body:
Build Identifier:

kmymoney crashes with a segmentation fault upon attempting to "ADD" a new
transaction in any account or upon attempting to "EDIT" an existing transaction
in any account. Visually, as soon as "ADD" or "EDIT" is left-clicked, the
application instantly disappears. The program is totally unusable as a result
of this behaviour.

Reproducible: Always

Steps to Reproduce:
1. Open KMyMoney
2. Open an existing bank account
3. Click "ADD" or "EDIT"
Actual Results:
Application instantly disappears. If run from the terminal, the following
output is observed:

rfl@linux-rmlm:~> kmymoney
WebConnect: Try to connect to WebConnect server
WebConnect: Connect to server failed
WebConnect: Starting server failed. Try to remove stale socket.
WebConnect: Running in server mode
Plugins: checkprinting loaded
Plugins: csvexporter loaded
Plugins: csvimporter loaded
Plugins: gncimporter loaded
Plugins: icalendarexporter loaded
Plugins: kbanking loaded
KBankingPlugin: No AqB4 config found.
KBankingPlugin: No AqB3 config found.
Plugins: kbanking pluged
Plugins: ofximporter loaded
Plugins: qifexporter loaded
Plugins: qifimporter loaded
Plugins: reconciliation report loaded
Online plugins found 2
Cost center model created with items 0
Payees model created with items 0
reading file
start parsing file
startDocument
reading securities
endDocument
libpng warning: iCCP: known incorrect sRGB profile
libpng warning: iCCP: known incorrect sRGB profile
Segmentation fault (core dumped)

Expected Results:
KMyMoney should not have crashed and instead have let me add a new transaction
or edit an existing one.

NB: I hope that this is reported in the right section. bugzilla.opensuse.org
has no option within the "Operating System" for OpenSuSE Leap 15.0 itself...

rfl@linux-rmlm:~> cat /etc/os-release
NAME="openSUSE Leap"
VERSION="15.0"
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="15.0"
PRETTY_NAME="openSUSE Leap 15.0"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:15.0"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"

-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^

rfl@linux-rmlm:~> zypper info kmymoney
Loading repository data...
Reading installed packages...

Information for package kmymoney:
---------------------------------
Repository     : Main Repository (OSS)
Name           : kmymoney
Version        : 5.0.1-lp150.1.4
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 23.1 MiB
Installed      : Yes
Status         : up-to-date
Source package : kmymoney-5.0.1-lp150.1.4.src
Summary        : A Personal Finance Manager by KDE

-^-^-^-^- AND (...NOTING THE VERSION NUMBER DISCREPANCY) ^-^-^-^-^-^

rfl@linux-rmlm:~> kmymoney -v
kmymoney 5.0.0

-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^

rfl@linux-rmlm:~> uname -r
4.12.14-lp150.12.4-default

-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^

rfl@linux-rmlm:~> grep "model name" /proc/cpuinfo
model name      : AMD A8-6500T APU with Radeon(tm) HD Graphics

-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^

rfl@linux-rmlm:~> zypper info kdebase4-runtime
Loading repository data...
Reading installed packages...

Information for package kdebase4-runtime:
-----------------------------------------
Repository     : Main Repository (OSS)
Name           : kdebase4-runtime
Version        : 17.08.3-lp150.5.15
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 15.0 MiB
Installed      : Yes
Status         : up-to-date
Source package : kdebase4-runtime-17.08.3-lp150.5.15.src
Summary        : The KDE Runtime Components

-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^

rfl@linux-rmlm:~> zypper info libQt5Core5
Loading repository data...
Reading installed packages...

Information for package libQt5Core5:
------------------------------------
Repository     : Main Repository (OSS)
Name           : libQt5Core5
Version        : 5.9.4-lp150.4.8
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 5.5 MiB
Installed      : Yes (automatically)
Status         : up-to-date
Source package : libqt5-qtbase-5.9.4-lp150.4.8.src
Summary        : Qt 5 Core Library

-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^-^

summary: kmymoney crashes (segmentation fault) upon attempting to add new transaction


--1530670033.c0EC45.13745
Date: Wed, 4 Jul 2018 02:07:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100041

            Bug ID: 1100041
           Summary: The "switch user" disappeared from control center on Tumbleweed gnome
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: bnc-team-gnome-at-forge.provo.novell.com
          Reporter: yren-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: fezhang-at-suse.com, gwang-at-suse.com, xwang-at-suse.com,
                    yfjiang-at-suse.com, zcjia-at-suse.com
          Found By: ---
           Blocker: ---

## Versions
   openSUSE Tumbleweed 20180629
   gnome-shell-3.28.2+20180519.a52597ac5-1.2.x86_64
   accountsservice-0.6.49-1.1.x86_64

   This is caused by recent update.

## Observation
   There is lost "switch user" in control center when I first logout and then
login.

## Reproducible steps
   settings->users->unlock user(username: admin)->add user(username: test)
->control center->switcher user->login(test)->lost the switcher user in control
center.

## Expected result
   Expected the "switch user" always appeared whatever the login many times.


body:
--1530694631.b4EfA0.3992
Date: Wed, 4 Jul 2018 08:57:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100088

            Bug ID: 1100088
           Summary: KDE default menu needs tuning
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

the menu we use by default in KDE displays application names only. That seems
to be rather meaningless and confusing. So for example in

Utilities we have

- Ark
- Kate
- KCalc
- KCharSelect
..
- Kleopatra
- KMag
- Kompare
- KTnef

in Multimedia:
- Dragon Player
- K3b

I guess for someone that is not into KDE that is just "wtf?" :-)

Can we do better? IIRC desktop files have the "GenericName" property exactly
for the reason to show that one instead of "Name" if only one of the kind is
installed, right?

Also, submenus don't get collapsed, eg Education->Science->Marble. Since Marbe
is the only entry in Science, shouldn't the menu avoid having that additional
submenu?

summary: KDE default menu needs tuning


--1530697178.2EFA6.19478
Date: Wed, 4 Jul 2018 09:39:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100095

            Bug ID: 1100095
           Summary: installling updates/zypper patch claims to remove firefox
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Maintenance
          Assignee: mls-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: adrian-at-suse.com, dleuenberger-at-suse.com, ma-at-suse.com
          Found By: ---
           Blocker: ---

Created attachment 776071
  --> http://bugzilla.opensuse.org/attachment.cgi?id=776071&action=edit
screenshot of KDE discover warning about firefox removal

zypper patch claims to remove firefox when installing updates. It refers to the
application, not the package. So appstream metadata related. I thought that was
supposed to be solved? It's even worse in KDE discover (see screenshot).


body:
--1530788204.c0C57435.32745
Date: Thu, 5 Jul 2018 10:56:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1100208

            Bug ID: 1100208
           Summary: Use default openSUSE wallpaper in LXQt
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: LXDE
          Assignee: andrea-at-opensuse.org
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Use wallpaper from wallpaper-branding-openSUSE

summary: Use default openSUSE wallpaper in LXQt


--1530853404.06a80.5508
Date: Fri, 6 Jul 2018 05:03:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100333

            Bug ID: 1100333
           Summary: VUL-0: CVE-2018-12021: singularity: Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control onsystems supporting overlay file system. When using the overlay option, amalicious user may access sensitive information by exploiting a fe
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/209630/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: eich-at-suse.com
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-12021

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on
systems supporting overlay file system. When using the overlay option, a
malicious user may access sensitive information by exploiting a few specific
Singularity features.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-12021
https://github.com/singularityware/singularity/releases/tag/2.5.2


--1530856553.d0AF10.17793
Date: Fri, 6 Jul 2018 05:55:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100343

            Bug ID: 1100343
           Summary: VUL-1: CVE-2018-3762: nextcloud: Improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/209622/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: ecsos-at-schirra.net
          Reporter: jsegitz-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-3762

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of
dropped permissions for incoming shares allowing a user to still request
previews for files it should not have access to.

Factory is already fixed.

No maintainer, would you be willing to take this one?

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-3762
https://nextcloud.com/security/advisory/?id=nc-sa-2018-002
https://hackerone.com/reports/358339


--1530856679.4f370.17740
Date: Fri, 6 Jul 2018 05:57:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100344

            Bug ID: 1100344
           Summary: VUL-0: CVE-2018-3761: nextcloud: Improper authentication on the OAuth2 token endpoint
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/209621/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: ecsos-at-schirra.net
          Reporter: jsegitz-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-3761

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication
on
the OAuth2 token endpoint. Missing checks potentially allowed handing out new
tokens in case the OAuth2 client was partly compromised.

Factory is already fixed.

No maintainer, would you be willing to take this one?

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-3761
https://nextcloud.com/security/advisory/?id=nc-sa-2018-003
https://hackerone.com/reports/343111


--1530904539.DAcddEd0.1860
Date: Fri, 6 Jul 2018 19:15:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100454

            Bug ID: 1100454
           Summary: Add support for latest kobo firmware (4.9.11311 ) in calibre
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: cornelis-at-solcon.nl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Kobo is rolling out firmware version 4.9.11311 for its ereaders. Support for
this is added in calibre 3.27.1.

To solve this I would like to see calibre 3.27.1 as maintenance update. This
version has been released today and will soon be submitted to
Documentation:Tools:calibre and then to Factory.


body:
--1530933723.a63b4.12470
Date: Sat, 7 Jul 2018 03:22:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100488

            Bug ID: 1100488
           Summary: bash-doc random html corruption
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: werner-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: aavindraa-at-gmail.com
          Found By: Development
           Blocker: ---

When working on reproducible builds for openSUSE,
I found that the bash-doc package sometimes has a corrupted byte in a .html
file
(below in "Bahh")

-

summary: bash-doc random html corruption


--1530965495.a07CCbCe0.23245
Date: Sat, 7 Jul 2018 12:11:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100496

            Bug ID: 1100496
           Summary: neovim should depend on specific version of libtermkey1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: saparvia-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After upgrading neovim to 0.3.0-1.1 it gave me the following error:

nvim: symbol lookup error: nvim: undefined symbol: termkey_hook_terminfo_getstr

It seems like neovim requires a new version of libtermkey1, but does not
specify this, so that package is not automatically updated when neovim is
updated.


body:
--1530993531.bdFb12A70.3605
Date: Sat, 7 Jul 2018 19:58:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100504

            Bug ID: 1100504
           Summary: GNU make 4.2.1 is broken wrt -jN
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: jayrusman-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

GNU make from git repository resolves an issue with a race condition around
make's pselect implementation.  Signals are lost, defunct child processes are
not reaped in a timely mannter.  The summary is that make -j4 can degrade to
-j1 functionally, etc.

Here's the commit that Paul Smith suggests actually fixes the issue:
http://git.savannah.gnu.org/cgit/make.git/commit/?id=b552b05251980f693c729e251f93f5225b400714

Example test data compiling Linux 4.17.2 with Tumbleweed's .config
* make_421 -j8 : 19-20 minutes
* make_421 -j4 : 32-60 minutes
* make_git -j4 : 18 minutes

This bug is a severe performance penalty on Tumbleweed, compared to Ubuntu
18.04

summary: GNU make 4.2.1 is broken wrt -jN


body:
--1531109968.2eE254.8899
Date: Mon, 9 Jul 2018 04:19:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100520

            Bug ID: 1100520
           Summary: glucat compiled with -march=native
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: badshah400-at-gmail.com
          Found By: Development
           Blocker: ---

While working on the reproducible builds effort, I found that
when building the glucat package for openSUSE Linux, there were slight
differences between builds on different machines.

This is because g++ is invoked with the -march=native option
which means that depending on which OBS build worker machine gets the job
it might produce binaries unsuitable for older machines.

        callq  <PyErr_SetString@plt>
        jmpq   <_ZNK6glucat12matrix_multiIeLin32ELi32EEeqERKe@plt + ofs>
+       vzeroupper
        callq  <__cxa_begin_catch@plt>
        mov    offset(%rip),%rdi        #   <PyExc_RuntimeError>

summary: glucat compiled with -march=native


--1531157210.ACe63.19496
Date: Mon, 9 Jul 2018 17:26:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100633

            Bug ID: 1100633
           Summary: Backport support for newer Wacom peripherals into wacom.ko
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: srid-at-rkmail.ru
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Some newer Wacom tablets won't work because kernel driver cannot recognize
them. Peripherals start working after loading kernel newer module. Is it
possible to backport the support for new devices into opensuse kernel?


body:
--1531196872.52D0bd0.26246
Date: Tue, 10 Jul 2018 04:27:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100677

            Bug ID: 1100677
           Summary: trackerbug: packages do not build reproducibly from compile-time CPU-detection
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bwiedemann-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
        Depends on: 1100520
            Blocks: 1081754
          Found By: Development
           Blocker: ---

e.g. bug 1100520
compiler options -march=native and -mtune=native
make the resulting machine code depend on the build system's CPU
which breaks reproducible builds.

affects at least: glucat form python-annoy legion trigger-rally

This is already fixed in: clpeak higan kyotocabinet

one common approach seems to do
sed -i "s|-march=native||g" $FILE

pkgs: form insighttoolkit liboqs librsb moarvm nauty pgvector python-autobahn ugrep


--1531224403.25cbe3.23091
Date: Tue, 10 Jul 2018 12:06:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100734

            Bug ID: 1100734
           Summary: No longer possible to run Jack with realtime audio in Leap 15.0
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: simonf.lees-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I am unable to get jack to start with realtime kernel priority on Leap 15.0,
this was working on Leap 42.3 after boo#1053777 was fixed.

simon@tek-master ~ >  cat /etc/security/limits.d/99-audio.conf
@audio   -  rtprio     99
@audio   -  memlock    unlimited

I'm still using Cadence to start Jack.
https://build.opensuse.org/package/show/home:simotek:multimedia/Cadence

Tue Jul 10 16:21:43 2018: ERROR: Cannot create thread res = 1
Tue Jul 10 16:21:43 2018: ERROR: Cannot use real-time scheduling (RR/99)(1:
Operation not permitted)
Tue Jul 10 16:21:43 2018: ERROR: AcquireSelfRealTime error


body:
--1531232413.f4B8F33.11555
Date: Tue, 10 Jul 2018 14:20:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100759

            Bug ID: 1100759
           Summary: Periodic black screen at radeon
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: mcepl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 776579
  --> http://bugzilla.opensuse.org/attachment.cgi?id=776579&action=edit
output of journalctl -xb

Quite often (at this moment, I have even problems to finish this bug report,
but normally it was just around five times daily) the screen gets black. All
programs run (e.g., YouTube in Firefox is still playing), but I haven't found a
way how to get screen reinitialized (Ctrl-Alt-F2 and similar do nothing).

summary: Periodic black screen at radeon


--1531242189.0CC20.14853
Date: Tue, 10 Jul 2018 17:03:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1100779

            Bug ID: 1100779
           Summary: default notify group "admin" does not exist
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AppArmor
          Assignee: suse-beta-at-cboltz.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

when trying to use aa-notify -p, you get:

# aa-notify -p
aa-notify: ERROR: 'root' must be in 'admin' group. Aborting.
Ask your admin to add you to this group or to change the group in
/etc/apparmor/notify.conf if you want to use aa-notify.

however, there is no such group "admin".

after changing /etc/apparmor/notify.conf to allow the group "root" instead
(which imho would be a more sensible default), you get this:

# aa-notify -p
aa-notify: ERROR: Could not find '/usr/bin/notify-send'. Please install
libnotify-bin. Aborting

of course there is no "libnotify-bin" package, it would be libnotify-tools


--1531242321.AFDDed6.15351
Date: Tue, 10 Jul 2018 17:05:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100780

            Bug ID: 1100780
           Summary: MozillaThunderbird:  Detaching attachments corrupts the main body of the e-mail text
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Firefox
          Assignee: sreeves-at-suse.com
          Reporter: astieger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: pcerny-at-suse.com, wolfgang-at-rosenauer.org
            Blocks: 1098998, 1100079, 1100081, 1100082
          Found By: ---
           Blocker: ---

Upstream regression in Mozilla Thunderbird 52.9.0, fixed in 52.9.0

- update to Thunderbird 52.9.1
  * Deleting or detaching attachments corrupted messages under certain
    circumstances (bmo#1473893)

https://bugzilla.mozilla.org/show_bug.cgi?id=1473893
https://build.opensuse.org/request/show/621922


--1531244351.67CcE2.19505
Date: Tue, 10 Jul 2018 17:39:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100786

            Bug ID: 1100786
           Summary: "rsync" or its dependencies pull in even systemd and dracut and systemd-presets-branding-CAASP (useless in containers at least)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: okurz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Observation

It seems some packages have heavy dependencies even without recommends, e.g.
rsync or its dependencies depend on systemd+dracut

```
$ docker run -it --rm opensuse/tumbleweed sh -c 'zypper -n in --no-recommends
rsync'
Retrieving repository 'openSUSE-Tumbleweed-Non-Oss' metadata
.............................................[done]Building repository
'openSUSE-Tumbleweed-Non-Oss' cache
..................................................[done]
Retrieving repository 'openSUSE-Tumbleweed-Oss' metadata
.................................................[done]
Building repository 'openSUSE-Tumbleweed-Oss' cache
......................................................[done]
Retrieving repository 'openSUSE-Tumbleweed-Update' metadata
..............................................[done]
Building repository 'openSUSE-Tumbleweed-Update' cache
...................................................[done]
Loading repository data...
Reading installed packages...
Resolving package dependencies...

The following 34 NEW packages are going to be installed:
  blog dbus-1 dracut elfutils file hardlink kbd kbd-legacy kmod kmod-compat
libapparmor1 libargon2-1 libasm1
  libcryptsetup12 libdbus-1-3 libdevmapper1_03 libexpat1 libjson-c4 libkmod2
libqrencode4 libseccomp2 openslp
  pam-config pigz pkg-config rsync suse-module-tools systemd
systemd-presets-branding-CAASP
  systemd-presets-common-SUSE systemd-sysvinit sysvinit-tools udev xz
```

## Steps to reproduce

See above docker command to reproduce. I assume one can also use a minimal
package self-test where a "BuildRequires: rsync" shows what is pulled in.

## Further details

See also https://bugzilla.opensuse.org/show_bug.cgi?id=980389


--1531307147.e3481.6698
Date: Wed, 11 Jul 2018 11:05:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100871

            Bug ID: 1100871
           Summary: lxqt authentication dialog does not appear on CJK environment
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: LXDE
          Assignee: andrea-at-opensuse.org
          Reporter: ribbon-at-users.sourceforge.jp
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Using lxqt, even if yast is activated from the menu, the authentication dialog
screen does not appear.
If the language specification is C, Thai, Arabic, it worked normally.
In case of language specification Japanese, Korean, Chinese, it did not work
properly.
lxqt - sudo starts and su is also running, but the authentication dialog box
can not be displayed.


--1531374636.87dBfAF0.9822
Date: Thu, 12 Jul 2018 05:50:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100968

            Bug ID: 1100968
           Summary: VUL-0: CVE-2018-10895: qutebrowser: Cross-site request forgery flaw allows sites to access 'qute://*' URLs and execute arbitrary code
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/210454/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: sor.alexei-at-meowr.ru
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#1599595

qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery
flaw that allows websites to access 'qute://*' URLs. A malicious website could
exploit this to load a 'qute://settings/set' URL, which then sets
'editor.command' to a bash script, resulting in arbitrary code execution.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1599595
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-10895
http://seclists.org/oss-sec/2018/q3/29
https://lists.schokokeks.org/pipermail/qutebrowser-announce/2018-July/000048.html
https://github.com/qutebrowser/qutebrowser/commit/ff686ff7f395d83e5ac48507ecfae0b0e97a61ef
https://github.com/qutebrowser/qutebrowser/commit/c3361c31b370140f323e481dd455450b1e74c099
https://github.com/qutebrowser/qutebrowser/commit/43e58ac865ff862c2008c510fc5f7627e10b4660
https://github.com/qutebrowser/qutebrowser/commit/22148ce488da52e8a0e01ed937c0cfdb24d34775
https://github.com/qutebrowser/qutebrowser/commit/c2ff32d92ba9bf40ff53498ee04a4124d4993c85
https://github.com/qutebrowser/qutebrowser/commit/ffc29ee


body:
--1531378119.ed08d2D80.23197
Date: Thu, 12 Jul 2018 06:48:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100978

            Bug ID: 1100978
           Summary: qutebrowser 0.11.1 maintenance update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: sor.alexei-at-meowr.ru
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

An update of qutebrowser from 0.10.1 to 0.11.1 for openSUSE Leap 42.3, the last
version supporting Python 3.4.

summary: qutebrowser 0.11.1 maintenance update


--1531380557.d2B3FaBb0.30918
Date: Thu, 12 Jul 2018 07:29:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1100984

            Bug ID: 1100984
           Summary: Grub stops complains about "no symbol table" but after pressing enter just proceeds as normal
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Bootloader
          Assignee: jsrain-at-suse.com
          Reporter: stakanov-at-freenet.de
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

I have a Lenovo X201 with tpm. I have the system installed as follows:
One hdd with a /dev/sda1 partition (unencrypted) and  an LVM (with the /dev/
home, /dev/system, /dev/root, /dev/swap)
as proposed by the partitioner at the time of fresh install of Leap 15.

I tried however an update first with a 42.3 system and a /boot partition and
the error I am describing here was the same in Leap 15.

When starting up the system reaches correctly trusted grub2.
You are asked to input the password. After having done the input, the system
works for some time and then states:
slot 0 opened (so this part works)
Error: no symbol table

and then you are brought - without any interaction required -  to grub (were
you have a second issue, of being asked always the password (no matter what).
Since the fix for this will be in the future (bug filed for the previous
version), this is not the issue. The password issue was present also in 42.3
(were no complain was there). (bug 1052420) So this is unrelated.

You input the user (root) and the password of choice. Then the system starts
up and stops right after loading the kernel with:
error - no symbol table found - press any key to proceed.

Then you press whatever key, e.g enter and all works fine up to full boot up.
No other disturbances seem to be there.
This happens only after the upgrade to Leap 15 / new install of Leap 15.


body:
--1531392816.72b0a8aD0.13980
Date: Thu, 12 Jul 2018 10:53:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101010

            Bug ID: 1101010
           Summary: kubernetes is in Leap 42.3 and Factory but not Leap 15
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: okurz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Observation

The package "kubernetes" is in openSUSE:Factory, was in SLE-12 as well as
openSUSE Leap 42.3 but not anymore in Leap 15.0.

## Problem

I guess as caasp is based on sle12sp3 still right now we will have a bigger
problem in the future.

https://build.opensuse.org/request/show/622283 to add to openSUSE Leap 15.1 at
least. At best it could be added to Leap 15.0 as well to also provide a smooth
upgrade path.

pkgs: kubectl kubernetes


body:
--1531398873.7a061d5.613
Date: Thu, 12 Jul 2018 12:34:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101024

            Bug ID: 1101024
           Summary: missing php packages in cacti.spec
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-12-SP3
          Hardware: S/390
                OS: SLES 12
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Build Target
          Assignee: packagehub-bugs-at-suse.com
          Reporter: uhaider.msee15seecs-at-seecs.edu.pk
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

After building from  server:monitoring/cacti and running cacti on s390x
following errors were observed in apache server logs

PHP Fatal error:  Call to undefined function json_encode() in
/srv/www/cacti/lib/functions.php on line 492

PHP Fatal error:  Call to undefined function ctype_xdigit() in
/srv/www/cacti/lib/functions.php on line 3216

PHP Fatal error:  Call to undefined function imagecreatetruecolor() in
/srv/www/cacti/lib/rrd.php on line 3332

Errors were fixed by installing the missing packages

zypper install php5-json
zypper install php5-ctype
zypper install php5-gd

So, cacti.spec file need to be updated.

pkgs: cacti cacti+cacti-spine

summary: missing php packages in cacti.spec


body:
--1531450539.56aE5430.24989
Date: Fri, 13 Jul 2018 02:55:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101107

            Bug ID: 1101107
           Summary: trackerbug: packages do not build reproducibly from including kernel version
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: bwiedemann-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

See also https://reproducible-builds.org/

When packages include the kernel version from the build system
it results in binaries that sometimes differ
and thus trigger rebuilds of depending packages
and are published to mirrors and users
when actually nothing really changed.

To reproduce locally, do one build with
osc build --vm-type=kvm
and another with
osc build --vm-type=lxc

pkgs: kvirc timescaledb


--1531464987.b1bCB5.1741
Date: Fri, 13 Jul 2018 06:56:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1101119

            Bug ID: 1101119
           Summary: Regression: bluetooth headset not connecting  after resume from suspend.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: cedric.devillers-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
                CC: PVince81-at-yahoo.fr
        Depends on: 1076898
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1076898 +++

it seems that the exact same problem that was fixed in tumbleweed is present in
leap 15.0.

After resuming from suspend, bluetooth headset is not able to be used anymore.
A workaround is to restart bluetooth service.

I've tried the exact same patch as on tumbleweed :
https://build.opensuse.org/request/show/575499 and now it's working fine on my
system, headset is reconnecting without the need to restart the service.

Also it seems that the patch was later dropped because bluez was fixed
upstream.

Please consider patching bluez on leap 15.0 updates to fix this.


body:
--1531477483.F06859.19616
Date: Fri, 13 Jul 2018 10:24:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101139

            Bug ID: 1101139
           Summary: cacti.conf Apache Invalid command 'Order'
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-12-SP3
          Hardware: S/390
                OS: SLES 12
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Packages
          Assignee: packagehub-bugs-at-suse.com
          Reporter: uhaider.msee15seecs-at-seecs.edu.pk
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

Installing cacti 1.1.38 on s390x SLE12SP3 (Apache/2.4.23) results in cacti.conf
which introduces following error while launching apache.

Invalid command 'Order', perhaps misspelled....

This is due to difference in Run-Time Configuration Changes for Aapche 2.2 and
Apache 2.4.

e.g

2.2 configuration:
Order deny,allow
Deny from all

2.4 configuration
Require all denied

cacti-httpd.conf.default file in server:monitoring/cacti should be updated to
resolve this.


body:
--1531479430.2d0d43133.30860
Date: Fri, 13 Jul 2018 10:57:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101143

            Bug ID: 1101143
           Summary: No sound with ALC1220
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: vv-at-tuxedocomputers.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,

I have a laptop at my hands with ALC1220 sound chip. The current Leap kernel
won't let me get sound to work. Audio devices can be listed and aplay shows
them as well, thought there's no sound coming from the speakers. Un-muting the
devices didn't help.

Using a Tumbleweed kernel everything's fine. So I suspect there's something not
backported yet.

uname -a:
Linux linux-tuxedo 4.17.4-1-default #1 SMP PREEMPT Tue Jul 3 11:31:47 UTC 2018
(882c99b) x86_64 x86_64 x86_64 GNU/Linux

lspci:
00:1f.3 Audio device: Intel Corporation Device a348 (rev 10)

aplay -l:
Karte 0: PCH [HDA Intel PCH], Ger�t 0: ALC1220 Analog [ALC1220 Analog]
  Sub-Ger�te: 1/1
  Sub-Ger�t #0: subdevice #0
Karte 0: PCH [HDA Intel PCH], Ger�t 1: ALC1220 Digital [ALC1220 Digital]
  Sub-Ger�te: 1/1
  Sub-Ger�t #0: subdevice #0

summary: No sound with ALC1220


body:
--1531687831.36E34.26889
Date: Sun, 15 Jul 2018 20:50:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101262

            Bug ID: 1101262
           Summary: ceph's dpdk builds with march=native
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: nirmoy.das-at-suse.com, tserong-at-suse.com
            Blocks: 1100677
          Found By: Development
           Blocker: ---

code built with gcc's -march=native might use opcodes available on new build
machines that old target machines don't understand. That will cause
hard-to-debug segfaults that depend on the build machine.

The param can be dropped with

sed -i 's|-march=native||' `find -name CMakeLists.txt -o -name \*.mk`

but then the ceph/dpdk build fails
in the same way as an unpatched ceph build in a VM started with
qemu-kvm -cpu kvm64

build failure is:
In file included from /usr/lib64/gcc/x86_64-suse-linux/8/include/x86int
rin.h:39,
                 from
/home/abuild/rpmbuild/BUILD/ceph-13.2.0-210-g0e990e900d/build/src/dpdk/include/rte_vect.h:56,
                 from
/home/abuild/rpmbuild/BUILD/ceph-13.2.0-210-g0e990e900d/build/src/dpdk/include/rte_memcpy.h:46,
                 from
/home/abuild/rpmbuild/BUILD/ceph-13.2.0-210-g0e990e900d/build/src/dpdk/include/rte_mempool.h:79,
                 from env.c:41:
/usr/lib64/gcc/x86_64-suse-linux/8/include/tmmintrin.h:185:1: error: inlining
failed in call to always_inline '_mm_alignr_epi8': target specific option
mismatch
 _mm_alignr_epi8(__m128i __X, __m128i __Y, const int __N)
 ^~~~~~~~~~~~~~~
In file included from
/home/abuild/rpmbuild/BUILD/ceph-13.2.0-210-g0e990e900d/build/src/dpdk/include/rte_mempool.h:79,
                 from env.c:41:
/home/abuild/rpmbuild/BUILD/ceph-13.2.0-210-g0e990e900d/build/src/dpdk/include/rte_memcpy.h:641:13:
note: called from here
             _mm_storeu_si128((__m128i *)((uint8_t *)dst + 1 * 16),
_mm_alignr_epi8(xmm2, xmm1, offset));    \
             ^~~~~~~~~~~~~

I guess that is because the code assumes availability of some features
like SSE* without specifying the appropriate gcc flags.

but OTOH our dpdk Factory package does not have this problem - are these very
different versions?

https://build.suse.de/request/show/119320 says sse3 is required for dpdk.

I'll try adding a -msse3 param and see if that fixes the build.

summary: ceph's dpdk builds with march=native


--1531723539.fdCE1.19477
Date: Mon, 16 Jul 2018 06:45:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101280

            Bug ID: 1101280
           Summary: VUL-0: CVE-2018-14056: ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skinname to access files outside of the intended skins directories.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/210683/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mpluskal-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: mpluskal-at-suse.com
          Found By: Security Response Team
           Blocker: ---

CVE-2018-14056

ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin
name to access files outside of the intended skins directories.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14056
http://www.cvedetails.com/cve/CVE-2018-14056/
https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773


--1531723578.cdbB58.20512
Date: Mon, 16 Jul 2018 06:46:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101281

            Bug ID: 1101281
           Summary: VUL-0: CVE-2018-14055: ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from thenetwork, allowing a non-admin user to escalate his privilege and inject roguevalues into znc.conf.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/210682/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mpluskal-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: mpluskal-at-suse.com
          Found By: Security Response Team
           Blocker: ---

CVE-2018-14055

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the
network, allowing a non-admin user to escalate his privilege and inject rogue
values into znc.conf.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14055
https://github.com/znc/znc/commit/a7bfbd93812950b7444841431e8e297e62cb524e
https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e7153979731c69d


--1531740361.de3c3.6937
Date: Mon, 16 Jul 2018 11:26:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101324

            Bug ID: 1101324
           Summary: asus keyboard backlight control not working on ASUS ROG GL753VE
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: dawoodtaii-at-tuta.io
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,
Asus keyboard backlight control was not working ASUS ROG GL753VE notebook on
openSUSE leap 15.0.

Actually /sys/class/leds/asus\:\:kbd_backlight did not exist. So neither
Fn+F3/F4 keys were working, nor manually modifying it.

After doing a lot of experiments; playing with acpi kernel params, enabling and
disabling asus modules with no success.
I've found this bug report
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1662316
According to this comment
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1662316/comments/20 it's
resolved on kernel 4.15. While leap is using 4.14.

So I've tried installing some newer kernel. I installed this package
https://build.opensuse.org/package/show/home:regataos/kernel-default
4.17.4-lp150.2-default version.

I can confirm everything is working fine with this kernel version.

I think this is the commit the need to be backported;
https://github.com/torvalds/linux/commit/1caccc2565a83b79dd6e4af15bea35995487a379

 HID: asus: support Republic of Gamers special keys

Add support for the special keys found on the internal keyboard of the
Asus Republic of Gamers (ROG) laptop models GL553VD, GL553VE, GL753VD
and GL753VE.


--1531755607.48b1215.4234
Date: Mon, 16 Jul 2018 15:40:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101357

            Bug ID: 1101357
           Summary: missing php-ctype packages in icingaweb2
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-12-SP3
          Hardware: S/390
                OS: SLED 12
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Packages
          Assignee: packagehub-bugs-at-suse.com
          Reporter: uhaider.msee15seecs-at-seecs.edu.pk
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

After building icinga2 and icingaweb2 for s390x SLE_12_Backports the testing
results in following error

[Sat Jul 14 12:51:24.622229 2018] [php5:error] [pid 10754] [client
103.255.7.31:24052] PHP Fatal error:  Call to undefined function ctype_digit()
in /usr/share/icingaweb2/library/vendor/lessphp/lessc.inc.php on line 2894,
referer: http://serverip/icingaweb2/setup

Solution:

zypper install php5-ctype

Fix:
Add Requires: php-ctype


body:
--1531815094.21fFf1.21451
Date: Tue, 17 Jul 2018 08:11:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1101420

            Bug ID: 1101420
           Summary: spice-gtk: introduce separate group for spice-client-glib-usb-acl-helper setuid binary
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: cbosdonnat-at-suse.com
          Reporter: matthias.gerstner-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: dimstar-at-opensuse.org, seife-at-novell.slipkontur.de
          Found By: ---
           Blocker: ---

In bug 744251 the whitelisting of spice-client-glib-usb-acl-helper has been
discussed for years without any result. A lot of users have complained about
this helper not working out of the box. Requiring users to add the setuid bit
manually is not a good approach.

The security team will agree wo whitelist this setuid binary when it is limited
to a separate group. Interested users can then add themselves to this group and
gain access to the setuid binary. This keeps the attack surface low, the
decision to use it explicit and it is still a clearly defined property that
doesn't get lost upon updates.

It would be nice if you could take the necessary steps to introduce an
appropriate group for spice-gtk. Basically we could be using the 'trusted'
group that already exists. But this group is a catch-it-all group that allows
access to a plethora of different setuid binaries already. We would like to
avoid extended usage of this group. Maybe there already is a suitable
virtualization related group or we can introduce one.

Maybe such a group setup and whitelisting could also be backported to SLE-15
and Leap-15.

pkgs: permissions spice-gtk


--1531828601.510C0.31273
Date: Tue, 17 Jul 2018 11:56:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1101450

            Bug ID: 1101450
           Summary: sddm before v0.18.0 allows to unlock existing sessions without authentication if ReuseSession=true
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

If sddm is configured with

[Users]
ReuseSession=true

the password is not checked for users with an already existing session.
Any user with access to the system dbus can therefore unlock any graphical
session.

Fixed with
https://github.com/sddm/sddm/commit/147cec383892d143b5e02daa70f1e7def50f5d98


--1531830538.e4E1Cc0.7467
Date: Tue, 17 Jul 2018 12:28:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1101457

            Bug ID: 1101457
           Summary: mitmproxy requires ldap3==2.4 (broken dependency)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: duge@pre-sense.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Tested on: openSUSE-15.0 and openSUSE-Tumbleweed-Snapshot20180712

python3-mitmproxy seems to be missing a dependency. When starting mitmproxy, it
say it requires 'ldap3<2.5,>=2.4'. So that's exactly ldap3==2.4. But
openSUSE-15.0 and Tumbleweed-Snapshot20180712 only provide python3-ldap3-2.5.

----------
$ mitmproxy
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 666,
in _build_master
    ws.require(__requires__)
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 984,
in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 875,
in resolve
    raise VersionConflict(dist, req).with_context(dependent_req)
pkg_resources.ContextualVersionConflict: (ldap3 2.5
(/usr/lib/python3.6/site-packages), Requirement.parse('ldap3<2.5,>=2.4'),
{'mitmproxy'})

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/bin/mitmproxy", line 6, in <module>
    from pkg_resources import load_entry_point
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3147,
in <module>
    @_call_aside
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3131,
in _call_aside
    f(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 3160,
in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 668,
in _build_master
    return cls._build_from_requirements(__requires__)
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 681,
in _build_from_requirements
    dists = ws.resolve(reqs, Environment())
  File "/usr/lib/python3.6/site-packages/pkg_resources/__init__.py", line 870,
in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'ldap3<2.5,>=2.4' distribution was not
found and is required by mitmproxy


--1531832502.4F5ec3.31092
Date: Tue, 17 Jul 2018 13:01:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101465

            Bug ID: 1101465
           Summary: arm64 kernels are missing I2C_PXA config
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 777152
  --> http://bugzilla.opensuse.org/attachment.cgi?id=777152&action=edit
Patch to enable I2C_PXA

arm64 kernels (master, stable, Leap15.0/SLE15) are missing I2C_PXA config, used
on Marvel EBU SoCs. One of the current use case is the Turris Mox board.

In attachment, a patch to update the arm64 config in stable branch.
Please also apply to master and Leap15.0/SLE15 branches.


body:
--1531832558.b43FA0.30759
Date: Tue, 17 Jul 2018 13:02:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101466

            Bug ID: 1101466
           Summary: feh crashes on right-click
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: novell-at-howorth.org.uk
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

On Leap 15 start feh from a terminal. Right click in the window. feh crashes
with the message:

> feh WARNING: couldn't load font yudit/10, attempting to fall back to fixed.
feh WARNING: failed to even load fixed! Attempting to find any font.
feh ERROR: couldn't load menu font yudit/10, did you make install?
Are you specifying a nonexistent font?
Did you tell feh where to find it with --fontpath?

The fonts are present and located at /usr/share/feh/fonts/ as normal. But feh
has the wrong path built-in apparently:

> strings /usr/bin/feh | grep usr
/usr/local/share/feh/fonts
/usr/local/share/feh/images/menubg_default.png

Notice the spurious 'local'.

summary: feh crashes on right-click


--1531843720.18aEdFc80.22048
Date: Tue, 17 Jul 2018 16:08:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1101507

            Bug ID: 1101507
           Summary: VUL-0: CVE-2018-1000559: Cross Site Scripting (XSS) vulnerability in history command
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: sor.alexei-at-meowr.ru
          Reporter: abergmann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2018-1000559

Description

qutebrowser version introduced in v0.11.0
(1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting
(XSS) vulnerability in history command, qute://history page that can result in
Via injected JavaScript code, a website can steal the user's browsing history.
This attack appear to be exploitable via the victim must open a page with a
specially crafted <title> attribute, and then open the qute://history site via
the :history command. This vulnerability appears to have been fixed in fixed in
v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and
v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2018-1000559


body:
--1531847900.3B17b12.31860
Date: Tue, 17 Jul 2018 17:18:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101519

            Bug ID: 1101519
           Summary: Ceph-Deploy not available on Leap 15.0
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: 64bit
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: johannesrs-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

First, sorry if this is the wrong product classification for this bug-report:
it is my first.

I'm trying to install a Ceph storage cluster among several machines. However,
I'm surprised that while most of the Ceph software is available for Leap 15.0,
precisely ceph-deploy (the first command needed to create the cluster) is not
yet available on it or on the repositories. I have even the man pages for it,
from some other ceph-related package already installed, but not the program
itself.

In the opensuse website software search I found that there is a version for
Leap 42.3, and I gave it a try. Despite the fact that it even installs in 15.0
without disrupting the system too much (only one package needed, no
dependencies), it will fail at its first job as follows:

[code]
# ceph-deploy new patricia bohemia polar pilsen original
[ceph_deploy.conf][DEBUG ] found configuration file at: /root/.cephdeploy.conf
[ceph_deploy.cli][INFO  ] Invoked (1.5.38): /usr/bin/ceph-deploy new patricia
bohemia polar pilsen original
[ceph_deploy.cli][INFO  ] ceph-deploy options:
[ceph_deploy.cli][INFO  ]  username                      : None
[ceph_deploy.cli][INFO  ]  verbose                       : False
[ceph_deploy.cli][INFO  ]  overwrite_conf                : False
[ceph_deploy.cli][INFO  ]  quiet                         : False
[ceph_deploy.cli][INFO  ]  cd_conf                       :
<ceph_deploy.conf.cephdeploy.Conf object at 0x7fc710482e90>
[ceph_deploy.cli][INFO  ]  cluster                       : ceph
[ceph_deploy.cli][INFO  ]  ssh_copykey                   : True
[ceph_deploy.cli][INFO  ]  mon                           : ['patricia',
'bohemia', 'polar', 'pilsen', 'original']
[ceph_deploy.cli][INFO  ]  func                          : <function new at
0x7fc7106e2140>
[ceph_deploy.cli][INFO  ]  public_network                : None
[ceph_deploy.cli][INFO  ]  ceph_conf                     : None
[ceph_deploy.cli][INFO  ]  cluster_network               : None
[ceph_deploy.cli][INFO  ]  default_release               : False
[ceph_deploy.cli][INFO  ]  fsid                          : None
[ceph_deploy.new][DEBUG ] Creating new cluster named ceph
[ceph_deploy.new][INFO  ] making sure passwordless SSH succeeds
[patricia][DEBUG ] connected to host: torcello
[patricia][INFO  ] Running command: ssh -CT -o BatchMode=yes patricia
[patricia][DEBUG ] connected to host: patricia
[patricia][DEBUG ] detect platform information from remote host
[ceph_deploy][ERROR ] UnsupportedPlatform: Platform is not supported:
#
[/code]

I guess it is some version incompatibility issue for this error, since it is
obviously provided for a different opensuse version. However, at the actual
state, a ceph storage server cannot be built using opensuse leap 15.0 (what I
guess can be considered a bug, at least since it is provided I would expect it
to be possible do employ).

Are there plans for actual version of ceph-deploy to be provided any time soon?
I really don't have any idea of who is responsible for these packages. Any
possible workaround to be suggested in the mean time?

Thanks a lot for any help or information provided.

summary: Ceph-Deploy not available on Leap 15.0


--1531896992.88F012b0.29651
Date: Wed, 18 Jul 2018 06:56:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101566

            Bug ID: 1101566
           Summary: VUL-0: CVE-2018-14363: neomutt: newsrc.c does not properlyrestrict '/' characters that may have unsafe interaction with cache pathnames.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/210794/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dsterba-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-14363

An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not
properly
restrict '/' characters that may have unsafe interaction with cache pathnames.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14363
http://www.cvedetails.com/cve/CVE-2018-14363/


--1531897689.a2AaB7e30.899
Date: Wed, 18 Jul 2018 07:08:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101568

            Bug ID: 1101568
           Summary: VUL-0: CVE-2018-14361: neomutt: nntp.c proceeds even ifmemory allocation fails for messages data.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/210792/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dsterba-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-14361

An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if
memory allocation fails for messages data.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14361
http://www.cvedetails.com/cve/CVE-2018-14361/
https://github.com/neomutt/neomutt/commit/9e927affe3a021175f354af5fa01d22657c20585


--1531897758.14210.1113
Date: Wed, 18 Jul 2018 07:09:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101569

            Bug ID: 1101569
           Summary: VUL-0: CVE-2018-14360: neomutt: nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/210791/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dsterba-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-14360

An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in
newsrc.c
has a stack-based buffer overflow because of incorrect sscanf usage.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14360
http://www.cvedetails.com/cve/CVE-2018-14360/
https://github.com/neomutt/neomutt/commit/6296f7153f0c9d5e5cd3aaf08f9731e56621bdd3


--1531916514.F7fAa5D0.31789
Date: Wed, 18 Jul 2018 12:21:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101652

            Bug ID: 1101652
           Summary: emacs-info update: install-info: No such file or directory for /usr/share/info/info.info.info.gz
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Upgrade Problems
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mail@bernhard-voelker.de
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

During "zypper dup" update today

  openSUSE Tumbleweed  20180712-0 -> 20180714-0

I saw the following in the output:

-----------------8<----------------------
(  9/217) Installing: emacs-info-26.1-2.1.noarch
..........................................................................................................................................[done]
Additional rpm output:
install-info: No such file or directory for /usr/share/info/info.info.info.gz
----------------->8---------------------

Not sure if this is a problem in 'emacs-info' or in '/usr/bin/install-info'
though.


body:
--1531920414.cEefa7f17.18462
Date: Wed, 18 Jul 2018 13:26:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101667

            Bug ID: 1101667
           Summary: VUL-0: virtualbox: Juli 2018 release, multiple vulnerabilities
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: Larry.Finger-at-gmail.com
          Reporter: jsegitz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Multiple vulnerabilities fixed in current virtualbox release

http://www.oracle.com/technetwork/security-advisory/cpujul2018verbose-4258253.html#OVIR

CVE-2018-3005: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability
can result in unauthorized ability to cause a partial denial of service
(partial DOS) of Oracle VM VirtualBox.
CVSS v3.0 Base Score 4.0 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVE-2018-3055: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in unauthorized
ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle
VM VirtualBox and unauthorized read access to a subset of Oracle VM VirtualBox
accessible data.
CVSS v3.0 Base Score 7.1 (Confidentiality and Availability impacts). CVSS
Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:H).

CVE-2018-3085: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in unauthorized
creation, deletion or modification access to critical data or all Oracle VM
VirtualBox accessible data as well as unauthorized read access to a subset of
Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang
or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox.
CVSS v3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H).

CVE-2018-3086: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in takeover of
Oracle VM VirtualBox.
CVSS v3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVE-2018-3087: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in takeover of
Oracle VM VirtualBox.
CVSS v3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVE-2018-3088: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in takeover of
Oracle VM VirtualBox.
CVSS v3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVE-2018-3089: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in takeover of
Oracle VM VirtualBox.
CVSS v3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVE-2018-3090: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in takeover of
Oracle VM VirtualBox.
CVSS v3.0 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).

CVE-2018-3091: Vulnerability in the Oracle VM VirtualBox component of Oracle
Virtualization (subcomponent: Core). The supported version that is affected is
Prior to 5.2.16. Easily exploitable vulnerability allows unauthenticated
attacker with logon to the infrastructure where Oracle VM VirtualBox executes
to compromise Oracle VM VirtualBox. Successful attacks require human
interaction from a person other than the attacker and while the vulnerability
is in Oracle VM VirtualBox, attacks may significantly impact additional
products. Successful attacks of this vulnerability can result in unauthorized
access to critical data or complete access to all Oracle VM VirtualBox
accessible data.
CVSS v3.0 Base Score 6.3 (Confidentiality impacts). CVSS Vector:
(CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N).

pkgs: kbuild+virtualbox virtualbox


--1531930228.5eD61.7659
Date: Wed, 18 Jul 2018 16:10:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1101699

            Bug ID: 1101699
           Summary: cirrus: modesetting/fbdev drivers no longer working in xorg-server 1.20
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: sndirsch-at-suse.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

modesetting and fbdev drivers are no longer working with cirrus emulation of
qemu/kvm.

modesetting
-------------
# X -retro
[  1460.410] failed to add fb -22
[  1460.410] (EE) modeset(0): failed to set mode: Invalid argument

fbdev
------
# X -retro
[  1615.736] (EE) FBDEV(0): mode initialization failed
[  1615.737] (EE)
Fatal server error:
[  1615.737] (EE) AddScreen/ScreenInit failed for driver 0

This is a regression in xorg-server 1.20. It still works with xorg-server
1.19.6.


--1531985627.FE473e0.5669
Date: Thu, 19 Jul 2018 07:33:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101780

            Bug ID: 1101780
           Summary: [Build 20180717] python-tornado 5.x update breaks salt
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/708354/modules/salt/
                    steps/16
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-cryptlvm@64bit fails in
[salt](https://openqa.opensuse.org/tests/708354/modules/salt/steps/16)

## Reproducible

Fails since (at least) Build
[20180717](https://openqa.opensuse.org/tests/708354) (current job)

## Expected result

Last good: [20180714](https://openqa.opensuse.org/tests/707492) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?test=cryptlvm&flavor=DVD&machine=64bit&distri=opensuse&version=Tumbleweed&arch=x86_64)

python-tornado has been updated to version 5.1, which in turn breaks salt
This issue is also reported to upstream (was known since January apparently(

https://github.com/saltstack/salt/issues/45790


--1531995496.12ebC7.23144
Date: Thu, 19 Jul 2018 10:18:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1101822

            Bug ID: 1101822
           Summary: cirrus.bpp=16 boot option leads to kernel Oops
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: tiwai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When booting with cirrus.bpp=16 option, KVM with cirrus VGA leads to an Oops
like below:

[    2.449554] [drm:cirrusfb_create [cirrus]] *ERROR* failed to create fbcon
backing object -22
[    2.450731] [drm:cirrus_modeset_init [cirrus]] *ERROR* cirrus_fbdev_init
failed
[    2.451729] cirrus 0000:00:02.0: Fatal error during modeset init: -22
[    2.453327] BUG: unable to handle kernel NULL pointer dereference at
0000000000000258
[    2.454452] IP: mutex_lock+0x10/0x20
[    2.454945] PGD 0 P4D 0
[    2.455296] Oops: 0002 [#1] PREEMPT SMP PTI
[    2.455871] Modules linked in: cirrus(+) drm_kms_helper syscopyarea
sysfillrect sysimgblt fb_sys_fops ttm serio_raw floppy drm virtio_scsi(+)
button sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua
[    2.458380] CPU: 0 PID: 256 Comm: systemd-udevd Not tainted
4.16.12-2-default #1 openSUSE Tumbleweed (unreleased)
[    2.459759] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.0.0-prebuilt.qemu-project.org 04/01/2014
[    2.461152] RIP: 0010:mutex_lock+0x10/0x20
[    2.461716] RSP: 0018:ffffa944404c3aa0 EFLAGS: 00010246
[    2.462427] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
ffffd611c0d13cdf
[    2.463393] RDX: ffff9457b60b0100 RSI: ffff9457bdaf1528 RDI:
0000000000000258
[    2.464361] RBP: 0000000000000258 R08: 0000000000000000 R09:
000000000000002c
[    2.465326] R10: ffff9457bce5dda8 R11: 000000000000002d R12:
ffff9457bdaf1528
[    2.466305] R13: ffffffffc042e120 R14: 0000000000000000 R15:
ffff9457b56e4620
[    2.467004] FS:  00007ffae0f61940(0000) GS:ffff9457bfc00000(0000)
knlGS:0000000000000000
[    2.467959] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.468498] CR2: 0000000000000258 CR3: 000000003607a000 CR4:
00000000000006f0
[    2.469135] Call Trace:
[    2.469384]  drm_mode_object_unregister+0x1e/0x50 [drm]
[    2.469858]  cirrus_fbdev_fini+0x5a/0x80 [cirrus]
[    2.470275]  cirrus_modeset_fini+0xe/0x30 [cirrus]
[    2.470699]  cirrus_driver_unload+0x1b/0x40 [cirrus]
[    2.471136]  cirrus_driver_load+0x7f/0xf0 [cirrus]
[    2.471566]  drm_dev_register+0x132/0x1c0 [drm]
[    2.471974]  drm_get_pci_dev+0x93/0x170 [drm]
[    2.472362]  local_pci_probe+0x42/0xa0
[    2.472759]  ? pci_match_device+0xde/0x110
[    2.473122]  pci_device_probe+0x125/0x190
[    2.473479]  driver_probe_device+0x30b/0x480
[    2.473864]  __driver_attach+0xb8/0xe0
[    2.474193]  ? driver_probe_device+0x480/0x480
[    2.474582]  ? driver_probe_device+0x480/0x480
[    2.474971]  bus_for_each_dev+0x65/0x90
[    2.475308]  bus_add_driver+0x161/0x260
[    2.475644]  ? 0xffffffffc0431000
[    2.475938]  driver_register+0x57/0xc0
[    2.476270]  ? 0xffffffffc0431000
[    2.476565]  do_one_initcall+0x4e/0x192
[    2.476934]  ? __vunmap+0x6d/0xb0
[    2.477229]  do_init_module+0x5b/0x20a
[    2.477567]  load_module+0x19ad/0x1f30
[    2.477906]  ? SYSC_finit_module+0xb7/0xd0
[    2.478257]  SYSC_finit_module+0xb7/0xd0
[    2.478595]  do_syscall_64+0x76/0x140
[    2.478911]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[    2.479340] RIP: 0033:0x7ffadfd8c529
[    2.479648] RSP: 002b:00007ffcfde7c0b8 EFLAGS: 00000246 ORIG_RAX:
0000000000000139
[    2.480310] RAX: ffffffffffffffda RBX: 000055a10ac5e9d0 RCX:
00007ffadfd8c529
[    2.480935] RDX: 0000000000000000 RSI: 000055a10ac8afc0 RDI:
0000000000000014
[    2.481546] RBP: 000055a10ac8afc0 R08: 0000000000000000 R09:
000055a10ac748a0
[    2.482192] R10: 0000000000000014 R11: 0000000000000246 R12:
0000000000020000
[    2.482810] R13: 000055a10ac82960 R14: 0000000000000000 R15:
0000000000000000
[    2.483756] Code: 6d fc ff ff 0f 1f 80 00 00 00 00 0f 1f 44 00 00 be 02 00
00 00 e9 01 fb ff ff 90 0f 1f 44 00 00 65 48 8b 14 25 00 5c 01 00 31 c0 <f0> 48
0f b1 17 48 85 c0 75 02 f3 c3 eb d2 66 90 0f 1f 44 00 00
[    2.485623] RIP: mutex_lock+0x10/0x20 RSP: ffffa944404c3aa0
[    2.486108] CR2: 0000000000000258
[    2.487158] ---[ end trace 79527e8c9ce260a5 ]---

The example is from a slightly old kernel, but the same happens with the latest
4.18.  Also it happens with SLE12-SP2/SP3 kernel as well, maybe older ones,
too.


--1532022050.FEDf3C19.13597
Date: Thu, 19 Jul 2018 17:40:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101938

            Bug ID: 1101938
           Summary: kgapi logs full oauth traffic to the journal
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: lbeltrame-at-kde.org
          Found By: ---
           Blocker: ---

Excerpt from a journal:

Jul 19 17:55:59 rofl akonadi_imap_resource[2579]: attempting client step after
doneflag
Jul 19 17:55:59 rofl akonadi_imap_resource[2579]: org.kde.pim.kimap:
sasl_client_step failed with: -1 "SASL(0): successful result: "
Jul 19 17:55:59 rofl akonadi_imap_resource[2579]: org.kde.kgapi.raw: Requesting
token refresh:
"client_id=554041944266.apps.googleusercontent.com&client_secret=XXX&refresh_token=XXX&grant_type=refresh_token"
Jul 19 17:55:59 rofl akonadi_imap_resource[2579]: org.kde.kgapi: Queued
QUrl("https://accounts.google.com/o/oauth2/token")
Jul 19 17:55:59 rofl akonadi_imap_resource[2579]: org.kde.kgapi:
KGAPI2::AuthJob(0x55bcb01239f0) Dispatching request to
QUrl("https://accounts.google.com/o/oauth2/token")
Jul 19 17:55:59 rofl akonadi_imap_resource[2579]: org.kde.kgapi.raw:
"client_id=554041944266.apps.googleusercontent.com&client_secret=XXX&refresh_token=XXX&grant_type=refresh_token"
Jul 19 17:56:00 rofl akonadi_imap_resource[2579]: org.kde.kgapi: Received reply
from QUrl("https://accounts.google.com/o/oauth2/token")
Jul 19 17:56:00 rofl akonadi_imap_resource[2579]: org.kde.kgapi: Status code:
200
Jul 19 17:56:00 rofl akonadi_imap_resource[2579]: org.kde.kgapi.raw: "{\n
\"access_token\" : \"XXX\",\n  \"expires_in\" : 3600,\n  \"id_token\" :
\"XXX\",\n  \"scope\" : \"https://www.googleapis.com/auth/plus.me
https://mail.google.com/ https://www.googleapis.com/auth/userinfo.email\",\n
\"token_type\" : \"Bearer\"\n}"
Jul 19 17:56:00 rofl akonadi_imap_resource[2579]: org.kde.kgapi:
Jul 19 17:56:00 rofl akonadi_imap_resource[2579]: qt.network.ssl:
QSslSocket::startClientEncryption: cannot start handshake on non-plain
connection
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: attempting client step after
doneflag
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.pim.kimap:
sasl_client_step failed with: -1 "SASL(0): successful result: "
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi.raw: Requesting
token refresh:  "XXX"
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi: Queued
QUrl("https://accounts.google.com/o/oauth2/token")
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi:
KGAPI2::AuthJob(0x55e1bb093950) Dispatching request to
QUrl("https://accounts.google.com/o/oauth2/token")
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi.raw: "XXX"
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi: Received reply
from QUrl("https://accounts.google.com/o/oauth2/token")
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi: Status code:
200
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi.raw: "{\n
\"access_token\" : \"XXX"...
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: org.kde.kgapi:
Jul 19 17:56:00 rofl akonadi_imap_resource[2578]: qt.network.ssl:
QSslSocket::startClientEncryption: cannot start handshake on non-plain
connection


--1532024368.0c2dF510.20233
Date: Thu, 19 Jul 2018 18:19:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1101942

            Bug ID: 1101942
           Summary: Grub does not insert Arch Linux entry correctly
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Bootloader
          Assignee: jsrain-at-suse.com
          Reporter: cavsfan-at-cfl.rr.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

If Arch Linux is installed, when openSUSE is installed it leaves out
/initramfs-linux.img on the line where "initrdefi /intel-ucode.img" is. One has
to press 'e' and insert the /initramfs-linux.img part at the end or Arch will
not boot.
The grub.cfg is attached.

The correct entry would be "initrdefi /intel-ucode.img /initramfs-linux.img".


--1532095328.D6faaB0.4810
Date: Fri, 20 Jul 2018 14:02:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1102075

            Bug ID: 1102075
           Summary: [Build 20180719] openQA test fails in rails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/709954/modules/rails
                    /steps/12
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Ruby
          Assignee: ruby-devel-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_in_textmode@64bit fails in
[rails](https://openqa.opensuse.org/tests/709954/modules/rails/steps/12)

## Reproducible

Fails since (at least) Build
[20180714](https://openqa.opensuse.org/tests/708132)

## Expected result

Last good: [20180714](https://openqa.opensuse.org/tests/707517) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&version=Tumbleweed&distri=opensuse&machine=64bit&flavor=DVD&test=extra_tests_in_textmode)

The rails stack is (once again) broken: the sqlite3 module seems not to be
present after executing the test.

the test-code does:

> zypper -n in -C "rubygem(rails)"
> rails new mycoolapp --skip-bundle --skip-test
> cd mycoolapp
> (rails server -b 0.0.0.0 &)


--1532103758.7ED5F8d0.15186
Date: Fri, 20 Jul 2018 16:22:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1102096

            Bug ID: 1102096
           Summary: python-virtualenv:  --always-copy always fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

> virtualenv --always-copy --verbose /tmp/tgc
> Using base prefix '/usr'
> Creating /tmp/tgc/lib/python3.6
> Cannot find file lib (bad symlink)
> Symlinking Python bootstrap modules
>   Copying to /tmp/tgc/lib/python3.6/lib-dynload
>   Creating parent directories for /tmp/tgc/lib64/python3.6
>   Copying to /tmp/tgc/lib64/python3.6/os.py
>   Ignoring built-in bootstrap module: posix
>   Copying to /tmp/tgc/lib64/python3.6/posixpath.py
>   Cannot import bootstrap module: nt
>   Copying to /tmp/tgc/lib64/python3.6/ntpath.py
>   Copying to /tmp/tgc/lib64/python3.6/genericpath.py
>   Copying to /tmp/tgc/lib64/python3.6/fnmatch.py
>   Copying to /tmp/tgc/lib64/python3.6/locale.py
>   Copying to /tmp/tgc/lib64/python3.6/encodings
>   Copying to /tmp/tgc/lib64/python3.6/codecs.py
>   Copying to /tmp/tgc/lib64/python3.6/stat.py
>   Cannot import bootstrap module: UserDict
>   Creating parent directories for /tmp/tgc/lib64/python3.6/lib-dynload
>   Copying to /tmp/tgc/lib64/python3.6/lib-dynload/readline.cpython-36m-x86_64-linux-gnu.so
>   Cannot import bootstrap module: copy_reg
>   Copying to /tmp/tgc/lib64/python3.6/types.py
>   Copying to /tmp/tgc/lib64/python3.6/re.py
>   Cannot import bootstrap module: sre
>   Copying to /tmp/tgc/lib64/python3.6/sre_parse.py
>   Copying to /tmp/tgc/lib64/python3.6/sre_constants.py
>   Copying to /tmp/tgc/lib64/python3.6/sre_compile.py
>   Copying to /tmp/tgc/lib64/python3.6/lib-dynload/zlib.cpython-36m-x86_64-linux-gnu.so
>   Cannot import bootstrap module: _abcoll
>   Copying to /tmp/tgc/lib64/python3.6/warnings.py
>   Copying to /tmp/tgc/lib64/python3.6/linecache.py
>   Copying to /tmp/tgc/lib64/python3.6/abc.py
>   Copying to /tmp/tgc/lib64/python3.6/io.py
>   Copying to /tmp/tgc/lib64/python3.6/_weakrefset.py
>   Copying to /tmp/tgc/lib64/python3.6/copyreg.py
>   Copying to /tmp/tgc/lib64/python3.6/tempfile.py
>   Copying to /tmp/tgc/lib64/python3.6/random.py
>   Copying to /tmp/tgc/lib64/python3.6/__future__.py
>   Copying to /tmp/tgc/lib64/python3.6/collections
>   Copying to /tmp/tgc/lib64/python3.6/keyword.py
>   Copying to /tmp/tgc/lib64/python3.6/tarfile.py
>   Copying to /tmp/tgc/lib64/python3.6/shutil.py
>   Copying to /tmp/tgc/lib64/python3.6/struct.py
>   Copying to /tmp/tgc/lib64/python3.6/copy.py
>   Copying to /tmp/tgc/lib64/python3.6/tokenize.py
>   Copying to /tmp/tgc/lib64/python3.6/token.py
>   Copying to /tmp/tgc/lib64/python3.6/functools.py
>   Copying to /tmp/tgc/lib64/python3.6/heapq.py
>   Copying to /tmp/tgc/lib64/python3.6/bisect.py
>   Copying to /tmp/tgc/lib64/python3.6/weakref.py
>   Copying to /tmp/tgc/lib64/python3.6/reprlib.py
>   Copying to /tmp/tgc/lib64/python3.6/base64.py
>   Copying to /tmp/tgc/lib64/python3.6/_dummy_thread.py
>   Copying to /tmp/tgc/lib64/python3.6/hashlib.py
>   Copying to /tmp/tgc/lib64/python3.6/hmac.py
>   Copying to /tmp/tgc/lib64/python3.6/imp.py
>   Copying to /tmp/tgc/lib64/python3.6/importlib
>   Copying to /tmp/tgc/lib64/python3.6/rlcompleter.py
>   Copying to /tmp/tgc/lib64/python3.6/operator.py
>   Copying to /tmp/tgc/lib64/python3.6/_collections_abc.py
>   Copying to /tmp/tgc/lib64/python3.6/_bootlocale.py
>   Copying to /tmp/tgc/lib64/python3.6/enum.py
> Creating /tmp/tgc/lib/python3.6/site-packages
> Writing /tmp/tgc/lib64/python3.6/site.py
> Writing /tmp/tgc/lib64/python3.6/orig-prefix.txt
> Writing /tmp/tgc/lib64/python3.6/no-global-site-packages.txt
> Creating /tmp/tgc/bin
> New python executable in /tmp/tgc/bin/python3
> Changed mode of /tmp/tgc/bin/python3 to 0o755
> Also creating executable in /tmp/tgc/bin/python
> Changed mode of /tmp/tgc/bin/python to 0o755
> Copying to /tmp/tgc/bin/python
> Copying to /tmp/tgc/bin/python3.6
> Testing executable with /tmp/tgc/bin/python3 -c "import sys;out=sys.stdout;getattr(out, "buffer", out).write(sys.prefix.encode("utf-8"))"
> Got sys.prefix result: '/tmp/tgc'
> Creating /tmp/tgc/lib64/python3.6/distutils
> Writing /tmp/tgc/lib64/python3.6/distutils/__init__.py
> Writing /tmp/tgc/lib64/python3.6/distutils/distutils.cfg
> Installing setuptools, pip, wheel...
>   Traceback (most recent call last):
>     File "<stdin>", line 4, in <module>
>     File "/tmp/tgc/lib64/python3.6/tempfile.py", line 45, in <module>
>       from random import Random as _Random
>     File "/tmp/tgc/lib64/python3.6/random.py", line 42, in <module>
>       from math import log as _log, exp as _exp, pi as _pi, e as _e, ceil as _ceil
>   ModuleNotFoundError: No module named 'math'
>   Complete output from command /tmp/tgc/bin/python3 - setuptools pip wheel:
>   Traceback (most recent call last):
>   File "<stdin>", line 4, in <module>
>   File "/tmp/tgc/lib64/python3.6/tempfile.py", line 45, in <module>
>     from random import Random as _Random
>   File "/tmp/tgc/lib64/python3.6/random.py", line 42, in <module>
>     from math import log as _log, exp as _exp, pi as _pi, e as _e, ceil as _ceil
> ModuleNotFoundError: No module named 'math'
> ----------------------------------------
> ...Installing setuptools, pip, wheel...done.
> Traceback (most recent call last):
>   File "/usr/bin/virtualenv", line 11, in <module>
>     sys.exit(main())
>   File "/usr/lib/python3.6/site-packages/virtualenv.py", line 712, in main
>     symlink=options.symlink)
>   File "/usr/lib/python3.6/site-packages/virtualenv.py", line 947, in create_environment
>     download=download,
>   File "/usr/lib/python3.6/site-packages/virtualenv.py", line 904, in install_wheel
>     call_subprocess(cmd, show_stdout=False, extra_env=env, stdin=SCRIPT)
>   File "/usr/lib/python3.6/site-packages/virtualenv.py", line 796, in call_subprocess
>     % (cmd_desc, proc.returncode))
> OSError: Command /tmp/tgc/bin/python3 - setuptools pip wheel failed with error code 1

See also https://github.com/pypa/virtualenv/issues/1192
Solved upstream with https://github.com/pypa/virtualenv/pull/1189


--1532332296.1fc43b0.1424
Date: Mon, 23 Jul 2018 07:51:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1102178

            Bug ID: 1102178
           Summary: VUL-1: CVE-2018-14505: mitmproxy: mitmweb allows DNS Rebinding attacks, related totools/web/app.py.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/211376/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: aloisio-at-gmx.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-14505

mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to
tools/web/app.py.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-14505
http://www.cvedetails.com/cve/CVE-2018-14505/
https://github.com/mitmproxy/mitmproxy/issues/3234
https://github.com/mitmproxy/mitmproxy/pull/3243