body:
--1576238707.d7DCcf0.6824
Date: Fri, 13 Dec 2019 12:05:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159195

            Bug ID: 1159195
           Summary: wsl --upgrade breaks zypper
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: libzypp
          Assignee: zypp-maintainers-at-suse.de
          Reporter: Mathias.Homann-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I'm running an opensuse 15.1 inside windows subsystem for linux, and I found
that upgrading the filesystem to WslFs breaks zypper.

if you run "wsl --upgrade openSUSE-Leap-15-1" as Administrator on windows, and
afterwards try to run "zypper refresh" in your WSL Leap image, zypper fails
with these errors:
kirika:~ # zypper ref
Retrieving repository 'leap-15.1' metadata
.............................................................................................................................................................[error]
Repository 'leap-15.1' is invalid.
[leap-15.1|http://download.opensuse.org/distribution/leap/15.1/repo/oss/] Valid
metadata not found at specified URL
Please check if the URIs defined for this repository are pointing to a valid
repository.
Skipping repository 'leap-15.1' because of the above error.
Retrieving repository 'leap-15.1-update' metadata
......................................................................................................................................................[error]
Repository 'leap-15.1-update' is invalid.
[leap-15.1-update|http://download.opensuse.org/update/leap/15.1/oss/] Valid
metadata not found at specified URL
Please check if the URIs defined for this repository are pointing to a valid
repository.
Skipping repository 'leap-15.1-update' because of the above error.
Could not refresh the repositories because of errors.

in /var/log/zypper.log you see:

2019-12-13 12:02:20 <5> kirika(120) [zypp] Exception.cc(log):166
RepoManager.cc(refreshMetadata):1221 THROW:
[leap-15.1-update|http://download.opensuse.org/update/leap/15.1/oss/] Valid
metadata not found at specified URL
2019-12-13 12:02:20 <5> kirika(120) [zypp] Exception.cc(log):166 History:
2019-12-13 12:02:20 <5> kirika(120) [zypp] Exception.cc(log):166  - Can't copy
public key data from
/var/cache/zypp/raw/leap-15.1-updatekRrguZ/repodata/repomd.xml.key to
/var/tmp/TmpFile.DWnK2Z
2019-12-13 12:02:20 <5> kirika(120) [zypp] Exception.cc(log):166
2

which leads me to believe that WslFS as storage for a WSL image is incompatible
with zypper.

There is no workaround, and only a **destructive** fix: reset the "app" which
basically means wipe the image and set it up again, losing everything you did
inside.
or run openSUSE-Leap-15-1.exe clean in an administrator shell which is
basically the same, and also wipes everything.

Reproduces with 15.0 and 15.1, can't try with other versions since they aren't
on the windows store.

summary: wsl --upgrade breaks zypper


--1576349594.a18587EF0.26426
Date: Sat, 14 Dec 2019 18:53:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1159235

            Bug ID: 1159235
           Summary: devel:kubic:images: raspberry pi2 images don't boot/stops with grub2 prompt
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Kubic
          Assignee: fvogt-at-suse.com
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The raspberry pi2 images from devel:kubic:images don't boot anymore, they stop
in a grub2 prompt


--1576410343.Cf4Bbb630.1298
Date: Sun, 15 Dec 2019 11:45:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159240

            Bug ID: 1159240
           Summary: [hplip] hp-sendfax requires python3-reportlab to operate properly
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: All
                OS: SUSE Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Printing
          Assignee: martin.wilck-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: jsmeix-at-suse.com
          Found By: Development
           Blocker: ---

Without reportlab, hp-sendfax core dumps after loading a file to fax.
Therefore, python3-reportlab should be at least a recommends of hplip.

Shell output of program:

$ hp-sendfax

HP Linux Imaging and Printing System (ver. 3.18.6)
PC Sendfax Utility ver. 9.0

Copyright (c) 2001-15 HP Development Company, LP
This software comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to distribute it
under certain conditions. See COPYING file for more details.

warning: Reportlab not installed. Fax coverpages disabled.
warning: Please install version 2.0+ of Reportlab for coverpage support.
qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 669, resource
id: 13465094, major code: 40 (TranslateCoords), minor code: 0
Traceback (most recent call last):
  File "/usr/share/hplip/ui5/sendfaxdialog.py", line 375, in
FilesTable_fileListChanged
    self.toggleCoverPage(self.FilesTable.isMIMETypeInList(MIME_TYPE_COVERPAGE))
  File "/usr/share/hplip/ui5/sendfaxdialog.py", line 328, in toggleCoverPage

self.CoverPageGroupBox.toggled[bool].disconnect(self.CoverPageGroupBox_toggled)
TypeError: 'method' object is not connected
Aborted (core dumped)


--1576428672.bC8a8B0.4104
Date: Sun, 15 Dec 2019 16:51:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159243

            Bug ID: 1159243
           Summary: python3-virtualenvwrapper is trying to use python 2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: heger.tomas-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

virtualenvwrapper (installed from python3-virtualenvwrapper) doesn't work on my
OpenSUSE 15.1. After investigating why I found out that it's trying to use
Python 2 (despite coming from python3 related package). I don't even have the
python2 version of the wrapper installed btw.

$ zypper se virtualenvwrapper
Repository 'packman' is out-of-date. You can run 'zypper refresh' as root to
update it.
Repository 'Main Update Repository' is out-of-date. You can run 'zypper
refresh' as root to update it.
Loading repository data...
Reading installed packages...

S  | Name                      | Summary                    | Type
---+---------------------------+----------------------------+--------
   | python2-virtualenvwrapper | Enhancements to virtualenv | package
i+ | python3-virtualenvwrapper | Enhancements to virtualenv | package

The problem is that unless a user sets VIRTUALENVWRAPPER_PYTHON environment
variable to tell virtualenvwrapper which python to use, the script calls `which
python` to determine that. In OpenSUSE 15.1 that points to a Python 2
interpreter though. It works after changing that to `which python3`.


body:
--1576506090.eD3fc1.4707
Date: Mon, 16 Dec 2019 14:21:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159288

            Bug ID: 1159288
           Summary: devel:languages:go/telegraf: Bug
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: jkowalczyk-at-suse.com
          Reporter: christian.pfenninger-at-suse.com
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

With the telegraf version 12.0 when sending the data from the agent via https
to the db, the information about the sending host gets lost.
As a workaround you have to put the hostname manually in the telegraf.con,
which is very anoying when you have hundreds or thousands of systems.

Version 12.6 or 13.0 should be better.
Can someone please create a new package with an actual version e.g. 12.6 or
13.0

summary: devel:languages:go/telegraf: Bug


--1576573506.6cAd0CE0.21301
Date: Tue, 17 Dec 2019 09:05:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159338

            Bug ID: 1159338
           Summary: VUL-1: CVE-2019-16778: heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/249132/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: guillaume.gardet-at-opensuse.org
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-16778

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be
produced when the Index template argument is int32. In this case data_size and
num_segments fields are truncated from int64 to int32 and can produce negative
numbers, resulting in accessing out of bounds heap memory. This is unlikely to
be exploitable and was detected and fixed internally in TensorFlow 1.15 and
2.0.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-16778
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16778
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-844w-j86r-4x2j
https://github.com/tensorflow/tensorflow/commit/db4f9717c41bccc3ce10099ab61996b246099892
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2019-002.md


--1576685360.71Ff0F81.3521
Date: Wed, 18 Dec 2019 16:09:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1159480

            Bug ID: 1159480
           Summary: No documentation about "DEFAULT_SUSE" ciphers
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: i586
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Apache
          Assignee: bnc-team-apache-at-forge.provo.novell.com
          Reporter: suseino-at-riseup.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I notice that in /etc/apache2/ssl-global.conf on a Leap 15.1 system the list of
ciphers is specified as:

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256: ...
(long list, truncated)

On Tumblweed though there is just:

SSLCipherSuite DEFAULT_SUSE

The later is quite unclear and I don't find any documentation on what is
included in "DEFAULT_SUSE". As ciphers have direct relation to security of
information - this is definitely a serious question.

* The name cannot be found in the documentation of Apache too:

https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslciphersuite


--1576700685.e5BD3.7522
Date: Wed, 18 Dec 2019 20:24:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159500

            Bug ID: 1159500
           Summary: BPF samples don't compile properly (missing BPF_FUNC_override_return)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: snguyen-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

In openSUSE Leap 15.1, the eBPF samples in /usr/src/linux/samples/bpf don't
compile properly. BPF_FUNC_override_return is missing from enum bpf_func_id.

Looking into include/uapi/linux/bpf.h, it is clear that "FN(override_return),"
is missing from the definition of __BPF_FUNC_MAPPER(FN).


--1576751928.3CC6c60.14879
Date: Thu, 19 Dec 2019 10:38:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159538

            Bug ID: 1159538
           Summary: KIWI creates a   redundant btrfs swap subvolume
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dcassany-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This is a tracker for the bug reported upstream in:

https://github.com/OSInside/kiwi/issues/1301

KIWI 9.19.7 creates an extra unneeded swap subvolum if swap partition is
requested.

Bug fix already provided in

https://github.com/OSInside/kiwi/pull/1302


--1576759992.F16De80.32737
Date: Thu, 19 Dec 2019 12:53:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159550

            Bug ID: 1159550
           Summary: VUL-0: CVE-2019-19724: singularity: Insecure permissions are set on $HOME/.singularity potentially to an information leak
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249524/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: burnus-at-gmx.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-19724

Insecure permissions (777) are set on $HOME/.singularity when it is newly
created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an
information leak, and malicious redirection of operations performed against
Sylabs cloud services.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19724
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19724
https://github.com/sylabs/singularity/releases/tag/v3.5.2


--1576764969.87ADa21f3.10491
Date: Thu, 19 Dec 2019 14:16:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159556

            Bug ID: 1159556
           Summary: libmicro has unreproducible .o files from LTO
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: mpluskal-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: martin.liska-at-suse.com, vmarsik-at-suse.com
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
the libmicro package varies across builds in .o files.

Are these .o files supposed to be in there? Why?

/usr/lib/libMicro/bin/benchmark_fini.o differs in ELF section
.gnu.lto_.jmpfuncs
.9193de93f5298bd9
-


--1576769969.c272F04.30080
Date: Thu, 19 Dec 2019 15:39:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1159563

            Bug ID: 1159563
           Summary: [HPC, environment modules]  MODULEPATH in lua-lmod
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: cgoll-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Adding an additional module directory for all users is reliable possible at the
moment. The module environment parses all the directories of $MODULEPATH, *but*
overwrites $MODULEPATH in /etc/profile.d/lmod.sh. To fix this, lmod.sh should
honor an existing MODULEPATH.
As work around, one can make that a script holding additional paths $MODULEPATH
is sourced after lmod.sh


body:
--1576770999.dCCf0ca014.3231
Date: Thu, 19 Dec 2019 15:56:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1159566

            Bug ID: 1159566
           Summary: /etc/yp.conf ownership
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: mt-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: kukuk-at-suse.com, max-at-suse.com
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1123699 +++

/etc/yp.conf is owned by ypbind as %ghost %config(noreplace) and by sysconfig
as %ghost

Not sure if of practical relevance but the file conflict checker bot trips over
this. Generating this symlink into /etc/ unconditionally by sysconfig seems
wrong anyways, so I'm proposing to not do that anymore. Instead we can have
ypbind read a config in /run:
https://github.com/thkukuk/ypbind-mt/pull/3

netconfig can then create that one instead, without invading admin space in
/etc. So sysconfig also no longer needs to own /etc/yp.conf

summary: /etc/yp.conf ownership


--1577086077.6de3E73.24005
Date: Mon, 23 Dec 2019 07:27:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159713

            Bug ID: 1159713
           Summary: VUL-0: CVE-2019-19918: heap-based buffer overflow in the srcnext() function in z02.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249649/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mcepl-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-19918

Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19918
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19918.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19918
https://lists.gnu.org/archive/html/lout-users/2019-12/msg00001.html


--1577086165.cBc7ee0.27280
Date: Mon, 23 Dec 2019 07:29:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159714

            Bug ID: 1159714
           Summary: VUL-0: CVE-2019-19917: lout: buffer overflow in the StringQuotedWord() function in z39.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249648/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mcepl-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-19917

Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19917
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19917.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19917
https://lists.gnu.org/archive/html/lout-users/2019-12/msg00002.html


--1577106783.aa658D4.30467
Date: Mon, 23 Dec 2019 13:13:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1159739

            Bug ID: 1159739
           Summary: Calamares  "Fail run dracut on the target" error
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: opensuse.lietuviu.kalba-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

ISO image may contain KIWI generated /etc/dracut.conf.d/02-livecd.conf file
that triggers dracut to look for dracut module 'kiwi-live' though it is not
required in installed system (i.e. after installing system from LiveCD into
real machine).
Thus /etc/dracut.conf.d/02-livecd.conf must be excluded from installation
process.

See also https://github.com/calamares/calamares/issues/1245


body:
--1577283221.8Be5C3b3.11059
Date: Wed, 25 Dec 2019 14:13:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159777

            Bug ID: 1159777
           Summary: v4l2loopback missing header
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: cshorler-at-googlemail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The debug package is missing v4l2loopback_formats.h file, I guess because
there's no executable code ref.  Nonetheless, it would be useful to include the
file in the debugsource package.

static const struct v4l2l_format formats[] = {
#include "v4l2loopback_formats.h"
};

summary: v4l2loopback missing header


--1577395387.cec54.2975
Date: Thu, 26 Dec 2019 21:23:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159812

            Bug ID: 1159812
           Summary: nodejs10 gyp config points to nodejs12 include dirs
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: itaranto7-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

grep -r node12 /usr/lib64/node_modules
npm10/node_modules/node-gyp/addon-rpm.gypi:      '/usr/include/node12/',
npm10/node_modules/node-gyp/lib/configure.js:        nodeDir =
'/usr/include/node12'

I replaced node12 with node10 and now my build works... just spent an entire
afternoon figuring out :(

This does not happen in Leap 15.1.


--1577435921.c51Eb7D0.13297
Date: Fri, 27 Dec 2019 08:38:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159824

            Bug ID: 1159824
           Summary: VUL-1: CVE-2019-20009: libredwg: Crafted input will lead to aexcessive memory allocation in dwg_decode_SPLINE_private in dwg.spec
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249843/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20009

An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to
an attempted excessive memory allocation in dwg_decode_SPLINE_private in
dwg.spec.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20009
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20009
https://github.com/LibreDWG/libredwg/issues/176#issue-541977765
https://github.com/LibreDWG/libredwg/issues/176
https://github.com/LibreDWG/libredwg/compare/0.9.2...0.9.3


--1577436025.E1Fa10.28497
Date: Fri, 27 Dec 2019 08:40:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159825

            Bug ID: 1159825
           Summary: VUL-1: CVE-2019-20010: libredwg: use-after-free in resolve_objectref_vector in decode.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249844/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20010

An issue was discovered in GNU LibreDWG 0.92. There is a use-after-free in
resolve_objectref_vector in decode.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20010
https://github.com/LibreDWG/libredwg/issues/176#issuecomment-568643383
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20010
https://github.com/LibreDWG/libredwg/issues/176


--1577436509.875ec6A0.18635
Date: Fri, 27 Dec 2019 08:48:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159826

            Bug ID: 1159826
           Summary: VUL-1: CVE-2019-20011: libredwg: heap-based buffer over-read in decode_R13_R2000 in decode.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249845/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20011

An issue was discovered in GNU LibreDWG 0.92. There is a heap-based buffer
over-read in decode_R13_R2000 in decode.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20011
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20011
https://github.com/LibreDWG/libredwg/issues/176
https://github.com/LibreDWG/libredwg/issues/176#issuecomment-568643439


--1577436675.cdCbC70.17568
Date: Fri, 27 Dec 2019 08:51:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159827

            Bug ID: 1159827
           Summary: VUL-1: CVE-2019-20012: libredwg: crafted input will lead to excessive memory allocation in dwg_decode_HATCH_private in dwg.spec
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249846/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20012

An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an
attempted excessive memory allocation in dwg_decode_HATCH_private in dwg.spec.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20012
https://github.com/LibreDWG/libredwg/issues/176#issuecomment-568643088
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20012
https://github.com/LibreDWG/libredwg/issues/176


--1577436803.4Ee525.14558
Date: Fri, 27 Dec 2019 08:53:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159828

            Bug ID: 1159828
           Summary: VUL-1: CVE-2019-20013: libredwg: crafted input will lead to excessive memory allocation in decode_3dsolid in dwg.spec
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249847/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20013

An issue was discovered in GNU LibreDWG before 0.93. Crafted input will lead to
an attempted excessive memory allocation in decode_3dsolid in dwg.spec.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20013
https://github.com/LibreDWG/libredwg/issues/176#issuecomment-568643060
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20013
https://github.com/LibreDWG/libredwg/issues/176
https://github.com/LibreDWG/libredwg/compare/0.9.2...0.9.3


--1577436984.3bb880.14445
Date: Fri, 27 Dec 2019 08:56:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159831

            Bug ID: 1159831
           Summary: VUL-1: CVE-2019-20014: libredwg: double-free in dwg_free in free.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249848/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20014

An issue was discovered in GNU LibreDWG before 0.93. There is a double-free in
dwg_free in free.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20014
https://github.com/LibreDWG/libredwg/issues/176
https://github.com/LibreDWG/libredwg/issues/176#issuecomment-568643172
https://github.com/LibreDWG/libredwg/compare/0.9.2...0.9.3
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20014


--1577437098.fD560.24755
Date: Fri, 27 Dec 2019 08:58:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159832

            Bug ID: 1159832
           Summary: VUL-1: CVE-2019-20015: libredwg: crafted input will lead to an attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in dwg.spec.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249849/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20015

An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an
attempted excessive memory allocation in dwg_decode_LWPOLYLINE_private in
dwg.spec.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20015
https://github.com/LibreDWG/libredwg/issues/176#issuecomment-568643028
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20015
https://github.com/LibreDWG/libredwg/issues/176


--1577437337.E40ABf1.23460
Date: Fri, 27 Dec 2019 09:02:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159833

            Bug ID: 1159833
           Summary: VUL-1: CVE-2019-20021: upx:  heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249855/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: crrodriguez-at-opensuse.org
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20021

A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX
3.95 via a crafted Mach-O file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20021
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20021
https://github.com/upx/upx/issues/315


--1577438359.DaeB0d1e0.23281
Date: Fri, 27 Dec 2019 09:19:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159838

            Bug ID: 1159838
           Summary: [Build 20191225] virt_install fails to find pci.ids
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/1124477/modules/virt
                    _install/steps/24
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-virtualization@64bit
fails in
[virt_install](https://openqa.opensuse.org/tests/1124477/modules/virt_install/steps/24)

There was an update to libosinfo with this (shortened) diff:
.changes:
+  * Fix pci.ids and usb.ids installation

when inspecting the new RPMs. pci.ids is not part of any of the built RPMs. so
that 'fix' might not have worked as reliably as expected

## Test suite description
Maintainer: okurz. Test virtualization stack using libvirt and virt-manager.

## Reproducible

Fails since (at least) Build
[20191223](https://openqa.opensuse.org/tests/1122498)

## Expected result

Last good: [20191221](https://openqa.opensuse.org/tests/1121109) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit&test=virtualization&version=Tumbleweed)


--1577438614.Cd7E810.4823
Date: Fri, 27 Dec 2019 09:23:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159839

            Bug ID: 1159839
           Summary: VUL-1: CVE-2019-20016: libmysofa: improper restriction of recursive function calls in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c may lead to stack consumption
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249850/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: 9+suse-at-cirno.systems
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20016

libmysofa 0.9 does not properly restrict recursive function calls, as
demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype
in
dataobject.c and directblockRead in fractalhead.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20016
https://github.com/hoene/libmysofa/commit/2e6fac6ab6156dae8e8c6f417741388084b70d6f
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20016
https://github.com/hoene/libmysofa/issues/84
https://github.com/hoene/libmysofa/issues/83


--1577453628.7DB01Ed3.16817
Date: Fri, 27 Dec 2019 13:33:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1159851

            Bug ID: 1159851
           Summary: glibc-locale-base %post modifies files in /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: schwab-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

$ rpm -q --scripts glibc-locale-base
postinstall scriptlet (using /bin/sh):
for l in /usr/share/locale/locale.alias /usr/lib64/gconv/gconv-modules; do
        [ -d "$l.d" ] || continue
        echo "###X# The following is autogenerated from extra files in the .d
directory:" >>"$l"
        cat "$l.d"/* >>"$l"
done
/usr/sbin/iconvconfig
$

/usr/share/locale/locale.alias and /usr/lib64/gconv/gconv-modules are not
%ghost so it's not legal to modify them.

Looks like in glibc LOCALE_ALIAS_PATH is already set up to be colon separated
list so could have two entries where one points to a file that may exist
somewhere in /var and is generated.


--1577454383.cadd2BC0.8426
Date: Fri, 27 Dec 2019 13:46:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159852

            Bug ID: 1159852
           Summary: VUL-1: CVE-2019-19950: use-after-free in ThrowException and ThrowLoggedException of magick/error.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249756/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: pgajdos-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-19950

In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in
ThrowException and ThrowLoggedException of magick/error.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19950
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19950
https://sourceforge.net/p/graphicsmagick/bugs/603/
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/44ab7f6c20b4


--1577722429.7aafb8c0.28257
Date: Mon, 30 Dec 2019 16:13:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159920

            Bug ID: 1159920
           Summary: VUL-1: CVE-2019-20053: An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249907/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: jengelh-at-inai.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20053

An invalid memory address dereference was discovered in the canUnpack function
in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20053
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20053
https://github.com/upx/upx/issues/314


body:
--1577802970.67a1c16.8555
Date: Tue, 31 Dec 2019 14:36:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159958

            Bug ID: 1159958
           Summary: All YaST icons lost
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: LXQt
          Assignee: mvetter-at-suse.com
          Reporter: axel.braun-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 826804
  --> http://bugzilla.opensuse.org/attachment.cgi?id=826804&action=edit
screenshot

Did a zypper dup from
openSUSE-Leap-15.1-ARM-LXQT-raspberrypi3.aarch64-2019.05.17-Snapshot1.62.raw.xz
to Leap 15.2
That worked nice so far, but there seems to be a problem with YaST: all icons
lost, see picture. Inside the YST application there are no icons either

pkgs: lxqt-session patterns-lxqt

summary: All YaST icons lost


body:
--1577817804.DFa1AfE00.11016
Date: Tue, 31 Dec 2019 18:43:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1159963

            Bug ID: 1159963
           Summary: post-build-checks breaks permissions
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: fabian@ritter-vogt.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

post-build-checks sets PERMISSION_SECURITY to "secure". This means that
packages installed after post-build-checks don't have setuid set, which makes
it impossible to do certain stuff during build. For instance, it makes it
impossible to test anything which uses FUSE.

Additionally, outside of openSUSE:Factory, post-bulid-checks is installed at
the end of the package list, so PERMISSION_SECURITY has zero effect.

I request dropping this behaviour.

summary: post-build-checks breaks permissions


--1577877508.C4aE0.19572
Date: Wed, 1 Jan 2020 11:18:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159968

            Bug ID: 1159968
           Summary: Bitcoin Core client in Leap fails to fully process chain state
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: marix-at-marix.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 826808
  --> http://bugzilla.opensuse.org/attachment.cgi?id=826808&action=edit
Screenshot of the block-version warning message (German language)

The Bitcoin Core client in Leap 15.1 (package bitcoin-qt5) is to old to parse
the latest block versions that are on the Bitcoin Core chain. Thus, it prints a
warning (roughly translated from German, see attached screen shot):

Warning! Unknown block version is being generated by mining. It might be
possible that unknown rules are in effect.

Expected behaviour would be for the Bitcoin Core client in Leap to be able to
process all block versions that can be found on Bitcoin Core's main chain.


--1577906581.6Bc21.15931
Date: Wed, 1 Jan 2020 19:23:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1159974

            Bug ID: 1159974
           Summary: Live images come with erroneous checksum
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Live Medium
          Assignee: dimstar-at-opensuse.org
          Reporter: fkrueger-at-mailbox.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Download of KDE LiveCD together with the corresponding checksum from
https://software.opensuse.org/distributions/tumbleweed followed by
"sha256sum -c
openSUSE-Tumbleweed-KDE-Live-x86_64-Snapshot20191230-Media.iso.sha256" leads to
the error message "sha256sum:
openSUSE-Tumbleweed-KDE-Live.x86_64-2.8.0-Build118.21.iso: file or directory
not found", which is due to the different file names. As a matter of fact, we
have

> cat openSUSE-Tumbleweed-KDE-Live-x86_64-Snapshot20191230-Media.iso.sha256
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

86fe34dc48951b2399406d1544d301dfd2733fc634a0677398cb41b762eb74ba
openSUSE-Tumbleweed-KDE-Live.x86_64-2.8.0-Build118.21.iso
-----BEGIN PGP SIGNATURE-----
...
-----END PGP SIGNATURE-----

While the issue is reported for Tumbleweed, it also applies to other Live
Images/Rescue CD including Leap 15.1/15.2.


--1578039510.DfdC1Cc9.9893
Date: Fri, 3 Jan 2020 08:18:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160040

            Bug ID: 1160040
           Summary: VUL-1: CVE-2019-20063: libmysofa: hdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as demonstrated by mysofa2json.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249913/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: 9+suse-at-cirno.systems
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20063

hdf/dataobject.c in libmysofa before 0.8 has an uninitialized use of memory, as
demonstrated by mysofa2json.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20063
https://github.com/hoene/libmysofa/issues/67
https://github.com/hoene/libmysofa/compare/v0.7...v0.8
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20063


body:
--1578059192.F0fc5D70.8114
Date: Fri, 3 Jan 2020 13:46:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1160066

            Bug ID: 1160066
           Summary: python-certbot update to 1.0.0
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mcalabkova-at-suse.com
          Reporter: mcalabkova-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Certbot 1.0.0
Removed

    The docs extras for the certbot-apache and certbot-nginx packages
    have been removed.

Changed

    certbot-auto has deprecated support for systems using OpenSSL 1.0.1 that
are
    not running on x86-64. This primarily affects RHEL 6 based systems.
    Certbot's config_changes subcommand has been removed
    certbot.plugins.common.TLSSNI01 has been removed.
    Deprecated attributes related to the TLS-SNI-01 challenge in
    acme.challenges and acme.standalone
    have been removed.
    The functions certbot.client.view_config_changes,
    certbot.main.config_changes,
    certbot.plugins.common.Installer.view_config_changes,
    certbot.reverter.Reverter.view_config_changes, and
    certbot.util.get_systemd_os_info have been removed
    Certbot's register --update-registration subcommand has been removed
    When possible, default to automatically configuring the webserver so all
    requests redirect to secure HTTPS access. This is mostly relevant when
    running Certbot in non-interactive mode. Previously, the default was
    to not redirect all requests.

pkgs: python-acme python-certbot python-certbot-apache python-certbot-nginx

summary: python-certbot update to 1.0.0


--1578063476.EbDd2bD8.28455
Date: Fri, 3 Jan 2020 14:57:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160070

            Bug ID: 1160070
           Summary: fetchmsttfonts: package not discoverable
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Windows 10
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: giecrilj@stegny.2a.pl
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

When I search for packages by keywords: Microsoft, Times, Arial, none of these
searches finds fetchmsttfonts.  Please improve the package description.


--1578240512.Ab0Baa3D1.21611
Date: Sun, 5 Jan 2020 16:08:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160100

            Bug ID: 1160100
           Summary: RFE: Add "apache-httpd-24-devel" as a virtual Provides to Apache httpd devel RPM
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Apache
          Assignee: bnc-team-apache-at-forge.provo.novell.com
          Reporter: minfrin-at-sharp.fm
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Description of problem:

The devel package for Apache httpd is inconsistently named across
distributions, and this means it is a headache to create Apache modules that
can be deployed across multiple distributions.

I recommend adding "Provides: apache-httpd-24-devel" as a virtual dependency to
the httpd headers RPM package but am open to suggestions.

Version-Release number of selected component (if applicable):

How reproducible: Always

Steps to Reproduce:
1. Develop and Apache httpd module
2. Depend on httpd-devel

Actual results:

Dependency failures on non Redhat distros.

Expected results:

RPM build works everywhere.

Additional info:


--1578391069.a5CBF0.5864
Date: Tue, 7 Jan 2020 09:57:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1160213

            Bug ID: 1160213
           Summary: transactional-update error message about missing fstab file
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: MicroOS
          Assignee: iforster-at-suse.com
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Only cosmetic, but the first transactional-update call always prints this error
message:

cp: cannot stat '/var/lib/overlay/1/etc/fstab': No such file or directory


body:
--1578401335.62E64.15469
Date: Tue, 7 Jan 2020 12:48:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160244

            Bug ID: 1160244
           Summary: [META] -fno-common package failures
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Starting from the upcoming GCC release 10, the default of -fcommon option will
change to -fno-common:

In C, global variables with multiple tentative definitions will result in
linker errors. Global variable accesses are also more efficient on various
targets.

Porting advice:

A common mistake in C is omitting extern when declaring a global
variable in a header file.  If the header is included by several files it
results in multiple definitions of the same variable.  In previous GCC versions
this error is ignored.  GCC 10 defaults to -fno-common,
which means a linker error will now be reported. To fix this, use
extern in header files when declaring global variables, and ensure
each global is defined in exactly one C file. As a workaround, legacy C code
can be compiled with -fcommon.

      int x;  // tentative definition - avoid in header files
      extern int y;  // correct declaration in a header file

Recommendations for package maintainers:
- report the violation to upstream
- cherry pick a fix from upsteam

Alternatively one can append -fcommon to $optflags for a package that will not
be fixed upstream.

summary: [META] -fno-common package failures


body:
--1578404069.2edEdF4.9367
Date: Tue, 7 Jan 2020 13:34:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160254

            Bug ID: 1160254
           Summary: libtool failure with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

There are multiple failures:

[   27s] ../libtool: eval: line 1719: syntax error near unexpected token `|'
[   27s] ../libtool: eval: line 1719: `/usr/bin/nm -B  .libs/maxminddb.o
.libs/data-pool.o   |  | /usr/bin/sed 's/.* //' | sort | uniq >
.libs/libmaxminddb.exp'

It's an upstream issue:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=39009

summary: libtool failure with -fno-common


body:
--1578404584.5Df84.16475
Date: Tue, 7 Jan 2020 13:43:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160257

            Bug ID: 1160257
           Summary: bindfs fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/bindfs/standard/x86_64

Please take a look at the META package for the instructions.

summary: bindfs fails with -fno-common


body:
--1578404921.Ef834.19096
Date: Tue, 7 Jan 2020 13:48:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160262

            Bug ID: 1160262
           Summary: dhcp fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1160244
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/dhcp/standard/x86_64

Please take a look at the META issue for the instructions.

summary: dhcp fails with -fno-common


body:
--1578405043.Fd71af14.9112
Date: Tue, 7 Jan 2020 13:50:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160264

            Bug ID: 1160264
           Summary: finger fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/finger/standard/x86_64

Please take a look at the META issue for the instructions.

summary: finger fails with -fno-common


body:
--1578405091.8CEF34.26757
Date: Tue, 7 Jan 2020 13:51:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160265

            Bug ID: 1160265
           Summary: foma fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/foma/standard/x86_64

Please take a look at the META issue for the instructions.

summary: foma fails with -fno-common


body:
--1578405230.CD7729.19400
Date: Tue, 7 Jan 2020 13:53:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160267

            Bug ID: 1160267
           Summary: gsoap fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/gsoap/standard/x86_64

Please take a look at the META issue for the instructions.

summary: gsoap fails with -fno-common


body:
--1578405272.ED1C668A4.29137
Date: Tue, 7 Jan 2020 13:54:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160269

            Bug ID: 1160269
           Summary: ifplugd fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/ifplugd/standard/x86_64

Please take a look at the META issue for the instructions.

summary: ifplugd fails with -fno-common


body:
--1578405321.D5741DfC35.19400
Date: Tue, 7 Jan 2020 13:55:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160271

            Bug ID: 1160271
           Summary: iproute2 fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/iproute2/standard/x86_64

Please take a look at the META issue for the instructions.

summary: iproute2 fails with -fno-common


body:
--1578405485.ADfD2B31.30695
Date: Tue, 7 Jan 2020 13:58:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160276

            Bug ID: 1160276
           Summary: libiscsi fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/libiscsi/standard/x86_64

Please take a look at the META issue for the instructions.

summary: libiscsi fails with -fno-common


body:
--1578405530.50e4A07d4.1628
Date: Tue, 7 Jan 2020 13:58:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160278

            Bug ID: 1160278
           Summary: liblbxutil fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/liblbxutil/standard/x86_64

Please take a look at the META issue for the instructions.

summary: liblbxutil fails with -fno-common


body:
--1578405605.05A04534.3970
Date: Tue, 7 Jan 2020 14:00:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160281

            Bug ID: 1160281
           Summary: logrotate fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/logrotate/standard/x86_64

Please take a look at the META issue for the instructions.

summary: logrotate fails with -fno-common


body:
--1578405625.1650b4.3969
Date: Tue, 7 Jan 2020 14:00:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160282

            Bug ID: 1160282
           Summary: makedumpfile fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/makedumpfile/standard/x86_64

Please take a look at the META issue for the instructions.

summary: makedumpfile fails with -fno-common


body:
--1578405722.78Ac8.20900
Date: Tue, 7 Jan 2020 14:02:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160287

            Bug ID: 1160287
           Summary: open-iscsi fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/open-iscsi/standard/x86_64

Please take a look at the META issue for the instructions.

summary: open-iscsi fails with -fno-common


body:
--1578405808.4Adff29.31015
Date: Tue, 7 Jan 2020 14:03:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160291

            Bug ID: 1160291
           Summary: schily fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/schily/standard/x86_64

Please take a look at the META issue for the instructions.

summary: schily fails with -fno-common


body:
--1578405889.cBed4.28280
Date: Tue, 7 Jan 2020 14:04:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160293

            Bug ID: 1160293
           Summary: socat fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/socat/standard/x86_64

Please take a look at the META issue for the instructions.

summary: socat fails with -fno-common


body:
--1578405962.aBcEf49.28280
Date: Tue, 7 Jan 2020 14:06:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160296

            Bug ID: 1160296
           Summary: tcsh fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/tcsh/standard/x86_64

Please take a look at the META issue for the instructions.

summary: tcsh fails with -fno-common


body:
--1578405984.5a860a13.3953
Date: Tue, 7 Jan 2020 14:06:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160297

            Bug ID: 1160297
           Summary: tftp fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/tftp/standard/x86_64

Please take a look at the META issue for the instructions.

summary: tftp fails with -fno-common


body:
--1578406008.C5aD2A19.29137
Date: Tue, 7 Jan 2020 14:06:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160298

            Bug ID: 1160298
           Summary: v4l-utils fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/v4l-utils/standard/x86_64

Please take a look at the META issue for the instructions.

summary: v4l-utils fails with -fno-common


--1578407510.AA2872B0.23821
Date: Tue, 7 Jan 2020 14:31:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1160303

            Bug ID: 1160303
           Summary: On aarch64 libseccomp does not work with new file--5.38
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The new sandboxing feature of file-5.38 uses libseccomp to  execute external
decompressing programs within such a sandbox.  On aarch64 this leads to signal
31 which cause to crash the file program at checking.


--1578411332.5dcb00.24829
Date: Tue, 7 Jan 2020 15:35:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160314

            Bug ID: 1160314
           Summary: aarch64 JeOS efi images comes with snapper unconfigured
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

aarch64 JeOS efi images have a btrfs filesystem, with snapper installed but
unconfigured.

Those images should provide a default snapper configuration.


--1578413098.CfC470.15186
Date: Tue, 7 Jan 2020 16:04:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160321

            Bug ID: 1160321
           Summary: VUL-1: CVE-2019-19951:  GraphcsMagick: heap-based buffer overflow in the function ImportRLEPixels of coders/miff.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/249757/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: pgajdos-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-19951

In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer
overflow in the function ImportRLEPixels of coders/miff.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19951
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-19951.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19951
http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/bc99af93614d
https://sourceforge.net/p/graphicsmagick/bugs/608/


--1578433742.bC8c0.32687
Date: Tue, 7 Jan 2020 21:49:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160337

            Bug ID: 1160337
           Summary: VUL-0: chromium: multiple security issues fixed in 79.0.3945.117
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop.html

3 security fixes in Chromium 79.0.3945.117:

* CVE-TBD: Use after free in audio
* Various fixes from internal audits, fuzzing and other initiatives

https://bugs.chromium.org/p/chromium/issues/detail?id=1029462
https://bugs.chromium.org/p/chromium/issues/detail?id=1039803


body:
--1578476097.a62e16.12197
Date: Wed, 8 Jan 2020 09:34:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160382

            Bug ID: 1160382
           Summary: SDL2 fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/SDL2/standard/x86_64

Please take a look at the META issue for the instructions.

summary: SDL2 fails with -fno-common


body:
--1578476176.78fB0E4.15164
Date: Wed, 8 Jan 2020 09:36:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160385

            Bug ID: 1160385
           Summary: blog fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/blog/standard/x86_64

Please take a look at the META issue for the instructions.

summary: blog fails with -fno-common


body:
--1578476227.8CE64.11903
Date: Wed, 8 Jan 2020 09:37:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160387

            Bug ID: 1160387
           Summary: cups-filters fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/cups-filters/standard/x86_64

Please take a look at the META issue for the instructions.

summary: cups-filters fails with -fno-common


body:
--1578476242.818a4.17421
Date: Wed, 8 Jan 2020 09:37:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160388

            Bug ID: 1160388
           Summary: dtc fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/dtc/standard/x86_64

Please take a look at the META issue for the instructions.

summary: dtc fails with -fno-common


body:
--1578476259.bb72Eb7714.11854
Date: Wed, 8 Jan 2020 09:37:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160389

            Bug ID: 1160389
           Summary: espeak-ng fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/espeak-ng/standard/x86_64

Please take a look at the META issue for the instructions.

summary: espeak-ng fails with -fno-common


body:
--1578476338.fC2127B4.11170
Date: Wed, 8 Jan 2020 09:38:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160392

            Bug ID: 1160392
           Summary: glusterfs fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/glusterfs/standard/x86_64

Please take a look at the META issue for the instructions.

summary: glusterfs fails with -fno-common


body:
--1578476326.F08424.16041
Date: Wed, 8 Jan 2020 09:38:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160391

            Bug ID: 1160391
           Summary: freeglut fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/freeglut/standard/x86_64

Please take a look at the META issue for the instructions.

summary: freeglut fails with -fno-common


body:
--1578476479.74CE7a79.15263
Date: Wed, 8 Jan 2020 09:41:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160399

            Bug ID: 1160399
           Summary: kexec-tools fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/kexec-tools/standard/x86_64

Please take a look at the META issue for the instructions.

summary: kexec-tools fails with -fno-common


body:
--1578476532.aEED2Da21.19881
Date: Wed, 8 Jan 2020 09:42:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160401

            Bug ID: 1160401
           Summary: mc fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/mc/standard/x86_64

Please take a look at the META issue for the instructions.

summary: mc fails with -fno-common


body:
--1578476561.Dc8819.12143
Date: Wed, 8 Jan 2020 09:42:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160403

            Bug ID: 1160403
           Summary: multipath-tools fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/multipath-tools/standard/x86_64

Please take a look at the META issue for the instructions.

summary: multipath-tools fails with -fno-common


body:
--1578476587.0eCcc4.20822
Date: Wed, 8 Jan 2020 09:43:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160405

            Bug ID: 1160405
           Summary: nfs-utils fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/nfs-utils/standard/x86_64

Please take a look at the META issue for the instructions.

summary: nfs-utils fails with -fno-common


body:
--1578476675.1E0b75B25.15263
Date: Wed, 8 Jan 2020 09:44:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160410

            Bug ID: 1160410
           Summary: pacemaker fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/pacemaker/standard/x86_64

Please take a look at the META issue for the instructions.

summary: pacemaker fails with -fno-common


body:
--1578476687.aB36e81C25.16967
Date: Wed, 8 Jan 2020 09:44:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160411

            Bug ID: 1160411
           Summary: pcp fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/pcp/standard/x86_64

Please take a look at the META issue for the instructions.

summary: pcp fails with -fno-common


body:
--1578476712.203Cf44.25492
Date: Wed, 8 Jan 2020 09:45:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160413

            Bug ID: 1160413
           Summary: postfix fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/postfix/standard/x86_64

Please take a look at the META issue for the instructions.

summary: postfix fails with -fno-common


body:
--1578476787.61eb04.27423
Date: Wed, 8 Jan 2020 09:46:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160417

            Bug ID: 1160417
           Summary: texlive fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/texlive/standard/x86_64

Please take a look at the META issue for the instructions.

summary: texlive fails with -fno-common


body:
--1578476799.3Cf7CF4.27156
Date: Wed, 8 Jan 2020 09:46:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160418

            Bug ID: 1160418
           Summary: vim fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/vim/standard/x86_64

Please take a look at the META issue for the instructions.

summary: vim fails with -fno-common


--1578476837.01bF02CF20.15254
Date: Wed, 8 Jan 2020 09:47:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160421

            Bug ID: 1160421
           Summary: xf86-video-amdgpu fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/xf86-video-amdgpu/standard/x86_64

Please take a look at the META issue for the instructions.


body:
--1578476850.24ccC5C4.27998
Date: Wed, 8 Jan 2020 09:47:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160422

            Bug ID: 1160422
           Summary: xf86-video-ati fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/xf86-video-ati/standard/x86_64

Please take a look at the META issue for the instructions.

summary: xf86-video-ati fails with -fno-common


body:
--1578476863.D8864.28039
Date: Wed, 8 Jan 2020 09:47:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160423

            Bug ID: 1160423
           Summary: xorg-x11-server fails with -fno-common
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:M/xorg-x11-server/standard/x86_64

Please take a look at the META issue for the instructions.

summary: xorg-x11-server fails with -fno-common


--1578489288.E24a014.25600
Date: Wed, 8 Jan 2020 13:14:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1160446

            Bug ID: 1160446
           Summary: osc (or obs) creates wrong submit request
    Classification: Internal Novell Products
           Product: openSUSE Build Service
           Version: master
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: osc
          Assignee: adrian-at-suse.com
          Reporter: snwint-at-suse.com
        QA Contact: adrian-at-suse.com
          Found By: ---
           Blocker: ---

'osc sr -r N ...' does not work correctly (specifying a release).

Compare

# osc sr -r 1227 openSUSE.org:system:install:head installation-images
SUSE:SLE-15-SP1:Update
https://build.suse.de/request/show/208898 (wrong)

with (copying revision 1227 to another project and submitting that)

https://build.suse.de/request/show/208900 (ok)

The bad part is that osc in both cases shows the same diff - see the
build.suse.de pages but the actual submission is different - see the changelog
diff. Despite '-r' the latest version is submitted.


--1578494507.32f57a8B0.17615
Date: Wed, 8 Jan 2020 14:41:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160456

            Bug ID: 1160456
           Summary: VUL-0: CVE-2020-5504: phpMyAdmin: SQL injection in user accounts page
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: chris-at-computersalat.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2020-5504

A SQL injection flaw has been discovered in the user accounts page. A malicious
user could inject custom SQL in place of their own username when creating
queries to this page. An attacker must have a valid MySQL account to access the
server.

Affected Versions
phpMyAdmin 4.x versions prior to 4.9.4 are affected, at least as old as 4.0.0.
phpMyAdmin 5.x version 5.0.0 is affected.

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5504
https://www.phpmyadmin.net/security/PMASA-2020-1/


--1578552841.Cd123E0.27420
Date: Thu, 9 Jan 2020 06:54:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160520

            Bug ID: 1160520
           Summary: VUL-1: CVE-2020-6609: libredwg: heap-based buffer over-read in read_pages_map in decode_r2007.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/250627/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-6609

GNU LibreDWG 0.9.3.2564 has a heap-based buffer over-read in read_pages_map in
decode_r2007.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6609
https://github.com/LibreDWG/libredwg/issues/179#issue-544834443
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6609


--1578553364.0CfB53F0.1365
Date: Thu, 9 Jan 2020 07:02:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160522

            Bug ID: 1160522
           Summary: VUL-1: CVE-2020-6610: libredwg: excessive memory allocation in read_sections_map in decode_r2007.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/250628/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-6610

GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in
read_sections_map in decode_r2007.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6610
https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6610


--1578553487.7Cbb0.3059
Date: Thu, 9 Jan 2020 07:04:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1160523

            Bug ID: 1160523
           Summary: VUL-1: CVE-2020-6611: libredwg: NULL pointer dereference in get_next_owned_entity in dwg.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/250629/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-6611

GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity
in dwg.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6611
https://github.com/LibreDWG/libredwg/issues/179#issuecomment-570447190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6611