--1512729578.F3fdBf0.4800
Date: Fri, 8 Dec 2017 10:39:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1071941

            Bug ID: 1071941
           Summary: pip installs packages in /usr/lib instead of /usr/local/lib
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: markos.chandras-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hello,

/usr/local is meant to be used for packages installed outside of package
manager. Such case is 'pip' in which you can install additional python
packages. The problem is that openSUSE pip is installing packages in /usr/lib
which overrides python packages installed by zypper

For example consider the python2-hpack installed using zypper

python2-hpack-3.0.0-1.1.noarch it is installed in

/usr/lib/python2.7/site-packages/hpack
/usr/lib/python2.7/site-packages/hpack-3.0.0-py2.7.egg-info
/usr/lib/python2.7/site-packages/hpack-3.0.0-py2.7.egg-info/PKG-INFO
...
etc

now installing hpack from pip results to

> pip2.7 install -I hpack
> pip2.7 show hpack|grep Location
Location: /usr/lib/python2.7/site-packages

As you can see, pip puts the wheel package into the same location that zypper
installed it which effectively overwrites it. Consider also the opposite
situation where you first install from pip and then from zypper. zypper will
overwrite what you had installed from pip. This is quite problematic when you
want zypper and pip packages to happily co-exist for development and testing
purposes.

This behavior is different compared to other distros where they put pip
packages in /usr/local in order to keep them separate from the python packages
installed by the package manager.

For example, here is the same package on Ubuntu Xenial installed with apt-get

$ dpkg -L python-hpack
/.
/usr
/usr/lib
/usr/lib/python2.7
/usr/lib/python2.7/dist-packages
/usr/lib/python2.7/dist-packages/hpack-2.1.0.egg-info
...
etc

and the one installed by pip

> sudo pip2.7 install -I hpack
> sudo pip2.7 show hpack|grep Location
Location: /usr/local/lib/python2.7/dist-packages

As you see both packages can exist on the same system. CentOS also puts pip
packages in /usr/local.


--1512733510.Fae601120.32162
Date: Fri, 8 Dec 2017 11:45:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1071961

            Bug ID: 1071961
           Summary: Unwanted addition of double slashes before a mail address
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: SUSE Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Xfce
          Assignee: bnc-team-xfce-at-forge.provo.novell.com
          Reporter: Markus.Elfring-at-web.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I can click on a link together with pressing the key “Ctrl” in the application
“XFCE4 Terminal 0.8.6-34.1”.
https://docs.xfce.org/apps/terminal/usage#%20To%20compose%20an%20email

A new mail could be edited by the program “Mozilla Thunderbird 52.5.0-1.7” (for
example).
Now I observe that two slashes are placed before the mail address in the input
field “To:”.
https://en.wikipedia.org/wiki/Slash_(punctuation)#Programming

This functionality worked without these extra characters for a while. Under
which circumstances will they be omitted there again?


body:
--1512845526.4075ed34.23519
Date: Sat, 9 Dec 2017 18:52:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1072031

            Bug ID: 1072031
           Summary: gambas3 depends on Qt WebKit 4
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: fa0sck-at-gmail.com
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: avvissu-at-yandex.by
          Found By: ---
           Blocker: ---

Qt WebKit 4 will be dropped in TW (and Leap 15) very soon and as gamas3
currently depends on it, it won't be able to build anymore.

Simply removing the pkgconfig(QtWebKit) BuildDep doesn't seem to be enough,
while it disables building of gb.qt4.webkit, it fails later on with
"FProperty.class:25: error: Unknown identifier: WebView".

summary: gambas3 depends on Qt WebKit 4


--1512850628.f7716D5.1047
Date: Sat, 9 Dec 2017 20:17:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1072036

            Bug ID: 1072036
           Summary: VUL-0: CVE-2017-7844: MozillaFirefox: Visited history information leak through SVG image
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/196081/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Firefox
          Assignee: security-team-at-suse.de
          Reporter: astieger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: wolfgang-at-rosenauer.org
          Found By: Security Response Team
           Blocker: ---

CVE-2017-7844: Visited history information leak through SVG image

A combination of an external SVG image referenced on a page and the coloring of
anchor links stored within this image can be used to determine which pages a
user has in their history. This can allow a malicious website to query user
history.
Note: This issue only affects Firefox 57. Earlier releases are not affected.

bmo#1420001

Fixed in 57.0.1, affects 57 only. Already fixed in Factory, amending changelog.


--1512934661.70d1B180.6887
Date: Sun, 10 Dec 2017 19:37:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072060

            Bug ID: 1072060
           Summary: TinyCA2 - Can't use 'defined(@array)'  Compilation failed in require at /usr/bin/tinyca2 line 35.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: 64bit
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: dutch.glory-at-yahoo.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

TinyCA2  dos not run on TW. also tried as root....

Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at
/usr/share/TinyCA2/lib/GUI.pm line 1252.
Compilation failed in require at /usr/bin/tinyca2 line 35.
BEGIN failed--compilation aborted at /usr/bin/tinyca2 line 35.


--1512936362.852A8a1.31191
Date: Sun, 10 Dec 2017 20:06:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072061

            Bug ID: 1072061
           Summary: [Build 20171210-2] openQA test fails in install_and_reboot
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.2
          Hardware: Other
               URL: http://openqa.opensuse.org/tests/555678/modules/instal
                    l_and_reboot/steps/21
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: astieger-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

This started failing 1-2 days ago...

## Observation

openQA test in scenario opensuse-42.2-UpdateTest-x86_64-kde@64bit-2G fails in
[install_and_reboot](http://openqa.opensuse.org/tests/555678/modules/install_and_reboot/steps/21)

The underlying error seems to be:
systemctl: error while loading shared libraries: libgpg-error.so.0: cannot open
shared object file: No such file or directory

This happens multiple times earlier in the log.

In context:
2017-12-10 14:12:06 <0> linux-nvlb(3375) [agent-system]
SystemAgent.cc(Execute):918 Execute (.bash_output)
2017-12-10 14:12:06 <0> linux-nvlb(3375) [bash]
ShellCommand.cc(shellcommand):31 shellcommand start
2017-12-10 14:12:06 <3> linux-nvlb(3375) [bash]
ShellCommand.cc(shellcommand):78 systemctl: error while loading shared
libraries: libgpg-error.so.0: cannot open shared object file: No such file or
directory
2017-12-10 14:12:06 <0> linux-nvlb(3375) [bash]
ShellCommand.cc(shellcommand):199 shellcommand end

## Reproducible

Fails since (at least) Build
[20171209-4](http://openqa.opensuse.org/tests/554688)

## Expected result

Last good: [20171209-3](http://openqa.opensuse.org/tests/554653) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](http://openqa.opensuse.org/tests/latest?test=kde&machine=64bit-2G&version=42.2&distri=opensuse&flavor=UpdateTest&arch=x86_64)


--1512999694.BFEd700.10856
Date: Mon, 11 Dec 2017 13:41:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072170

            Bug ID: 1072170
           Summary: VUL-0: CVE-2017-15120: pdns: Parsing error while handling authoritative answers leading to a recursor crash via a NULL-pointer dereference
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/196434/
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jsegitz-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-15120

(CVE-2017-15120) affecting PowerDNS Recursor from 4.0.0 up to and
including 4.0.7. PowerDNS Recursor 3.7.4 and 4.1.0 are not affected. The
full security advisory can be found below and at
https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2017-08.html

The issue is a parsing error while handling authoritative answers
containing a CNAME of a different class than IN, leading to a recursor
crash via a NULL-pointer dereference. We don't believe this crash to be
exploitable, but it results in an unauthenticated remote denial of
service which can be mitigated by running the recursor inside a
supervisor like supervisord or systemd so it can be automatically restarted.

We also provide a minimal patch for the 4.0.7 release at
https://downloads.powerdns.com/patches/2017-08/

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15120
http://seclists.org/oss-sec/2017/q4/382
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15120
https://downloads.powerdns.com/patches/2017-08/
https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2017-08.html


--1513034855.c7BC31eA0.13833
Date: Mon, 11 Dec 2017 23:27:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072274

            Bug ID: 1072274
           Summary: network/tor: replace torctl with systemd service file
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: astieger-at-suse.com
          Reporter: opensuse-bz-at-riseup.net
        QA Contact: opensuse-communityscreening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Created attachment 752465
  --> http://bugzilla.opensuse.org/attachment.cgi?id=752465&action=edit
/usr/lib/systemd/system/tor-master.service (from Fedora)

The current tor.service systemd file is a wrapper around torctl instead of
being a native service file.

This ticket is about making tor.service a native systemd service file.

I'm attaching the following files:

/usr/lib/systemd/system/tor.service
/usr/lib/systemd/system/tor-master.service
/usr/share/tor/defaults-torrc
/etc/logrotate.d/tor

These files are mostly copies from the Fedora package with very minor changes
to the specifics in openSUSE (i.e. tor username).

I tested them briefly on openSUSE Leap 42.3.

This is related to #1071981


--1513061720.D03D73c0.17112
Date: Tue, 12 Dec 2017 06:55:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072307

            Bug ID: 1072307
           Summary: VUL-0: CVE-2017-16876: python-mistune: Cross-site-scripting
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/195763/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: jmatejek-at-suse.com
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

https://snyk.io/vuln/SNYK-PYTHON-MISTUNE-40765

Overview

mistune is the fastest markdown parser in pure Python.

Affected versions of the package are vulnerable to Cross-site Scripting (XSS).
Details

Cross-Site Scripting (XSS) attacks occur when an attacker tricks a user’s
browser to execute malicious JavaScript code in the context of a victim’s
domain. Such scripts can steal the user’s session cookies for the domain,
scrape or modify its content, and perform or modify actions on the user’s
behalf, actions typically blocked by the browser’s Same Origin Policy.

These attacks are possible by escaping the context of the web application and
injecting malicious scripts in an otherwise trusted website. These scripts can
introduce additional attributes (say, a "new" option in a dropdown list or a
new link to a malicious site) and can potentially execute code on the clients
side, unbeknown to the victim. This occurs when characters like \< > \" \' are
not escaped properly.

There are a few types of XSS:

    Persistent XSS is an attack in which the malicious code persists into the
web app’s database.
    Reflected XSS is an which the website echoes back a portion of the request.
The attacker needs to trick the user into clicking a malicious link (for
instance through a phishing email or malicious JS on another page), which
triggers the XSS attack.
    DOM-based XSS is an that occurs purely in the browser when client-side
JavaScript echoes back a portion of the URL onto the page. DOM-Based XSS is
notoriously hard to detect, as the server never gets a chance to see the attack
taking place.

You can read more about Cross-site Scripting (XSS) on our blog.
Remediation

Upgrade mistune to version 0.8.1 or higher.

Upstream patch:

https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98


--1513064471.Ca0c50.24212
Date: Tue, 12 Dec 2017 07:41:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072317

            Bug ID: 1072317
           Summary: VUL-1: CVE-2017-17554: aubio: A NULL pointer dereference in the function aubio_source_avcodec_readframe may lead to DoS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/196469/
                OS: openSUSE Factory
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: tiwai-at-suse.com
          Reporter: jsegitz-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-17554

A NULL pointer dereference (DoS) Vulnerability was found in the
function aubio_source_avcodec_readframe in io/source_avcodec.c of aubio
0.4.6, which may lead to DoS when playing a crafted audio file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-17554
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17554


--1513071014.c80484.1604
Date: Tue, 12 Dec 2017 09:30:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072345

            Bug ID: 1072345
           Summary: leap staging: "Cannot adjust NTP service"
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: http://openqa.opensuse.org/tests/557090/modules/instal
                    l_and_reboot/steps/21
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: lnussel-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario opensuse-15.0:S:D-Staging-DVD-x86_64-cryptlvm@64bit
fails in
[install_and_reboot](http://openqa.opensuse.org/tests/557090/modules/install_and_reboot/steps/21)

YaST shows an error that it "Cannot adjust NTP service". That is a bit terse.
The real reason is that chrony is not installed/available so as result it
cannot enable chronyd.service. My suggestion would be to
a) make sure chrony is installed before trying to configure it
b) make the error message a bit more specific :)


--1513074836.c0A30AE8.27203
Date: Tue, 12 Dec 2017 10:33:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072359

            Bug ID: 1072359
           Summary: obs-service-set_version has UTF8/Unicode problem at build-time
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: FSchreiner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The following error occurs when running set_version while buildtime

##################################################################################
[   41s] Compressed rawspeed-v3.0~git1624.e8ad6e3b.tar to
rawspeed-v3.0~git1624.e8ad6e3b.tar.xz
[   41s] /usr/lib/obs/service/set_version:32: RuntimeWarning: install
'packaging' to improve python package versions
[   41s]   RuntimeWarning)
[   41s] Traceback (most recent call last):
[   41s]   File "/usr/lib/obs/service/set_version", line 335, in <module>
[   41s]     add_if_missing=False)
[   41s]   File "/usr/lib/obs/service/set_version", line 181, in
_replace_define
[   41s]     contents = f.read()
[   41s]   File "/usr/lib64/python3.6/encodings/ascii.py", line 26, in decode
[   41s]     return codecs.ascii_decode(input, self.errors)[0]
[   41s] UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position
1301: ordinal not in range(128)
[   41s] service run failed for service 'set_version'
[   41s]
[   41s] wildcard2 failed "build rawspeed.spec" at Mon Dec 11 17:27:35 UTC
2017.
##################################################################################

fix already provided in:
https://github.com/openSUSE/obs-service-set_version/commit/b2927f1189a8e9c76267e391dbb2e93d63733654


--1513076365.A7Db0.12697
Date: Tue, 12 Dec 2017 10:59:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072366

            Bug ID: 1072366
           Summary: VUL-1: CVE-2017-17555: ffmpeg: The swri_audio_convert function allows remote attackers to cause a DoS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/196470/
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: jsegitz-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-17555

The swri_audio_convert function in audioconvert.c in FFmpeg libswresample
through 3.0.101, as used in FFmpeg 3.4.1, aubio 0.4.6, and other products,
allows remote attackers to cause a denial of service (NULL pointer dereference
and application crash) via a crafted audio file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-17555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17555
https://github.com/IvanCql/vulnerability/blob/master/An%20NULL%20pointer%20dereference%28DoS%29%20Vulnerability%20was%20found%20in%20function%20swri_audio_convert%20of%20ffmpeg%20libswresample.md


body:
--1513173506.1EAeBFe80.31275
Date: Wed, 13 Dec 2017 13:58:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1072657

            Bug ID: 1072657
           Summary: tcl make check transient failures
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: normand-at-linux.vnet.ibm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 752840
  --> http://bugzilla.suse.com/attachment.cgi?id=752840&action=edit
tcl_ring0_tw_ppc64le.log

tcl make check transient failures

last one reported in
https://build.opensuse.org/package/show/openSUSE:Factory:PowerPC:Rings:0-Bootstrap/tcl

there were 3 failing tests:
===
[  319s] ==== chan-io-53.9 CopyData: -size and event interaction, Bug 780533
FAILED
[  357s] ==== event-12.4 Tcl_UpdateCmd procedure FAILED
[  801s] ==== timer-2.1 Tcl_DeleteTimerHandler procedure FAILED
===
$osc  jobhist -l10 openSUSE:Factory:PowerPC:Rings:0-Bootstrap/tcl standard
ppc64le
time                 package reason           code      build time      worker
2017-11-30 18:48:43  tcl     new build        succeeded  11m 45s
obs-power8-05:10
2017-11-30 23:54:19  tcl     meta change      failed     14m 53s
obs-power8-02:7
2017-12-01 12:55:07  tcl     new build        succeeded  12m 54s
obs-power8-05:3
2017-12-01 15:19:25  tcl     meta change      succeeded   9m 33s
obs-power8-04:15
2017-12-06 12:01:48  tcl     meta change      failed     11m 37s
obs-power8-03:18
2017-12-13 00:14:48  tcl     meta change      failed     14m 15s
obs-power8-03:7
===

summary: tcl make check transient failures


body:
--1513181472.4fd5ab4.12265
Date: Wed, 13 Dec 2017 16:11:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072692

            Bug ID: 1072692
           Summary: monit: unable to start
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: chris-at-computersalat.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

after installing monit I am unable to start:

----------------------------------------
rcmonit start
redirecting to systemctl start monit.service
Failed to start monit.service: Unit monit.service failed to load: No such file
or directory.

----------------------------------------
l /usr/sbin/rcmon*
lrwxrwxrwx 1 root root 17 Dez 13 12:44 /usr/sbin/rcmonit -> /etc/init.d/monit*

----------------------------------------
chkconfig -l monit

Note: This output shows SysV services only and does not include native
systemd services. SysV configuration data might be overridden by native
systemd configuration.

If you want to list systemd services use 'systemctl list-unit-files'.
To see services enabled on particular target use
'systemctl list-dependencies [target]'.

monit                     0:off  1:off  2:off  3:off  4:off  5:off  6:off

----------------------------------------
rcmonit status
Checking for service monit
                                                           unused
● monit.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)

summary: monit: unable to start


--1513181773.03f6d0.27617
Date: Wed, 13 Dec 2017 16:16:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072697

            Bug ID: 1072697
           Summary: VUL-0: CVE-2017-13098: bouncycastle: TLS server vulnerable to Adaptive Chosen Ciphertext attack when using JCE allowing plaintext recovery or MITM attack
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.2
          Hardware: Other
               URL: https://smash.suse.de/issue/196499/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Java
          Assignee: tchvatal-at-suse.com
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#1525528

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any
TLS cipher suite using RSA key exchange is negotiated. An attacker can recover
the private key from a vulnerable wolfSSL application. This vulnerability is
referred to as "ROBOT."

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1525528
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13098
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13099
http://seclists.org/oss-sec/2017/q4/391
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-13099.html
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-13098.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13099
https://github.com/bcgit/bc-java/commit/a00b684465b38d722ca9a3543b8af8568e6bad5c
http://www.kb.cert.org/vuls/id/144389
https://github.com/wolfSSL/wolfssl/pull/1229


--1513247004.d01E30.8635
Date: Thu, 14 Dec 2017 10:23:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072826

            Bug ID: 1072826
           Summary: pam limits breaks in docker containers for leap 42.3
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dcassany-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

For some reason I can't figure out latest patch to leap 42.3 and leap 42.2
(related to pam-limit-nproc.patch [bsc#1012494, bsc#1013706]) of pam breaks
sudo in Leap 42.3 (that's not the case for Leap 42.2). Any sudo call results in
this error:

sudo: pam_open_session: Permission denied
sudo: policy plugin failed session initialization

See https://github.com/openSUSE/docker-containers/issues/82

The issue has been recently introduced in this SR
https://build.opensuse.org/request/show/539224

Also I am wondering why we have it different in Tumbleweed, where those tricky
rules for the root user are not applied at all.


body:
--1513254636.Ebef1.14844
Date: Thu, 14 Dec 2017 12:30:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072867

            Bug ID: 1072867
           Summary: Update keepassxc to version 2.2.4
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: mpluskal-at-suse.com
          Reporter: mpluskal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

* Update to version 2.2.4 brings such changes as:
  * Prevent database corruption when locked
  * Fixes apply button not saving new entries
  * Switch to Consolas font on Windows for password edit
  * Fixes multiple memory leaks
  * Resize message close to 16x16 pixels

summary: Update keepassxc to version 2.2.4


--1513294396.cE440.15942
Date: Thu, 14 Dec 2017 23:33:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1072976

            Bug ID: 1072976
           Summary: VUL-0: CVE-2017-15429: chromium: UXSS in V8
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html

Fixed in Chromium 63.0.3239.108

- CVE-2017-15429: UXSS in V8
  https://crbug.com/788453
- Various fixes from internal audits, fuzzing and other initiatives
  https://crbug.com/794792


--1513341362.6eECaba0.15215
Date: Fri, 15 Dec 2017 12:36:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073084

            Bug ID: 1073084
           Summary: Doomsday desktop file calls non-existing binary
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: P.Suetterlin-at-royac.iac.es
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package of the doomsday engine for Leap 42.3 (doomsday-1.14.5-5.23.x86_64)
ships with a .desktop file (/usr/share/applications/doomsday-engine.desktop)
that calls /usr/bin/launch-doomsday to start it.  However, this file does not
exist.

Seems this program is in doomsday-launcher, but neither has the doomsday
package a dependency on this, nor is it needed at all to play.


body:
--1513351457.1A4CA7.24595
Date: Fri, 15 Dec 2017 15:24:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073114

            Bug ID: 1073114
           Summary: Introduce lldpd to Leap and Backports
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mpluskal-at-suse.com
          Reporter: mpluskal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I would like to introduce lldpd to Leap and backports, its a leaf package with
following purpose:

LLDP (Link Layer Discovery Protocol) is an industry standard protocol designed
to supplant proprietary Link-Layer protocols such as Extreme's EDP (Extreme
Discovery Protocol) and CDP (Cisco Discovery Protocol). The goal of LLDP is to
provide an inter-vendor compatible mechanism to deliver Link-Layer
notifications to adjacent network devices.

See also:
https://en.wikipedia.org/wiki/Link_Layer_Discovery_Protocol
http://vincentbernat.github.com/lldpd/

summary: Introduce lldpd to Leap and Backports


--1513444173.Ede00.19558
Date: Sat, 16 Dec 2017 17:09:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073194

            Bug ID: 1073194
           Summary: XDG Desktop Portal KDE fails to start (GDBus.Error:org.freedesktop.DBus.Error.Spawn.ChildSig naled)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: janousek.jiri-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Up-to-date Leap 42.3.

1. Install xdg-desktop-portal-kde (5.10.3-1.1) & d-feet
2. Open d-feet, select session bus and click on org.freedesktop.portal.Desktop.

Expected result: XDG Desktop Portal KDE is launched as the default
implementation of org.freedesktop.portal.Desktop DBus API.

Actual result: DBus Exception is shown: org.freedesktop.portal.Desktop :
g-dbus-error-quark: DBus.Error:org.freedesktop.DBus.Error.Spawn.ChildSignaled:
Process org.freedesktop.portal.Desktop received signal 11

Workaround: Uninstall xdg-desktop-portal-kde and install
xdg-desktop-portal-gtk.

Reproducible also with dbus-send:

$ dbus-send --print-reply --dest=org.freedesktop.portal.Desktop
/org/freedesktop/portal/desktop org.freedesktop.portal.ProxyResolver.Lookup
string:"http://google.com"
Error org.freedesktop.DBus.Error.Spawn.ChildSignaled: Process
org.freedesktop.portal.Desktop received signal 11


--1513536076.E4530.10405
Date: Sun, 17 Dec 2017 18:41:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073210

            Bug ID: 1073210
           Summary: Link Time Optimization doesn't work out of the box on 64 bit systems because of bfd-plugins path mixup
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: l.lunak-at-centrum.cz
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When using LTO, linker is supposed to find a plugin for handling LTO in
/usr/lib/bfd-plugins . And this path is hardcoded in sources, and it's "lib"
even for 64 bit systems. However, neither GCC nor Clang/LLVM install their
plugin there. GCC doesn't do anything with its plugin except for shipping it in
its own directory, and LLVMGold is installed to /usr/lib64/bfd-plugins. So
instead of LTO simply working when using -flto, one has to use gcc-ar/llvm-ar
etc. to override the ar etc. which should work but don't because of this.

I can easily submit fixed binutils and gcc packages to make them use
/usr/lib64/bfd-plugins too, but I've first created this bugreport so that
there's just one place for referring to this issue. Also I would first like to
verify that this would indeed be the proper fix - is there any special reason
why binutils hardcodes the "lib" there?


--1513583007.bE5a8.20879
Date: Mon, 18 Dec 2017 07:43:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073248

            Bug ID: 1073248
           Summary: VUL-0: CVE-2017-17528: scummvm: backends/platform/sdl/posix/posix.cpp does not validate strings before launching the program specified by the BROWSER environment variable
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/196760/
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: aloisio-at-gmx.com
          Reporter: jsegitz-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-17528

backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate
strings
before launching the program specified by the BROWSER environment variable,
which might allow remote attackers to conduct argument-injection attacks via a
crafted URL.

Factory only and no maintainer. Would you be willing to take this one?

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-17528
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-17528.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17528


body:
--1513607569.ab6b5c81.4971
Date: Mon, 18 Dec 2017 14:32:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073323

            Bug ID: 1073323
           Summary: Update re2 to version 2017-12-01
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mpluskal-at-suse.com
          Reporter: mpluskal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

re2 should have been updated with chromium - there is no upstream changelog
available but I am sure there are important fixes

summary: Update re2 to version 2017-12-01


--1513696931.7D86d0.12503
Date: Tue, 19 Dec 2017 15:22:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073535

            Bug ID: 1073535
           Summary: translate-toolkit contains vulnerable code
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: sbrabec-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

translate-toolkit in Leap 42.* contains a potential security vulnerability:
https://github.com/translate/translate/pull/3632

The problem is fixed in the version 2.2.0.


body:
--1513712904.E0D2B70.20083
Date: Tue, 19 Dec 2017 19:48:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073564

            Bug ID: 1073564
           Summary: python3-Fabric does not support Python3
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: tmkn-at-tmkn.uk
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

For some reason `python3-Fabric` package exists in Tumbleweed even though
Fabric itself does not support Python 3.

https://software.opensuse.org/package/python3-Fabric

The only valid package should be `python3-Fabric.

Running `fab` on openSUSE Tumbleweed does not work when using `python3-Fabric`
package.

Steps to reproduce:
```
zypper install python3-Fabric
fab
```

Actual Results:
Python error because of Python3 incompatibility.

```
from operator import isMappingType
ImportError: cannot import name 'isMappingType'
```

Expected Results:
Should display fabric default output instead.

Additional Information:
Should only be available as `python2-Fabric` and that should be a default `fab`
command executable.

summary: python3-Fabric does not support Python3


--1513717314.B53e15d50.31270
Date: Tue, 19 Dec 2017 21:01:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073572

            Bug ID: 1073572
           Summary: KDE:Frameworks5/sddm: Black screen with sddm, cannot log in
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: x86-64
                OS: openSUSE 42.2
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: 3rd party software
          Assignee: fabian@ritter-vogt.de
          Reporter: ashaduri-at-gmail.com
        QA Contact: opensuse-communityscreening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

After upgrading to sddm 0.17.0 and Qt 5.10 (from KDE:/Frameworks5 and KDE:/Qt5
repositories) sddm crashes and a black screen is displayed with no ability to
log in (other than switch to tty1).
journalctl reports sddm crash in libQt5XcbQpa.so.5.

The previous version from the same repositories (based on Qt 5.9) worked fine.

I don't know how to get a backtrace.

Thanks


--1513722223.eaeE1A44.11345
Date: Tue, 19 Dec 2017 22:23:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073579

            Bug ID: 1073579
           Summary: obs memory constraints ineffective for 32 bit targets
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: stefan.bruens@rwth-aachen.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

If a package has a memory constraint, it is ineffective for 32 bit targets.

The kvm instance is started with an appropriate -m memory parameter, but the
worker is not able to use it, as the worker uses a non-PAE kernel and is only
able to use 3 GByte of "physical" memory.

This can trivially be fixed by using the PAE kernel (resp LPAE for armv7l) for
building obs-kernel.


body:
--1513788869.28700.13075
Date: Wed, 20 Dec 2017 16:54:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1073730

            Bug ID: 1073730
           Summary: libvirtd crash when stopping
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: cbosdonnat-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

How to reproduce:

  * Launch virt-manager connected to the local libvirtd (whatever the driver)
  * systemctl stop libvirtd

Actual:

  * libvirt crashes

Expected:

  * libvirtd stops cleanly

Backtrace of the crash:

#0  networkConnectNetworkEventDeregisterAny (conn=0x7f118c0036a0, callbackID=0)
at network/bridge_driver.c:3066
#1  0x00007f11befcf16e in virConnectNetworkEventDeregisterAny
(conn=0x7f118c0036a0, callbackID=callbackID@entry=0) at libvirt-network.c:1109
#2  0x000056295b4ed241 in remoteClientFreePrivateCallbacks
(priv=0x56295cb19c30) at remote.c:1702
#3  remoteClientCloseFunc (client=client@entry=0x56295cb1d0b0) at remote.c:1756
#4  0x000056295b5283ff in virNetServerClientClose (client=0x56295cb1d0b0) at
rpc/virnetserverclient.c:989
#5  0x000056295b524b20 in virNetServerDispose (obj=0x56295cad3f30) at
rpc/virnetserver.c:778
#6  0x00007f11beed9efb in virObjectUnref (anyobj=<optimized out>) at
util/virobject.c:356
#7  0x00007f11beeafd79 in virHashFree (table=<optimized out>) at
util/virhash.c:318
#8  0x00007f11bf0189c5 in virNetDaemonDispose (obj=0x56295cad3cb0) at
rpc/virnetdaemon.c:105
#9  0x00007f11beed9efb in virObjectUnref (anyobj=<optimized out>) at
util/virobject.c:356
#10 0x000056295b4eaef1 in main (argc=<optimized out>, argv=<optimized out>) at
libvirtd.c:1524

summary: libvirtd crash when stopping


body:
--1513805415.26810.10952
Date: Wed, 20 Dec 2017 21:30:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073748

            Bug ID: 1073748
           Summary: Segfault in libpython2.7.so.1
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: daniel-at-saltstack.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

We are experiencing a SegFault with python2.7 when trying to run our test
suite.

[  860.345322] salt-call[18552]: segfault at 3ea0 ip 00007ff59cede8bc sp
00007ffefe1e2170 error 4 in libpython2.7.so.1.0[7ff59ce0b000+1ae000]

This is happening with the 42.2 ami on Amazon AWS, as well as 42.2 and 42.3 on
Linode.

We are running our test suite salt states here

https://github.com/saltstack/salt-jenkins

We are calling

`salt-call --local state.apply git.salt pillar='{testing_dir:
/tmp/kitchen/testing, clone_repo: false, salttesting_namespec:
"salttesting==2017.6.1"}' saltenv=2017.7`

It does have to be called as the exec from ssh for this to fail.

I am attaching the core dump.

Thanks,
Daniel

summary: Segfault in libpython2.7.so.1


--1513848262.DbB80.3719
Date: Thu, 21 Dec 2017 09:24:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073820

            Bug ID: 1073820
           Summary: meson fails to build projects when run under the fish shell
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: sor.alexei-at-meowr.ru
          Reporter: simonf.lees-at-suse.com
        QA Contact: opensuse-communityscreening-at-forge.provo.novell.com
                CC: pth-at-suse.com, sbrabec-at-suse.com
          Found By: ---
           Blocker: ---

I have my shell set to /usr/bin/fish and meson fails to detect gcc properly, if
I switch to bash then the project builds fine, i've seen this on multiple
projects when building under tumbleweed.

simon@tek-top ~/src/build/wireless ➤ meson build
The Meson build system
Version: 0.43.0
Source dir: /home/simon/src/build/wireless
Build dir: /home/simon/src/build/wireless/build
Build type: native build
Project name: wireless

Meson encountered an error in file meson.build, line 1, column 0:
Unable to detect GNU compiler type:
cc: error trying to exec 'cc1': execvp: No such file or directory

A full log can be found at
/home/simon/src/build/wireless/build/meson-logs/meson-log.txt


body:
--1513853804.6EF6560.1800
Date: Thu, 21 Dec 2017 10:56:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073845

            Bug ID: 1073845
           Summary: python-attrs andpython-pluggy form a build cycle together
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The two packages python-attrs and python-pluggy cause trouble for bootstrapping
a distro, since they depend on each other to build

pkgs: python-attrs python-pluggy


body:
--1513936266.81FB17B80.25758
Date: Fri, 22 Dec 2017 09:51:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073975

            Bug ID: 1073975
           Summary: Sending messages with kmail2 impossible
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: freek-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Using Kontact/Kmail I am unable to send messages.
Sending the messages always fails. Message in Notification widget:
E-Mail sending failed
Failed to transport message. Connection to server lost.
However clicking on the message in the outbox list of messages, shows the
message with an error message:
Dictionary was not found. Please verify that you will use a correct dictionary.

This started yesterday after the upgrade to Tumbleweed 20171219, now I am on
20171220, which did not solve this issue.

HELP. I can't use this e-mail system anymore.

summary: Sending messages with kmail2 impossible


--1513949664.0715d7430.5876
Date: Fri, 22 Dec 2017 13:34:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1073996

            Bug ID: 1073996
           Summary: libxcb1, Display socket connection issue causes infinite retries
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: SUSE Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: paka-at-opensuse.org
        QA Contact: fvogt-at-suse.com
          Found By: ---
           Blocker: ---

python app backintime when running from cron starts xdpyinfo instance when
never finishes causing 100% cpu use

determined by Fabian Vogt


--1513970228.17c876d10.11878
Date: Fri, 22 Dec 2017 19:17:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074025

            Bug ID: 1074025
           Summary: devel:languages:php/php7: Bug "Uncaught Error: Call to undefined function imagecreatefromwebp"
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: i586
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: pgajdos-at-suse.com
          Reporter: archon810-at-gmail.com
        QA Contact: opensuse-communityscreening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Hi,

Looks like php7-gd is compiled without WebP support, which results in:

PHP Fatal error:  Uncaught Error: Call to undefined function
imagecreatefromwebp()

http://php.net/manual/en/function.imagecreatefromwebp.php says it's supported
since PHP 5.5, but I'm testing with 7.2 with no avail.

Perhaps the fix is adding webp support to php compilation, similar to
https://github.com/centminmod/centminmod/commit/407c64c25c37bc981dfeceecd268c7337d6ed932?

Thank you.


--1514064642.eAF6a1.23888
Date: Sat, 23 Dec 2017 21:30:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074043

            Bug ID: 1074043
           Summary: VUL-0: CVE-2017-7846: MozillaThunderbird: JavaScript Execution via RSS in mailbox:// origin
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197240/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: wolfgang-at-rosenauer.org
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is
viewed as a website, e.g. via “View -> Feed article -> Website” or in the
standard format of “View -> Feed article -> default format”.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7846
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7846
https://bugzilla.mozilla.org/show_bug.cgi?id=1411716
https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/#CVE-2017-7846


--1514064644.3B3Add1.24441
Date: Sat, 23 Dec 2017 21:30:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074044

            Bug ID: 1074044
           Summary: VUL-0: CVE-2017-7847: MozillaThunderbird: Local path string can be leaked from RSS feed
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197241/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: wolfgang-at-rosenauer.org
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

Crafted CSS in an RSS feed can leak and reveal local path strings, which may
contain user name.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7847
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7847
https://bugzilla.mozilla.org/show_bug.cgi?id=1411708
https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/#CVE-2017-7847


--1514064649.0d4Ac1.24446
Date: Sat, 23 Dec 2017 21:30:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074045

            Bug ID: 1074045
           Summary: VUL-0: CVE-2017-7848: MozillaThunderbird: RSS Feed vulnerable to new line Injection
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197242/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: wolfgang-at-rosenauer.org
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

RSS fields can inject new lines into the created email structure, modifying the
message body.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7848
https://bugzilla.mozilla.org/show_bug.cgi?id=1411699
https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/#CVE-2017-7848


--1514064653.cDB8beE5.24446
Date: Sat, 23 Dec 2017 21:30:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074046

            Bug ID: 1074046
           Summary: VUL-1: CVE-2017-7829: MozillaThunderbird: From address with encoded null character is cut off in message header display
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197243/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: wolfgang-at-rosenauer.org
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

It is possible to spoof the sender's email address and display an arbitrary
sender address to the email recipient. The real sender's address is not
displayed if preceded by a null character in the display string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7829
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7829
https://bugzilla.mozilla.org/show_bug.cgi?id=1423432
https://www.mozilla.org/en-US/security/advisories/mfsa2017-30/#CVE-2017-7829


body:
--1514139384.D7d2e0.8199
Date: Sun, 24 Dec 2017 18:16:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074054

            Bug ID: 1074054
           Summary: sane-backends systemd unit files broken
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: biblbroks-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 754246
  --> http://bugzilla.opensuse.org/attachment.cgi?id=754246&action=edit
Spec file patch to fix the issue

Due to a typo in sane-backends RPM build spec, saned.socket and saned@.service
systemd unit files are installed as directories, not regular files.

This makes it impossible to enable saned service through systemd:

# systemctl enable saned.socket
Failed to enable unit: File saned.socket: Is a directory

The attached patch highlights the problem and the fix in the spec file.

summary: sane-backends systemd unit files broken


body:
--1514233949.7CEecFfe4.7507
Date: Mon, 25 Dec 2017 20:32:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074074

            Bug ID: 1074074
           Summary: suspend hibernate nfs
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: Ralf.Friedl-at-online.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I have current Tumbleweed with systemd-234-9.1.x86_64 and
NetworkManager-1.8.4-4.1.x86_64.

When I do Suspend (to RAM) or Hibernate (to Disk), the system is no longer
usable after resume, /proc, /sys, /dev, /run, and probably other filesystems
are not usable. I traced this to /etc/NetworkManager/dispatcher.d/nfs where the
root partition is unmounted.

Here a part of the strace output:
> 3132  execve("/etc/NetworkManager/dispatcher.d/nfs", ["/etc/NetworkManager/dispatcher.d/nfs", "wlan0", "down"], 0x55a1a867ec00 /* 7 vars */) = 0
> 3156  execve("/usr/bin/umount", ["umount", "-l", "-f", "/"], 0x55808b81f390 /* 10 vars */) = 0
> 3156  lstat("/proc/3156/mountinfo", {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
> 3156  umount2("/", MNT_DETACH)  = 0
> 1     openat(AT_FDCWD, "/proc/self/mountinfo", O_RDONLY|O_CLOEXEC)   = -1 ENOENT (No such file or directory)

As you can see, immediately after umount root, /proc is no longer accessible.

The problem is /etc/NetworkManager/dispatcher.d/nfs:57
> NET_MOUNTS=$(sed -e '/^.*#/d' -e '/^.*:/!d' -e 's/\t/ /g' /etc/fstab | tr -s " ")$'\n'b
On my system, the output of this command is
> /dev/disk/by-id/md-uuid-XXXXXXXX:XXXXXXXX:XXXXXXXX:XXXXXXXX / ext4 defaults,acl,user_xattr 1 1
I verified that an "exit 0" at the start of the file solves my problem.

I'm not sure whether it is actually necessary to unmount NFS filesystems, but
the test should make sure that the filesystem is actually NFS, and probably
that the filesystem is not root. Or is there a way to recover from "umount -l
-f /"? Trying to mount /proc, /sys or any other filesystem manually failed.

summary: suspend hibernate nfs


--1514300607.75CF6b70.17461
Date: Tue, 26 Dec 2017 15:03:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074097

            Bug ID: 1074097
           Summary: RN: "systemctl stop apparmor" intentionally broken
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Release Notes
          Assignee: sknorr-at-suse.com
          Reporter: suse-beta-at-cboltz.de
        QA Contact: lnussel-at-suse.com
          Found By: ---
           Blocker: ---

Please add this information about AppArmor to the Leap 15 release notes

(copy&paste from
https://blog.cboltz.de/archives/77-AppArmor-2.12-The-Grinch-is-confined!.html
and assuming that Leap 15 will pick up AppArmor 2.12 or newer)

---

One important change in the [AppArmor 2.12] packages is that I intentionally
broke "systemctl stop apparmor". The reason for this is "systemctl restart
apparmor" - systemd maps this to stop, followed by start. This resulted in
unloading all AppArmor profiles by the "stop" part and, even if they get loaded
again a second later, running processes will stay unconfined unless you restart
them. The systemd developers were unwilling to implement the proposed
ExecRestart= option for unit files, therefore breaking "stop" is the best thing
I can do. (See boo#996520 and boo#853019 for more details.)

"systemctl reload apparmor" will continue to work and is still the recommended
way to reload the AppArmor profiles, but accidently typing "restart" instead of
"reload" can easily happen. Therefore I chose to break "stop" - that's
annoying, but more secure than accidently removing the AppArmor confinement
from running processes.

If you really want to unload all AppArmor profiles, you can use the new
"aa-teardown" command which does what "systemctl stop apparmor" did before -
but who would do that? ;-)


body:
Build Identifier:

mktexfmt [ERROR]: -user mode but path setup is -sys type, bailing out

this happens at every compilation attempt with several different programs and
even manual compilation with lualatex

texlive scheme base and full and manual texlie have been tested

Reproducible: Always

Steps to Reproduce:
1.install texlive scheme full
https://software.opensuse.org/package/texlive-scheme-full
2. zypper in texstudio select lualatex
3. try to compile anything in texstudio
Actual Results:
mktexfmt [ERROR]: -user mode but path setup is -sys type, bailing out

Expected Results:
working latex compilation

pkgs: texlive texlive-filesystem texlive-specs-a texlive-specs-b texlive-specs-c texlive-specs-d texlive-specs-e texlive-specs-f texlive-specs-g texlive-specs-h texlive-specs-i texlive-specs-j texlive-specs-k texlive-specs-l texlive-specs-m texlive-specs-n texlive-specs-o texlive-specs-p texlive-specs-q texlive-specs-r texlive-specs-s texlive-specs-t texlive-specs-u texlive-specs-v texlive-specs-w texlive-specs-x texlive-specs-y texlive-specs-z

summary: Unable to compile Latex in Tumbleweed 'kpathsea running mktexfmt pdflatex.fmt'


--1514573338.5af63ED4.14163
Date: Fri, 29 Dec 2017 18:48:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074235

            Bug ID: 1074235
           Summary: MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: bnc-team-mozilla-at-forge.provo.novell.com
          Reporter: astieger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: studio-at-anchev.net
          Found By: Security Response Team
           Blocker: ---

https://www.mozilla.org/en-US/firefox/52.5.3/releasenotes/
https://www.mozilla.org/en-US/firefox/57.0.3/releasenotes/

Firefox was affected by a crash reporting issue that inadvertently
sends background tab crash reports to Mozilla without user opt-in

https://bugzilla.mozilla.org/show_bug.cgi?id=1427111
Fixed in 52.5.3 ESR and 57.0.3

May explain some observations alleged in bug 1073399.


body:
--1514651931.CfAecd1A0.25198
Date: Sat, 30 Dec 2017 16:38:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074246

            Bug ID: 1074246
           Summary: Opera 49.0.2725.64 maintenance update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: sor.alexei-at-meowr.ru
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

An update of Opera from 48.0.2685.52 to 49.0.2725.64 for openSUSE Leap 42.2 and
Leap 42.3: https://blogs.opera.com/desktop/changelog-for-49/

summary: Opera 49.0.2725.64 maintenance update


--1514820274.d2db2cEe0.18985
Date: Mon, 1 Jan 2018 15:24:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074265

            Bug ID: 1074265
           Summary: syntax error in virt-aa-helper AppArmor profile
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE 42.2
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: suse-beta-at-cboltz.de
        QA Contact: qa-bugs-at-suse.de
          Found By: Beta-Customer
           Blocker: ---

/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper contains a syntax error which
prevents loading the profile:

  /run/libvirt/**/[sv]d[a-z] r

This line should be

  /run/libvirt/**/[sv]d[a-z] r,

(comma added at the end to fix the syntax)
or even better

  /{,var/}run/libvirt/**/[sv]d[a-z] r,

to also work on systems where /var/run/ is not a symlink to /run/ (like mine).


body:
--1514820943.472a40.19772
Date: Mon, 1 Jan 2018 15:35:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074266

            Bug ID: 1074266
           Summary: ghostscript-fonts is outdated
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: joshua.kraemer-at-gmail.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

URW's base 35 fonts provided by ghostscript-fonts-std and
ghostscript-fonts-other are severely outdated (almost 6 years old). They should
be replaced by the current fonts, available here:

https://github.com/ArtifexSoftware/urw-base35-fonts

Also, the ghostscript-fonts-* packages should probably be renamed to
urw-base35-fonts.

The current outdated fonts have old formats and old names, which are for
example no longer compatible with the current fontconfig files, available here:

https://github.com/ArtifexSoftware/urw-base35-fonts/tree/master/fontconfig

summary: ghostscript-fonts is outdated


--1514841604.E8c70.17402
Date: Mon, 1 Jan 2018 21:20:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074271

            Bug ID: 1074271
           Summary: scrolling in KMail: "page down" only works once
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE 42.2
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: suse-beta-at-cboltz.de
        QA Contact: qa-bugs-at-suse.de
          Found By: Beta-Customer
           Blocker: ---

Since a few days / some Tumbleweed snapshots (looking at /var/log/zypp/history,
the Qt and KDE updates in 20171223 might be a candidate) I noticed a funny
scrolling problem in KMail.

When reading a long mail (for example a Tumbleweed snapshot announcement), I
can scroll down with the "page down" key exactly once. Pressing page down again
does nothing, even if there's enough text left to scroll down.

If I scroll up again, the "page down" key works again exactly once to scroll to
the "second page", and then it stops to work.

I can scroll down with the "down arrow" key (slowly of course) until the end of
the mail.

Scrolling with the mouse also works until the end of the mail - both by
clicking the scrollbar and by using the mouse wheel.

Oh, and if I scrolled down with the down key or the mouse, pressing "page up"
brings me to the beginning of the mail, as if I had only scrolled down by one
page. Even more funny - pressing "page down" scrolls up to the second page.

This bug was confirmed by some people on the opensuse-factory mailinglist.


--1514888681.67cFe6516.877
Date: Tue, 2 Jan 2018 10:24:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074312

            Bug ID: 1074312
           Summary: VUL-0: CVE-2017-18009: opencv: heap-based buffer over-read in function cv::HdrDecoder::checkSignature
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197460/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: kde-maintainers-at-suse.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-18009

In OpenCV 3.3.1, a heap-based buffer over-read exists in the function
cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18009
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18009
http://www.cvedetails.com/cve/CVE-2017-18009/
https://github.com/opencv/opencv/issues/10479


--1514888740.dcd1F5.3783
Date: Tue, 2 Jan 2018 10:25:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074313

            Bug ID: 1074313
           Summary: VUL-0: CVE-2017-17760: opencv: buffer overflow in function cv::PxMDecoder::readData
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197410/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: kde-maintainers-at-suse.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-17760

OpenCV 3.3.1 has a Buffer Overflow in the cv::PxMDecoder::readData function in
grfmt_pxm.cpp, because an incorrect size value is used.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-17760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17760
https://github.com/opencv/opencv/issues/10351
https://github.com/opencv/opencv/pull/10369/commits/7bbe1a53cfc097b82b1589f7915a2120de39274c


--1514966530.b81A2320.25419
Date: Wed, 3 Jan 2018 08:02:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074428

            Bug ID: 1074428
           Summary: VUL-0: CVE-2017-1000420: syncthing: symlink traversal issue resulting in arbitrary file overwrite
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197516/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: sor.alexei-at-meowr.ru
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-1000420

Syncthing version 0.14.33 and older is vulnerable to symlink traversal
resulting
in arbitrary file overwrite

Upstream bug:
https://github.com/syncthing/syncthing/issues/4286

Upstream fix:
https://github.com/viable-hartman/syncthing/commit/6f44119ab788fe457cf0b0affbe3017618253356

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000420


--1514967409.3cFc70.28522
Date: Wed, 3 Jan 2018 08:16:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074429

            Bug ID: 1074429
           Summary: [20180101] AppArmor cannot be started in Kubic
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AppArmor
          Assignee: suse-beta-at-cboltz.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

With snapshot 20180101, apparmor was updated to version 2.12, which seems to be
responsible for the new openQA failure seen on Tumbleweed Kubic:

apparmor does not get successfully started, as it seems to try to write to
locations it's not supposed to.

The journal shows:

● apparmor.service - Load AppArmor profiles
    Loaded: loaded (/usr/lib/systemd/system/apparmor.service; enabled; vendor
preset: enabled)
    Active: failed (Result: exit-code) since Tue 2018-01-02 17:15:44 UTC; 3min
34s ago
   Process: 461 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited,
status=1/FAILURE)
  Main PID: 461 (code=exited, status=1/FAILURE)
       CPU: 221ms

 Jan 02 17:15:43 localhost apparmor.systemd[461]: mkstemp: Read-only file
system
 Jan 02 17:15:43 localhost apparmor.systemd[461]: Error:
/etc/apparmor.d/usr.lib.dovecot.dovecot-auth failed to load
 Jan 02 17:15:43 localhost apparmor.systemd[461]: mkstemp: Read-only file
system
 Jan 02 17:15:43 localhost apparmor.systemd[461]: Error:
/etc/apparmor.d/usr.lib.dovecot.dovecot-lda failed to load
 Jan 02 17:15:43 localhost apparmor.systemd[461]: mkstemp: Read-only file
system
 Jan 02 17:15:43 localhost apparmor.systemd[461]: Error:
/etc/apparmor.d/usr.lib.dovecot.imap failed to load
 Jan 02 17:15:44 localhost systemd[1]: apparmor.service: Main process exited,
code=exited, status=1/FAILURE
 Jan 02 17:15:44 localhost systemd[1]: Failed to start Load AppArmor profiles.
 Jan 02 17:15:44 localhost systemd[1]: apparmor.service: Unit entered failed
state.
 Jan 02 17:15:44 localhost systemd[1]: apparmor.service: Failed with result
'exit-code'.

https://openqa.opensuse.org/tests/572483#step/journal_check/14


--1514986158.c42D6613.3833
Date: Wed, 3 Jan 2018 13:29:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074487

            Bug ID: 1074487
           Summary: VUL-0: CVE-2017-1000450: opencv: functions FillUniColor and FillUniGray do not check the input length
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197500/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: kde-maintainers-at-suse.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-1000450

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and
FillUniGray do not check the input length, which can lead to integer overflow.
If the image is from remote, may lead to remote code execution or denial of
service. This affects Opencv 3.3 and earlier.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000450
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000450.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000450
https://github.com/opencv/opencv/issues/9723
https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor


--1514994022.AcdfFBB1.8283
Date: Wed, 3 Jan 2018 15:40:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074515

            Bug ID: 1074515
           Summary: Name Service Switch configuration is incorrect
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kubic
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: mkravec-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

If a customer edits /etc/passwd, the edited version in the overlayfs
will shadow the original /etc/passwd and customers would never
see new system users.

Comparing nsswitch.conf on CaaSP and Kubic:

Kubic:
 passwd: compat
 group:  compat

CaaSP:
 passwd: files usrfiles
 group:  files usrfiles

Solution: libnss_usrfiles.so.2, which will look in
/usr/etc/{group,passwd,shadow}


body:
--1515094716.2fE13aA0.29174
Date: Thu, 4 Jan 2018 19:38:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074711

            Bug ID: 1074711
           Summary: desktop file categories broken
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: BuildService
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: axel.braun-at-gmx.de
        QA Contact: adrian-at-suse.com
          Found By: ---
           Blocker: ---

I noticed that a .desktop file with the category definitions
Categories=Science;MedicalSoftware;Biology
does not work, but if I replace it with
Categories=Office;Finance;
it builds w/o problems. Error message:
[   46s] ERROR: No sufficient Category definition:
/home/abuild/rpmbuild/BUILDROOT/gnuhealth-client-3.2.5-8.1.x86_64//usr/share/applications/gnuhealth-client.desktop
[   46s] Please refer to
https://en.opensuse.org/openSUSE:Packaging_desktop_menu_categories

according to the page, all three definitions are correct

summary: desktop file categories broken


body:
Build Identifier:

Whenever launching gvim, I get the following error:

E484: Can't open file /usr/share/vim/vim80/syntax/syntax.vim

The file indeed doesn't exist since it is excluded in the spec file[1] at the
line 471:

%exclude %{_datadir}/vim/%{VIM_SUBDIR}/syntax/syntax.vim

[1]
https://build.opensuse.org/package/view_file/openSUSE:Factory/vim/vim.spec?expand=1

Reproducible: Always

Steps to Reproduce:
1. Install gvim
2. Launch gvim
3. Error happens

summary: Exclusion of syntax.vim in package gvim causing error


--1515164214.ff3e1.25485
Date: Fri, 5 Jan 2018 14:56:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074838

            Bug ID: 1074838
           Summary: wireless-regdb: update to version 2017.12.23
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: mpluskal-at-suse.com
          Reporter: mpluskal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Following changes are part of this:
  * update regulatory database based on preceding changes
  * Document regulatory.db in the manual page
  * Install regulatory.db and regulatory.db.p7s to /lib/firmware
  * Better support for generating public certificates
  * Add sforshee's x509 certificate
  * Restore generation of old format database files
  * regdb: write firmware file format (version code 20)


--1515247153.ccA4f20.24873
Date: Sat, 6 Jan 2018 13:59:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074890

            Bug ID: 1074890
           Summary: [HPC, libraries] Missing dependencies in Library Packages
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

Some HPC library packages are missing dependencies for the *-compilers-hpc and
lua-lmod packages. Others have duplicate requires.
This should be fixed by using the %hpc_requires and %hpc_requires_devel macros.

The present list if packages is:

fftw3
mpich
mvapich2
netcdf-cxx4
openblas
openmpi
openmpi3
papi
petsc
python-numpy


body:
Build Identifier:

On launching the bootloader customiser. The following error occurs.Aegus
Parsing Serialisation error.

Reproducible: Always

Steps to Reproduce:
1.Open yast in GUI mode. Launch bootloader
2.Open YAST in TUI mode. Launch bootloader
3.
Actual Results:
Same error occurs each time

Expected Results:
Ability to access the GRUB customisation screen to ammend boot parameters

summary: Error on upgrade process of bootloader and calling the bootloader customisation through YAST2


--1515300985.bAbB0.9767
Date: Sun, 7 Jan 2018 04:56:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074897

            Bug ID: 1074897
           Summary: [HPC, libraries] Environment Modules Files contain unexpanded RPM Macros
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

In some library packages there are environment module files which contain
unexpanded RPM macros due to misspelling.

The list of packages includes:
openblas
papi
petsc


--1515353591.A0bc2F553.21237
Date: Sun, 7 Jan 2018 19:33:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074919

            Bug ID: 1074919
           Summary: Boot Probleme with Intel Microcode on Core i7 6800K (Broadwell E) and latest Intel microcode
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: andras.fabian@t-online.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After an update on Friday (2017-01-05) to

    kernel : 4.4.104-39.1
    ucode-intel : 20170707-13.1

My computer didn't boot anymore and was hanging in the "loading initial
ramdisk" screen.

After some researching and experimenting, I got the tip to try disabling the
loading of custom microcode with the kernel parameter "dis_ucode_ldr" (which
prevents the loading of any custom ucode)!

As soon as I did this, I could again boot my machine without any problems.

This then brought me the idea, to check what has been updated in the microcode
area, and indeed, there was that latest ucode-intel update: 20170707-13.1

After reverting back to an old ucode-intel (20170511-8.1) - and locking it
until things get fixed - I can normally boot up without the need to use
"dis_ucode_ldr".

--------------------------------

I also checked a little bit, what kind of microcode updates I got. First I
scanned for my CPU ID with iucode_tool:

      iucode_tool: system has processor(s) with signature 0x000406f1

Then looked with iucode_tool what was included in
ucode-intel-20170707-13.1.x86_64.rpm:

      085/001: sig 0x000406f1, pf_mask 0xef, 2017-03-01, rev 0xb000021, size
26624
      085/002: sig 0x000406f1, pf_mask 0xef, 2017-03-01, rev 0xb000021, size
26624
      085/003: sig 0x000406f1, pf_mask 0xef, 2017-11-18, rev 0xb000025, size
27648

Its quite likely, that the latest line (with date 2017-11-18) was / is the
culprit, as it seems to be a relatively new ucode!

But what made me really surprised was, when I checked what the latest -
downloadable - Intel (official) packaes includes which one can download here
https://downloadcenter.intel.com/download/27337/Linux-Processor-Microcode-Data-File
There you get the latest 20171117.tgz .... and this one only offers one ucode
for my CPU:

      089/001: sig 0x000406f1, pf_mask 0xef, 2017-03-01, rev 0xb000021, size
26624

So, obviously there is some confusion on what should be in the current ucode
package ...  Maybe Intel already removed the ucode update for my CPU because
they know that it created some issues? What I also find interesting that the
latest ucode-intel-20170707-13.1.x86_64.rpm with the 2017-11-18 entry seems to
be newer than what is on the official Intel Download.

For the moment it seems that at least my CPU don't boot (or hang) when it gets
treated with the latest ucode. Thus maybe - for now - its better to stay with
an older (but stable) ucode package on CPUs which exhibit these issues.

--------------------------------
My lscpu

Architektur:           x86_64
CPU Operationsmodus:   32-bit, 64-bit
Byte-Reihenfolge:      Little Endian
CPU(s):                16
Liste der Online-CPU(s):0-15
Thread(s) pro Kern:    2
Kern(e) pro Socket:    8
Sockel:                1
NUMA-Knoten:           1
Anbieterkennung:       GenuineIntel
Prozessorfamilie:      6
Modell:                79
Modellname:            Intel(R) Core(TM) i7-6900K CPU @ 3.20GHz
Stepping:              1
CPU MHz:               3700.029
Maximale Taktfrequenz der CPU:4000,0000
Minimale Taktfrequenz der CPU:1200,0000
BogoMIPS:              6399.48
Virtualisierung:       VT-x
L1d Cache:             32K
L1i Cache:             32K
L2 Cache:              256K
L3 Cache:              20480K
NUMA-Knoten0 CPU(s):   0-15
Markierungen:          fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca
cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx
pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology
nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2
ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt
tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch ida arat
invpcid_single pln pts dtherm intel_pt kaiser tpr_shadow vnmi flexpriority ept
vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdseed
adx smap xsaveopt cqm_llc cqm_occup_llc

--------------------------------


--1515382889.6CCb7b1.2533
Date: Mon, 8 Jan 2018 03:41:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1074933

            Bug ID: 1074933
           Summary: susefirewall rules are note applied to ipv6, only to ipv4
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: dan.weatherill-at-cantab.net
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Created attachment 755076
  --> http://bugzilla.opensuse.org/attachment.cgi?id=755076&action=edit
output of iptables --list and ip6tables --list

when configuring allowed services through yast2 ncurses TUI, the rules are only
added to iptables, not to ip6tables.

Attached are the output of "iptables --list" and "ip6tables --list"

e.g. configured NFS server and samba browsing and some custom ports.

The nfs client machine is able to mount an NFS share over ipv4, but not ipv6,
since the service is disallowed.


--1515405732.E1575.15030
Date: Mon, 8 Jan 2018 10:02:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1074988

            Bug ID: 1074988
           Summary: gnuhealth test fails on openQA(openSUSE Leap 15.0 only)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mlin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: axel.braun-at-gmx.de, okurz-at-suse.com
          Found By: ---
           Blocker: ---

Hi Axel,

We have a gnuhealth openqa test running on TW and Leap, the test step basically
follows [1][2], however we see the test failed on Leap but not on TW, as you
can see that at
https://openqa.opensuse.org/tests/575058#step/gnuhealth_setup/9, it fails while
createdb, do you have any idea about this issue? it may be postgresql related,
we are up to postgresql 10 now, but TW has postgresql10 as well and have no
this issue occurred.

[1]
https://build.opensuse.org/package/view_file/openSUSE:Factory/gnuhealth/GNUHealth.README.SUSE?expand=1

[2]
https://openqa.opensuse.org/tests/575058/modules/gnuhealth_setup/steps/1/src


--1515418629.FE605.24705
Date: Mon, 8 Jan 2018 13:37:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1075017

            Bug ID: 1075017
           Summary: VUL-0: CVE-2018-5268: opencv:  In OpenCV 3.3.1, a heap-based buffer overflow happens incv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cppwhen parsing a crafted image file.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197794/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: kde-maintainers-at-suse.de
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-5268

In OpenCV 3.3.1, a heap-based buffer overflow happens in
cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp
when parsing a crafted image file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5268
https://github.com/opencv/opencv/issues/10541


--1515418685.cBEf80.24156
Date: Mon, 8 Jan 2018 13:38:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1075019

            Bug ID: 1075019
           Summary: VUL-0: CVE-2018-5269: opencv: In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos inmodules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/197795/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-5269

In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in
modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5269
https://github.com/opencv/opencv/issues/10540


--1515529196.73beb20.19029
Date: Tue, 9 Jan 2018 20:19:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1075251

            Bug ID: 1075251
           Summary: SUSEfirewall2 IPv6 drop rules on input chains not set correctly
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: andreas.osterburg-at-digide.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 755419
  --> http://bugzilla.suse.com/attachment.cgi?id=755419&action=edit
Fix for the issue.

SuSEfirewall2 usually sets DROP-rules on each input and forward chain (the
latter only when FW_ROUTE is enabled).

For the IPv6-chains it doesn't work. Instead the drop rules are added twice
to the forward chains due to an invalid scope for the variable 'chainprefix'
within function 'drop_all'.

Attached patch fixes this.


--1515573765.6283ECD1.15351
Date: Wed, 10 Jan 2018 08:42:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1075329

            Bug ID: 1075329
           Summary: openSUSE:Factory/rebootmgr fails to build since json-c update
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kubic
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

json-c has been updated to version 0.13 on Jan 09 2017

This in turn breaks rebootmgr from building - and this causes the Kubic DVD to
be unresolvable

A fix is urgently needed (no snapshot build can finish) - or json-c needs to be
reverted (once rebootmgr builds again, I'll promote it to ring2, so it would be
seen pre-integration as well; Kubic staging tests are still missing
unfortunately)


body:
--1515582074.AbAF4BaB3.24594
Date: Wed, 10 Jan 2018 11:01:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1075359

            Bug ID: 1075359
           Summary: Long delay to switch root during boot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 755507
  --> http://bugzilla.suse.com/attachment.cgi?id=755507&action=edit
Timings can be found in the output of the journal

This looks more like a problem with kernel as I see kernel error messages about
tpm and (amd)kfd modules at switch root, the grep through dmesg output shows:

  [   17.942195] tpm_tis 00:04: 1.2 TPM (device-id 0x0, rev-id 78)
  [   17.974398] tpm tpm0: A TPM error (6) occurred attempting to read a pcr
value
  [   17.975009] tpm tpm0: TPM is disabled/deactivated (0x6)
  [   17.975014] tpm tpm0: tpm_read_log_acpi: TCPA log area empty
  [   17.975029] tpm_tis: probe of 00:04 failed with error -5
  [   19.387074] kfd kfd: Initialized module
  [   21.240162] kfd kfd: DID 68f9 is missing in supported_devices
  [   21.240164] kfd kfd: kgd2kfd_probe failed

with lsmod also grepped

  amdkfd                147456  1
  amd_iommu_v2           20480  1 amdkfd
  tpm_tis                16384  0
  tpm_tis_core           20480  1 tpm_tis
  tpm                    65536  2 tpm_tis,tpm_tis_core

the system has an old ATI Radeon HD 5450 graphic card and an Interl i7-2600 CPU

summary: Long delay to switch root during boot