--1618407175.A4fD0.25158
Date: Wed, 14 Apr 2021 13:32:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184726

            Bug ID: 1184726
           Summary: VUL-0: CVE-2021-20307: libpano13: Format string vulnerability in panoFileOutputNamesCreate()
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/281090/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#1946284

Format string vulnerability in panoFileOutputNamesCreate() in libpano13
2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary memory
values.

References:

https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1946284
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20307
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20307
https://sourceforge.net/projects/panotools/files/libpano13/libpano13-2.9.20/
https://lists.debian.org/debian-lts-announce/2021/04/msg00010.html


body:
--1618412357.2Cace3B0.7987
Date: Wed, 14 Apr 2021 14:59:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184750

            Bug ID: 1184750
           Summary: librsb embeds build system memory info
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: x86-64
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: jengelh-at-inai.de
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
our Leap 15.3 librsb-1.2.0-rc7 emeds details about build system memory info

-

summary: librsb embeds build system memory info


--1618412827.A3dc23.9682
Date: Wed, 14 Apr 2021 15:07:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184753

            Bug ID: 1184753
           Summary: salt-minion conflicts with busybox-hostname
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: MicroOS
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: jgonzalez-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

openSUSE MicroOS installed from DVD
(openSUSE-MicroOS-DVD-x86_64-Snapshot20210408-Media.iso), using the default
System Role (MicroOS).

After the installation is complete I try to install salt-minion, and it
conflicts with busybox-hostname:

> localhost:~ # transactional-update pkg install salt-minion
> Checking for newer version.
> transactional-update 3.3.0 started
> Options: pkg install salt-minion
> Separate /var detected.
> 2021-04-14 15:05:16 tukit 3.3.0 started
> 2021-04-14 15:05:16 Options: -c1 open
> 2021-04-14 15:05:17 Using snapshot 1 as base for new snapshot 3.
> 2021-04-14 15:05:17 No previous snapshot to sync with - skipping
> ID: 3
> 2021-04-14 15:05:17 Transaction completed.
> Calling zypper install
> 2021-04-14 15:05:19 tukit 3.3.0 started
> 2021-04-14 15:05:19 Options: callext 3 zypper -R {} install salt-minion
> 2021-04-14 15:05:19 Executing `zypper -R /tmp/transactional-update-S4U6H4 install salt-minion`:
> Loading repository data...
> Reading installed packages...
> Resolving package dependencies...
>
> Problem: salt-minion-3002.2-4.1.x86_64 requires salt = 3002.2-4.1, but this requirement cannot be provided
>   not installable providers: salt-3002.2-4.1.i586[repo-oss]
>                   salt-3002.2-4.1.x86_64[repo-oss]
> Solution 1: deinstallation of busybox-hostname-1.33.0-17.2.noarch
> Solution 2: do not install salt-minion-3002.2-4.1.x86_64
> Solution 3: break salt-minion-3002.2-4.1.x86_64 by ignoring some of its dependencies
>
> Choose from above solutions by number or cancel [1/2/3/c/d/?] (c):

If I pick solution 1, then busybox-hostname gets removed an apparently
salt-minion works fine, but still I guess that having this conflict is not
fine.


body:
--1618436460.B47d2A0d0.18213
Date: Wed, 14 Apr 2021 21:41:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1184764

            Bug ID: 1184764
           Summary: VUL-0: chromium: Update to 90.0.4430.72
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: atoptsoglou-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2021-21201: Use after free in permissions.
CVE-2021-21202: Use after free in extensions.
CVE-2021-21203: Use after free in Blink.
CVE-2021-21204: Use after free in Blink.
CVE-2021-21205: Insufficient policy enforcement in navigation.
CVE-2021-21221: Insufficient validation of untrusted input in Mojo.
CVE-2021-21207: Use after free in IndexedDB.
CVE-2021-21208: Insufficient data validation in QR scanner.
CVE-2021-21209: Inappropriate implementation in storage.
CVE-2021-21210: Inappropriate implementation in Network.
CVE-2021-21211: Inappropriate implementation in Navigation.
CVE-2021-21212: Incorrect security UI in Network Config UI.
CVE-2021-21213: Use after free in WebMIDI.
CVE-2021-21214: Use after free in Network API.
CVE-2021-21215: Inappropriate implementation in Autofill.
CVE-2021-21216: Inappropriate implementation in Autofill.
CVE-2021-21217: Uninitialized Use in PDFium.
CVE-2021-21218: Uninitialized Use in PDFium.
CVE-2021-21219: Uninitialized Use in PDFium.

Reference

https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html

summary: VUL-0: chromium: Update to 90.0.4430.72


--1618468408.fD75CF0.28187
Date: Thu, 15 Apr 2021 06:33:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184770

            Bug ID: 1184770
           Summary: VUL-0: CVE-2021-22879: Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/282026/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-22879

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by
way of missing validation of URLs, allowing a malicious server to execute
remote
commands. User interaction is needed for exploitation.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22879
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22879
https://github.com/nextcloud/desktop/pull/2906
https://nextcloud.com/security/advisory/?id=NC-SA-2021-008
https://hackerone.com/reports/1078002


--1618475266.7B42eb4e0.9993
Date: Thu, 15 Apr 2021 08:27:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1184779

            Bug ID: 1184779
           Summary: apparmor startup fails during boot with "Too many open files" (OpenQA releated
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AppArmor
          Assignee: suse-beta-at-cboltz.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Since a couple of weeks, I've noticed that the startup of apparmor.service on
my workstation takes considerable time during boot. Today, the system entered
emergency mode with these error messages:

> Apr 15 09:51:47 apollon apparmor.systemd[2044]: Restarting AppArmor
> Apr 15 09:51:47 apollon apparmor.systemd[2044]: Reloading AppArmor profiles
> [  110.957956] apollon apparmor.systemd[2224]: AppArmor parser error for /etc/apparmor.d in profile /etc/apparmor.d/abstractions/bash at line 11: Could not open 'abi/3.0': Too many open files
> [  111.150984] apollon apparmor.systemd[2471]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.libvirtd
> [  111.346699] apollon systemd[1]: systemd-rfkill.service: Succeeded.
> [  115.639827] apollon apparmor.systemd[2505]: AppArmor parser error for /etc/apparmor.d/usr.share.openqa.script.openqa in profile /etc/apparmor.d/abstractions/bash at line 11: Could not open 'abi/3.0': Too many open files
> [  115.726333] apollon apparmor.systemd[2044]: Error: At least one profile failed to load
> [  115.727028] apollon systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE
> [  115.727243] apollon systemd[1]: apparmor.service: Failed with result 'exit-code'.
> [  115.727295] apollon systemd[1]: Failed to start Load AppArmor profiles.

In emergency mode, I tried to run "systemctl start apparmor" manually, with the
same result.

Because I needed the system up, I deinstalled openQA. After that, apparmor
started in a wink. (note that I don't use openQA on this system. It was
installed from past experiments and never removed).

> [  265.104588] apollon [RPM][2860]: erase openQA 4.6.1617960903.4aa567c96-2.1.noarch: success
> ...
> [  270.584039] apollon systemd[1]: Starting Load AppArmor profiles...
> [  270.591930] apollon apparmor.systemd[2922]: Restarting AppArmor
> [  270.591930] apollon apparmor.systemd[2922]: Reloading AppArmor profiles
> [  270.643749] apollon apparmor.systemd[2969]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.libvirtd
> [  270.648461] apollon systemd[1]: Finished Load AppArmor profiles.
> [  284.296476] apollon systemd[1]: Reloading.

apparmor 3.0.1-5
systemd-246.13-1.1.x86_64
kernel-default-5.11.11-1.2.x86_64

Note that I had a nother problem during this which I'll report separately. It
may or may not be related to this one. Anyway, the other problem was gone by
simply re-mounting /var/tmp in emergency mode, whereas this problem persisted
until openQA was uninstalled.


body:
--1618477593.8CdB7.14619
Date: Thu, 15 Apr 2021 09:06:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1184786

            Bug ID: 1184786
           Summary: Deduplicate directory ownership with filesystem package
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,

checksec pointed out that various directories in our /usr are 0755 while
they're 0555 on Fedora and Red Hat. For more hardened environments this might
make a difference, as it prevents a user "root" that doesn't have DAC_OVERRIDE
permission to no longer write/create files there.

In order to achieve that, only one package need to own the permissions of that
directory. currently we have various packages co-owning it, which means actual
permission would depend on installation order, and we'd get installation
conflicts.

This can be prevented by de-duplicating directory ownership. this is a tracker
bug that tracks the work related to it.

pkgs: deepin-draw deepin-image-viewer deepin-movie deepin-music-player deepin-screen-recorder deepin-voice-note filesystem gobby jag kronometer kstars opi qt6-base scribus


--1618477597.06CBf40.1173
Date: Thu, 15 Apr 2021 09:06:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1184787

            Bug ID: 1184787
           Summary: Deduplicate directory ownership with filesystem package
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,

checksec pointed out that various directories in our /usr are 0755 while
they're 0555 on Fedora and Red Hat. For more hardened environments this might
make a difference, as it prevents a user "root" that doesn't have DAC_OVERRIDE
permission to no longer write/create files there.

In order to achieve that, only one package need to own the permissions of that
directory. currently we have various packages co-owning it, which means actual
permission would depend on installation order, and we'd get installation
conflicts.

This can be prevented by de-duplicating directory ownership. this is a tracker
bug that tracks the work related to it.


--1618488286.af50F613.25334
Date: Thu, 15 Apr 2021 12:04:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184800

            Bug ID: 1184800
           Summary: VUL-0: CVE-2021-23358: nodejs-underscore: Arbitrary code execution via the template function
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/280628/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: hillwoodroc-at-gmail.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-23358

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before
1.12.1 are vulnerable to Arbitrary Code Execution via the template function,
particularly when a variable property is passed as an argument as it is not
sanitized.

References:

https://github.com/jashkenas/underscore/blob/master/modules/template.js#L71
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1081504
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBJASHKENAS-1081505
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1081503
https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1944286
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23358
http://www.debian.org/security/-1/dsa-4883
https://access.redhat.com/security/cve/CVE-2021-23358
https://www.debian.org/security/2021/dsa-4883
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358
https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71
https://lists.apache.org/thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba@%3Cissues.cordova.apache.org%3E
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986171
https://lists.debian.org/debian-lts-announce/2021/03/msg00038.html
https://lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf@%3Cissues.cordova.apache.org%3E
https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1@%3Cissues.cordova.apache.org%3E
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1081504
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1081503
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBJASHKENAS-1081505
https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984


--1618488453.Ea870.9401
Date: Thu, 15 Apr 2021 12:07:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1184801

            Bug ID: 1184801
           Summary: OVMF in Tumbleweed does crash with SEV-ES enabled
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: jroedel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The currently shipped OVMF-x86-64 images shipped in Tumbleweed crash when
booted in an SEV-ES guest.

The reason has been debugged down to TPM support in OVMF, which needs to be
fixed upstream.

This is a bug to track this issue in Tumbleweed and make sure we provide a fix
once it becomes available.


body:
--1618490551.CB4Fbca0.13859
Date: Thu, 15 Apr 2021 12:42:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184804

            Bug ID: 1184804
           Summary: move kernel out of /boot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

One of the motivations for UsrMerge is to have all read-only parts of
the operating system in /usr. The kernel packages install files in /boot
though which isn't in line with that idea.
Having the kernel installed via rpm in /boot also causes issues with eg
snapshots if /boot is on a separate partition.
So it make sense to store the rpm provided parts of the kernel packages where
the rest of the OS is and manage /boot separately.

Looking at Fedora they install files like vmlinuz that used to be named
/boot/$name-$kver as (/usr)/lib/modules/$kver/$name instead. They
include /boot/$name-$kver as %ghost.

summary: move kernel out of /boot


body:
--1618512934.6165F00.19892
Date: Thu, 15 Apr 2021 18:55:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184830

            Bug ID: 1184830
           Summary: ffmpeg does not support av1
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: aloisio-at-gmx.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I see it from mpv which is built against ffmpeg-4.

  ~> mpv testvideo.mp4
  ...
  Failed to initialize a decoder for codec 'av1'.
  Video: no video

Shouldn't ffmpeg 4.2 and dav1d 0.8.2 be able to support it?
Is it only a question of enabling it in the build or is there more to it?

summary: ffmpeg does not support av1


--1618551066.2b2F1D0b5.24202
Date: Fri, 16 Apr 2021 05:31:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184842

            Bug ID: 1184842
           Summary: meld: Meld requires GtkSourceView 4.0 or higher, typelib-1_0-GtkSource-4 not picked
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

With what I think are the Gtk/GNOME related changes in TW snapshot 20210414
Meld stopped working at runtime:

$ meld
Meld requires GtkSourceView 4.0 or higher

The last paths touched before this message:

/usr/lib64/girepository-1.0
/usr/lib64/girepository-1.0/GLib-2.0.typelib
/usr/lib64/girepository-1.0
/usr/lib64/girepository-1.0/GtkSource-3.0.typelib

meld requires typelib(GtkSource), provided by both typelib-1_0-GtkSource-3_0
and typelib-1_0-GtkSource-4. Installing typelib-1_0-GtkSource-4 works around
the issue


--1618557811.C3bfc23.3536
Date: Fri, 16 Apr 2021 07:23:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184848

            Bug ID: 1184848
           Summary: VUL-0: irssi: multiple security issues fixed in 1.2.3
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: ailin.nemui-at-gmail.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: ailin.nemui-at-gmail.com, meissner-at-suse.com,
                    mrueckert-at-suse.com, security-team-at-suse.de
          Found By: ---
           Blocker: ---

irssi 1.2.3 contains some security fixes.

* memory handling issues
* memory leaks
* erroneous free
* crashes / freezes
* null pointer dereference when receiving broken JOIN record

References:
https://irssi.org/2021/04/11/irssi-1.2.3-released/
https://irssi.org/NEWS/#v1-2-3


--1618561999.e7D2C0.18898
Date: Fri, 16 Apr 2021 08:33:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1184852

            Bug ID: 1184852
           Summary: pipewire-media-session.service not enabled/started after installing pipewire-pulse
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Sound
          Assignee: tiwai-at-suse.com
          Reporter: lukas.kucharczyk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I have installed pipewire-pulse, then I restarted the computer and no sound
devices were detected. I checked the status of pipewire-media-session.service:

~ $ systemctl --user status pipewire-media-session.service
??? pipewire-media-session.service - Multimedia Service Session Manager
     Loaded: loaded (/usr/lib/systemd/user/pipewire-media-session.service;
disabled; vendor preset: enabled)
     Active: inactive (dead)

Seems like the vendor preset is enabled but that does not enable it even after
a restart.

For completeness, after enabling and starting the service manually, the sound
works again.


--1618581427.ae3511.11665
Date: Fri, 16 Apr 2021 13:57:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184888

            Bug ID: 1184888
           Summary: XZ test of createrepo_c does not work with file 5.40
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: fvogt-at-suse.com
        Depends on: 1184881
          Found By: ---
           Blocker: ---

With file version 5.40 the checksum type is also provided:

./tests/testdata/compressed_files/01_plain.foo3: XZ compressed data, checksum
CRC64
abuild@noether:~/rpmbuild/BUILD/createrepo_c-0.16.0> file
./tests/testdata/compressed_files/01_plain.txt.xz
./tests/testdata/compressed_files/01_plain.txt.xz: XZ compressed data, checksum
CRC64
abuild@noether:~/rpmbuild/BUILD/createrepo_c-0.16.0> file --version
file-5.40
magic file from /etc/magic:/usr/share/misc/magic


--1618582400.BdE3Bd0.13514
Date: Fri, 16 Apr 2021 14:13:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184891

            Bug ID: 1184891
           Summary: XZ test of libmodulemd does not work with file 5.40
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: fvogt-at-suse.com
        Depends on: 1184881
            Blocks: 1184888
          Found By: ---
           Blocker: ---

With file version 5.40 the checksum type is also provided:

abuild@noether:~/rpmbuild/BUILD/modulemd-2.12.0> file
./modulemd/tests/test_data/compression/xzipped
./modulemd/tests/test_data/compression/xzipped: XZ compressed data, checksum
CRC64
abuild@noether:~/rpmbuild/BUILD/modulemd-2.12.0> file
./modulemd/tests/test_data/compression/xzipped.yaml.xz
./modulemd/tests/test_data/compression/xzipped.yaml.xz: XZ compressed data,
checksum CRC64
abuild@noether:~/rpmbuild/BUILD/modulemd-2.12.0> file --version
file-5.40
magic file from /etc/magic:/usr/share/misc/magic


--1618585420.C3e4Ffb20.26099
Date: Fri, 16 Apr 2021 15:03:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184899

            Bug ID: 1184899
           Summary: tests of subversion does not work with file 5.40
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: fvogt-at-suse.com
        Depends on: 1184881, 1184888, 1184891
          Found By: ---
           Blocker: ---

With file version 5.40 more informations are provided:

Old output

BUILD/subversion-1.14.1> file subversion/tests/templates/*
subversion/tests/templates/empty-fsfs-v1.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/empty-fsfs-v2.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/empty-fsfs-v3.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/empty-fsfs-v4.zip: Zip archive data, at least v2.0
to extract Zip archive data, at least v2.0 to extract
subversion/tests/templates/empty-fsfs-v6.zip: Zip archive data, at least v2.0
to extract Zip archive data, at least v2.0 to extract
subversion/tests/templates/empty-fsfs-v7.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/greek-fsfs-v1.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/greek-fsfs-v2.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/greek-fsfs-v3.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/greek-fsfs-v4.zip: Zip archive data, at least v2.0
to extract Zip archive data, at least v2.0 to extract
subversion/tests/templates/greek-fsfs-v6.zip: Zip archive data, at least v2.0
to extract Zip archive data, at least v2.0 to extract
subversion/tests/templates/greek-fsfs-v7.zip: Zip archive data, at least v1.0
to extract Zip archive data, at least v1.0 to extract
subversion/tests/templates/greek.dump:        Subversion dumpfile (version: 2)
BUILD/subversion-1.14.1> file --version
file-5.39
magic file from /etc/magic:/usr/share/misc/magic

versus new output

abuild@noether:~/rpmbuild/BUILD/subversion-1.14.1> file
subversion/tests/templates/*
subversion/tests/templates/empty-fsfs-v1.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/empty-fsfs-v2.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/empty-fsfs-v3.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/empty-fsfs-v4.zip: Zip archive data, at least v2.0
to extract, compression method=deflate
subversion/tests/templates/empty-fsfs-v6.zip: Zip archive data, at least v2.0
to extract, compression method=deflate
subversion/tests/templates/empty-fsfs-v7.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/greek-fsfs-v1.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/greek-fsfs-v2.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/greek-fsfs-v3.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/greek-fsfs-v4.zip: Zip archive data, at least v2.0
to extract, compression method=deflate
subversion/tests/templates/greek-fsfs-v6.zip: Zip archive data, at least v2.0
to extract, compression method=deflate
subversion/tests/templates/greek-fsfs-v7.zip: Zip archive data, at least v1.0
to extract, compression method=store
subversion/tests/templates/greek.dump:        Subversion dumpfile (version: 2)
abuild@noether:~/rpmbuild/BUILD/subversion-1.14.1> file --version
file-5.40
magic file from /etc/magic:/usr/share/misc/magic


body:
--1618599116.33b175.24808
Date: Fri, 16 Apr 2021 18:51:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184906

            Bug ID: 1184906
           Summary: gnome transparent window
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: 8494-at-protonmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 848459
  --> http://bugzilla.opensuse.org/attachment.cgi?id=848459&action=edit
screenclip of transparent welcome window directly after login

Hello,

After installing server, server-extra and server-wayland from:

https://download.opensuse.org/repositories/home:/yudaike:/branches:/SUSE:/SLE-15-SP2:/Update/pool-leap-15.3/x86_64/

and logging into option Gnome, the welcome window is transparent.

Filemanager, firefox, is not transparent.

Please see attached screenshot.

summary: gnome transparent window


--1618744380.6E7a6d42.10137
Date: Sun, 18 Apr 2021 11:13:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184930

            Bug ID: 1184930
           Summary: GNOME:Factory/system-config-printer: Requiring namespace 'Gdk' version '3.0', but '4.0' is already loaded
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: os.gnome.maintainers-at-gmail.com
          Reporter: sebix+novell.com-at-sebix.at
        QA Contact: screening-team-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Running oS TW in version 20210415, system-config-printer raises an exception on
start:

$ system-config-printer
/usr/share/system-config-printer/system-config-printer.py:31: PyGIWarning:
Polkit was imported without specifying a version first. Use
gi.require_version('Polkit', '1.0') before import to ensure that the right
version gets loaded.
  from gi.repository import Polkit
/usr/share/system-config-printer/system-config-printer.py:36: PyGIWarning:
GdkPixbuf was imported without specifying a version first. Use
gi.require_version('GdkPixbuf', '2.0') before import to ensure that the right
version gets loaded.
  from gi.repository import GdkPixbuf
/usr/share/system-config-printer/system-config-printer.py:38: PyGIWarning: Gdk
was imported without specifying a version first. Use gi.require_version('Gdk',
'4.0') before import to ensure that the right version gets loaded.
  from gi.repository import Gdk
Traceback (most recent call last):
  File "/usr/lib64/python3.8/site-packages/gi/importer.py", line 137, in
load_module
    introspection_module = get_introspection_module(namespace)
  File "/usr/lib64/python3.8/site-packages/gi/module.py", line 257, in
get_introspection_module
    module = IntrospectionModule(namespace, version)
  File "/usr/lib64/python3.8/site-packages/gi/module.py", line 109, in __init__
    repository.require(namespace, version)
gi.RepositoryError: Requiring namespace 'Gdk' version '3.0', but '4.0' is
already loaded

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/share/system-config-printer/system-config-printer.py", line 40, in
<module>
    from gi.repository import Gtk
  File "/usr/lib64/python3.8/site-packages/gi/importer.py", line 139, in
load_module
    raise ImportError(e)
ImportError: Requiring namespace 'Gdk' version '3.0', but '4.0' is already
loaded

using 1.5.7-21.7 of the package here, which seems to be out of data from (the
new!) upstream: https://github.com/OpenPrinting/system-config-printer

I'll provide an update to the new version soon, but this won't fix the issue
described here.


--1618751922.ECbf5.13122
Date: Sun, 18 Apr 2021 13:18:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1184933

            Bug ID: 1184933
           Summary: gnome-shell-classic-session package is empty (minus the COPYING file) and could be remove
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: gp-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I noticed this when updating to GNOME 40; it already was the case with
GNOME 38, though:

  # rpm -q gnome-shell-classic-session
  gnome-shell-classic-session-40.0-2.1.x86_64

  # rpm -ql gnome-shell-classic-session
  /usr/share/licenses/gnome-shell-classic-session
  /usr/share/licenses/gnome-shell-classic-session/COPYING

And there's also nothing it dragged in:

  # zypper rm --clean-deps gnome-shell-classic-session

  The following package is going to be REMOVED:
    gnome-shell-classic-session

  1 package to remove.
  After the operation, 17,5 KiB will be freed.

  # zypper in --recommends gnome-shell-classic-session
  The following NEW package is going to be installed:
    gnome-shell-classic-session

  1 new package to install.


--1618829394.aCDeb5e13.26516
Date: Mon, 19 Apr 2021 10:49:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184951

            Bug ID: 1184951
           Summary: winegcc regression: missing /usr/include path in 6.6
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: davejplater-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Carla Lmms and most probably others fail to build against wine, see:
https://bugs.winehq.org/show_bug.cgi?id=50996
The winehq bug supplies a patch which I have added and now lmms and carla build
against wine 6.6
Will submit, I just need a bug number for changes


--1618843787.eda4c31.9869
Date: Mon, 19 Apr 2021 14:49:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184973

            Bug ID: 1184973
           Summary: VUL-0: CVE-2020-28601: cgal: code execution vulnerability may lead to oob read
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/279202/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-28601

A code execution vulnerability exists in the Nef polygon-parsing functionality
of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in
Nef_2/PM_io_parser.h PM_io_parser::read_vertex() Face_of[] OOB read. An
attacker can provide malicious input to trigger this vulnerability.

External Reference:

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1939901
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28601
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28601
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
https://lists.fedoraproject.org/archives/list/package-announce-at-lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
https://lists.fedoraproject.org/archives/list/package-announce-at-lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/


--1618844111.Ff0111.1434
Date: Mon, 19 Apr 2021 14:55:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184975

            Bug ID: 1184975
           Summary: VUL-0: CVE-2020-35636: CGAL: code execution vulnerability may lead to oob read
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/279208/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-35636

A code execution vulnerability exists in the Nef polygon-parsing functionality
of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in
Nef_S2/SNC_io_parser.h SNC_io_parser::read_sface() sfh->volume(). An attacker
can provide malicious input to trigger this vulnerability.

External Reference:

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1939906
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35636
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35636
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
https://lists.fedoraproject.org/archives/list/package-announce-at-lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
https://lists.fedoraproject.org/archives/list/package-announce-at-lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/


--1618844222.3BdBf001.11427
Date: Mon, 19 Apr 2021 14:57:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184977

            Bug ID: 1184977
           Summary: VUL-0: CVE-2020-28636: cgal: code execution vulnerability may lead to oob read
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/279203/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-28636

A code execution vulnerability exists in the Nef polygon-parsing functionality
of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in
Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->twin() An attacker can
provide malicious input to trigger this vulnerability.

External Reference:

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1939904
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28636
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28636
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225
https://lists.fedoraproject.org/archives/list/package-announce-at-lists.fedoraproject.org/message/E4J344OKKDLPRN422OYRR46HDEN6MM6P/
https://lists.fedoraproject.org/archives/list/package-announce-at-lists.fedoraproject.org/message/NB5SF5OJR2DSV7CC6U7FVW5VJSJO5EKV/


--1618844643.D753c1.4564
Date: Mon, 19 Apr 2021 15:04:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184978

            Bug ID: 1184978
           Summary: VUL-0: CVE-2020-35628: cgal: code execution vulnerability may lead to oob read
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/279207/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-35628

A code execution vulnerability exists in the Nef polygon-parsing functionality
of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in
Nef_S2/SNC_io_parser.h SNC_io_parser::read_sloop() slh->incident_sface. An
attacker can provide malicious input to trigger this vulnerability.

External Reference:

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1939905
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35628
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35628
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1225


--1618848213.3ac7d78.12574
Date: Mon, 19 Apr 2021 16:03:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1184984

            Bug ID: 1184984
           Summary: Kernel 5.11.12: unable to open usb port ACM0
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: i586
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: ferdinando.vivacqua-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

With the kernel 5.11.12 it is impossible to open serial port for devices such
as Arduino. Error message /dev/ttyACM0: unable to connect to serial device
could not open port.

dmesg output:

cdc_acm 2-1:1.0: acm_port_activate - usb_submit_urb(ctrl irq) failed


--1618922627.22672.19868
Date: Tue, 20 Apr 2021 12:43:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185023

            Bug ID: 1185023
           Summary: GRUB2 error at 98% of openSUSE Tumbleweed installation.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: 32bit
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: pj.world-at-gmx.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Created attachment 848544
  --> http://bugzilla.opensuse.org/attachment.cgi?id=848544&action=edit
Screenshot of GRUB2 error message at 98% completion.

Hi, I am installing openSUSE Tumbleweed on my laptop computer. The
live usb starts up fine now with the "nomodeset" flag. The problem I am
having is at 98% of installation completed I get a warning concerning
GRUB2 (Installing grub2 to device failed-/usr/sbin/grub2-install:
Decompressor is to big). I have attached a link containing the error
message here: -> https://ibb.co/6Jh4t7C

I have posted a screenshot of the error also.

I was told to file a bug report on users-at-lists.opensuse.org ->
lzma_decompress.img in trustedgrub is 129MB. This is certainly too big
to make any sense. Open bug report.


body:
--1618989044.8a2188B0.22078
Date: Wed, 21 Apr 2021 07:10:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185047

            Bug ID: 1185047
           Summary: VUL-0: chromium: Update to 90.0.4430.85
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: rfrohl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: security-team-at-suse.de
          Found By: ---
           Blocker: ---

The Stable channel has been updated to 90.0.4430.85 for Windows, Mac and Linux
which will roll out over the coming days/weeks.

A full list of changes in this build is available in the log. Interested in
switching release channels?  Find out how here. If you find a new issue, please
let us know by filing a bug. The community help forum is also a great place to
reach out for help or learn about common issues.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven???t yet fixed.

This update includes 7 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

[$TBD][1194046] High CVE-2021-21222: Heap buffer overflow in V8. Reported by
Guang Gong of Alpha Lab, Qihoo 360 on 2021-03-30

[$TBD][1195308] High CVE-2021-21223: Integer overflow in Mojo. Reported by
Guang Gong of Alpha Lab, Qihoo 360 on 2021-04-02

[$TBD][1195777] High CVE-2021-21224: Type Confusion in V8. Reported by Jose
Martinez (tr0y4) from VerSprite Inc. on 2021-04-05

[$TBD][1195977] High CVE-2021-21225: Out of bounds memory access in V8.
Reported by Brendon Tiszka (@btiszka) supporting the EFF on 2021-04-05

[$TBD][1197904] High CVE-2021-21226: Use after free in navigation. Reported by
Brendon Tiszka (@btiszka) supporting the EFF on 2021-04-11

We would also like to thank all security researchers that worked with us during
the development cycle to prevent security bugs from ever reaching the stable
channel.

Google is aware of reports that exploits for CVE-2021-21224 exist in the wild.

As usual, our ongoing internal security work was responsible for a wide range
of fixes:

    [1200824] Various fixes from internal audits, fuzzing and other initiatives

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer,
UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Srinivas Sista
Google Chrome

https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html

summary: VUL-0: chromium: Update to 90.0.4430.85


--1619004224.1cb2bf20.21399
Date: Wed, 21 Apr 2021 11:23:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185083

            Bug ID: 1185083
           Summary: VUL-0: CVE-2021-21372: nim: doCmd can be leveraged to execute arbitrary commands
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/280574/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: anicka-at-suse.com
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: adrian.glaubitz-at-suse.com
          Found By: Security Response Team
           Blocker: ---

rh#1951714

Nimble is a package manager for the Nim programming language. In Nim release
version before versions 1.2.10 and 1.4.4, Nimble doCmd is used in different
places and can be leveraged to execute arbitrary commands. An attacker can
craft a malicious entry in the packages.json package list to trigger code
execution.

https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37
https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1951714
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21372
https://github.com/nim-lang/security/security/advisories/GHSA-rg9f-w24h-962p
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21372
https://github.com/nim-lang/nimble/commit/7bd63d504a4157b8ed61a51af47fb086ee818c37
https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/


--1619004429.FACb768.29879
Date: Wed, 21 Apr 2021 11:27:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185084

            Bug ID: 1185084
           Summary: VUL-0: CVE-2021-21373: nim: "nimble refresh" falls back to a non-TLS URL in case of errror
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/280575/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: anicka-at-suse.com
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: adrian.glaubitz-at-suse.com
          Found By: Security Response Team
           Blocker: ---

rh#1951711

Nimble is a package manager for the Nim programming language. In Nim release
versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of
Nimble packages over HTTPS by default. In case of error it falls back to a
non-TLS URL http://irclogs.nim-lang.org/packages.json. An attacker able to
perform MitM can deliver a modified package list containing malicious software
packages. If the packages are installed and used the attack escalates to
untrusted code execution.

https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1951711
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21373
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21373
https://github.com/nim-lang/security/security/advisories/GHSA-8w52-r35x-rgp8
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/


--1619004566.32fBa0.29578
Date: Wed, 21 Apr 2021 11:29:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185085

            Bug ID: 1185085
           Summary: VUL-0: CVE-2021-21374: nim: Improper verification of the SSL/TLS certificate
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/280576/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: anicka-at-suse.com
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: adrian.glaubitz-at-suse.com
          Found By: Security Response Team
           Blocker: ---

rh#1951717

Nimble is a package manager for the Nim programming language. In Nim release
versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of
Nimble packages over HTTPS without full verification of the SSL/TLS certificate
due to the default setting of httpClient. An attacker able to perform MitM can
deliver a modified package list containing malicious software packages. If the
packages are installed and used the attack escalates to untrusted code
execution.

https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/
https://github.com/nim-lang/Nim/pull/16940
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhxx

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1951717
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-21374
https://github.com/nim-lang/Nim/pull/16940
https://github.com/nim-lang/nimble/blob/master/changelog.markdown#0130
https://github.com/nim-lang/security/security/advisories/GHSA-c2wm-v66h-xhxx
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21374
https://consensys.net/diligence/vulnerabilities/nim-insecure-ssl-tls-defaults-remote-code-execution/


--1619016074.CACB0.27317
Date: Wed, 21 Apr 2021 14:41:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185100

            Bug ID: 1185100
           Summary: GCC 11: libqt5-qtdeclarative package fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:Gcc7/libqt5-qtdeclarative/standard/x86_64

with:
[   68s]
/home/abuild/rpmbuild/BUILD/qtdeclarative-everywhere-src-5.15.2/src/3rdparty/masm/yarr/Yarr.h:46:44:
error: 'numeric_limits' is not a member of 'std'
[   68s]    46 | static const unsigned offsetNoMatch =
std::numeric_limits<unsigned>::max();
[   68s]       |                                            ^~~~~~~~~~~~~~
[   68s]
/home/abuild/rpmbuild/BUILD/qtdeclarative-everywhere-src-5.15.2/src/3rdparty/masm/yarr/Yarr.h:46:59:
error: expected primary-expression before 'unsigned'
[   68s]    46 | static const unsigned offsetNoMatch =
std::numeric_limits<unsigned>::max();
[   68s]       |
^~~~~~~~


--1619031100.C2171.21327
Date: Wed, 21 Apr 2021 18:51:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185113

            Bug ID: 1185113
           Summary: With kernel 5.3.18-lp152.72.1 kernel-syms requires kernel-preempt and kernel-preempt-devel
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: openSUSE Leap 15.2
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: maintenance-at-opensuse.org
          Reporter: kaykaykay123-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

System notoriously installs kernel-preempt and kernel-preempt-devel.

It looks the same as bug ??? 1184578
https://bugzilla.opensuse.org/show_bug.cgi?id=1184578, but going further.

I don't need something-preempt at all. I don't want to install preempt kernel
and update it. I don't want to suddenly reveal that LAN/WLAN/etc. is not
working due to preempt kernel is loaded.

Possible solution: bifurcate kernel-syms to kernel-syms-default and
kernel-syms-preempt.

Forum discussion:
https://forums.opensuse.org/showthread.php/552942-With-kernel-5-3-18-lp152-72-1-kernel-syms-requires-kernel-preempt-and-kernel-preempt-devel
https://forums.opensuse.org/showthread.php/549337-Is-it-normal-that-my-running-kernel-is-kernel-preempt-instead-of-kernel-default?p=3022911#post3022911


--1619094498.8eB30.5666
Date: Thu, 22 Apr 2021 12:28:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185150

            Bug ID: 1185150
           Summary: python-M2Crypto: missing dependency on python-parameterized ?
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mcepl-at-suse.com
          Reporter: rfrohl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

For an internal tool we use python-M2Crypto, but it looks like the rpm might be
missing a dependency onto python-parameterized:

Traceback (most recent call last):
  File "/usr/bin/mtk", line 6, in <module>
    from pkg_resources import load_entry_point
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 3252,
in <module>
    def _initialize_master_working_set():
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 3235,
in _call_aside
    f(*args, **kwargs)
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 3264,
in _initialize_master_working_set
    working_set = WorkingSet._build_master()
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 583,
in _build_master
    ws.require(__requires__)
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 900,
in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/lib/python3.8/site-packages/pkg_resources/__init__.py", line 786,
in resolve
    raise DistributionNotFound(req, requirers)
pkg_resources.DistributionNotFound: The 'parameterized' distribution was not
found and is required by M2Crypto


body:
--1619167672.6d28823.17026
Date: Fri, 23 Apr 2021 08:47:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185220

            Bug ID: 1185220
           Summary: GCC 11: farstream package fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:Gcc7/farstream/standard/x86_64

upstream issue:
https://gitlab.freedesktop.org/farstream/farstream/-/issues/19

summary: GCC 11: farstream package fails


--1619182819.cE84b0.31394
Date: Fri, 23 Apr 2021 13:00:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185232

            Bug ID: 1185232
           Summary: something has gone seriously wrong: shim_init() - system does not boot anymore after installing today's updates
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: openSUSE Leap 15.2
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Bootloader
          Assignee: screening-team-bugs-at-suse.de
          Reporter: Mathias.Homann-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

after today's updates, either openSUSE-2021-598 or openSUSE-2021-599, my system
didn't boot anymore. All I got was a black screen with this text:

"Failed to get load options: Invalid Parameter
set_second_stage() failed: Invalid Parameter
Something has gone seriously wrong: shim_init() failed: Invalid Parameter"

to get it back to working I had to:
1. disable secure boot in bios
2. boot the installed system from DVD
3. log in as root, and re-install grub2 from yast with "secure boot off".

I'm not sure if its the shim patch or the grub patch that is broken, or
something about the bios on my computer - on my laptop everything is fine...


--1619198221.44AF2E0.11423
Date: Fri, 23 Apr 2021 17:17:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185245

            Bug ID: 1185245
           Summary: openSUSE-build-key can not be built on s390x
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: S/390-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ada.lovelace-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

opensuse-build-key can not be built for s390x at the moment.

There is following error message:
[   24s] Processing files: openSUSE-build-key-1.0-38.1.s390x
[   24s] error: File not found:
/home/abuild/rpmbuild/BUILDROOT/openSUSE-build-key-1.0-38.1.s390x/usr/lib/rpm/gnupg/keys/gpg-pubkey-f6ab3975-5ad08cb7.asc
[   24s] Executing(%doc): /bin/sh -e /var/tmp/rpm-tmp.QRsX0O
[   24s] + umask 022
[   24s] + cd /home/abuild/rpmbuild/BUILD
[   24s] + cd openSUSE-build-key-1.0
[   24s] +
DOCDIR=/home/abuild/rpmbuild/BUILDROOT/openSUSE-build-key-1.0-38.1.s390x/usr/share/doc/packages/openSUSE-build-key
[   24s] + export LC_ALL=C
[   24s] + LC_ALL=C
[   24s] + export DOCDIR
[   24s] + /usr/bin/mkdir -p
/home/abuild/rpmbuild/BUILDROOT/openSUSE-build-key-1.0-38.1.s390x/usr/share/doc/packages/openSUSE-build-key
[   24s] + cp -pr security_at_suse_de.asc
/home/abuild/rpmbuild/BUILDROOT/openSUSE-build-key-1.0-38.1.s390x/usr/share/doc/packages/openSUSE-build-key
[   24s] + cp -pr security_at_suse_de_old.asc
/home/abuild/rpmbuild/BUILDROOT/openSUSE-build-key-1.0-38.1.s390x/usr/share/doc/packages/openSUSE-build-key
[   24s] + RPM_EC=0
[   24s] ++ jobs -p
[   24s] + exit 0
[   24s]
[   24s]
[   24s] RPM build errors:
[   24s]     File not found:
/home/abuild/rpmbuild/BUILDROOT/openSUSE-build-key-1.0-38.1.s390x/usr/lib/rpm/gnupg/keys/gpg-pubkey-f6ab3975-5ad08cb7.asc

Failed build:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:zSystems/openSUSE-build-key/standard/s390x


--1619288152.Cf51f50.30281
Date: Sat, 24 Apr 2021 18:15:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185261

            Bug ID: 1185261
           Summary: UEFI Boot fail after update - could not create MoklistXRT
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: openSUSE Leap 15.2
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: bugs-at-elhoy.co.uk
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Recent zypper up on 15.2 resulted in system which will not boot - is a
GRUB/UEFI fault, as far as I can tell from other internet research.

I am new to MOK and UEFI inner workings.

Host is Dell Optiplex 790, A22 BIOS (latest 2018).

---
Boot error on screen:
"Could not create MokListXRT: Out of Resources
Something has gone seriously wrong: import_mok_state() failed: Out of
Resources"

Pauses for 5-10seconds then powers off.

Not an error flagged by BIOS - Boot from USB, BIOS settings etc all okay.

---

Other possibly related info, but few mentions of MOKLISTXRT particularly:
* https://forums.opensuse.org/showthread.php/543433-update-killed-bootloader
(Aug 2020)

* https://bugzilla.opensuse.org/show_bug.cgi?id=909157 (2014 MOKListXRT)

* https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1867092


--1619296008.eCadD50.19878
Date: Sat, 24 Apr 2021 20:26:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185265

            Bug ID: 1185265
           Summary: [SELinux] no default label for /dev/mqueue and confusion about
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: mcepl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 848729
  --> https://bugzilla.suse.com/attachment.cgi?id=848729&action=edit
photo of the screen with the problem

When running autorelabel with new SELinux policy
(selinux-policy-20210419-93.2.noarch) I get two interesting error messages:

* Warning: no default label for /dev/mqueue

* conflicting labels for
/usr/lib64/libreoffice/program/resource/common/fonts/opens___.ttf and
/usr/lib64/libreoffice/share/fonts/truetype/opens___.ttf (it ended up with
system_u:object_r:lib_t:s0 label.


body:
--1619431328.Db6B0.18937
Date: Mon, 26 Apr 2021 10:02:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185285

            Bug ID: 1185285
           Summary: AUDIT-0: systemd homed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: systemd-maintainers-at-suse.de
          Found By: ---
           Blocker: ---

homed in https://build.opensuse.org/request/show/885896 offers a dbus service
and uses polkit and pam.

[  314s] systemd-experimental.i586: E: suse-dbus-unauthorized-service (Badness:
10) /usr/share/dbus-1/system-services/org.freedesktop.home1.service
[  314s] systemd-experimental.i586: E: suse-dbus-unauthorized-service (Badness:
10)
/usr/share/dbus-1/system.d/org.freedesktop.home1.conf

[  314s] systemd-experimental.i586: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.home1.authenticate-home
(auth_admin_keep:auth_admin_keep:auth_admin_keep)
[  314s] systemd-experimental.i586: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.home1.create-home
(auth_admin_keep:auth_admin_keep:auth_admin_keep)
[  314s] systemd-experimental.i586: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.home1.passwd-home
(auth_admin_keep:auth_admin_keep:auth_admin_keep)
[  314s] systemd-experimental.i586: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.home1.remove-home
(auth_admin_keep:auth_admin_keep:auth_admin_keep)
[  314s] systemd-experimental.i586: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.home1.resize-home
(auth_admin_keep:auth_admin_keep:auth_admin_keep)
[  314s] systemd-experimental.i586: E: polkit-untracked-privilege (Badness: 10)
org.freedesktop.home1.update-home
(auth_admin_keep:auth_admin_keep:auth_admin_keep)

[  314s] systemd-experimental.i586: E: suse-pam-unauthorized-module (Badness:
10) pam_systemd_home.so

Upstream:
https://github.com/systemd/systemd/tree/main/src/home
https://github.com/systemd/systemd/blob/main/src/home/org.freedesktop.home1.policy
https://github.com/systemd/systemd/blob/main/src/home/org.freedesktop.home1.conf
https://github.com/systemd/systemd/blob/main/src/home/pam_systemd_home.c

summary: AUDIT-0: systemd homed


body:
--1619436578.DbE78A83.30272
Date: Mon, 26 Apr 2021 11:29:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185287

            Bug ID: 1185287
           Summary: Images fail to build on armv6 and armv7
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: armv7
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
                CC: afaerber-at-suse.com, dmueller-at-suse.com, fvogt-at-suse.com
          Found By: ---
           Blocker: ---

Images fail to build on armv6 and armv7 because it cannot find some packages
whereas they are built properly.
This prevent Tumbleweed to roll.

One example is:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:ARM/JeOS:JeOS-efi-pxe/images/armv7l

[  149s] [ ERROR   ]: 10:07:17 | KiwiBootStrapPhaseFailed: Bootstrap package
installation failed: No provider of 'systemd' found.
[  149s] No provider of 'btrfsprogs' found.
[  149s] No provider of 'sysconfig' found.
[  149s] No provider of 'grub2' found.
[  149s] No provider of 'filesystem' found.
[  149s] No provider of 'openssh' found.
[  149s] No provider of 'udev' found.
[  149s] No provider of 'zypper' found.
[  149s] No provider of 'dracut' found.
[  149s] No provider of 'e2fsprogs' found.
[  149s] No provider of 'gpg2' found.
[  149s] No provider of 'iproute2' found.
[  149s] No provider of 'pam' found.
[  149s] No provider of 'snapper' found.
[  149s] No provider of 'wicked' found.
[  149s] No provider of 'alsa' found.
[  149s] No provider of 'cpupower' found.
[  149s] No provider of 'gettext-runtime' found.
[  149s] No provider of 'kmod' found.
[  149s] No provider of 'openSUSE-release' found.
[  149s] No provider of 'shadow' found.
[  149s] No provider of 'timezone' found.
[  149s] No provider of 'aaa_base-extras' found.
[  149s] No provider of 'acl' found.
[  149s] No provider of 'bzip2' found.
[  149s] No provider of 'chrony' found.
[  149s] No provider of 'glibc-locale' found.
[  149s] No provider of 'gptfdisk' found.
[  149s] No provider of 'iputils' found.
[  149s] No provider of 'ncurses-utils' found.
[  149s] No provider of 'ntfs-3g' found.
[  149s] No provider of 'pam_pwquality' found.
[  149s] No provider of 'rsync' found.
[  149s] No provider of 'systemd-sysvinit' found.
[  149s] No provider of 'unzip' found.
[  149s] No provider of 'upower' found.
[  149s] No provider of 'vim' found.
[  149s] No provider of 'wicked-service' found.
[  149s] No provider of 'wireless-tools' found.
[  149s] No provider of 'dtc' found.
[  149s] No provider of 'fipscheck' found.
[  149s] No provider of 'irqbalance' found.
[  149s] No provider of 'kernel-default' found.
[  149s] No provider of 'krb5' found.
[  149s] No provider of 'less' found.
[  149s] No provider of 'libgcc_s1' found.
[  149s] No provider of 'libgomp1' found.
[  149s] No provider of 'libyui-ncurses-pkg' found.
[  149s] No provider of 'lsof' found.
[  149s] No provider of 'ntfsprogs' found.
[  149s] No provider of 'openSUSE-build-key' found.
[  149s] No provider of 'patterns-base-base' found.
[  149s] No provider of 'patterns-base-basesystem' found.
[  149s] No provider of 'patterns-base-console' found.
[  149s] No provider of 'patterns-base-sw_management' found.
[  149s] No provider of 'sudo' found.
[  149s] No provider of 'sysconfig-netconfig' found.
[  149s] No provider of 'systemd-logger' found.
[  149s] No provider of 'usbutils' found.
[  149s] No provider of 'util-linux-systemd' found.
[  149s] No provider of 'wget' found.
[  149s] No provider of 'which' found.
[  149s] No provider of 'wpa_supplicant' found.
[  149s] No provider of 'cracklib-dict-small' found.
[  149s] No provider of 'iw' found.
[  149s] No provider of 'libsystemd0' found.
[  149s] No provider of 'libudev1' found.
[  149s] No provider of 'net-tools' found.
[  149s] No provider of 'openSUSE-release-ftp' found.
[  149s] No provider of 'yast2-users' found.

summary: Images fail to build on armv6 and armv7


body:
--1619516954.Fc3CD5.18651
Date: Tue, 27 Apr 2021 09:49:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185340

            Bug ID: 1185340
           Summary: gnome-system-monitor 40.0 has a Bug
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: Sauerlandlinux-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Can somebody update gnome-system-monitor to version 40.1 because of this error:

gnome-system-monitor

(gnome-system-monitor:29710): Gtk-CRITICAL **: 20:08:25.688: gtk_box_pack:
assertion '_gtk_widget_get_parent (child) == NULL' failed

(gnome-system-monitor:29710): Handy-ERROR **: 20:08:25.732:
gtk_window_set_titlebar() is not supported for HdyWindow fish: Job 1,
'gnome-system-monitor' terminated by signal SIGTRAP (Verfolgungs- oder
Haltepunkt erreicht) micha@odin2 ~ [SIGTRAP]>

See:
https://forums.opensuse.org/showthread.php/552837-gnome-system-monitor-startet-nicht-mehr-unter-Cinnamon-DE

See: https://gitlab.gnome.org/GNOME/gnome-system-monitor/-/issues/182

Its patched with version 40.1
https://gitlab.gnome.org/GNOME/gnome-system-monitor/-/tree/gnome-40

summary: gnome-system-monitor 40.0 has a Bug


--1619518997.02Ae02.25054
Date: Tue, 27 Apr 2021 10:23:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185343

            Bug ID: 1185343
           Summary: UDF can be selected as file system but udftools is missing on DVD
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: aschnell-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

During installation with YaST it is possible to select UDF as a file
system. Later YaST tells that the udftools package must be selected.
It is not included on the DVD.

Only when going back and activating online repositories the package
is available. So an installation without network is not possible.

Also after going back and forth in YaST it seems as if the changes
done to the storage proposal where silently lost.


--1619599771.d72A0.13059
Date: Wed, 28 Apr 2021 08:49:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185398

            Bug ID: 1185398
           Summary: VUL-0: CVE-2021-21227,CVE-2021-21232,CVE-2021-21233,CVE-2021- 21228,CVE-2021-21229,CVE-2021-21230,CVE-2021-21231: chromium: Update to 90.0.4430.93
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: atoptsoglou-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2021-21227: Insufficient data validation in V8.
CVE-2021-21232: Use after free in Dev Tools.
CVE-2021-21233: Heap buffer overflow in ANGLE.
CVE-2021-21228: Insufficient policy enforcement in extensions.
CVE-2021-21229: Incorrect security UI in downloads.
CVE-2021-21230: Type Confusion in V8.
CVE-2021-21231: Insufficient data validation in V8.

Reference

https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html


--1619606043.A80bAd10.18673
Date: Wed, 28 Apr 2021 10:34:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185400

            Bug ID: 1185400
           Summary: [icu69.1] nodejs 15 fails to build against updated icu version
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

icu has been submitted for upgrade from version 68 to 69.1

AMongst the failures is nodejs15, failing with something like:

[ 2060s] ../deps/v8/src/objects/js-list-format.cc:146:67: error: 'static
icu_69::ListFormatter* icu_69::ListFormatter::createInstance(const
icu_69::Locale&, const char*, UErrorCode&)' is private within this context
[ 2060s]   146 |       icu_locale, GetIcuStyleString(style_enum, type_enum),
status);

A full build log can currently by found at

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:L/nodejs15/standard/x86_64


--1619627945.Ce570.31614
Date: Wed, 28 Apr 2021 16:39:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185418

            Bug ID: 1185418
           Summary: AUDIT-0: [tuned]: [tuned.noarch: E: polkit-unauthorized-privilege (Badness: 10000) com.redhat.tuned.post_loaded_profile (yes:yes:yes)]
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: trenn-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Also see:
https://build.opensuse.org/request/show/886742


--1619648112.e117a00.21004
Date: Wed, 28 Apr 2021 22:15:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185429

            Bug ID: 1185429
           Summary: qbs doesn't accomodate -qt5 suffix on Qt tools
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: uhhadd-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Qbs is currently incapable of building Qt applications on openSUSE due to the
fact that setup-qt.js has not been modified to accomodate for the changed names
of Qt tools downstream.


--1619682641.B3a73cF0.7265
Date: Thu, 29 Apr 2021 07:50:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185441

            Bug ID: 1185441
           Summary: "system is compromised" during boot after grub2+shim update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Bootloader
          Assignee: screening-team-bugs-at-suse.de
          Reporter: robert.simai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I installed the most recent

kernel-default-5.3.18-lp152.72.1.x86_64
shim-15.4-lp152.4.8.1.x86_64
grub2-2.04-lp152.7.25.1.x86_64

on my Dell Precision 3620 this week and rebooted as required. The system
doesn't come up but shows "system is compromised" for a second, followed by
power down.

If I change from "UEFI with secure boot" to "UEFI without secure boot" it
behaves well again and just boots.

I've set "mokutil --set-verbosity true" as advised which outputs a lot of
messages, I unfortunately have no serial console at hand to connect and save
them. I'll try to attach a video from the screen that shows the boot process
and messages.


--1619684066.2c808f0.6785
Date: Thu, 29 Apr 2021 08:14:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185444

            Bug ID: 1185444
           Summary: Stellarium: cannot toggle full screen mode on GNOME 40
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pstivanin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I've opened an issue upstream
(https://github.com/Stellarium/stellarium/issues/1625), because since the
update to GNOME 40 full screen mode cannot be toggled anymore.

It works fine on KDE, and it was working fine on GNOME 3.38, so the issue is
definitely due to GNOME 40.

How to reproduce:
* install openSUSE Tumbleweed with GNOME 40.x
* install Stellarium 0.21.0
* Stellarium starts in full screen mode. Press F11 and watch the window
disappear, but with ps aux we can see that the process is still alive in bg.


--1619705411.272b44480.21427
Date: Thu, 29 Apr 2021 14:10:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185468

            Bug ID: 1185468
           Summary: AUDIT-0: systemd: new D-Bus method / polkit action org.freedesktop.login1.inhibit-handle-reboot-key
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fbui-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

A new DBUS method has been introduced with systemd v248 which we plan to
release in Factory soon.

Relevant commit is :
https://github.com/systemd/systemd/commit/adbb2b6afed7858f64f5b940579f6efe79eee997

Could you give it a review and whitelist it if appropriate ?

Thanks.


--1619705987.0f34Db0.9564
Date: Thu, 29 Apr 2021 14:19:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185469

            Bug ID: 1185469
           Summary: [AUDIT] systemd-network.x86_64: W: polkit-changed-rules /usr/share/polkit-1/rules.d/60-systemd-networkd.rules
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fbui-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Can you please review the changes in
/usr/share/polkit-1/rules.d/60-systemd-networkd.rules [1] introduced by systemd
v248 ?

I think only the file header changed.

Thanks

[1]
https://github.com/openSUSE/systemd/blob/openSUSE-Factory/src/network/systemd-networkd.rules


body:
--1619777041.F21e1f0.6647
Date: Fri, 30 Apr 2021 10:04:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185496

            Bug ID: 1185496
           Summary: chromium does not support ftp
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: msuchanek-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Enable support for FTP URLs in chrome://flags/ is disabled and the code is
scheduled for removal upstream.

I don't think there is much to be done except using another web browser.

It should be documented once Chromium 88 or whatever version brought the change
reaches Leap.

summary: chromium does not support ftp


--1619874192.41Dbf46.15300
Date: Sat, 1 May 2021 13:03:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185525

            Bug ID: 1185525
           Summary: Please update Gnome Drawing and add to main repo
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: sb56637-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi there, Gnome Drawing is an excellent little app, and it fills a need on the
Linux desktop. I am using the current version in the Graphics repo, and it
works well. Would it be possible to update it to the newest 0.8.0 release and
include the package in the main TW and Leap 15.2 and 15.3 repos? Thanks a lot!


--1619959253.C345a8B40.3587
Date: Sun, 2 May 2021 12:40:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185531

            Bug ID: 1185531
           Summary: virt-viewer 10.0 second display handling
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: code-at-bnavigator.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Since virt-viewer has been updated to 10.0 with the headerbar instead of the
menu, there is trouble with handling the second virtual displays of my guest
vm.

My system:
Host:
openSUSE Tumbleweed, x86_64, latest snapshot.
X11
KDE-Plasma 5.21.4
KDE-Framework 5.81.0
libgtk 3.24.29

Guest 1:
openSUSE MicroOS, latest snapshot
qemu, KVM, x86_64, 1 QXL Graphics device
spice-vdagent 0.21.0, systemd service is active. Resizing the window correctly
emits a resolution change.

On connecting, virt-viewer opens one window, one screen is active, offers to
activate the second screen in the title-bar, but clicking on the menu item has
no effect except for this error mesage on the console:
...
(virt-viewer:6247): virt-viewer-CRITICAL **: 14:08:13.192:
virt_viewer_app_action_window: assertion 'VIRT_VIEWER_IS_WINDOW(win)' failed
...

This has worked before virt-viewer 10.0

Guest2:
Windows 10
qemu, KVM, x86_64, 2 QXL Graphics devices

On connecting virt-viewer, it starts with two windows for two screens. Enabling
and disabling the second screen from the window of the first screen works.

Disabling the second screen by its own title-bar menu item closes the window
and causes the window of the first screen to be frozen, not reacting to any
user input anymore. Killing and reconnecting virt-viewer helps.

(I never tried a second screen on a Windows guest before virt-viewer 10.0)


--1619962264.4EcA0.6864
Date: Sun, 2 May 2021 13:31:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185534

            Bug ID: 1185534
           Summary: kernel: Lockdown: systemd: /dev/mem,kmem,port is restricted; see man kernel_lockdown.7
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Documentation
          Assignee: fs-at-suse.com
          Reporter: Ulrich.Windl-at-rz.uni-regensburg.de
        QA Contact: fs-at-suse.com
          Found By: ---
           Blocker: ---

There are several syslog messages referring to kernel_lockdown.7, but no such
manual page exists:
# man 7 kernel_lockdown
No manual entry for kernel_lockdown in section 7

I've installed all the obvious manual packages.


--1620113574.b6DaAb0.24906
Date: Tue, 4 May 2021 07:32:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185600

            Bug ID: 1185600
           Summary: texlive 2021 fails on tests on Arm and PowerPC
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
                CC: afaerber-at-suse.com, dmueller-at-suse.com
          Found By: ---
           Blocker: ---

texlive 2021 fails on tests on Arm and PowerPC:
https://build.opensuse.org/package/show/openSUSE:Factory:ARM/texlive
https://build.opensuse.org/package/show/openSUSE:Factory:PowerPC/texlive

It succeeds in Publishing:TeXLive project becauseof the project config which
contains:
%if "%_repository" == "openSUSE_Factory" || "%_repository" ==
"openSUSE_Factory_ARM" || "%_repository" == "openSUSE_Factory_PowerPC" ||
"%_repository" == "openSUSE_Tumbleweed"
Substitute: lua-devel lua53-devel
Preinstall: liblua5_3-5 !liblua5_3
%endif

IMHO, this part should dropped to detect build failures which happen in
Factory:* projects.

The tests are broken with lua 5.4 whereas they pass with lua 5.3. AFAICS, only
the 'sortinithash' is different in failing tests:
# -      \\field{sortinithash}{8de16967003c7207dae369d874f1456e}
# +      \\field{sortinithash}{d7095fff47cda75ca2589920aae98399}


--1620147876.D3dc2e0.17316
Date: Tue, 4 May 2021 17:04:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1185625

            Bug ID: 1185625
           Summary: transactional-update: /etc has wrong selinux label
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: MicroOS
          Assignee: iforster-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: aplanas-at-suse.com
          Found By: ---
           Blocker: ---

The context of /etc is not properly initialized during a transactional-update
session. So installing packages that call ldconfig in %post don't work.

# l -Zd /etc
drwxr-xr-x. 1 root root system_u:object_r:etc_t:s0 86  4. Mai 16:34 /etc/
# transactional-update shell
[...]
# l -Zd /etc
drwxr-xr-x. 1 root root unconfined_u:object_r:unlabeled_t:s0 10 May  4 17:02
/etc/
# ldconfig
ldconfig: Warning: ignoring configuration file that cannot be opened:
/etc/ld.so.conf: Permission denied
ldconfig: Can't create temporary cache file /etc/ld.so.cache.KuqjFz: Permission
denied
# setfilecon system_u:object_r:etc_t:s0 /etc
# ldconfig
#


--1620196239.87F55C180.18470
Date: Wed, 5 May 2021 06:30:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1185631

            Bug ID: 1185631
           Summary: VUL-0: exim: 21Nails - Multiple vulnerabilities in Exim
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: rfrohl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

oss-security:

Qualys Security Advisory

21Nails: Multiple vulnerabilities in Exim

========================================================================
Contents
========================================================================

Summary
Local vulnerabilities
- CVE-2020-28007: Link attack in Exim's log directory
- CVE-2020-28008: Assorted attacks in Exim's spool directory
- CVE-2020-28014: Arbitrary file creation and clobbering
- CVE-2021-27216: Arbitrary file deletion
- CVE-2020-28011: Heap buffer overflow in queue_run()
- CVE-2020-28010: Heap out-of-bounds write in main()
- CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
- CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
- CVE-2020-28015: New-line injection into spool header file (local)
- CVE-2020-28012: Missing close-on-exec flag for privileged pipe
- CVE-2020-28009: Integer overflow in get_stdinput()
Remote vulnerabilities
- CVE-2020-28017: Integer overflow in receive_add_recipient()
- CVE-2020-28020: Integer overflow in receive_msg()
- CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
- CVE-2020-28021: New-line injection into spool header file (remote)
- CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
- CVE-2020-28026: Line truncation and injection in spool_read_header()
- CVE-2020-28019: Failure to reset function pointer after BDAT error
- CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
- CVE-2020-28018: Use-after-free in tls-openssl.c
- CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
Acknowledgments
Timeline

========================================================================
Summary
========================================================================

We recently audited central parts of the Exim mail server
(https://en.wikipedia.org/wiki/Exim) and discovered 21 vulnerabilities
(from CVE-2020-28007 to CVE-2020-28026, plus CVE-2021-27216): 11 local
vulnerabilities, and 10 remote vulnerabilities. Unless otherwise noted,
all versions of Exim are affected since at least the beginning of its
Git history, in 2004.

We have not tried to exploit all of these vulnerabilities, but we
successfully exploited 4 LPEs (Local Privilege Escalations) and 3 RCEs
(Remote Code Executions):

- CVE-2020-28007 (LPE, from user "exim" to root);

- CVE-2020-28008 (LPE, from user "exim" to root);

- CVE-2020-28015 (LPE, from any user to root);

- CVE-2020-28012 (LPE, from any user to root, if allow_filter is true);

- CVE-2020-28020 (unauthenticated RCE as "exim", in Exim < 4.92);

- CVE-2020-28018 (unauthenticated RCE as "exim", in 4.90 <= Exim < 4.94,
  if TLS encryption is provided by OpenSSL);

- CVE-2020-28021 (authenticated RCE, as root);

- CVE-2020-28017 is also exploitable (unauthenticated RCE as "exim"),
  but requires more than 25GB of memory in the default configuration.

We will not publish our exploits for now; instead, we encourage other
security researchers to write and publish their own exploits:

- This advisory contains sufficient information to develop reliable
  exploits for these vulnerabilities; in fact, we believe that better
  exploitation methods exist.

- We hope that more security researchers will look into Exim's code and
  report their findings; indeed, we discovered several of these
  vulnerabilities while working on our exploits.

- We will answer (to the best of our abilities) any questions regarding
  these vulnerabilities and exploits on the public "oss-security" list
  (https://oss-security.openwall.org/wiki/mailing-lists/oss-security).

Last-minute note: as explained in the Timeline, we developed a minimal
set of patches for these vulnerabilities; for reference and comparison,
it is attached to this advisory and is also available at
https://www.qualys.com/research/security-advisories/.

https://seclists.org/oss-sec/2021/q2/93