--1663572520.aeDd1.5282
Date: Mon, 19 Sep 2022 07:28:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203507

            Bug ID: 1203507
           Summary: VUL-0: tensorflow-lite: multiple security fixes in tensorflow 2.10.0
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/342676/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: code-at-bnavigator.de
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

Multiple security fixes in tensorflow 2.10.0 [0]:

 - Fixes a CHECK failure in tf.reshape caused by overflows (CVE-2022-35934)
 - Fixes a CHECK failure in SobolSample caused by missing validation
(CVE-2022-35935)
 - Fixes an OOB read in Gather_nd op in TF Lite (CVE-2022-35937)
 - Fixes a CHECK failure in TensorListReserve caused by missing validation
(CVE-2022-35960)
 - Fixes an OOB write in Scatter_nd op in TF Lite (CVE-2022-35939)
 - Fixes an integer overflow in RaggedRangeOp (CVE-2022-35940)
 - Fixes a CHECK failure in AvgPoolOp (CVE-2022-35941)
 - Fixes a CHECK failures in UnbatchGradOp (CVE-2022-35952)
 - Fixes a segfault TFLite converter on per-channel quantized transposed
convolutions (CVE-2022-36027)
 - Fixes a CHECK failures in AvgPool3DGrad (CVE-2022-35959)
 - Fixes a CHECK failures in FractionalAvgPoolGrad (CVE-2022-35963)
 - Fixes a segfault in BlockLSTMGradV2 (CVE-2022-35964)
 - Fixes a segfault in LowerBound and UpperBound (CVE-2022-35965)
 - Fixes a segfault in QuantizedAvgPool (CVE-2022-35966)
 - Fixes a segfault in QuantizedAdd (CVE-2022-35967)
 - Fixes a CHECK fail in AvgPoolGrad (CVE-2022-35968)
 - Fixes a CHECK fail in Conv2DBackpropInput (CVE-2022-35969)
 - Fixes a segfault in QuantizedInstanceNorm (CVE-2022-35970)
 - Fixes a CHECK fail in FakeQuantWithMinMaxVars (CVE-2022-35971)
 - Fixes a segfault in Requantize (CVE-2022-36017)
 - Fixes a segfault in QuantizedBiasAdd (CVE-2022-35972)
 - Fixes a CHECK fail in FakeQuantWithMinMaxVarsPerChannel (CVE-2022-36019)
 - Fixes a segfault in QuantizedMatMul (CVE-2022-35973)
 - Fixes a segfault in QuantizeDownAndShrinkRange (CVE-2022-35974)
 - Fixes segfaults in QuantizedRelu and QuantizedRelu6 (CVE-2022-35979)
 - Fixes a CHECK fail in FractionalMaxPoolGrad (CVE-2022-35981)
 - Fixes a CHECK fail in RaggedTensorToVariant (CVE-2022-36018)
 - Fixes a CHECK fail in QuantizeAndDequantizeV3 (CVE-2022-36026)
 - Fixes a segfault in SparseBincount (CVE-2022-35982)
 - Fixes a CHECK fail in Save and SaveSlices (CVE-2022-35983)
 - Fixes a CHECK fail in ParameterizedTruncatedNormal (CVE-2022-35984)
 - Fixes a CHECK fail in LRNGrad (CVE-2022-35985)
 - Fixes a segfault in RaggedBincount (CVE-2022-35986)
 - Fixes a CHECK fail in DenseBincount (CVE-2022-35987)
 - Fixes a CHECK fail in tf.linalg.matrix_rank (CVE-2022-35988)
 - Fixes a CHECK fail in MaxPool (CVE-2022-35989)
 - Fixes a CHECK fail in Conv2DBackpropInput (CVE-2022-35999)
 - Fixes a CHECK fail in EmptyTensorList (CVE-2022-35998)
 - Fixes a CHECK fail in tf.sparse.cross (CVE-2022-35997)
 - Fixes a floating point exception in Conv2D (CVE-2022-35996)
 - Fixes a CHECK fail in AudioSummaryV2 (CVE-2022-35995)
 - Fixes a CHECK fail in CollectiveGather (CVE-2022-35994)
 - Fixes a CHECK fail in SetSize (CVE-2022-35993)
 - Fixes a CHECK fail in TensorListFromTensor (CVE-2022-35992)
 - Fixes a CHECK fail in TensorListScatter and TensorListScatterV2
(CVE-2022-35991)
 - Fixes a CHECK fail in FakeQuantWithMinMaxVarsPerChannelGradient
(CVE-2022-35990)
 - Fixes a CHECK fail in FakeQuantWithMinMaxVarsGradient (CVE-2022-36005)
 - Fixes a CHECK fail in tf.random.gamma (CVE-2022-36004)
 - Fixes a CHECK fail in RandomPoissonV2 (CVE-2022-36003)
 - Fixes a CHECK fail in Unbatch (CVE-2022-36002)
 - Fixes a CHECK fail in DrawBoundingBoxes (CVE-2022-36001)
 - Fixes a CHECK fail in Eig (CVE-2022-36000)
 - Fixes a null dereference on MLIR on empty function attributes
(CVE-2022-36011)
 - Fixes an assertion failure on MLIR empty edge names (CVE-2022-36012)
 - Fixes a null-dereference in mlir::tfg::GraphDefImporter::ConvertNodeDef
(CVE-2022-36013)
 - Fixes a null-dereference in mlir::tfg::TFOp::nameAttr (CVE-2022-36014)
 - Fixes an integer overflow in math ops (CVE-2022-36015)
 - Fixes a CHECK-fail in tensorflow::full_type::SubstituteFromAttrs
(CVE-2022-36016)
 - Fixes an OOB read in Gather_nd op in TF Lite Micro (CVE-2022-35938)

[0] https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0


--1663658168.7F24b861.25057
Date: Tue, 20 Sep 2022 07:16:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203553

            Bug ID: 1203553
           Summary: VUL-0: CVE-2022-40468: tinyproxy: information leak related to process_request()
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/342909/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-40468

Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the
process_request() function and is using uninitialized buffers. This
vulnerability allows attackers to access sensitive information at system
runtime.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40468
https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346
https://www.cve.org/CVERecord?id=CVE-2022-40468
https://github.com/tinyproxy/tinyproxy
https://github.com/tinyproxy/tinyproxy/issues/457


body:
--1663830167.eB72BbEF0.18390
Date: Thu, 22 Sep 2022 07:02:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203644

            Bug ID: 1203644
           Summary: [Build 20220921] tumbler fails to build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2717124/modules/rist
                    retto/steps/5
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Xfce
          Assignee: bnc-team-xfce-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

After the update to GNOME 43, Tumbler no longer builds
 unresolvable: nothing provides pkgconfig(libgepub-0.6)

libgepub was updated to version 0.7

openQA test in scenario opensuse-Tumbleweed-XFCE-Live-x86_64-xfce-live@uefi-usb
fails in
[ristretto](https://openqa.opensuse.org/tests/2717124/modules/ristretto/steps/5)

## Test suite description
Maintainer: fvogt
Not tested yet, let's see what it does.

## Reproducible

Fails since (at least) Build
[20220921](https://openqa.opensuse.org/tests/2717124) (current job)

## Expected result

Last good: [20220920](https://openqa.opensuse.org/tests/2712705) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=XFCE-Live&machine=uefi-usb&test=xfce-live&version=Tumbleweed)

summary: [Build 20220921] tumbler fails to build


body:
--1663833488.175d1.25947
Date: Thu, 22 Sep 2022 07:58:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203647

            Bug ID: 1203647
           Summary: Postfixadmin shouldn't require apache
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: openSUSE Leap 15.4
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: k.subs.suse@meszaros-szegi.cloud
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Postfixadmin package requires "mod_php_any", which is only provided by apache
packages, when in reality Postfixadmin in itself doesn't even require a
webserver, much less apache!
You could run for example postfixamin behind a reverse proxy, it only needs a
php.
For comparison, https://github.com/postfixadmin/docker has an apache
**version**.
This doesn't specify apache2 as a requirement either:
https://blog.cboltz.de/uploads/postfixadmin-30-english.pdf (it does say you
need a webserver though)
So mod_php_any is nowhere near a runtime requirement of Postfixadmin.
I'd say it is not even a recommended extra infrastructural component (as nginx
seems to be a better **choice**), but that would be tolerable to recommend it.
It's a bit sad especially, that postfixadmin seems to be (or was) developed by
a OpenSUSE community member.

PS: I don't know what is happening these days, but there is a TON of misshappen
requirements and recommendations popping up in packages.
I have a few dozen of package lock to keep the recommended trash at bay (e.g.
opinionated: openldap2 recommends cyrus-sasl), and I also got into the habit of
installing with `--no-recommends` after cancelling the suggested "vanilla"
`zypper in xyz` after reading its proposed changes.
But false positive `zypper verify` errors are another thing (e.g.: if you add a
lock for apache2 and install posfixadmin). No wonder SUSE is not often used for
docker images, even though there is https://microos.opensuse.org/

summary: Postfixadmin shouldn't require apache


--1663857390.cd7aAb0.24016
Date: Thu, 22 Sep 2022 14:36:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203659

            Bug ID: 1203659
           Summary: python310-keyring misses dependency on python310-jaraco.classes
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: wagner-thomas-at-gmx.at
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Just notices that gajim's omemo plugin failed to work on my Tumbleweed.
The reason was, that python310-keyring misses a dependency on
python310-jaraco.classes

Please add the dependency to the python310-keyring package.


--1663935065.25D54520.6661
Date: Fri, 23 Sep 2022 12:11:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203689

            Bug ID: 1203689
           Summary: [tw 20220921] remote-viewer fails to start: libsoup3 symbols detected.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: milsav92-at-outlook.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

remote-viewer fails to start with the following error:

libsoup-ERROR **: 14:07:03.085: libsoup3 symbols detected. Using libsoup2 and
libsoup3 in the same process is not supported.

The problem doesn't exist in the 20220920 snapshot.


--1664146182.8E320.6425
Date: Sun, 25 Sep 2022 22:49:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203727

            Bug ID: 1203727
           Summary: rsync: implicit containing directory sometimes rejected as unrequested
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jimc-at-jfcarter.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 861720
  --> http://bugzilla.opensuse.org/attachment.cgi?id=861720&action=edit
Reproduces the bug in a simplified context.

Versions:
rsync-3.2.6-1.1.x86_64 shows the bug;
rsync-3.2.5-1.1.x86_64 works perfectly.

Command line:
rsync -a --files-from=$j/filesfrom.ls $HOSTNAME:$j/src/ $j/dst/
($j = a temporary directory.)  The source is remote; destination
is local.  The --files-from list contains:
usr/lib/security/pam_runscript.so
usr/lib/security/pam_runscript.so.i586
usr/lib64/mesa/bin/data
usr/lib64/sasl2/cgi-helper
usr/lib64/sasl2/cgi-helper.x86_64
usr/lib64/security/pam_runscript.so
usr/lib64/security/pam_runscript.so.x86_64

It will reliably exude this error message:
    ERROR: rejecting unrequested file-list name: usr/lib64
    rsync error: protocol incompatibility (code 2) at flist.c(998) \
         [Receiver=3.2.6]

rsync has recent work on the file-list plugging CVE-2022-29154.
Workarounds:  A.  Revert to v3.2.5.  B.  Add option --trust-sender
turning off the CVE-2022-29154 fix.  C.  Upstream has fixed the
problem; Wayne Davison points to
https://download.samba.org/pub/rsync/binaries/opensuse-15-x86_64/
for the latest tarball, which fixes the problem in my context.

https://www.mail-archive.com/rsync-at-lists.samba.org/msg33587.html
is my upstream bug report, with outcomes for more variations that
I tried, plus Wayne's reply.

Attaching the reproducer script.


body:
--1664159065.D0d4ec0.17706
Date: Mon, 26 Sep 2022 02:24:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203731

            Bug ID: 1203731
           Summary: [trackerbug] lxd 5.6 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXD 5.6. The full upstream changelog is available from:
  https://discuss.linuxcontainers.org/t/lxd-5-6-has-been-released/15191

  LXD 5.6:
   + Grafana Loki support
   + Object storage on local storage pools
   + Infiniband support for virtual machines
   + Restricted network access in projects
   + instance-ready lifecycle event
   + Metric for total effective CPUs

  LXD 5.5:
   + Storage buckets (on Ceph)
   + Instance Ready state
   + Configurable BGP hold time
   + All projects queries for storage volumes
   + OOM kill counter in metrics
   * Database optimization

  LXD 5.4:
   + Load-balancers (OVN)
   + Bi-directional vsock interface (VM)
   * Changes to vsock API (LXD VMs)

summary: [trackerbug] lxd 5.6 update


--1664175347.EA1C0.1496
Date: Mon, 26 Sep 2022 06:55:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203735

            Bug ID: 1203735
           Summary: virtualbox-guest-tools obsoletes but does not provide virtualbox-guest-x11
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: llrainey15-at-gmail.com
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: Larry.Finger-at-gmail.com
          Found By: ---
           Blocker: ---

Some images still refer to "virtualbox-guest-x11", but that is only provided by
the old package. As virtualbox-guest-tools appears to be a full replacement
FWICT, it needs to to "Provide: virtualbox-guest-x11" as well.

15.3, 15.4 and TW are affected.


--1664278878.EFE71Ad0.16021
Date: Tue, 27 Sep 2022 11:41:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203791

            Bug ID: 1203791
           Summary: quilt setup breaks with default --fast option
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: filippo.bonazzi-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Working on security:SELinux/selinux-policy I observed that the normal workflow

```
quilt setup selinux-policy.spec
cd <PATCHES_FOLDER>
quilt push -a
```

now fails to apply an unchanged patch that was previously working
(fix_cron.patch). This breaks the patch series.

After some investigation we noticed that adding the `--slow` flag to the quilt
setup invocation makes the patch series apply cleanly. Sure enough, quilt 0.67
changed the default setup from slow to fast mode.

Why would quilt setup in fast mode break the patch series?


--1664302060.e063E321.25654
Date: Tue, 27 Sep 2022 18:07:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203808

            Bug ID: 1203808
           Summary: VUL-0: chromium: multiple security issues fixed in 106.0.5249.61
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html

  * CVE-2022-3304: Use after free in CSS
  * CVE-2022-3201: Insufficient validation of untrusted input in Developer
Tools
  * CVE-2022-3305: Use after free in Survey
  * CVE-2022-3306: Use after free in Survey
  * CVE-2022-3307: Use after free in Media
  * CVE-2022-3308: Insufficient policy enforcement in Developer Tools
  * CVE-2022-3309: Use after free in Assistant
  * CVE-2022-3310: Insufficient policy enforcement in Custom Tabs
  * CVE-2022-3311: Use after free in Import
  * CVE-2022-3312: Insufficient validation of untrusted input in VPN
  * CVE-2022-3313: Incorrect security UI in Full Screen
  * CVE-2022-3314: Use after free in Logging
  * CVE-2022-3315: Type confusion in Blink
  * CVE-2022-3316: Insufficient validation of untrusted input in Safe Browsing
  * CVE-2022-3317: Insufficient validation of untrusted input in Intents
  * CVE-2022-3318: Use after free in ChromeOS Notifications


--1664349225.6dF181.6759
Date: Wed, 28 Sep 2022 07:13:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203824

            Bug ID: 1203824
           Summary: [SELinux] chrony NetworkManager AVC denials
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

I was playing around with the ALP prototype 0.0.1 and I stumbled over these avc
denials in the policy version 20220714-6.2 in enforcing mode upon boot:

----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.626:65): avc:  denied  { write } for  pid=1017
comm="mkdir" name="chrony" dev="tmpfs" ino=967
scontext=system_u:system_r:NetworkManager_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=dir permissive=0
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.662:67): avc:  denied  { execute } for  pid=1028
comm="20-chrony" name="chronyc" dev="vda3" ino=1084
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyc_exec_t:s0 tclass=file permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.662:68): avc:  denied  { read open } for
pid=1028 comm="20-chrony" path="/usr/bin/chronyc" dev="vda3" ino=1084
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyc_exec_t:s0 tclass=file permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.662:69): avc:  denied  { execute_no_trans } for
pid=1028 comm="20-chrony" path="/usr/bin/chronyc" dev="vda3" ino=1084
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyc_exec_t:s0 tclass=file permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:70): avc:  denied  { dac_read_search } for
pid=1028 comm="chronyc" capability=2
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tclass=capability permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:71): avc:  denied  { dac_override } for
pid=1028 comm="chronyc" capability=1
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tclass=capability permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:72): avc:  denied  { write } for  pid=1028
comm="chronyc" name="chrony" dev="tmpfs" ino=967
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=dir permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:73): avc:  denied  { add_name } for  pid=1028
comm="chronyc" name="chronyc.1028.sock"
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=dir permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:74): avc:  denied  { create } for  pid=1028
comm="chronyc" name="chronyc.1028.sock"
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=sock_file permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:75): avc:  denied  { setattr } for  pid=1028
comm="chronyc" name="chronyc.1028.sock" dev="tmpfs" ino=1141
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=sock_file permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:76): avc:  denied  { write } for  pid=1028
comm="chronyc" name="chronyd.sock" dev="tmpfs" ino=1074
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=sock_file permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:77): avc:  denied  { sendto } for  pid=1028
comm="chronyc" path="/run/chrony/chronyd.sock"
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:system_r:chronyd_t:s0 tclass=unix_dgram_socket permissive=1
----
time->Wed Sep 28 09:05:24 2022
type=AVC msg=audit(1664348724.666:78): avc:  denied  { sendto } for  pid=828
comm="chronyd" path="/run/chrony/chronyc.1028.sock"
scontext=system_u:system_r:chronyd_t:s0
tcontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tclass=unix_dgram_socket permissive=0
----
time->Wed Sep 28 09:05:25 2022
type=AVC msg=audit(1664348725.666:79): avc:  denied  { sendto } for  pid=828
comm="chronyd" path="/run/chrony/chronyc.1028.sock"
scontext=system_u:system_r:chronyd_t:s0
tcontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tclass=unix_dgram_socket permissive=0
----
time->Wed Sep 28 09:05:27 2022
type=AVC msg=audit(1664348727.666:83): avc:  denied  { sendto } for  pid=828
comm="chronyd" path="/run/chrony/chronyc.1028.sock"
scontext=system_u:system_r:chronyd_t:s0
tcontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tclass=unix_dgram_socket permissive=0
----
time->Wed Sep 28 09:05:31 2022
type=AVC msg=audit(1664348731.671:84): avc:  denied  { write } for  pid=1028
comm="chronyc" name="chrony" dev="tmpfs" ino=967
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=dir permissive=1
----
time->Wed Sep 28 09:05:31 2022
type=AVC msg=audit(1664348731.671:85): avc:  denied  { remove_name } for
pid=1028 comm="chronyc" name="chronyc.1028.sock" dev="tmpfs" ino=1141
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=dir permissive=1
----
time->Wed Sep 28 09:05:31 2022
type=AVC msg=audit(1664348731.671:86): avc:  denied  { unlink } for  pid=1028
comm="chronyc" name="chronyc.1028.sock" dev="tmpfs" ino=1141
scontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0
tcontext=system_u:object_r:chronyd_var_run_t:s0 tclass=sock_file permissive=1

Can be reproduced with:
sudo systemctl restart NetworkManager


--1664371640.8BAaE00.24680
Date: Wed, 28 Sep 2022 13:27:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203847

            Bug ID: 1203847
           Summary: Updating to systemd-251.4-3.1 throws additional rpm output "Too few arguments".
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: paul.pgp-7-at-gmx.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

On both of my two TW systems when performing a "zypper dup" 20220921 ->
20220926 when installing "systemd-251.4-3.1" additional rpm output indicates
"Too few arguments"

# 2022-09-28 13:59:21 systemd-251.4-3.1.x86_64.rpm installed ok
# Additional rpm output:
# Too few arguments.
#
2022-09-28
13:59:21|install|systemd|251.4-3.1|x86_64||repo-oss|7c696173a1c08d2ae8d9e5db3b3ef9c5073da27d2c2d2a0326ea682c07c3b00a|

paul@Orion-15:~$ rpm -q rpm-config-SUSE
rpm-config-SUSE-20220421-2.1.noarch
paul@Orion-15:~$


body:
--1664375956.EEe80.5129
Date: Wed, 28 Sep 2022 14:39:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203850

            Bug ID: 1203850
           Summary: ARM JeOS images use wrong console font
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: guillaume.gardet-at-opensuse.org
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The default console font is eurlatgr, but that is not set in JeOS'
/etc/vconsole.conf. This is visible in the jeos-firstboot license dialog:

https://openqa.opensuse.org/tests/2757706#step/firstrun/6

shows "openSUSER Leap" instead of "openSUSE? Leap".

Also affects TW: https://openqa.opensuse.org/tests/2750582#step/firstrun/6
15.3 is not affected: https://openqa.opensuse.org/tests/2757598#step/firstrun/5

summary: ARM JeOS images use wrong console font


body:
--1664540029.f0ADAC20.888
Date: Fri, 30 Sep 2022 12:13:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203934

            Bug ID: 1203934
           Summary: cannot install cockpit-machines
    Classification: openSUSE
           Product: openSUSE Leap Micro
           Version: 5.3
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2753195
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Patterns
          Assignee: lubos.kocman-at-suse.com
          Reporter: mloviska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: jalausuch-at-suse.com
        Depends on: 1202569
          Found By: openQA
           Blocker: ---

Issue should have already been solved by SR#998260 [1] and looks like the
requirements of daemon-driver-qemu are set correctly. [2]

```
2022-09-29 18:20:05 Options: callext 2 zypper -R {} install cockpit
cockpit-wicked cockpit-machines cockpit-tukit
2022-09-29 18:20:05 Executing `zypper -R /.snapshots/2/snapshot install cockpit
cockpit-wicked cockpit-machines cockpit-tukit`:
Loading repository data...
Reading installed packages...
Package 'cockpit-wicked' not found.
Resolving package dependencies...

Problem: the to be installed cockpit-machines-249.1-150400.2.1.noarch requires
'libvirt-daemon-qemu', but this requirement cannot be provided
  not installable providers:
libvirt-daemon-qemu-8.0.0-150400.5.8.x86_64[repo-main]
 Solution 1: deinstallation of busybox-gzip-1.34.1-150400.2.23.noarch
 Solution 2: do not install cockpit-machines-249.1-150400.2.1.noarch
 Solution 3: break cockpit-machines-249.1-150400.2.1.noarch by ignoring some of
its dependencies

Choose from above solutions by number or cancel [1/2/3/c/d/?] (c):
```

The test has detected usage of wicked instead of NetworkManager which diverges
with SLEM 5.3. Therefore tries to pull *cockpit-wicked*

```
Package 'cockpit-wicked' not found.
```

[1] https://build.opensuse.org/request/show/998260
[2]
https://build.opensuse.org/package/view_file/openSUSE/libvirt/libvirt.spec?expand=1

summary: cannot install cockpit-machines


--1664572570.2CBfDE60.21535
Date: Fri, 30 Sep 2022 21:16:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203945

            Bug ID: 1203945
           Summary: systemd-rpm-macros: syntax error in %tmpfiles_create_package()
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I tried %tmpfiles_create_package in my latest package

> Sep 30 23:07:23 apollon.suse.de [RPM][19156]: scriptlet %prein(multipath-tools-0.9.1+61+suse.5a0a5cd-6.1.x86_64) failure: 2
> Sep 30 23:07:23 apollon.suse.de [RPM][19156]: install multipath-tools-0.9.1+61+suse.5a0a5cd-6.1.x86_64: failure

> if [ -z "${TRANSACTIONAL_UPDATE}" ]; then
>         /usr/bin/systemd-tmpfiles --replace=/usr/lib/tmpfiles.d/multipath-tools.conf --create - <<SYSTEMD_INLINE_EOF || :
> # Make sure the tmpfiles entry exists in initramfs already
> install_items+=" @TMPFILESDIR@/multipath-tools.conf "
> SYSTEMD_INLINE_EOF
> %fi
> ^ problem is this '%'

Introduced with this change:

* Thu May 20 2021 Franck Bui <fbui-at-suse.com>
- Introduce %sysusers_create_package
  %sysusers_create and %sysusers_create_inline are now deprecated and
  the new macro should be used instead.
  Upstream commit 07a7d4a0040d221ff09e527e91c112b4ffab1dba.
- Introduce %tmpfiles_create_package
  %%tmpfiles_create is now deprecreated and the new macros should be
  used instead.
  Upstream commit 0f78fee8d039000b987848a558fbaa15d916e14e.


--1664655394.C6F50.25625
Date: Sat, 1 Oct 2022 20:16:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203949

            Bug ID: 1203949
           Summary: Updating to Mesa*22.2.0 makes videos have corrupted colors in Firefox
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: factory-mozilla-at-lists.opensuse.org
          Reporter: a.samirh78-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Downgrading to Mesa*21.1.7 fixes the issue.

This is with a GTX770 nvidia card, using nouveau and the modesetting driver.

Disabling hw acceleration in Firefox also fixes the issue (which means that
WebRender software doesn't have the problem, but performance is too bad).


--1664734313.c6f52d1.4859
Date: Sun, 2 Oct 2022 18:11:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203952

            Bug ID: 1203952
           Summary: VUL-0: cacti: cross-site injection when creating new graphs
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

It was discovered that in cacti before 1.2.22, creating new graphs, cross site
injection is possible.

References:
https://github.com/Cacti/cacti/commit/8e7bc5d76a6d247628299e64a60591af514530f0
https://github.com/Cacti/cacti/commit/ccb8b62de0f27f59d5e6073c2ae577a9ca7adaf8
https://github.com/Cacti/cacti/issues/4834


--1664873331.B8a64D608.25846
Date: Tue, 4 Oct 2022 08:48:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203995

            Bug ID: 1203995
           Summary: File conflict between qemu and qemu-guest-agent: /usr/share/doc/packages/qemu/interop/qemu-ga.html
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: dheidler-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: li.zhang-at-suse.com
          Found By: ---
           Blocker: ---

https://openqa.opensuse.org/tests/2773213#step/openqa_worker/3


--1664881498.1e2EAC0.10625
Date: Tue, 4 Oct 2022 11:04:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204001

            Bug ID: 1204001
           Summary: qemu-linux-user 7.1 regression with glibc 2.36
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Qemu 7.1 dropped the linux/fs.h includes which broke a lot of essential ioctl
emulations in qemu-linux-user, as they were ifdef'ed but the condition it is
testing against is no longer defined.

this was reported by Andreas upstream here:

https://lists.nongnu.org/archive/html/qemu-devel/2022-10/msg00091.html

and let to this patch series which fixes it up:

https://lists.gnu.org/archive/html/qemu-devel/2022-10/msg00351.html

would be nice to include that in tumbleweed asap as the 7.1.0 update is now no
longer able to build any package on emulated architectures as the post-build
step is leveraging FIGETBSZ which leads to errors like:

[  786s] ... saving built packages
[  787s] RPMS/riscv64/apache2-debuginfo-2.4.54-7.1.riscv64.rpm
[  787s] RPMS/riscv64/apache2-debuginfo-2.4.54-7.1.riscv64.rpm: FIGETBSZ
failed: Function not implemented


--1664908934.E638b0.978
Date: Tue, 4 Oct 2022 18:42:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204019

            Bug ID: 1204019
           Summary: VBoxClient: VbglR3InitUser failed: VERR_ACCESS_DENIED
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: richlv-at-nakts.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Upon startup, error is displayed in xmessage:

VBoxClient: VbglR3InitUser failed: VERR_ACCESS_DENIED

There might be other effects, but one is that shared clipboard does not work.

The processlist shows:

root       636  0.0  0.0  86744  1456 ?        Ss   21:09   0:00
/usr/bin/VBoxDRMClient
root       936  0.0  0.0 291712  3308 ?        Sl   21:09   0:00
/usr/sbin/VBoxService --pidfile /var/run/vboxadd-service.sh
rich      1272  0.0  0.0   7200  3472 ?        S    21:09   0:00
/bin/sh /etc/X11/xinit/xinitrc.d/98vboxadd-xclient
rich      1284  0.0  0.0  15420  4220 ?        S    21:09   0:00
/usr/bin/VBoxClient --clipboard
rich      1715  0.0  0.0   9240  4992 ?        S    21:09   0:00
xmessage -buttons OK:0 -center VBoxClient: VbglR3InitUser failed:
VERR_ACCESS_DENIED
rich      1281  0.0  0.0   7200  3412 ?        S    21:09   0:00
/bin/sh /etc/X11/xinit/xinitrc.d/98vboxadd-xclient.sh
rich      1713  0.0  0.0  15420  4020 ?        S    21:09   0:00
/usr/bin/VBoxClient --checkhostversion
rich      1726  0.0  0.0   9240  4840 ?        S    21:09   0:00
xmessage -buttons OK:0 -center VBoxClient: VbglR3InitUser failed:
VERR_ACCESS_DENIED
rich      1651  0.0  0.0   7652  3728 ?        Ss   21:09   0:00     /bin/sh
/usr/bin/VBoxClient-all
rich      1658  0.0  0.0  15420  4220 ?        S    21:09   0:00
/usr/bin/VBoxClient --clipboard
rich      1717  0.0  0.0   9240  4940 ?        S    21:09   0:00
xmessage -buttons OK:0 -center VBoxClient: VbglR3InitUser failed:
VERR_ACCESS_DENIED

Closing all xmessage windows results in the VBoxClient processes dying.


--1664922042.b4EAA0.11394
Date: Tue, 4 Oct 2022 22:20:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204026

            Bug ID: 1204026
           Summary: AUDIT-0: fwupd: review of 2 new polkit-untracked-privilege - fwupd version 1.8.5
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: bjorn.lie-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

New update of fwupd brings new privs - please review.

fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.fwupd.get-bios-settings (auth_admin:no:auth_admin_keep)
fwupd.x86_64: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.fwupd.set-bios-settings (auth_admin:no:auth_admin)

Updated package can be found in
https://build.opensuse.org/package/show/home:iznogood:branches:Base:System/fwupd

aka branch of Base:System/fwupd

Upstream git

https://github.com/fwupd/fwupd


--1664977369.B3E21.20236
Date: Wed, 5 Oct 2022 13:42:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204052

            Bug ID: 1204052
           Summary: AUDIT-WHITELIST: gdm: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Move /etc/dbus-1/system.d/gdm.conf to /usr/share/dbus-1/system.d/gdm.conf

Devel prj: GNOME:Factory
Maint: GNOME


--1664977568.CaB1D1D81.20965
Date: Wed, 5 Oct 2022 13:46:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204054

            Bug ID: 1204054
           Summary: AUDIT-WHITELIST: geoclue2: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Multi move of /etc to /usr:
* org.freedesktop.GeoClue2.conf
* org.freedesktop.GeoClue2.Agent.conf

Devel prj: Application:Geo
Maint: GNOME


--1664977689.12Be1.29809
Date: Wed, 5 Oct 2022 13:48:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204055

            Bug ID: 1204055
           Summary: AUDIT-WHITELIST: iio-sensor-proxy: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Move /etc/dbus-1/system.d/net.hadess.SensorProxy.conf to
/usr/share/dbus-1/system.d/net.hadess.SensorProxy.conf

Devel prj: hardware
Maint: GNOME


body:
--1664993894.83600884.25586
Date: Wed, 5 Oct 2022 18:18:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204071

            Bug ID: 1204071
           Summary: gnome-keyring missing dependencies
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: jeffm-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After doing a zypper dup this morning, I get:

Oct 05 13:23:25 nuc gnome-keyring-daemon[5800]: the /usr/bin/ssh-add command
failed: Child process exited with code 1
Oct 05 13:23:25 nuc gnome-keyring-daemon[5800]: ssh_askpass:
exec(/usr/libexec/gcr-ssh-askpass): No such file or directory

gnome-keyring requires libgcr-base-3.so.1()(64bit) but nothing requires
gcr3-ssh-askpass.

libgcr-3-1-3.41.0 *recommends* gcr3-ssh-askpass, which makes sense since it's
not strictly required by it.  It *is* required by gnome-keyring, though.

gcr-ssh-askpass installs /usr/libexec/gcr4-ssh-askpass so gnome-keyring won't
use it.

summary: gnome-keyring missing dependencies


--1665061652.fd0BDC180.31229
Date: Thu, 6 Oct 2022 13:07:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204082

            Bug ID: 1204082
           Summary: guests with qemu 7.1.0 hang when using iothread and aio=io_uring
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KVM
          Assignee: kvm-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

doing osc build --vm-type=kvm on tumbleweed (5.19.13) with qemu 7.1.0 hangs in
the guest kernel bootup on modprobing virtio_blk:

[    1.119181] dracut-pre-udev[268]:
///lib/dracut/hooks/pre-udev/10-setup_obs.sh@44(source): modprobe -q
virtio_mmio
[    1.121893] dracut-pre-udev[268]:
///lib/dracut/hooks/pre-udev/10-setup_obs.sh@45(source): info '  virtio_blk'
[    1.122015] dracut-pre-udev[268]: //lib/dracut-lib.sh@89(info): echo '
virtio_blk'
[    1.122107] dracut-pre-udev[268]:
///lib/dracut/hooks/pre-udev/10-setup_obs.sh@46(source): modprobe -q virtio_blk

the problem goes away when disabling *either* iothreads or aio=io_uring, or
when downgrading qemu to 7.0.

I am not able to spot anything obvious in the gdb of qemu. any idea how to
debug it?


--1665067490.3cDAd0.11656
Date: Thu, 6 Oct 2022 14:44:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204085

            Bug ID: 1204085
           Summary: spice-vdagentd 0.22.1 doesn't work properly on guest
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KVM
          Assignee: kvm-bugs-at-suse.de
          Reporter: paolo.perego-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Today I upgraded my qemu/kvm guest Tumbleweed installation to latest snapshot.
After the reboot, the KDE desktop environment doesn't resize anymore
accorgingly to host window geometry.

Checking spice-vdagentd daemon it appeared to be inactive on every reboot.


--1665086080.ae063FaA0.13907
Date: Thu, 6 Oct 2022 19:54:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204103

            Bug ID: 1204103
           Summary: error: unpacking of archive failed on file /usr/lib/firmware/qcom/LENOVO/21BX;633f2acf: cpio: File from package already exists as a directory in system
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jshand2013-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

error: unpacking of archive failed on file
/usr/lib/firmware/qcom/LENOVO/21BX;633f2acf: cpio: File from package already
exists as a directory in system
error: kernel-firmware-qcom-20220930-1.1.noarch: install failed
error: kernel-firmware-qcom-20220902-1.1.noarch: erase skipped
( 82/133) Installing: kernel-firmware-qcom-20220930-1.1.noarch
...............................................................[error]
Installation of kernel-firmware-qcom-20220930-1.1.noarch failed:
Error: Subprocess failed. Error: RPM failed: Command exited with status 1.


--1665143001.E8BccE4.13039
Date: Fri, 7 Oct 2022 11:43:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204138

            Bug ID: 1204138
           Summary: Default openSUSE wallpaper is not present in dark mode
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: milachew-at-mail.lv
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 862028
  --> http://bugzilla.opensuse.org/attachment.cgi?id=862028&action=edit
GNOME Control Center

Details : in gnome-control-center default wallpaper isn't present in dark mode.
After choose dark mode, wallpaper dissapear. User need to manually choose
present wallpaper to fix it.

Fixing : after trying to fix the problem for some time, it was discovered that
if you put the wallpaper on the path /usr/share/backgrounds/gnome/ and rename
it to adwaita-d.webp, the problem is solved.

And so, to fix it, I suggest :
- or create a patch for rewrite default path of wallpaper
- or add package "gnome-backgrounds" as Recommends for patterns-gnome. This
action add "adwaita-d.webp", so, problem will be resolved for user, who use
default GNOME setup without customize set of packages. In my humble opinion,
this is the best solution.


--1665190048.CAfFAf0d0.19870
Date: Sat, 8 Oct 2022 00:47:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204151

            Bug ID: 1204151
           Summary: VirtualBox: Location of variable-length array in middle of struct breaks build with kernel v6.0 headers
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: Larry.Finger-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

One of the VirtualBox structs has a variable-length member in the middle. This
layout is suspect, but generates a compile error when building against kernel
6.0.0 headers. See https://build.opensuse.org/request/show/1007740


body:
--1665242909.ce250.5171
Date: Sat, 8 Oct 2022 15:28:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204157

            Bug ID: 1204157
           Summary: Plank not working properly on Pantheon
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pemex44-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 862047
  --> http://bugzilla.opensuse.org/attachment.cgi?id=862047&action=edit
Output gotten from running Plank from shell

Plank takes a long time to load. Pantheon session starts as usual but Plank
takes a long time to load. Once it does, it doesn't show opened apps, it only
shows pinned apps. If a pinned app is already opened, clicking its icon on
Plank opens a new instance.

This behavior started after Tumbleweed's last update.

I've attached the output I get when launching plank from shell

summary: Plank not working properly on Pantheon


body:
--1665517362.1EEaC25E0.17284
Date: Tue, 11 Oct 2022 19:42:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204214

            Bug ID: 1204214
           Summary: kdump fails to build for riscv64
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

kdump fails to build for riscv64 in tumbleweed and SUSE:ALP:

[  355s] [  3%] Building C object
calibrate/CMakeFiles/mkelfcorehdr.dir/mkelfcorehdr.c.o
[  355s] cd
/home/abuild/rpmbuild/BUILD/kdump-1.0.2+git19.g0c60ffb/build/calibrate &&
/usr/bin/cc -D_FILE_OFFSET_BITS=64
-I/home/abuild/rpmbuild/BUILD/kdump-1.0.2+git19.g0c60ffb/build
-I/usr/include/libmount -I/usr/include/blkid -O2 -Wall -U_FORTIFY_SOURCE
-D_FORTIFY_SOURCE=3 -fstack-protector-strong -funwind-tables
-fasynchronous-unwind-tables -fstack-clash-protection -Werror=return-type
-flto=auto -g -O2 -g -DNDEBUG   -Wall -W -Wno-unused-parameter -MD -MT
calibrate/CMakeFiles/mkelfcorehdr.dir/mkelfcorehdr.c.o -MF
CMakeFiles/mkelfcorehdr.dir/mkelfcorehdr.c.o.d -o
CMakeFiles/mkelfcorehdr.dir/mkelfcorehdr.c.o -c
/home/abuild/rpmbuild/BUILD/kdump-1.0.2+git19.g0c60ffb/calibrate/mkelfcorehdr.c
[  355s]
/home/abuild/rpmbuild/BUILD/kdump-1.0.2+git19.g0c60ffb/calibrate/mkelfcorehdr.c:52:3:
error: #error "Unimplemented architecture!"
[  355s]    52 | # error "Unimplemented architecture!"
[  355s]       |   ^~~~~
[  355s]
/home/abuild/rpmbuild/BUILD/kdump-1.0.2+git19.g0c60ffb/calibrate/mkelfcorehdr.c:
In function 'write_elfcorehdr':
[  355s]
/home/abuild/rpmbuild/BUILD/kdump-1.0.2+git19.g0c60ffb/calibrate/mkelfcorehdr.c:85:30:
error: 'ELF_MACHINE' undeclared (first use in this function)
[  355s]    85 |                 .e_machine = ELF_MACHINE,
[  355s]       |                              ^~~~~~~~~~~
[  355s]
/home/abuild/rpmbuild/BUILD/kdump-1.0.2+git19.g0c60ffb/calibrate/mkelfcorehdr.c:85:30:
note: each undeclared identifier is reported only once for each function it
appears in

summary: kdump fails to build for riscv64


--1665555132.DCDCA1.16712
Date: Wed, 12 Oct 2022 06:12:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204223

            Bug ID: 1204223
           Summary: VUL-0: chromium: multiple security issues fixed in 106.0.5249.119
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: rfrohl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: security-team-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2022-3445: Use after free in Skia. Reported by Nan Wang (@eternalsakura13)
and Yong Liu of 360 Vulnerability Research Institute on 2022-09-16
CVE-2022-3446: Heap buffer overflow in WebSQL. Reported by Kaijie Xu
(@kaijieguigui) on 2022-09-26
CVE-2022-3447: Inappropriate implementation in Custom Tabs. Reported by
Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India) on 2022-09-22
CVE-2022-3448: Use after free in Permissions API. Reported by raven at KunLun
lab on 2022-09-13
CVE-2022-3449: Use after free in Safe Browsing. Reported by asnine on
2022-09-17
CVE-2022-3450: Use after free in Peer Connection. Reported by Anonymous on
2022-09-30

https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html


--1665567582.3d3E1.11337
Date: Wed, 12 Oct 2022 09:39:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204232

            Bug ID: 1204232
           Summary: VUL-0: CVE-2022-21797: python-joblib: Arbitrary Code Execution in joblib
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/343589/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2129823

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code
Execution via the pre_dispatch flag in Parallel() class due to the eval()
statement.

https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
https://github.com/joblib/joblib/issues/1128
https://github.com/joblib/joblib/pull/1321
https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2129823
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21797
https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
https://github.com/joblib/joblib/issues/1128
http://www.cvedetails.com/cve/CVE-2022-21797/
https://github.com/joblib/joblib/pull/1321
https://www.cve.org/CVERecord?id=CVE-2022-21797
https://security.snyk.io/vuln/SNYK-PYTHON-JOBLIB-3027033
https://lists.fedoraproject.org/archives/list/package-announce-at-lists.fedoraproject.org/message/BVOMMW37OXZWU2EV5ONAAS462IQEHZOF/


--1665567751.7DC8E60.30537
Date: Wed, 12 Oct 2022 09:42:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204233

            Bug ID: 1204233
           Summary: Virtualbox 6.1.40 is available (new version)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
               URL: https://www.virtualbox.org/wiki/Changelog-6.1#v40
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: jayjayjazz-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

VirtualBox 6.1.40 (released October 11 2022)

This is a maintenance release. The following items were fixed and/or added:

- GUI: Fixed missed machine-items state translation on language change
- USB: Fixed possible crash when the device got detached while the controller
is resetting the port
- Main: Provide guest's absolute pointing mouse device with buttons state when
mouse integration is ON
- Linux Host and Guest Additions: Prevented build failure on 5.8+ 32-bit
kernels
- Linux Host and Guest Additions: Introduced additional fixes for kernel 6.0
- Linux Host and Guest Additions: Introduced additional fixes for Debian
specific kernels
- Solaris and Linux Guest Additions: Added better handling of negative screen
sizes which some X11 desktop environments are reporting
- Windows Guest Additions: Added fixes related to VBoxTray IPC


--1665645742.13Ab00.11206
Date: Thu, 13 Oct 2022 07:22:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204259

            Bug ID: 1204259
           Summary: dino fails to start with libsoup3 symbols detected. Using libsoup2 and libsoup3 in the same process is not supported.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: sebix+novell.com-at-sebix.at
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Tumbleweed 20221008
dino version dino-0.3.0-1.5.src

$ dino

(dino:7315): libsoup-ERROR **: 09:21:13.964: libsoup3 symbols detected. Using
libsoup2 and libsoup3 in the same process is not supported.
Trace/breakpoint trap (core dumped)

gajim has the same issue:
https://bugzilla.opensuse.org/show_bug.cgi?id=1203676


body:
--1665652811.4DAED0b20.14010
Date: Thu, 13 Oct 2022 09:20:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204267

            Bug ID: 1204267
           Summary: Plasmashell crashes on armv7
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: armv7
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 862142
  --> http://bugzilla.opensuse.org/attachment.cgi?id=862142&action=edit
journal.log

Plasmashell crashes on armv7 since snapshot 20221006.

Oct 13 04:54:05 localhost.localdomain plasmashell[2046]: QFont::setPointSizeF:
Point size <= 0 (0.000000), must be greater than 0
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]: LLVM ERROR: Cannot
select: 0x3003d38: v4i32 = ARMISD::VCMPZ 0x2f64940, Constant:i32<2>
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]:   0x2f64940: v4i32,ch
= ARMISD::VLD1DUP<(load (s32) from %ir.326)> 0x2fcdea8, 0x2fb0848,
Constant:i32<4>
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]:     0x2fb0848: i32 =
add 0x3006648, Constant:i32<64>
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]:       0x3006648:
i32,ch = CopyFromReg 0x2e4bf5c, Register:i32 %35
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]:         0x2fed080: i32
= Register %35
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]:       0x2e65f08: i32 =
Constant<64>
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]:     0x2fd93c0: i32 =
Constant<4>
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]:   0x2fd9690: i32 =
Constant<2>
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]: In function:
fs_variant_partial
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]: KCrash: Application
'plasmashell' crashing...
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]: KCrash: Attempting to
start /usr/libexec/drkonqi
Oct 13 04:54:06 localhost.localdomain plasmashell[2077]: libEGL warning: DRI2:
failed to authenticate
Oct 13 04:54:06 localhost.localdomain kded5[1600]: Service
"org.kde.StatusNotifierHost-2046" unregistered
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]: Unable to start Dr.
Konqi
Oct 13 04:54:06 localhost.localdomain plasmashell[2046]: Re-raising signal for
core dump handling.
Oct 13 04:54:06 localhost.localdomain systemd[1284]:
plasma-plasmashell.service: Main process exited, code=dumped, status=6/ABRT

summary: Plasmashell crashes on armv7


--1665671736.Ad6337e82.7801
Date: Thu, 13 Oct 2022 14:35:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204284

            Bug ID: 1204284
           Summary: VUL-0: CVE-2022-42889: apache-commons-text: code execution when processing untrusted input due to insecure interpolation defaults
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/344987/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: fstrba-at-suse.com
          Reporter: carlos.lopez-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-42889

Posted by Gary D. Gregory on Oct 13Severity: important

Description:

Apache Commons Text performs variable interpolation, allowing properties to be
dynamically evaluated and expanded. The
standard format for interpolation is "${prefix:name}", where "prefix" is used
to locate an instance of
org.apache.commons.text.lookup.StringLookup that performs the interpolation.
Starting with version 1.5 and continuing
through 1.9, the set of default Lookup instances...

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-42889
https://seclists.org/oss-sec/2022/q4/22


body:
Build Identifier:

matrix-synapse doesn't start if the package is built with python-poetry-core
1.3.x and if the url_preview feature is enabled. See
https://github.com/matrix-org/synapse/issues/14079 for details.

I worked around the problem by editing
/usr/lib/python3.10/site-packages/synapse/config/repository.py. I replaced
check_requirements("url_preview") with check_requirements("url-preview").

Reproducible: Always

Steps to Reproduce:
1. Add "url_preview_enabled: true" and "url_preview_ip_range_blacklist" to
/etc/matrix-synapse/homeserver.yaml in as described in
https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#url_preview_enabled
2. Restart the Matrix server with "systemctl restart matrix-synapse.service".
3. Check the log with "journalctl -b -u matrix-synapse".
Actual Results:
The matrix-synapse service fails to start and writes "ValueError: Synapse
1.67.0 does not provide the feature 'url_preview'" to the log.

Expected Results:
The matrix-synapse service starts.

summary: matrix-synapse doesn't start if url_preview is enabled


body:
--1665791721.6bfF4f0.9873
Date: Fri, 14 Oct 2022 23:55:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204331

            Bug ID: 1204331
           Summary: Redirecting USB device crashes guest
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: opensuse-at-trummer.xyz
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Operating System: openSUSE Tumbleweed 20221013
KDE Plasma Version: 5.26.0
KDE Frameworks Version: 5.99.0
Qt Version: 5.15.6
Kernel Version: 6.0.0-1-default (64-bit)
Graphics Platform: X11
Processors: 24 ? AMD Ryzen 9 3900X 12-Core Processor
Memory: 31.3 GiB of RAM
Graphics Processor: AMD Radeon RX 570 Series

VirtualBox version: 6.1.38

Redirecting a USB device to the guest crashes it.
Extension pack with matching version (6.1.38) is installed.
Tested with Win11 and Win7 guests and all virtual USB controller versions (1.1,
2.0, 3.0)

Kernel log:
[ 3321.004949] EMT-0[11855]: segfault at 0 ip 00007fcc17580527 sp
00007fcc241ca200 error 6 in VBoxDD.so[7fcc1740c000+178000]
[ 3321.004963] Code: 5d 41 5e 41 5f 5d c3 0f 1f 40 00 48 83 c3 08 4d 8d 75 60
48 89 df e8 e8 d6 e8 ff 49 8b 55 68 49 8b 45 60 48 89 df 66 0f ef c0 <48> 89 02
48 89 50 08 41 0f 11 45 60 e8 98 bf e8 ff 48 8b 45 98 48

journald:
Stack trace of thread 11855:
#0  0x00007fcc17580527 n/a (VBoxDD.so + 0x199527)
#1  0x00007fcc1757d808 n/a (VBoxDD.so + 0x196808)
#2  0x00007fcc1757dcb2 n/a (VBoxDD.so + 0x196cb2)
#3  0x00007fcc4a144583 n/a (VBoxVMM.so + 0x21a583)
#4  0x00007fcc4a145f41 PDMR3UsbCreateProxyDevice (VBoxVMM.so + 0x21bf41)
#5  0x00007fcc4a061fa3 n/a (VBoxVMM.so + 0x137fa3)
#6  0x00007fcc4a062fa2 n/a (VBoxVMM.so + 0x138fa2)
#7  0x00007fcc49ffa70c n/a (VBoxVMM.so + 0xd070c)
#8  0x00007fcc49ffb9c0 n/a (VBoxVMM.so + 0xd19c0)
#9  0x00007fcc4a060c7a n/a (VBoxVMM.so + 0x136c7a)
#10 0x00007fcc6d9478bc n/a (VBoxRT.so + 0x19f8bc)
#11 0x00007fcc6da05d6a n/a (VBoxRT.so + 0x25dd6a)
#12 0x00007fcc6dbaa9ad start_thread (libc.so.6 + 0x8e9ad)
#13 0x00007fcc6dc31290 __clone3 (libc.so.6 + 0x115290)

summary: Redirecting USB device crashes guest


body:
--1666025415.276d4e140.923
Date: Mon, 17 Oct 2022 16:50:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204395

            Bug ID: 1204395
           Summary: Python 3.8 has broken
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mcepl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

$ python3.9 -c 'from distutils.sysconfig import get_python_lib; pr
int(get_python_lib(plat_specific=1), get_python_lib())'
/usr/lib64/python3.9/site-packages /usr/lib/python3.9/site-packages
$ python3.8 -c 'from distutils.sysconfig import get_python_lib; pr
int(get_python_lib(plat_specific=1), get_python_lib())'
/usr/lib/python3.8/site-packages /usr/lib/python3.8/site-packages
$ python3.6 -c 'from distutils.sysconfig import get_python_lib; pr
int(get_python_lib(plat_specific=1), get_python_lib())'
/usr/lib64/python3.6/site-packages /usr/lib/python3.6/site-packages
$ python3.10 -c 'from distutils.sysconfig import get_python_lib; p
rint(get_python_lib(plat_specific=1), get_python_lib())'
/usr/lib64/python3.10/site-packages /usr/lib/python3.10/site-packages
$

pkgs: python-dmidecode python-setuptools

summary: Python 3.8 has broken


--1666078997.2Fd8551.5145
Date: Tue, 18 Oct 2022 07:43:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204409

            Bug ID: 1204409
           Summary: VUL-0: CVE-2022-41751: jhead: arbitrary OS commands by placing them in a JPEG filename
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/345422/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: sbrabec-at-suse.com
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2135591

Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing
them in a JPEG filename and then using the regeneration -rgt50 option.

Reference:

https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788
https://github.com/Matthias-Wandel/jhead/pull/57

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2135591
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-41751
https://www.cve.org/CVERecord?id=CVE-2022-41751
https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788
https://github.com/Matthias-Wandel/jhead/pull/57
https://github.com/Matthias-Wandel/jhead


--1666086956.5FeEd42.26659
Date: Tue, 18 Oct 2022 09:55:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204427

            Bug ID: 1204427
           Summary: VUL-0: CVE-2022-3559: exim: use after free in processing of the component Regex Handler
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/345424/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: wullinger-at-rz.uni-kiel.de
          Reporter: carlos.lopez-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2135611

This issue affects some unknown processing of the component Regex Handler. The
manipulation leads to use after free. The name of the patch is
4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to
fix this issue. The identifier VDB-211073 was assigned to this vulnerability.

Reference:

https://git.exim.org/exim.git/commit/4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2135611
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3559
https://www.cve.org/CVERecord?id=CVE-2022-3559
https://git.exim.org/exim.git/commit/4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2
https://vuldb.com/?id.211073


body:
--1666274327.8f44Bda80.17923
Date: Thu, 20 Oct 2022 13:58:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204546

            Bug ID: 1204546
           Summary: hugin segfault on startup
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pstivanin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

$ grep -E '^NAME|^VERSION' /etc/os-release
NAME="openSUSE Tumbleweed"
VERSION_ID="20221019"

$ hugin
(hugin:15794): Gtk-CRITICAL **: 15:55:48.072: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.104: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.200: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.201: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.202: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.203: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.203: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.209: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.211: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.212: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.212: gtk_widget_set_size_request:
assertion 'height >= -1' failed
(hugin:15794): Gtk-CRITICAL **: 15:55:48.212: gtk_widget_set_size_request:
assertion 'height >= -1' failed
Aborted (core dumped)

summary: hugin segfault on startup


--1666307813.C18d440.28327
Date: Thu, 20 Oct 2022 23:16:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204567

            Bug ID: 1204567
           Summary: default value of BASH_LOADABLES_PATH does not include the path in bash-loadables package.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jason-at-ferrer.com.ph
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

`declare -p BASH_LOADABLES_PATH`

prints

`declare --
BASH_LOADABLES_PATH="/usr/local/lib/bash:/usr/lib/bash:/opt/local/lib/bash:/usr/pkg/lib/bash:/opt/pkg/lib/bash:."`

while `rpm -ql bash-loadables`

prints

/usr/lib64/bash
/usr/lib64/bash/Makefile.sample
/usr/lib64/bash/accept
/usr/lib64/bash/basename
/usr/lib64/bash/csv
/usr/lib64/bash/cut
/usr/lib64/bash/dirname
/usr/lib64/bash/dsv
/usr/lib64/bash/fdflags
/usr/lib64/bash/finfo
/usr/lib64/bash/getconf
/usr/lib64/bash/head
/usr/lib64/bash/id
/usr/lib64/bash/ln
/usr/lib64/bash/logname
/usr/lib64/bash/mkdir
/usr/lib64/bash/mkfifo
/usr/lib64/bash/mktemp
/usr/lib64/bash/mypid
/usr/lib64/bash/pathchk
/usr/lib64/bash/print
/usr/lib64/bash/printenv
/usr/lib64/bash/push
/usr/lib64/bash/realpath
/usr/lib64/bash/rm
/usr/lib64/bash/rmdir
/usr/lib64/bash/seq
/usr/lib64/bash/setpgid
/usr/lib64/bash/sleep
/usr/lib64/bash/stat
/usr/lib64/bash/strftime
/usr/lib64/bash/sync
/usr/lib64/bash/tee
/usr/lib64/bash/truefalse
/usr/lib64/bash/tty
/usr/lib64/bash/uname
/usr/lib64/bash/unlink
/usr/lib64/bash/whoami

`enable csv` will not find the loadable builtin `csv`

Current work around set in `~/.bashrc`

if [[ :$BASH_LOADABLES_PATH: != *:/usr/lib/64/bash:* ]]; then
  BASH_LOADABLES_PATH="/usr/lib/64/bash:$BASH_LOADABLES_PATH"
fi

then `source ~/.bashrc`

load the loadable builtin csv via `enable csv`

then `help csv`

csv is just one of the loadable builtin in bash version 5.2


--1666444286.1aDeDaFB0.10858
Date: Sat, 22 Oct 2022 13:11:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204599

            Bug ID: 1204599
           Summary: g++: internal compiler error: Segmentation fault
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jonathan.brady-at-denbridgemarine.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 862368
  --> http://bugzilla.opensuse.org/attachment.cgi?id=862368&action=edit
g++ 10 preprocessed source

Hello,

Trying to compile software using Qt 6.4.0 with g++-10 and g++-11.

Simple test program consisting of one line:

#include <QtTest/QtTest>

I've resolved the issue down to the -Wmismatched-tags option, if this is
removed the crash goes away.

g++-10:

g++-10 test.10.ii --std=c++17 -Wmismatched-tags
In file included from /opt/qt-6.4.0/include/QtCore/qfuture.h:13,
                 from /opt/qt-6.4.0/include/QtCore/QtCore:98,
                 from /opt/qt-6.4.0/include/QtTest/QtTestDepends:3,
                 from /opt/qt-6.4.0/include/QtTest/QtTest:3,
                 from test.cpp:1:
/opt/qt-6.4.0/include/QtCore/qfuture_impl.h:101:34: internal compiler error:
Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://bugs.opensuse.org/> for instructions.

g++-11:

g++-11 test.11.ii -Wmismatched-tags
In file included from /opt/qt-6.4.0/include/QtCore/qfuture.h:13,
                 from /opt/qt-6.4.0/include/QtCore/QtCore:98,
                 from /opt/qt-6.4.0/include/QtTest/QtTestDepends:3,
                 from /opt/qt-6.4.0/include/QtTest/QtTest:3,
                 from test.cpp:1:
/opt/qt-6.4.0/include/QtCore/qfuture_impl.h:101:34: internal compiler error:
Segmentation fault
0x7f68767b329c __libc_start_main
        ???:0
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://bugs.opensuse.org/> for instructions.

Pasting the test.11.ii into gcc.godbolt.org and trying g++ 12.1 I get:

In file included from /opt/qt-6.4.0/include/QtCore/qfuture.h:13,
                 from /opt/qt-6.4.0/include/QtCore/QtCore:98,
                 from /opt/qt-6.4.0/include/QtTest/QtTestDepends:3,
                 from /opt/qt-6.4.0/include/QtTest/QtTest:3,
                 from test.cpp:1:
/opt/qt-6.4.0/include/QtCore/qfuture_impl.h:101:34: internal compiler error:
Segmentation fault
0x1ba65f9 internal_error(char const*, ...)
    ???:0
0x822b81 class_decl_loc_t::add(cp_parser*, unsigned int, tag_types, tree_node*,
bool, bool)
    ???:0
0x85cf97 c_parse_file()
    ???:0
0x9385c2 c_common_parse_file()
    ???:0
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1

With g++ 12.2 I get no error.


--1666543287.A7Bc40.32255
Date: Sun, 23 Oct 2022 16:41:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204607

            Bug ID: 1204607
           Summary: Version 1.9.1-2.1 of irqbalance generates journal error
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: genes1122-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The update to irqbalancd-1.9.1-2.1 produced a journalctl error and a coredump
at boot.

> journalctl -b -p err
Oct 23 09:31:50 Mobile-PC /usr/sbin/irqbalance[916]: thermal: socket bind
failed.

> coredumpctl | grep irqbalance
Sat 2022-10-22 12:04:42 PDT  994    0    0 SIGABRT inaccessible
/usr/sbin/irqbalance            n/a
Sun 2022-10-23 09:32:32 PDT  916    0    0 SIGABRT inaccessible
/usr/sbin/irqbalance            n/a

This occurs for kernel 6.0 and kernel 6.1.

Thanks,

Gene


--1666617666.4e52c41c4.30656
Date: Mon, 24 Oct 2022 13:21:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204657

            Bug ID: 1204657
           Summary: missing icon in about section in gnome-control-center
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: lubos.kocman-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

(copy paste from https://build.opensuse.org/request/show/1030444)

In Live ISO and after install openSUSE Leap 15.4/15.5 with GNOME system role,
there is "Exclamation point" instead distribution logo in "About" section in
GNOME Control Center.

Need to install distribution-logos-openSUSE-icons to fix this.

distribution-logos-openSUSE-icons just more "extended" version of logos, so,
this shouldn't negatively affect other system components/applications.


--1666705653.cb25488b0.24829
Date: Tue, 25 Oct 2022 13:47:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204710

            Bug ID: 1204710
           Summary: LD_DEBUG=bindings provides no useful output on TW
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

LD_DEBUG=bindings provides almost no useful output on Tumbleweed:

# rpm -q glibc
glibc-2.36-5.1.x86_64
# LD_DEBUG=bindings /bin/ls
     19916:
     19916:     calling init: /lib64/ld-linux-x86-64.so.2
     19916:
     19916:
     19916:     calling init: /lib64/libc.so.6
     19916:
     19916:
     19916:     calling init: /lib64/libpcre2-8.so.0
     19916:
     19916:
     19916:     calling init: /lib64/libcap.so.2
     19916:
     19916:
     19916:     calling init: /lib64/libselinux.so.1
     19916:
     19916:
     19916:     initialize program: /bin/ls
     19916:
     19916:
     19916:     transferring control: /bin/ls
     19916:
lib64  sbin  usr

On Leap 15.3, I get lots of useful binding information instead:

# LD_DEBUG=bindings /bin/ls
      1149:     binding file linux-vdso.so.1 [0] to linux-vdso.so.1 [0]: normal
symbol `__vdso_clock_gettime' [LINUX_2.6]
      1149:     binding file linux-vdso.so.1 [0] to linux-vdso.so.1 [0]: normal
symbol `__vdso_gettimeofday' [LINUX_2.6]
      1149:     binding file linux-vdso.so.1 [0] to linux-vdso.so.1 [0]: normal
symbol `__vdso_time' [LINUX_2.6]
      1149:     binding file linux-vdso.so.1 [0] to linux-vdso.so.1 [0]: normal
symbol `__vdso_getcpu' [LINUX_2.6]
      1149:     binding file linux-vdso.so.1 [0] to linux-vdso.so.1 [0]: normal
symbol `__vdso_clock_getres' [LINUX_2.6]
...


--1666766936.C20e4CaB0.23584
Date: Wed, 26 Oct 2022 06:48:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204731

            Bug ID: 1204731
           Summary: multipath -t segfault with multipath-tools 0.9.2
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Version 0.9.2 crashes with a segmentation fault:

> $ multipath -t 2
> 612.793257 | couldn't open configuration dir '/etc/multipath/conf.d': Permission denied
> [1]    13266 segmentation fault (core dumped)  multipath -t 2

This appears to be a subtle interaction between the separation of libmultipath
and libmpathutil we did in 0.9.1 and the libmultipath ABI version bump in
0.9.2.

Some symbols ({get,put}_multipath_config, libmp_verbosity, and udev) are
exported by both libmpathutil and
libmultipath. The symbols exported by libmpathutil are dummies, intended to be
overridden by libmultipath using the "breadth-first" symbol lookup specified by
ELF 1. The dummy symbols are only used by programs not linking to libmultipath,
i.e. only multipathc.

Because we're using ABI versioning, code in libmpathutil actually exports and
references get_multipath_config@LIBMULTIPATH_16.0.0. That worked until 0.9.1,
because both libraries were using the same ABI version, and
get_multipath_config@LIBMULTIPATH_16.0.0 from libmultipath overrides the symbol
from libmpathutil. But in 0.9.2, we bumped the ABI version of libmultipath to
17.0.0. libmultipath now exports (only)
get_multipath_config@LIBMULTIPATH_17.0.0, which doesn't override
get_multipath_config@LIBMULTIPATH_16.0.0 from libmpathutil.

The effect is that references to these duplicate symbols, when done from
libmpathutil, are resolved to the libmpathutil dummy symbols, which is wrong
and causes the crash.

This affects only multipath, not multipathd, because multipathd overrides
get_multipath_config with yet another symbol. Same for put_multipath_config and
libmp_verbosity, but not for udev.

Upstream Issue: https://github.com/opensvc/multipath-tools/pull/47
Fix: https://github.com/opensvc/multipath-tools/pull/48


--1666766987.4aCC5d31.23689
Date: Wed, 26 Oct 2022 06:49:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204732

            Bug ID: 1204732
           Summary: VUL-0: chromium: multiple security issues fixed in 107.0.5304.68
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: Andreas.Stieger-at-gmx.de
          Found By: ---
           Blocker: ---

CVE-2022-3652: Type Confusion in V8. Reported by srodulv and ZNMchtss at S.S.L
Team on 2022-09-30
CVE-2022-3653: Heap buffer overflow in Vulkan. Reported by SeongHwan Park
(SeHwa) on 2022-08-19
CVE-2022-3654: Use after free in Layout. Reported by Sergei Glazunov of Google
Project Zero on 2022-09-19
CVE-2022-3655: Heap buffer overflow in Media Galleries. Reported by
koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on
2022-07-11
CVE-2022-3656: Insufficient data validation in File System. Reported by Ron
Masas, Imperva on 2022-07-18
CVE-2022-3657: Use after free in Extensions. Reported by Omri Bushari, Talon
Cyber Security on 2022-08-09
CVE-2022-3658: Use after free in Feedback service on Chrome OS. Reported by Nan
Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute
on 2022-08-14
CVE-2022-3659: Use after free in Accessibility. Reported by @ginggilBesel on
2022-08-23
CVE-2022-3660: Inappropriate implementation in Full screen mode. Reported by
Irvan Kurniawan (sourc7) on 2022-05-20
CVE-2022-3661: Insufficient data validation in Extensions. Reported by Young
Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2022-08-04

https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_25.html


--1666776950.ad56aAb00.13517
Date: Wed, 26 Oct 2022 09:35:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204736

            Bug ID: 1204736
           Summary: Application:/Geo: missing php-mapscript.so for mapsever version 8.0
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: x86-64
                OS: openSUSE Leap 15.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: screening-team-bugs-at-suse.de
          Reporter: klaus.braun-at-geographie.uni-freiburg.de
        QA Contact: screening-team-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hello,

after upgrading mapserver to version 8.0 I can not find the corresponding
php-mapscript library. Java, Perl and Python mapscript seems to be available,
but not the one for using with php.

Can this be fixed? Thank you.

Best

Klaus


body:
--1666788278.d6Fb51.15810
Date: Wed, 26 Oct 2022 12:44:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204746

            Bug ID: 1204746
           Summary: texlive-scheme-medium missing english documentation for fancyhdr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Patterns
          Assignee: dimstar-at-opensuse.org
          Reporter: lukasstraub2-at-web.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When installing texlive-scheme-medium, it includes documentation, but for
example for fancyhdr only the italian docs are included, not the english ones.
i.e. only texlive-fancyhdr-it is installed, not texlive-fancyhdr-doc.

I suspect this is not the only package that has this problem.

I expect at least english documentation to be installed.

pkgs: texlive-filesystem texlive-specs-m


--1666885043.AD173B731.3245
Date: Thu, 27 Oct 2022 15:37:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204795

            Bug ID: 1204795
           Summary: AUDIT-WHITELIST: NetworkManager-openconnect: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Move /etc/dbus-1/system.d/nm-openconnect-service.conf to
/usr/share/dbus-1/system.d/nm-openconnect-service.conf

Devel prj: GNOME:Factory
Maint: GNOME


--1666910707.e8bc36F0.16683
Date: Thu, 27 Oct 2022 22:45:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1204811

            Bug ID: 1204811
           Summary: chage does not show Last password change / Password expires dates
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: bjoernv-at-arcor.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The chage version from the newest Tumbleweed shadow-4.12.3-2.1.x86_64 package
does not show the "Last password change" and "Password expires" dates:

#  chage -l myuser
Last password change                                    : %b %d, %Y
Password expires                                        : %b %d, %Y
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 90
Number of days of warning before password expires       : 7

This works correctly on openSUSE 15.4 with shadow-4.8.1-150400.8.57.x86_64:

# chage -l myuser
Last password change                                    : Oct 07, 2022
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7


--1666942484.B8411.21680
Date: Fri, 28 Oct 2022 07:34:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204819

            Bug ID: 1204819
           Summary: VUL-0: chromium: multiple security issues fixed in 107.0.5304.87
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: Andreas.Stieger-at-gmx.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-3723: Type Confusion in V8. Reported by Jan Vojt????ek, Mil??nek, and
Przemek Gmerek of Avast on 2022-10-25

https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html


body:
--1666961437.76A80.8551
Date: Fri, 28 Oct 2022 12:50:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204842

            Bug ID: 1204842
           Summary: [trackerbug] lxc 5.0.1 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXC 5.0.1.

  Bugfixes:
  * Fixed a mount issue resulting in container startup failure when host
    bind-mounts were used
  * Various meson packaging fixes especially around libcap detection

  Major changes from LXC 5.0:
  * Switch to meson build tooling.
  * New cgroup configuration options.
  * Time namespace support.
  * VLAN support on veth devices.
  * Configurable tx/rx queues on veth devices.

summary: [trackerbug] lxc 5.0.1 update


body:
--1667001454.f5BCfd0.27542
Date: Fri, 28 Oct 2022 23:57:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1204852

            Bug ID: 1204852
           Summary: [trackerbug] lxd 5.7 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXD 5.7. The full upstream changelog is available from:
  https://discuss.linuxcontainers.org/t/lxd-5-7-has-been-released/15432

  + ACME / Let???s Encrypt support
  + Cloud-init validation
  + Internal metrics
  + Cluster join tokens expiry
  + Proxy device hotplugging to VM

summary: [trackerbug] lxd 5.7 update


body:
Build Identifier:

missing 00-radv-defaults.conf file, thus some native games are not working out
of the box, for details see discussion below this reported issue:
https://gitlab.freedesktop.org/mesa/mesa/-/issues/6944

Reproducible: Always

summary: libvulkan_radeon is incorrectly packaged