Ethernet controller on my Asus X453MA stops working after suspend/resume.

Steps to reproduce:

1. Boot the laptop. I did so while not connected to the wired network.
   May not be relevant.
2. Suspend the system to RAM.
3. Plug an Ethernet cable into the laptop.
4. Wake up the laptop (e.g. by pressing the power button).

After the wakeup, some packets are truncated to 60 bytes, see the attached
network capture.


body:
--1594729648.c6F6DB0.29532
Date: Tue, 14 Jul 2020 12:27:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174116

            Bug ID: 1174116
           Summary: Kernel repeatedly crashing
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: msvec-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 839676
  --> https://bugzilla.suse.com/attachment.cgi?id=839676&action=edit
kernel log

This is the latest 15.2 with kernel-default-5.3.18-lp152.20.7.1.x86_64

The only thing I need to do was:
 - kinit
 - access a file in the NFS directory

See the attached crash log

summary: Kernel repeatedly crashing


--1594760979.faf1cDa3.25015
Date: Tue, 14 Jul 2020 21:09:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174141

            Bug ID: 1174141
           Summary: Dolphin does not execute a binary if path contains space
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: alexander.shchadilov-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

It is not possible to run a binary file using Dolphin if a file path contains
space.

Steps to Reproduce:
1. Install openSUSE Leap 15.2 with suggested Plasma desktop environment.
2. Create a new directory named "New Folder" in ~/.
3. Copy dolphin binary from /usr/bin/ to ~/New Folder/.
4. Click dolphin binary placed in ~/New Folder/.
5. Choose "Execute" in Dolphin dialogue box.

Actual Results:
No visible result.

Expected Results:
New Dolphin process is created.


--1594805473.61Da0b00.16155
Date: Wed, 15 Jul 2020 09:31:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174159

            Bug ID: 1174159
           Summary: VUL-0: CVE-2020-2741: virtualbox: Oracle 2020 July CPU (update to 6.0.24 and 6.1.12)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2020-14628
CVE-2020-14646
CVE-2020-14647
CVE-2020-14649
CVE-2020-14713
CVE-2020-14674
CVE-2020-14675
CVE-2020-14676
CVE-2020-14677
CVE-2020-14699
CVE-2020-14711
CVE-2020-14629
CVE-2020-14703
CVE-2020-14704
CVE-2020-14648
CVE-2020-14650
CVE-2020-14673
CVE-2020-14694
CVE-2020-14695
CVE-2020-14698
CVE-2020-14700
CVE-2020-14712
CVE-2020-14707
CVE-2020-14714
CVE-2020-14715

Reference

https://www.oracle.com/security-alerts/cpujul2020.html#AppendixOVIR


--1594821034.c3ae4eC3.19209
Date: Wed, 15 Jul 2020 13:50:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174169

            Bug ID: 1174169
           Summary: unable to upload file via webdavs in Dolphin file manager : "not enough space"
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: csto-at-lle.rochester.edu
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 839732
  --> http://bugzilla.opensuse.org/attachment.cgi?id=839732&action=edit
Diff of fix to kf5 kio libraries

SUMMARY
I'm using Dolphin file manager on Leap 15.2 to manage a distant website via a
webdavs protocol. Since some weeks, I can't add or replace files, with the
message "not enough available disk space to write file:///...".
Deleting files is still possible.
This works in Ubuntu with Nautilus and Leap 15.1

I did look through the source code and found that WEBDAV servers, which don't
report quota-available numbers (Nextcloud, ...), are not handled correctly.
You'll find the fix attached for review and implementation

This also has been reported to KDE as bug 423661. Given their track record on
bug fixing, I don't have high confidence that this will be fixed soon.
I hope your are more responsive.


--1594825517.56DCD7231.30248
Date: Wed, 15 Jul 2020 15:05:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174173

            Bug ID: 1174173
           Summary: AutoYaST: do not refer to Profile.current
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AutoYaST
          Assignee: yast2-maintainers-at-suse.de
          Reporter: igonzalezsosa-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The `Profile.current` method returns the current profile. However, all modules
are supposed to get the relevant part of the profile through the "import"
method, so it should be used only internally by the AutoYaST.


--1594832302.EbdF3.1479
Date: Wed, 15 Jul 2020 16:58:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174177

            Bug ID: 1174177
           Summary: [HPC,netcdf-fortran] 'serial' (non-MPI) flavor is missing
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The 'serial' - ie non-MPI - build flavor for netcdf-fortran is missing. This
should be provided as well.


--1594843894.B4b43D070.12086
Date: Wed, 15 Jul 2020 20:11:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174180

            Bug ID: 1174180
           Summary: display-manager.service: /etc/rc.status: No such file or directory
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: gfx-bugs-at-suse.de
          Reporter: beppe85-at-gmail.com
        QA Contact: gfx-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Around the date below, insserv-compat became an unneeded package, according to
zypper, so I have removed it.

jun 29 13:46:23 display-manager[1291]: /usr/lib/X11/display-manager: line 16:
/etc/rc.status: No such file or directory
jun 29 13:46:23 display-manager[1294]: /usr/lib/X11/display-manager: line 159:
rc_reset: command not found

The system boots to desktop, but display-manager.service is marked as failed.

From xdm.changes:

-------------------------------------------------------------------
Mon Jun 22 18:56:47 UTC 2020 - Cristian Rodr�guez <crrodriguez-at-opensuse.org>

- Require fillup_prereq not insserv-compat when using systemd

-------------------------------------------------------------------


--1594880322.35C2A0.26167
Date: Thu, 16 Jul 2020 06:18:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174189

            Bug ID: 1174189
           Summary: VUL-0: CVE-2020-6510: chromium: Update to 84.0.4147.89
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Critical CVE-2020-6510: Heap buffer overflow in background fetch.
High CVE-2020-6511: Side-channel information leakage in content security
policy.
High CVE-2020-6512: Type Confusion in V8.
High CVE-2020-6513: Heap buffer overflow in PDFium.
High CVE-2020-6514: Inappropriate implementation in WebRTC.
High CVE-2020-6515: Use after free in tab strip.
High CVE-2020-6516: Policy bypass in CORS.
High CVE-2020-6517: Heap buffer overflow in history.
Medium CVE-2020-6518: Use after free in developer tools.
Medium CVE-2020-6519: Policy bypass in CSP.
Medium CVE-2020-6520: Heap buffer overflow in Skia.
Medium CVE-2020-6521: Side-channel information leakage in autofill.
Medium CVE-2020-6522: Inappropriate implementation in external protocol
handlers.
Medium CVE-2020-6523: Out of bounds write in Skia.
Medium CVE-2020-6524: Heap buffer overflow in WebAudio.
Medium CVE-2020-6525: Heap buffer overflow in Skia.
Low CVE-2020-6526: Inappropriate implementation in iframe sandbox.
Low CVE-2020-6527: Insufficient policy enforcement in CSP.
Low CVE-2020-6528: Incorrect security UI in basic auth.
Low CVE-2020-6529: Inappropriate implementation in WebRTC.
Low CVE-2020-6530: Out of bounds memory access in developer tools.
Low CVE-2020-6531: Side-channel information leakage in scroll to text.
Low CVE-2020-6533: Type Confusion in V8.
Low CVE-2020-6534: Heap buffer overflow in WebRTC.
Low CVE-2020-6535: Insufficient data validation in WebUI.
Low CVE-2020-6536: Incorrect security UI in PWAs.

Reference
https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html


--1594994557.EB2ac630.25746
Date: Fri, 17 Jul 2020 14:02:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174250

            Bug ID: 1174250
           Summary: VUL-1: CVE-2020-3481: clamav: improper error handling causing crash due to NULL pointer dereference
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/263930/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: max-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-3481

Fixed a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3
that could cause a denial-of-service (DoS) condition. Improper error handling
could cause a crash due to a NULL pointer dereference. This vulnerability is
mitigated for those using the official ClamAV signature databases because the
file type signatures in daily.cvd will not enable the EGG archive parser in
affected versions.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1858264
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-3481


--1595058191.fEAace40.26569
Date: Sat, 18 Jul 2020 07:43:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174270

            Bug ID: 1174270
           Summary: devel:tools:building/meson: meson 0.55 broke build service macros
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: sor.alexei-at-meowr.ru
          Reporter: srid-at-rkmail.ru
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Building a project with %meson_build macro in spec file fails with following
message after meson 0.55 update:

+ export LANG=C.UTF-8
+ LANG=C.UTF-8
+ /usr/bin/meson compile -C build -j '%{_smp_build_ncpus}' --verbose
usage: meson compile [-h] [--clean] [-C BUILDDIR] [-j JOBS] [-l LOAD_AVERAGE]
                     [--verbose] [--ninja-args NINJA_ARGS] [--vs-args VS_ARGS]
                     [TARGET [TARGET ...]]
meson compile: error: argument -j/--jobs: invalid int value:
'%{_smp_build_ncpus}'


--1595066977.aDbA5d8a0.1429
Date: Sat, 18 Jul 2020 10:09:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174272

            Bug ID: 1174272
           Summary: ImageMagick fails to use Inkscape for SVGs
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: raffarti-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

/etc/ImageMagick-7-SUSE/delegates.xml pass `--export-file` instead of
`--export-filename` to inkscape, causing conversion to fail.


body:
--1595213537.DdCEFD830.13661
Date: Mon, 20 Jul 2020 02:52:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174290

            Bug ID: 1174290
           Summary: AppArmor abstractions/X does not allow access to /run/user xauth
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AppArmor
          Assignee: suse-beta-at-cboltz.de
          Reporter: masterpatricko-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Shipped "abstractions/X" does not allow access to the new Xauthority file path
at
/run/user/{UID}/xauth_*

e.g. /run/user/1000/xauth_yfDehn

this causes graphical apps with an apparmor profile to fail.

Not sure if best method is to allow access via env var $XAUTHORITY or with a
glob.

pkgs: apparmor redshift


--1595228245.072de40.16219
Date: Mon, 20 Jul 2020 06:57:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174293

            Bug ID: 1174293
           Summary: AppArmor X abstraction not compatible with sddm change
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AppArmor
          Assignee: suse-beta-at-cboltz.de
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Recently, we applied https://github.com/sddm/sddm/pull/1230 to sddm to improve
the use of Xauthority. This includes a move of the file to
$XDG_RUNTIME_DIR/xauth_XXXXXX, but it seems like AppArmor doesn't allow access
there by default.

According to https://github.com/jonls/redshift/issues/763, this works:

owner /{,var/}run/user/*/xauth_* r,

No idea where to submit that, as the PR isn't merged upstream yet, so I just
opened a bug report instead...


--1595233196.D2F7BF40.5531
Date: Mon, 20 Jul 2020 08:19:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174295

            Bug ID: 1174295
           Summary: VUL-1: CVE-2020-15807: libredwg:  null pointer dereferences via crafted input files
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/263939/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-15807

GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input
files.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15807
https://github.com/LibreDWG/libredwg/issues/186
https://github.com/LibreDWG/libredwg/issues/189
https://github.com/LibreDWG/libredwg/issues/190


body:
--1595254182.EfAaf7c0.22879
Date: Mon, 20 Jul 2020 14:09:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174320

            Bug ID: 1174320
           Summary: shim-install uses wrong paths for EFI files
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Bootloader
          Assignee: screening-team-bugs-at-suse.de
          Reporter: tudor-at-tudorr.ro
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

At the beginning of the script, the sourcedir variable has the value
`$libdir/efi`, where libdir is `/usr/lib64`. The path `/usr/lib64/efi` is
deprecated, per the /usr/lib64/efi/DEPRECATED file. The correct path is
`/usr/share/efi/x86_64`.

This does not stop shim-install from working, because the correct efi files are
symlinked in `/usr/lib64/efi`. However, trusted boot no longer works (normal
boot is used instead) because when enabling trusted boot with the
`--suse-enable-tpm` flag, the script sets the source_grub_efi variable to
`/usr/lib/grub2/${grub_install_target}/grub-tpm.efi`. Because this file does
not exist, shim-install silently sets the value back to the normal, non-tpm efi
file. The correct path is
`/usr/share/grub2/${grub_install_target}/grub-tpm.efi` (notice that it's
/usr/share instead of /usr/lib).

This issue also affects Leap 15.2

pkgs: shim shim-leap


--1595405103.321003.28502
Date: Wed, 22 Jul 2020 08:05:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174374

            Bug ID: 1174374
           Summary: qemu does not work for OBS worker on factory
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KVM
          Assignee: kvm-bugs-at-suse.de
          Reporter: ro-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

builds on factory abort with:
[   13s] booting kvm...
[   13s] ### VM INTERACTION START ###
[   13s] Using UART console
[   13s] /usr/bin/qemu-system-ppc64 -nodefaults -no-reboot -nographic -vga none
-cpu host -enable-kvm -M pseries -object rng-random,filename=/dev/hwrng,id=rng0
-device virtio-rng-pci,rng=rng0 -runas qemu -net none -kernel
/var/cache/obs/worker/root_4/.mount/boot/kernel -initrd
/var/cache/obs/worker/root_4/.mount/boot/initrd -append
root=/dev/disk/by-id/virtio-0 rootfstype=ext3
rootflags=data=writeback,nobarrier,commit=150,noatime ext4.allow_unsupported=1
mitigations=off panic=1 quiet no-kvmclock elevator=noop nmi_watchdog=0 rw
rd.driver.pre=binfmt_misc console=hvc0 init=/.build/build -m 3584 -drive
file=/var/cache/obs/worker/root_4/root,format=raw,if=none,id=disk,cache=unsafe
-device virtio-blk-pci,drive=disk,serial=0 -drive
file=/var/cache/obs/worker/root_4/swap,format=raw,if=none,id=swap,cache=unsafe
-device virtio-blk-pci,drive=swap,serial=1 -serial stdio -chardev
socket,id=monitor,server,nowait,path=/var/cache/obs/worker/root_4/root.qemu/monitor
-mon chardev=monitor,mode=readline -smp 4,threads=2
[   13s] qemu-system-ppc64: Requested count cache flush assist capability level
not supported by kvm, try appending -machine cap-ccf-assist=off
[   13s] ### VM INTERACTION END ###
[   13s] No buildstatus set, either the base system is broken
(kernel/initrd/udev/glibc/bash/perl)
[   13s] or the build host has a kernel or hardware problem...

host kernel:
Linux obs-power8-05 5.7.7-1-default #1 SMP Wed Jul 1 19:03:27 UTC 2020
(cba119b) ppc64le ppc64le ppc64le GNU/Linux

obs-power8-05:~ # rpm -q qemu
qemu-5.0.0-3.1.ppc64le


--1595423576.CF6bE3d02.11745
Date: Wed, 22 Jul 2020 13:12:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174390

            Bug ID: 1174390
           Summary: Categories of updates are blank in YaST "Online update" module
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: alexander.shchadilov-at-gmail.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Created attachment 839912
  --> http://bugzilla.opensuse.org/attachment.cgi?id=839912&action=edit
Screenshot fragment

When you have some pending updates categories' labels in YaST Online
Update\"Summary" are missing, see screenshot.


body:
--1595519775.7D5ebCe43.10682
Date: Thu, 23 Jul 2020 15:56:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174439

            Bug ID: 1174439
           Summary: [HPC, gcc10] Add build support for gcc10 to HPC Libraries
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: SUSE Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

gcc10 is available for quite a while already. Add build support to the HPC
packages.

pkgs: adios boost gnu-compilers-hpc hdf5 hypre metis mumps netcdf netcdf-cxx4 netcdf-fortran ocr openblas petsc scalapack superlu trilinos


--1595571047.21dA42250.27838
Date: Fri, 24 Jul 2020 06:10:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174457

            Bug ID: 1174457
           Summary: VUL-1: CVE-2020-15917: claws-mail:  protocol violation because suffix data after STARTTLS is mishandled
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/264168/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-15917

common/session.c in Claws Mail before 3.17.6 has a protocol violation because
suffix data after STARTTLS is mishandled.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15917
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15917
https://git.claws-mail.org/?p=claws.git;a=blob;f=RELEASE_NOTES
https://git.claws-mail.org/?p=claws.git;a=commit;h=fcc25329049b6f9bd8d890f1197ed61eb12e14d5


--1595581373.FAEB277.22355
Date: Fri, 24 Jul 2020 09:02:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174464

            Bug ID: 1174464
           Summary: AUDIT-1: opa-ff:  no-op change in /etc/cron.daily/opa-cablehealth
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: nmoreychaisemartin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: dimstar-at-opensuse.org, matthias.gerstner-at-suse.com,
                    nmoreychaisemartin-at-suse.com, security-team-at-suse.de
        Depends on: 1172859
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1172859 +++

+++ This bug was initially created as a clone of Bug #1162255

As discussed with Matthias on RC, /etc/cron.daily/opa-cablehealth has changed
(noop) yet another time as Copyright and version numbers were bumped in its
comments

$ diff /usr/lib/opa/tools/opacablehealthcron
.//usr/lib/opa/tools/opacablehealthcron
4c4
< # Copyright (c) 2015-2018, Intel Corporation
---
> # Copyright (c) 2015-2020, Intel Corporation
31c31
< # [ICS VERSION STRING: @(#) ./fastfabric/opacablehealthcron 10_10_1_0_35
[06/09/20 12:00]
---
> # [ICS VERSION STRING: @(#) ./fastfabric/opacablehealthcron 10_10_3_0_11 [07/22/20 00:00]

As Matthias suggested, the best solution might be to strip comments from the
script to only checksum the actual running code.

Latest version (not yet submitted to devel of Factory) can be found here:
https://build.opensuse.org/package/show/home:NMoreyChaisemartin:branches:science:HPC/opa-ff


body:
--1595614208.77fca6c70.6501
Date: Fri, 24 Jul 2020 18:10:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174483

            Bug ID: 1174483
           Summary: Broken indian keyboard layout
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: gfx-bugs-at-suse.de
          Reporter: fabian@ritter-vogt.de
        QA Contact: gfx-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The in xkb file has a git conflict marker, which breaks compilation, please
backport
https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/commit/c8d68304c826567f27f5a913dd38f6e045b81483

summary: Broken indian keyboard layout


body:
--1595762733.ebF0F0.25618
Date: Sun, 26 Jul 2020 11:25:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174497

            Bug ID: 1174497
           Summary: clipboard does not work in nvim
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Using the latest Tumbleweed, Gnome and gnome-terminal (I tried also others),
nvim prints the following error after I paste from clipboard (middle mouse
key):

E353: Nothing in register *

There must be a recent change in nvim or a dependent library that caused this.

summary: clipboard does not work in nvim


--1595787171.caa81e0.24689
Date: Sun, 26 Jul 2020 18:12:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174504

            Bug ID: 1174504
           Summary: AUDIT-0: allow ping and ICMP commands without CAP_NET_RAW
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

ping tools currently ship with CAP_NET_RAW. Consider dropping this in favor of
using ICMP_PROTO sockets (a.k.a. dgram icmp, "ping sockets"). These are enabled
via sysctl ping_group_range (net.ipv4.ping_group_range
/proc/sys/net/ipv4/ping_group_range - covering IPv6 as well) and are supported
since 3.0 and 3.11 for IPv6.

https://github.com/torvalds/linux/commit/c319b4d76b9e583a5d88d6bf190e079c4e43213d#diff-5b536a7a92abed603bbb4caa61613270R57

This would remove the need for RAW socket access while allowing users to do the
same thing they can do now.

iputils:
/usr/bin/ping = cap_net_raw+p
/usr/bin/ping6 -> /usr/bin/ping

https://github.com/openSUSE/permissions/blob/master/profiles/permissions.secure#L141-L142

fping:
/usr/sbin/fping = cap_net_raw+ep

https://github.com/openSUSE/permissions/blob/master/profiles/permissions.secure#L341-L343

Last touched via bug 1047921 AUDIT-0: fping: possibly allow users to run
non-disruptive options

User-mode traceroute -I would start working.

If reviewed okay, ship the sysctl preset to allow interactive users by default,
and update iputils and fping to remove the capability (and others). iputils has
had this support for a while, fping since 4.3.


body:
--1595832480.be4680.22097
Date: Mon, 27 Jul 2020 06:48:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174512

            Bug ID: 1174512
           Summary: shim: Patch to correct license
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Bootloader
          Assignee: glin-at-suse.com
          Reporter: jsegitz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

During the shim review we were asked to add
476cbff111001d01a5a27dc2289fc7cd2d34c38e to shim to fix an incorrect license
claim. Please add it to the devel project so we have it in the next submission.
Thanks

summary: shim: Patch to correct license


--1595841864.1d11B561.23358
Date: Mon, 27 Jul 2020 09:24:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174521

            Bug ID: 1174521
           Summary: All kernel-firmware packages got dropped from MicroOS/Kubic DVDs
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Kubic
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

All kernel-firmware packages got dropped from MicroOS/Kubic DVDs.
That's bad if you need e.g. a firmware for your network card.


--1595887334.3DdD54aC0.21273
Date: Mon, 27 Jul 2020 22:02:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174572

            Bug ID: 1174572
           Summary: server:mail/sendmail: Please update to Sendmail 8.16.1
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: werner-at-suse.com
          Reporter: bjoernv-at-arcor.de
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Announcement and Changelog for Sendmail 8.16.1 can be found here:

https://marc.info/?l=sendmail-announce&m=159394546814125


--1595917388.0D0FA6C0.21682
Date: Tue, 28 Jul 2020 06:23:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174579

            Bug ID: 1174579
           Summary: VUL-0: CVE-2020-15953: libetpan: response injection via STARTTLS in IMAP
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/264274/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-15953

LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products,
has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server
sends a "begin TLS" response, the client reads additional data (e.g., from a
meddler-in-the-middle attacker) and evaluates it in a TLS context, aka
"response injection."

Reference:
https://github.com/dinhvh/libetpan/issues/386

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1861068
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15953
https://github.com/dinhvh/libetpan/issues/386


--1595924272.76f550.5652
Date: Tue, 28 Jul 2020 08:17:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174582

            Bug ID: 1174582
           Summary: VUL-0: chromium: update to 84.0.4147.105
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

Chromium's stable channel has been updated to 84.0.4147.105

This update includes 8 security fixes:
CVE-2020-6537: Type Confusion in V8. Reported by Alphalaab on 2020-07-14
CVE-2020-6538: Inappropriate implementation in WebView. Reported by Yongke
Wang(@Rudykewang) and Aryb1n(@aryb1n) of Tencent Security Xuanwu Lab
(腾讯安全玄武实验室） on 2020-06-18
CVE-2020-6532: Use after free in SCTP. Reported by Anonymous on 2020-07-09
CVE-2020-6539: Use after free in CSS. Reported by Oriol Brufau on 2020-07-14
CVE-2020-6540: Heap buffer overflow in Skia. Reported by Zhen Zhou of NSFOCUS
Security Team on 2020-07-15
CVE-2020-6541: Use after free in WebUSB. Reported by Sergei Glazunov of Google
Project Zero on 2020-07-17


--1595932885.Bd4edb0.11426
Date: Tue, 28 Jul 2020 10:41:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174593

            Bug ID: 1174593
           Summary: pam_xauth(.so) module is extremly slow on Leap 15.2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Doing `sudo -i` is extremaly slow if pam_xauth.so module is used in
`/etc/pam/sudo-i`:

  #%PAM-1.0
  auth     required       pam_dbus.so
  auth     include        common-auth
  account  include        common-account
  password include        common-password
  session  optional       pam_keyinit.so revoke
  session  include        common-session
  session  optional       pam_xauth.so

setting ther debug option on the pam_xauth line leads to:

  Jul 28 12:29:05 boole sudo[20464]: pam_unix(sudo-i:session): session opened
for user root by werner(uid=0)
  Jul 28 12:29:05 boole sudo[20464]: pam_xauth(sudo-i:session): requesting user
0/0, target user 0/0
  Jul 28 12:29:05 boole sudo[20464]: pam_xauth(sudo-i:session): current and
target user are the same, forward X11
  Jul 28 12:29:05 boole sudo[20464]: pam_xauth(sudo-i:session): reading keys
from `/suse/werner/.Xauthority'
  Jul 28 12:29:05 boole sudo[20464]: pam_xauth(sudo-i:session): running
"/usr/bin/xauth -f /suse/werner/.Xauthority nlist :0" as 0/0
  Jul 28 12:29:25 boole sudo[20464]: pam_xauth(sudo-i:session): no key

and the `XAUTORITY` variable is set to the Xauthority file used by the sddm for
the X server of display :0.

Btw: this works flawless with Tumbleweed and there is also set the Xauthority
file used by the sddm.

Could be related to the fact that my HOME diretory is a NFS share, but this is
a wild guess.


--1595998802.8841BDCC0.18601
Date: Wed, 29 Jul 2020 05:00:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174625

            Bug ID: 1174625
           Summary: uvcvideo module doesn't create /dev/video devices
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: david-at-gloveraoki.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Somewhere between kernel 5.7.7 and 5.7.9, uvcvideo stopped working.

dmesg for 5.7.7:
[   69.528291] usb 1-14: new high-speed USB device number 4 using xhci_hcd
[   69.679365] usb 1-14: New USB device found, idVendor=534d, idProduct=2109,
bcdDevice=21.00
[   69.679370] usb 1-14: New USB device strings: Mfr=1, Product=0,
SerialNumber=0
[   69.679373] usb 1-14: Manufacturer: MACROSILICON
[   69.681595] hid-generic 0003:534D:2109.0005: hiddev97,hidraw4: USB HID v1.10
Device [MACROSILICON] on usb-0000:00:14.0-14/input4
[   69.698468] mc: Linux media interface: v0.10
[   69.714359] videodev: Linux video capture interface: v2.00
[   69.722387] usbcore: registered new interface driver snd-usb-audio
[   69.730136] uvcvideo: Found UVC 1.00 device <unnamed> (534d:2109)
[   69.730785] uvcvideo 1-14:1.0: Entity type for entity Processing 2 was not
initialized!
[   69.730786] uvcvideo 1-14:1.0: Entity type for entity Camera 1 was not
initialized!
[   69.730831] usbcore: registered new interface driver uvcvideo
[   69.730831] USB Video Class driver (1.1.1)

dmesg for 5.7.9:
[   57.374607] usb 1-14: new high-speed USB device number 4 using xhci_hcd
[   57.525662] usb 1-14: New USB device found, idVendor=534d, idProduct=2109,
bcdDevice=21.00
[   57.525667] usb 1-14: New USB device strings: Mfr=1, Product=0,
SerialNumber=0
[   57.525670] usb 1-14: Manufacturer: MACROSILICON
[   57.527975] hid-generic 0003:534D:2109.0005: hiddev97,hidraw4: USB HID v1.10
Device [MACROSILICON] on usb-0000:00:14.0-14/input4
[   57.543400] mc: Linux media interface: v0.10
[   57.563578] videodev: Linux video capture interface: v2.00
[   57.565995] usbcore: registered new interface driver snd-usb-audio
[   57.581779] usbcore: registered new interface driver uvcvideo
[   57.581780] USB Video Class driver (1.1.1)

Under 5.7.9, the /dev/video devices are not created.

Booting from the earlier kernel, but changing nothing else, fixes the problem.


--1596020170.bB6f20.832
Date: Wed, 29 Jul 2020 10:56:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174656

            Bug ID: 1174656
           Summary: update-alternatives has no options for cc or ld
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: william.brown-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Attempting to set clang and lld as my default compiler and linker, I have
encountered the following issue;

# /usr/sbin/alternatives --set ld /usr/bin/ld.lld
update-alternatives: error: alternative /usr/bin/ld.lld for ld not registered;
not setting

# /usr/sbin/alternatives --set cc /usr/bin/clang
update-alternatives: error: no alternatives for cc

expect results: update-alternatives can be used to change ld to lld, and cc to
clang.


--1596095724.Bff5620.10467
Date: Thu, 30 Jul 2020 07:55:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174711

            Bug ID: 1174711
           Summary: VUL-1: CVE-2020-16118: balsa: a malicious server or MITM can trigger a NULL pointer dereference
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/264508/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: bjorn.lie-at-gmail.com
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-16118

In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle
can trigger a NULL pointer dereference and client crash by sending a PREAUTH
response to imap_mbox_connect in libbalsa/imap/imap-handle.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-16118
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16118
https://gitlab.gnome.org/GNOME/balsa/-/commit/4e245d758e1c826a01080d40c22ca8706f0339e5
https://gitlab.gnome.org/GNOME/balsa/-/issues/23


--1596117684.b46a0.10211
Date: Thu, 30 Jul 2020 14:01:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174737

            Bug ID: 1174737
           Summary: kernel-default-5.3.18-lp152.33.1.x86_64 hard lockup
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: novell@tower-net.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 840209
  --> http://bugzilla.opensuse.org/attachment.cgi?id=840209&action=edit
boot-no-kdump.log

The latest kernel update

kernel-default-5.3.18-lp152.33.1.x86_64 (33.1)

produces hard lockup crashes after some minutes up to an hour of working.

Can't see any error messages in the logs.
Also when booting the kernel with enabled kdump, the kernel doesn't crash any
longer.

The older kernel package "kernel-default-5.3.18-lp152.26.2.x86_64" (26.2) works
without problems (also without kdump enabled).

I'm attaching 2 boot journal logs. One with enabled kdump, the other with
disabled kdump which locked up.

If I can provide some more information please ask.

Thanks
Markus


--1596180827.Aaf300.16929
Date: Fri, 31 Jul 2020 07:33:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174753

            Bug ID: 1174753
           Summary: gcc10 on aarch64 miscompiles 128bit CAS operation
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: linnaea-at-lavia.moe
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 840233
  --> http://bugzilla.opensuse.org/attachment.cgi?id=840233&action=edit
Testcase

See attached file for test source code.

Compile with: gcc -o test test.c

Expected output: 1 1

Actual output: 0 1

uname -a:
Linux localhost 5.7.9-1-default #1 SMP Thu Jul 16 09:40:08 UTC 2020 (a010166)
aarch64 aarch64 aarch64 GNU/Linux

gcc -v:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib64/gcc/aarch64-suse-linux/10/lto-wrapper
Target: aarch64-suse-linux
Configured with: ../configure --prefix=/usr --infodir=/usr/share/info
--mandir=/usr/share/man --libdir=/usr/lib64 --libexecdir=/usr/lib64
--enable-languages=c,c++,objc,fortran,obj-c++,ada,go,d
--enable-checking=release --disable-werror
--with-gxx-include-dir=/usr/include/c++/10 --enable-ssp --disable-libssp
--disable-libvtv --disable-cet --disable-libcc1 --enable-plugin
--with-bugurl=https://bugs.opensuse.org/ --with-pkgversion='SUSE Linux'
--with-slibdir=/lib64 --with-system-zlib --enable-libstdcxx-allocator=new
--disable-libstdcxx-pch --enable-libphobos
--enable-version-specific-runtime-libs --with-gcc-major-version-only
--enable-linker-build-id --enable-linux-futex --enable-gnu-indirect-function
--program-suffix=-10 --without-system-libunwind --enable-fix-cortex-a53-835769
--enable-fix-cortex-a53-843419 --with-build-config=bootstrap-lto-lean
--enable-link-mutex --build=aarch64-suse-linux --host=aarch64-suse-linux
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 10.1.1 20200625 [revision c91e43e9363bd119a695d64505f96539fa451bf2]
(SUSE Linux)

Assembly dump of CAS16 operation generated:
00000000004006f0 <__aarch64_cas16_acq_rel>:
  4006f0:       90000110        adrp    x16, 420000
<__libc_start_main@GLIBC_2.17>
  4006f4:       3940e610        ldrb    w16, [x16, #57]
  4006f8:       34000070        cbz     w16, 400704
<__aarch64_cas16_acq_rel+0x14>
  4006fc:       4860fc82        caspal  x0, x1, x2, x3, [x4]
  400700:       d65f03c0        ret
  400704:       aa0003f0        mov     x16, x0
  400708:       aa0103f1        mov     x17, x1
  40070c:       c87f8480        ldaxp   x0, x1, [x4]
  400710:       eb10001f        cmp     x0, x16
  400714:       fa510020        ccmp    x1, x17, #0x0, eq  // eq = none
  400718:       54000061        b.ne    400724 <__aarch64_cas16_acq_rel+0x34>
// b.any
  40071c:       c82fc490        stlxp   w15, x16, x17, [x4]
  400720:       35ffff6f        cbnz    w15, 40070c
<__aarch64_cas16_acq_rel+0x1c>
  400724:       d65f03c0        ret
  400728:       d503201f        nop
  40072c:       d503201f        nop

CASPAL instruction (at 4006fc) would compare and read 2 64-bit values starting
at memory specified in register x4 to values stored in x0 and x1, and if they
compare equal, overwrite values stored at x4 with x2 and x3.

However the fallback instructions (starting at 40070c) writes x0 and x1 (saved
in x16 and x17 at 400704) to memory pointed by x4 rather than x2 and x3.


body:
--1596266219.d70B0.12968
Date: Sat, 1 Aug 2020 07:16:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174789

            Bug ID: 1174789
           Summary: [trackerbug] lxd 4.4 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXD 4.4. The full upstream changelog is available from:
  https://discuss.linuxcontainers.org/t/lxd-4-4-has-been-released/8574

  + VGA console for virtual machines
  + Clustering failure domains
  + /dev/lxd API in virtual machines
  + Graceful daemon shutdown
  + macvlan and sriov managed network types
  + Disk usage limits in projects
  + AppAmor confinement for dnsmasq
  + GPU mediated devices in resources API
  + --console option in lxc launch

summary: [trackerbug] lxd 4.4 update


--1596376738.CCAEA62B1.5909
Date: Sun, 2 Aug 2020 13:58:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174800

            Bug ID: 1174800
           Summary: Touchsreen and touchpad randomly don't work
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: hillwoodroc-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 840276
  --> http://bugzilla.opensuse.org/attachment.cgi?id=840276&action=edit
dmesg

When this issue occurs, the booting provides a warning: i2c_hid
i2c-ELAN2514:00: HID over i2c has not been provided an Int IRQ.
Confirm it in openSUSE Tumbleweed with kernel 5.7.6 as well.


--1596444535.Db620.4260
Date: Mon, 3 Aug 2020 08:48:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174817

            Bug ID: 1174817
           Summary: gcc 10.2 fails to compile current aarch64 kernel
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mkubecek-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After update to gcc 10.2, recent kernel packages fail to build on aarch64 with
this error:

> ../crypto/aegis128-neon-inner.c: In function 'crypto_aegis128_init_neon':
> ../crypto/aegis128-neon-inner.c:151:3: error: incompatible types when initializing type 'unsigned char' using type 'uint8x16_t'
>   151 |   k ^ vld1q_u8(const0),
>       |   ^
> ../crypto/aegis128-neon-inner.c:152:3: error: incompatible types when initializing type 'unsigned char' using type 'uint8x16_t'
>   152 |   k ^ vld1q_u8(const1),
>       |   ^
> ../crypto/aegis128-neon-inner.c:147:29: warning: missing braces around initializer [-Wmissing-braces]
>   147 |  struct aegis128_state st = {{
>       |                             ^
> ......
>   151 |   k ^ vld1q_u8(const0),
>       |   {
>   152 |   k ^ vld1q_u8(const1),
>   153 |  }};
>       |  }

This is a known issue of gcc 10.2 handled in upstream bugzilla:

  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96377

AFAICS a fix is already available there.


--1596463764.BeD0a460.20556
Date: Mon, 3 Aug 2020 14:09:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174829

            Bug ID: 1174829
           Summary: Leap 15.1 -> 15.2 breaks chroot'd Postfix installation
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: sean-at-sdoconnell.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Latest Postfix in Leap 15.1 is postfix-3.3.1-lp151.2.9.1.x86_64.
Current Postfix in Leap 15.2 is postfix-3.4.7-lp152.1.30.x86_64.

Upgrading from Leap 15.1 to Leap 15.2 causes a chroot'd Postfix install to fail
in some operations with error:

   warning: midna_domain_to_ascii_create: Problem translating domain "<domain
name>" to ASCII form: U_FILE_ACCESS_ERROR

This is due to an implementation change in the ICU library, and the inability
of the chroot'd daemon to access the necessary library files.

This problem was documented by upstream and remediated in a later release. See:
http://www.postfix.org/announcements/postfix-3.5.2.html

The fix was backported to Postfix 3.4.12.

Solution: bump Postfix package version to 3.4.12.

Workaround: disable chroot config for Postfix daemons.


--1596465115.A0CAc0.22918
Date: Mon, 3 Aug 2020 14:31:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174830

            Bug ID: 1174830
           Summary: VUL-1: CVE-2020-1776: otrs: Invalidating or changing user does not invalidate session
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/264018/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: chris-at-computersalat.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-1776

When an agent user is renamed or set to invalid the session belonging to the
user is keept active. The session can not be used to access ticket data in the
case the agent is invalid. This issue affects ((OTRS)) Community Edition:
6.0.28
and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1776
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-1776.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1776
https://otrs.com/release-notes/otrs-security-advisory-2020-13/


--1596490487.4dC80.12998
Date: Mon, 3 Aug 2020 21:34:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174850

            Bug ID: 1174850
           Summary: VUL-1: cacti: Improper escaping of error message leads to XSS during template import preview
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

Improper escaping of error message leads to XSS during template import preview

https://github.com/Cacti/cacti/issues/3723
https://github.com/Cacti/cacti/commit/39458efcd5286d50e6b7f905fedcdc1059354e6e


--1596501146.BdF71f0.25969
Date: Tue, 4 Aug 2020 00:32:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174854

            Bug ID: 1174854
           Summary: package 'build' fails to build systemd rpm
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: comes-at-naic.edu
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

While I was building the rpm systemd with build on my computer, I got this
error message:
  expansion error
    nothing provides this-is-only-for-build-envs needed by libsystemd0-mini
    nothing provides this-is-only-for-build-envs needed by libudev-mini1
The same source rpm builds fine on Leap 15.1. Comparing the content of
  /usr/lib/build/configs/sl15.1.conf
and
  /usr/lib/build/configs/sl15.2.conf

I have found the following lines present in sl15.1.conf and missing in
sl15.2.conf

Ignore: erlang-rebar-obs:this-is-only-for-build-envs
Ignore: harfbuzz-bootstrap:this-is-only-for-build-envs
Ignore: jdk-bootstrap:this-is-only-for-build-envs
Ignore: libsystemd0-mini:this-is-only-for-build-envs
Ignore: libudev-mini1:this-is-only-for-build-envs
Ignore: libunbound-devel-mini:this-is-only-for-build-envs
Ignore: systemd-mini:this-is-only-for-build-envs
Ignore: udev-mini:this-is-only-for-build-envs
Ignore: curl-mini:this-is-only-for-build-envs
Ignore: libcurl-mini-devel:this-is-only-for-build-envs
Ignore: libcurl4-mini:this-is-only-for-build-envs

Adding such lines to sl15.2.conf avoid the error in build.


--1596699335.13cb30.7384
Date: Thu, 6 Aug 2020 07:35:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174949

            Bug ID: 1174949
           Summary: VUL-0: CVE-2020-17353: lilypond: lack of restrictions on embedded-ps and embedded-svg when -dsafe is used
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/264793/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: davejplater-at-gmail.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-17353

scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through
2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and
embedded-svg, as demonstrated by including dangerous PostScript code.

Reference and upstream commit:
http://git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=b84ea4740f3279516905c5db05f4074e777c16ff

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1866488
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17353
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-17353.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17353
http://git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=b84ea4740f3279516905c5db05f4074e777c16ff


--1596715690.b6DD7b000.26368
Date: Thu, 6 Aug 2020 12:08:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1174960

            Bug ID: 1174960
           Summary: VUL-0: CVE-2018-18944: artha:  Buffer Overflow may lead to DoS
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/235376/
                OS: openSUSE Factory
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: badshah400-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
                CC: atoptsoglou-at-suse.com
        Depends on: 1143860
          Found By: Security Response Team
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1143860 +++

CVE-2018-18944

Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.

Exploit:

https://www.exploit-db.com/exploits/45760

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1727889
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18944
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18944
https://www.exploit-db.com/author/?a=8844
https://www.exploit-db.com/exploits/45760

Artha has seen an update to version 1.0.5 recently (see
https://build.opensuse.org/request/show/823029) and the exploit may no longer
be reproducible on openSUSE Tumbleweed (see comments in the submit request
above). Could the security team please have a look at the updated package from
Education (https://build.opensuse.org/package/show/Education/artha) and let us
know if we can resubmit it to openSUSE:Factory? Thanks!


--1596746524.62aBfa3f1.22068
Date: Thu, 6 Aug 2020 20:42:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174977

            Bug ID: 1174977
           Summary: (CVE-2020-16845) VUL-0: CVE-2020-16845: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jkowalczyk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in
ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions
to read an unlimited number of bytes from the ByteReader argument before
returning an error. This could lead to processing more input than expected when
the caller is reading directly from the network and depends on ReadUvarint and
ReadVarint only consuming a small, bounded number of bytes, even from invalid
inputs.

With the update, ReadUvarint and ReadVarint now always return after consuming a
bounded number of bytes (specifically, MaxVarintLen64, which is 10). The result
being returned has not changed; the functions merely detect and return some
errors without reading as much input.

This issue is CVE-2020-16845.


--1596788001.DfED63F50.29313
Date: Fri, 7 Aug 2020 08:13:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1174986

            Bug ID: 1174986
           Summary: VUL-0: CVE-2020-17367,CVE-2020-17368: firejail -- security update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/264830/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: sebix+novell.com-at-sebix.at
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: mrueckert-at-suse.com
          Found By: Security Response Team
           Blocker: ---

CVE-2020-17367

Tim Starling discovered two vulnerabilities in firejail, a sandbox
program to restrict the running environment of untrusted applications.

CVE-2020-17367
It was reported that firejail does not respect the end-of-options
    separator ("--"), allowing an attacker with control over the command
    line options of the sandboxed application, to write data to a
    specified file.
CVE-2020-17368
It was reported that firejail when redirecting output via --output
    or --output-stderr, concatenates all command line arguments into a
    single string that is passed to a shell. An attacker who has control
    over the command line arguments of the sandboxed application could
    take advantage of this flaw to run arbitrary commands.

For the stable distribution (buster), these problems have been fixed in
version 0.9.58.2-2+deb10u1.
We recommend that you upgrade your firejail packages.
For the detailed security status of firejail please refer to its

security tracker page at:
https://security-tracker.debian.org/tracker/firejail

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17367
http://www.debian.org/security/-1/dsa-4742
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-17367.html
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-17368
http://www.debian.org/security/-1/dsa-4742
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-17368.html


--1596827718.4Cc1DB1.31476
Date: Fri, 7 Aug 2020 19:15:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1175025

            Bug ID: 1175025
           Summary: Please backport fix for rpm installing hardlinks
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: mls-at-suse.com
          Reporter: fabian@ritter-vogt.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

With the recent enablement of minimize_writes in general, some packages do not
upgrade correctly: https://github.com/rpm-software-management/rpm/issues/1278

This is especially bad in the combination with %fdupes, as it leads to more
hardlinks.


body:
--1596841886.C4BB3d40.9539
Date: Fri, 7 Aug 2020 23:11:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1175028

            Bug ID: 1175028
           Summary: Emacs segfault libX11
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: rjhorniii-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Emacs with window support segfaults with libX11 version 1.6.5-lp151.4.3-x86_64.
 It does not fail with libX11 version 1.6.5-lp151.3.3-x86_64.  Emacs -nw
operates properly.  Tested with both Emacs versions 26.2 and 26.3.

It's not clear whether this is an upstream problem or a build problem.

The full error trace is:

Fatal error 11: Segmentation fault
Backtrace:
src/emacs[0x508444]
src/emacs[0x4ef454]
src/emacs[0x506d3e]
src/emacs[0x506f38]
src/emacs[0x506fac]
/lib64/libpthread.so.0(+0x132d0)[0x7fe419d3e2d0]
src/emacs[0x4d317c]
src/emacs[0x4d3537]
src/emacs[0x4d4164]
src/emacs[0x5610c0]
src/emacs[0x595bb0]
src/emacs[0x56103b]
src/emacs[0x595bb0]
src/emacs[0x56103b]
src/emacs[0x562be2]
src/emacs[0x5610c0]
src/emacs[0x595bb0]
src/emacs[0x56103b]
src/emacs[0x595bb0]
src/emacs[0x56103b]
src/emacs[0x595bb0]
src/emacs[0x56103b]
src/emacs[0x595bb0]
src/emacs[0x56103b]
src/emacs[0x595bb0]
src/emacs[0x5639c3]
src/emacs[0x562f27]
src/emacs[0x564cfb]
src/emacs[0x56033e]
src/emacs[0x4f054c]
src/emacs[0x5602ad]
src/emacs[0x4ef773]
src/emacs[0x4f45b3]
src/emacs[0x4f48bc]
src/emacs[0x41985a]
/lib64/libc.so.6(__libc_start_main+0xea)[0x7fe41908934a]
src/emacs[0x41a44a]
Segmentation fault (core dumped)

pkgs: emacs xemacs

summary: Emacs segfault libX11


body:
--1596926677.EB88C0.3903
Date: Sat, 8 Aug 2020 22:44:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1175034

            Bug ID: 1175034
           Summary: xpra not installableon Leap 15.2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mook.moz+com.novell-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The xpra package [1] cannot be installed properly on Leap 15.2, as it requires
/usr/bin/bash but the bash package on 15.2 doesn't provide that (only
/bin/bash, /usr/bin/sh, /bin/sh).  This is not a problem on Factory, where the
bash package does provide /usr/bin/bash.

[1]: https://build.opensuse.org/package/show/openSUSE%3ALeap%3A15.2/xpra

Sample run:
> # zypper -n in xpra
> Problem: nothing provides /usr/bin/bash needed by xpra-4.0.1-lp152.1.1.x86_64
>  Solution 1: do not install xpra-4.0.1-lp152.1.1.x86_64
>  Solution 2: break xpra-4.0.1-lp152.1.1.x86_64 by ignoring some of its dependencies
>
> Choose from above solutions by number or cancel [1/2/c/d/?] (c): c

> # zypper if --requires xpra | grep bash
>     /usr/bin/bash

> # zypper if --provides bash
> Information for package bash:
<snip>
> Provides       : [6]
>     bash = 4.4-lp152.11.80
>     bash(x86-64) = 4.4-lp152.11.80
>     config(bash) = 4.4-lp152.11.80
>     /bin/sh
>     /bin/bash
>     /usr/bin/sh

summary: xpra not installableon Leap 15.2


--1596976368.6a4a40.5017
Date: Sun, 9 Aug 2020 12:32:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1175038

            Bug ID: 1175038
           Summary: Reinstalling bcm20702a1-firmware-1201650-5.1.noarch seems to remove the *.hcd files
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: nick.chorley-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

From dmesg, I found that the firmware for my device couldn't be found and was
lead to believe it was provided by the package above. My system already had it
installed, but the files were not present in /lib/firmware/brcm. I don't know
how my system got into this state and figuring that the installation went wrong
somehow, I decided to try and reinstall with

# zypper in -f bcm20702a1-firmware-1201650-5.1.noarch

This looked like it was successful, the output ending with

Converting BCM_DriverOnly/64/BCM20702A1_001.002.014.1443.1467.hex to
BCM20702A1-0b05-17cb.hcd
Converting BCM_DriverOnly/64/BCM20702A1_001.002.014.1443.1469.hex to
BCM20702A1-0b05-17cf.hcd
Converting BCM_DriverOnly/64/BCM20702A1_001.002.014.1483.1647.hex to
BCM20702A1-05ac-21e1.hcd
Converting BCM_DriverOnly/64/BCM20702A1_001.002.014.1483.1669.hex to
BCM20702A1-0a5c-21e6.hcd
Converting BCM_DriverOnly/64/BCM20702A1_001.002.014.1443.1467.hex to
BCM20702A1-050d-065a.hcd

but after completion, the firmware files were still not present in
/lib/firmware/brcm.

Over on the openSUSE forums, someone told me that the installation script
unconditionally removes the files in its post-uninstall step and that that is
always run on update (see the thread here:
https://forums.opensuse.org/showthread.php/542851-Problem-reinstalling-bcm20702a1-firmware-1201650-5-1-noarch?p=2953852#post2953852).