body:
--1535949126.B0CD0Cb0.18053
Date: Mon, 3 Sep 2018 04:32:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1106850

            Bug ID: 1106850
           Summary: xfig crashes if  noto-sans-cjk-fonts are installed
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: comes-at-naic.edu
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After I install the fonts noto-sans-cjk-fonts, when I start xfig I got these
warnings in the terminal:

Warning: Missing charsets in String to FontSet conversion
Warning: Cannot convert string "-URW-Nimbus Roman No9
L-medium-r-normal--34-*-*-*-*-*-*-*,-kochi-mincho-medium-r-normal--34-*-*-*-*-*-jisx0208.1983-0,-baekmukttf-batang-medium-r-normal--34-*-*-*-*-*-ksc5601.1987-0,-*-times-medium-r-normal--34-*-*-*-*-*-*-*,-*-*-medium-r-normal--34-*-*-*-*-*-*-*,*--34-*-*-times-medium-r-normal--16-*-*-*-*-*-*-*,-*-*-medium-r-normal--16-*-*-*-*-*-*-*,*--16-*"
to type FontSet
Warning: Missing charsets in String to FontSet conversion
Warning: Unable to load any usable fontset
Warning: Missing charsets in String to FontSet conversion
Warning: Unable to load any usable fontset

and when I select File->Open (or Merge or Save As or Export) xfig crashes and
print this error message:

Error: Aborting: no fontset found

If I remove all the noto-sans-cjk-fonts, then xfig works again.

Whatever is causing the problem apparently it got fixed in tumbleweed (xfig
works fine also with noto-sans-cjk-fonts installed). It would be good to apply
the fix to 15.0 too.

pkgs: mkfontdir mkfontscale xfig


--1535996553.D560fc181.9432
Date: Mon, 3 Sep 2018 17:42:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1106954

            Bug ID: 1106954
           Summary: libqalculate has a weak dependency on its datafiles
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: stefan.bruens@rwth-aachen.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The qualculate sources include definitions of additional units, functions, etc.
which libqalculate tries to load on startup. These are not hard requirements.

libqalculate is e.g. used but the Plasma calculator krunner. If the qualculate
package is installed (which provides a command line calculator, and *also* the
xml data files), the following expression in KRunner works:

= 3 * 10^8 m/s * 24 * 60 * 60 * 365 s / lightyears
-> 1,000007349054008

Without qalculate installed, krunner issues some warnings:
---
I/O warning : failed to load external entity
"/usr/share/qalculate/prefixes.xml"
I/O warning : failed to load external entity
"/usr/share/qalculate/currencies.xml"
I/O warning : failed to load external entity "/usr/share/qalculate/units.xml"
I/O warning : failed to load external entity
"/usr/share/qalculate/functions.xml"
I/O warning : failed to load external entity
"/usr/share/qalculate/datasets.xml"
I/O warning : failed to load external entity
"/usr/share/qalculate/variables.xml"
I/O warning : failed to load external entity
"/usr/share/qalculate/currencies.xml"
I/O warning : failed to load external entity
"/usr/share/qalculate/eurofxref-daily.xml"
---

-> (9460800000000000 "m" "s") / ("s" * li("g" "h" "t" * year("s")))
i.e. it fails to parse the expression completely

simple expressions (i.e without e.g. units) work with or without the data sets:
= 100 * 20 + 1
-> 2001


body:
--1536052598.abCeD0.23331
Date: Tue, 4 Sep 2018 09:16:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107030

            Bug ID: 1107030
           Summary: python3 builds without -fwrapv option
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mcepl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Investigation of the failing tests in python-persistence package
(https://github.com/zopefoundation/persistent/issues/86) lead us to find out
that SUSE python3 is build without -fwrapv option for the C compiler. It is
upstream default which we successfully ignored for a long time, but it seems it
is really not correct. Therefore I suggest to add -fwrapv to OPT variable
(which governs options for the C compiler) for all python3 SPEC files.

summary: python3 builds without -fwrapv option


--1536067659.ADBF06F20.565
Date: Tue, 4 Sep 2018 13:27:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1107103

            Bug ID: 1107103
           Summary: Requesting icons for KDE Plasma and PIM patterns
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Plasma uses the generic KDE icon now and KDE PIM has no icon at all.


body:
--1536090762.27eFE670.5817
Date: Tue, 4 Sep 2018 19:52:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107187

            Bug ID: 1107187
           Summary: kpartx -l leaves a loop device behind
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: seroton10-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Steps to reproduce:

print:~ # truncate -s 10M disk.image
print:~ # fdisk disk.image

Welcome to fdisk (util-linux 2.31.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Device does not contain a recognized partition table.
Created a new DOS disklabel with disk identifier 0x1245ac3a.

Command (m for help): w
The partition table has been altered.
Syncing disks.

print:~ # fdisk -l disk.image
Disk disk.image: 10 MiB, 10485760 bytes, 20480 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x1245ac3a
print:~ # losetup --list
print:~ # kpartx -l disk.image
print:~ # losetup --list
NAME       SIZELIMIT OFFSET AUTOCLEAR RO BACK-FILE        DIO LOG-SEC
/dev/loop0         0      0         0  0 /root/disk.image   0     512

???
Why does kpartx -l leave behind a loop device on the inspected image?
???

print:~ # cat /etc/os-release
NAME="openSUSE Leap"
VERSION="15.0"
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="15.0"
PRETTY_NAME="openSUSE Leap 15.0"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:15.0"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
print:~ # uname -a
Linux print 4.12.14-lp150.12.16-default #1 SMP Tue Aug 14 17:51:27 UTC 2018
(28574e6) x86_64 x86_64 x86_64 GNU/Linux
print:~ # rpm -q kpartx
kpartx-0.7.3+67+suse.8f0c27b-lp150.1.1.x86_64

The same behaviour occurs with Tumbleweed 20180831.

summary: kpartx -l leaves a loop device behind


--1536145512.F6F43.27715
Date: Wed, 5 Sep 2018 11:05:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1107265

            Bug ID: 1107265
           Summary: openSUSE-15.0/armv7l/lpae: BUILD FAILED (ce24e5ea)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: armv7
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: yousaf.kaukab-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

../arch/arm/kvm/hyp/../../../../virt/kvm/arm/hyp/vgic-v2-sr.c:29:13: error:
implicit declaration of function 'read_sysreg_el2'; did you mean
'read_sysreg_el0'? [-Werror=implicit-function-declaration]
../arch/arm/kvm/hyp/../../../../virt/kvm/arm/hyp/vgic-v2-sr.c:29:29: error:
'spsr' undeclared (first use in this function)
../arch/arm/kvm/hyp/../../../../virt/kvm/arm/hyp/vgic-v2-sr.c:31:33: error:
macro "__read_sysreg" requires 4 arguments, but only 1 given
../arch/arm/include/asm/cp15.h:62:27: error: '__read_sysreg' undeclared (first
use in this function); did you mean 'vcpu_sysreg'?
../arch/arm/kvm/hyp/../../../../virt/kvm/arm/hyp/vgic-v2-sr.c:31:37: error:
'SCTLR_ELx_EE' undeclared (first use in this function); did you mean
'SCTLR_EE'?
                        ^~~~~~~
cc1: some warnings being treated as errors
make[4]: *** [../scripts/Makefile.build:326:
arch/arm/kvm/hyp/../../../../virt/kvm/arm/hyp/vgic-v2-sr.o] Error 1
make[3]: *** [../scripts/Makefile.build:599: arch/arm/kvm/hyp] Error 2
make[2]: ***
[/home/abuild/rpmbuild/BUILD/kernel-lpae-4.12.14/linux-4.12/Makefile:1059:
arch/arm/kvm] Error 2
make[2]: *** Waiting for unfinished jobs....
  CC      init/init_task.o
  LD      init/built-in.o
make[1]: *** [Makefile:152: sub-make] Error 2
make: *** [Makefile:24: __sub-make] Error 2


--1536151249.730518c5.28806
Date: Wed, 5 Sep 2018 12:40:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1107283

            Bug ID: 1107283
           Summary: Don't create /cloud-init-config subvolume by default
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kubic
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: fvogt-at-suse.com
          Found By: ---
           Blocker: ---

/cloud-init-config makes only sense if customers create their own, golden
images which contain a cloud-init configuration from the beginning. On YaST,
autoyast installed or with our kiwi by us created images, this subvolume does
not make much sense, as the user has to boot and login at first to create the
config files in this directory.

So it makes no sense to provide that directory by default.


--1536168802.C08720.9451
Date: Wed, 5 Sep 2018 17:33:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107337

            Bug ID: 1107337
           Summary: wxWidgets: Restore Webkit support for wxGTK3
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: j.v.dijk-at-tue.nl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Not so long ago, webview support was dropped from the wxWidgets packages. The
reason appears to be that there were various issues with the older webkit
versions that the wx-GTK2 packages relied upon. I understand that, although
this  is a major issue for us and has rendered the OpenSuse wx packages usable.
I think the problem started between 42.3 and 15.0.

At home I compiled wxWidgets with the --gtk=3 option, using webkit2, which *is*
still offered by OpenSuse and does not have the unresolved security issues. I
did not see any problem and everything works like a charm.

So my friendly request is:

Please, please, compile the wxGTK3* packages with webview (->webkit) enabled,
so we do not need to tell our OpenSuse users to compile wxWidgets themselves or
move to another distro. I duly note that there are already more custom wx reps
for OpenSuse than I believe is desirable.

Thank you in advance.


--1536186482.E6EDF1.21108
Date: Wed, 5 Sep 2018 22:28:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107387

            Bug ID: 1107387
           Summary: python-fiona fail to install (upgrade to latest version should fix it)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: nicole.xin-at-mdacorporation.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Package: python-fiona
Version: 1.5.1
failed to install due to dependency on python-orderdict.

python-orderdict is in python standard since python 2.7 and Fiona fixed this
bug in its version 1.8a2.

See https://github.com/Toblerity/Fiona/blob/master/CHANGES.txt for first bug
fix, version 1.8a2.

Can we get a upgraded package of python-fiona with version 1.8a2+.

Thanks!

----------------------------------------------
Log:
Building repository 'application' cache [....done]
Repository 'oss' is up to date.
Retrieving repository 'oss-update' metadata [.done]
Building repository 'oss-update' cache [....done]
All repositories have been refreshed.
Loading repository data...
Reading installed packages...
Resolving package dependencies...

Problem: nothing provides python-ordereddict needed by
python-fiona-1.5.1-lp150.1.3.x86_64
Solution 1: do not install python-fiona-1.5.1-lp150.1.3.x86_64
Solution 2: break python-fiona-1.5.1-lp150.1.3.x86_64 by ignoring some of its
dependencies


--1536301761.A74DF0.15385
Date: Fri, 7 Sep 2018 06:29:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107591

            Bug ID: 1107591
           Summary: VUL-0: CVE-2018-1000801: okular: Directory traversal in function unpackDocumentArchive() in core/document.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/213875/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#1626265

okular version 18.08 and earlier contains a Directory Traversal vulnerability
in
function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in
Arbitrary file creation on the user workstation. This attack appear to be
exploitable via he victim must open a specially crafted Okular archive. This
issue appears to have been corrected in version 18.08.1

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1626265
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000801
https://cgit.kde.org/okular.git/commit/?id=8ff7abc14d41906ad978b6bc67e69693863b9d47
https://bugs.kde.org/show_bug.cgi?id=398096


body:
--1536305190.c151FF3F3.1273
Date: Fri, 7 Sep 2018 07:26:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1107611

            Bug ID: 1107611
           Summary: move /etc/modprobe.d/50-blacklist.conf out of sysconfig
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: mt-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: martin.wilck-at-suse.com
          Found By: ---
           Blocker: ---

sysconfig doesn't seem to have much purpose anymore nowadays. It contains
/etc/modprobe.d/50-blacklist.conf though. It's counter intuitive to have such
hardware and physical machine related settings in sysconfig. How about moving
that file to e.g. suse-module-tools?

pkgs: suse-module-tools sysconfig


--1536337749.1fd85.11281
Date: Fri, 7 Sep 2018 16:29:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107711

            Bug ID: 1107711
           Summary: hp-setup 3.18.6 crash after network scanning when find a printer/fax
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Printing
          Assignee: jsmeix-at-suse.com
          Reporter: ecsos-at-schirra.net
        QA Contact: jsmeix-at-suse.com
          Found By: ---
           Blocker: ---

The new version 3.18.6 in Printing crash after networkscan.

replication:

Chose Network
Show Advanced Options
Click Manual Discovery
Enter IP Adress
Click at ok after find printer
Click at ok after find fax
---> Crash!!!

See: https://bugs.launchpad.net/hplip/+bug/1773320
Patch: https://launchpadlibrarian.net/373402368/hplip-use-binary-str.patch

Please fix it.
Thanks.


--1536483444.bad3aa2d0.17069
Date: Sun, 9 Sep 2018 08:57:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107765

            Bug ID: 1107765
           Summary: SpamAssassin Net::DNS : Patching required
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: b631093f-779b-4d67-9ffe-5f6d5b1d3f8a-at-protonmail.ch
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

SpamAssassin 3.4.1 has an important bug
(https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7223) that needs to be
patched if the release of the Net::DNS Perl package installed on your system is
1.01 or larger.

Leap15 is affected: SpamAssassin Server version 3.4.1 > perl -MNet::DNS -le
'print $Net::DNS::VERSION' 1.14


body:
Build Identifier:

Tried to start a VM at boot using the tools provided together package
virtualbox-5.2.18-lp150.4.14.1.
The VBoxManage binary creates/deletes the files e.g. "user.start" in the
VBOXAUTOSTART_DB directory when Autostart is enabled/disabled for the VM in
question.
However the vboxes.sh (/user/lib/virtualbox) seems not to fit to this mechanism
it eg implies the config file in /etc/sysconfig/vbox, which is not delivered
with the package, also telling from the script it expects the VM given in
tuples in the form of "vm-name;user" which does not fit to the user.start
approach taken by VBoxManage

Reproducible: Always

Actual Results:
vboxes.sh fails with no VM configured for autostart

Expected Results:
VM runs after boot

summary: Starting of virtualbox at boot fails


body:
--1536516502.082De2aA0.27337
Date: Sun, 9 Sep 2018 18:08:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107771

            Bug ID: 1107771
           Summary: tryton general bugfix release
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: axel.braun-at-gmx.de
          Reporter: astieger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The following general bugfix release was requested:

gnuhealth

- Adding a dummy executable called 'gnuhealth' with some help text

proteus

- Version 4.2.4 - Bugfix Release

tryton:

- Version 4.2.17 - Bugfix Release
- Version 4.2.16 - Bugfix Release
- Version 4.2.15 - Bugfix Release

trytond

- Version 4.2.15 - Bugfix Release
- Version 4.2.14 - Bugfix Release

trytond_purchase

- Version 4.2.6 - Bugfix Release

trytond_stock_supply

- Version 4.2.2 - Bugfix Release

pkgs: gnuhealth proteus tryton trytond trytond_purchase trytond_stock_supply

summary: tryton general bugfix release


--1536518607.7AD8DFA20.31160
Date: Sun, 9 Sep 2018 18:43:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107772

            Bug ID: 1107772
           Summary: Thunderbird 60.0 crashes on startup with old profile, runs with new one. Reverting to 52.9 fixes this.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: schleth_es-at-web.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After today's online update all our Thunderbirds (various users on several PCs,
all on Leap15) stopped working with the existing profiles.

thunderbird --ProfileManager works and lets me create a new profile that seems
to be working.

Just copying my old prefs.js into this profile makes it crash again. I have no
addons or themes installed.

Reverting to the previous version (52.9) fixes this problem.

With 60.0 the commandline says:
ExceptionHandler::GenerateDump cloned child 29331
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...

and the crashreporter means:
Add-ons:
langpack-ar%40thunderbird.mozilla.org:60.0,langpack-ca%40thunderbird.mozilla.org:60.0,langpack-cs%40thunderbird.mozilla.org:60.0,langpack-da%40thunderbird.mozilla.org:60.0,langpack-de%40thunderbird.mozilla.org:60.0,langpack-el%40thunderbird.mozilla.org:60.0,langpack-en-GB%40thunderbird.mozilla.org:60.0,langpack-es-AR%40thunderbird.mozilla.org:60.0,langpack-es-ES%40thunderbird.mozilla.org:60.0,langpack-fi%40thunderbird.mozilla.org:60.0,langpack-fr%40thunderbird.mozilla.org:60.0,langpack-hu%40thunderbird.mozilla.org:60.0,langpack-it%40thunderbird.mozilla.org:60.0,langpack-ja%40thunderbird.mozilla.org:60.0,langpack-ko%40thunderbird.mozilla.org:60.0,langpack-nb-NO%40thunderbird.mozilla.org:60.0,langpack-nl%40thunderbird.mozilla.org:60.0,langpack-pl%40thunderbird.mozilla.org:60.0,langpack-pt-BR%40thunderbird.mozilla.org:60.0,langpack-pt-PT%40thunderbird.mozilla.org:60.0,langpack-ru%40thunderbird.mozilla.org:60.0,langpack-sv-SE%40thunderbird.mozilla.org:60.0,langpack-zh-CN%40thunderbird.mo
 zilla.org:60.0,langpack-zh-TW%40thunderbird.mozilla.org:60.0,%7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:60.0
BuildID: 20180731173940
ContentSandboxCapabilities: 119
ContentSandboxCapable: 1
ContentSandboxLevel: 0
CrashTime: 1536518090
EMCheckCompatibility: true
FramePoisonBase: 9223372036600930304
FramePoisonSize: 4096
InstallTime: 1536506147
MozCrashReason: MOZ_RELEASE_ASSERT(this->mLength > 0) (|First()| called on an
empty string)
Notes: openSUSE Leap 15.0FP(D00-L1100-W00000000-T000) OpenGL: Intel Open Source
Technology Center


--1536535609.e15b6e0.20388
Date: Sun, 9 Sep 2018 23:26:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107776

            Bug ID: 1107776
           Summary: electronics/kicad: 3D models do not work
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: dmitry-at-roshchin.org
          Reporter: arjunmnair1-at-gmail.com
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Created attachment 782497
  --> http://bugzilla.opensuse.org/attachment.cgi?id=782497&action=edit
Select 3D Model

Hi,

KiCad 5 is unable to show any 3D models (wrl/step). The attachment shows a
screenshot of "Select 3D model", where the preview pane remains empty. The 3D
file exists and ${KISYS3DMOD} points to the correct path. None of the 3D models
show up in the 3D view.

A discussion on this issue can be found at :
https://forum.kicad.info/t/3d-models-not-showing/12494

About KiCad :
Application: kicad
Version: 5.0.0, release build
Libraries:
    wxWidgets 3.0.4
    libcurl/7.61.0 OpenSSL/1.1.0h zlib/1.2.11 libidn2/2.0.5 libpsl/0.20.2
(+libidn2/2.0.5) libssh/0.8.2/openssl/zlib nghttp2/1.32.0
Platform: Linux 4.18.5-1-default x86_64, 64 bit, Little endian, wxGTK
Build Info:
    wxWidgets: 3.0.4 (wchar_t,STL containers,compatible with 2.8) GTK+ 2.24
    Boost: 1.67.0
    OpenCASCADE Community Edition: 6.9.1
    Curl: 7.61.0
    Compiler: GCC 8.2.1 with C++ ABI 1013
Build settings:
    USE_WX_GRAPHICS_CONTEXT=OFF
    USE_WX_OVERLAY=OFF
    KICAD_SCRIPTING=ON
    KICAD_SCRIPTING_MODULES=ON
    KICAD_SCRIPTING_WXPYTHON=ON
    KICAD_SCRIPTING_ACTION_MENU=OFF
    BUILD_GITHUB_PLUGIN=ON
    KICAD_USE_OCE=ON
    KICAD_USE_OCC=OFF
    KICAD_SPICE=ON

OS information :
Distributor ID: openSUSE
Description:    openSUSE Tumbleweed
Release:        20180905


--1536567406.336af1B0.16770
Date: Mon, 10 Sep 2018 08:16:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1107798

            Bug ID: 1107798
           Summary: Fails to update python3-appdirs from Leap 15 to Tumbleweed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mlin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

With the last change in python-appdirs
https://build.opensuse.org/request/show/633233 , upgrade to current Tumbleweed
from Leap 15.0 fails to work due to python3-appdirs install failed.

2018-09-08 10:11:00 <5> install(3439) [zypp] Exception.cc(log):166
RpmDb.cc(doInstallPackage):2093 THROW:    Subprocess failed. Error: RPM failed:
error: unpacking of archive failed on file
/usr/lib/python3.6/site-packages/appdirs-1.4.3-py3.6.egg-info: cpio: File from
package already exists as a directory in system
2018-09-08 10:11:00 <5> install(3439) [zypp] Exception.cc(log):166 error:
python3-appdirs-1.4.3-2.1.noarch: install failed
2018-09-08 10:11:00 <5> install(3439) [zypp] Exception.cc(log):166 error:
python3-appdirs-1.4.3-lp150.1.6.noarch: erase skipped
2018-09-08 10:11:00 <5> install(3439) [zypp] Exception.cc(log):166
2018-09-08 10:11:01 <0> install(3439) [Pkg] Callbacks.YCP.cc(evaluate):240
Evaluating callback (registered funciton: ruby_reference)
2018-09-08 10:11:01 <0> install(3439) [Ruby]
binary/Yast.cc(ycp_module_call_ycp_function):282 Dynamic Proxy:
[UI::WidgetExists] with [5] params
2018-09-08 10:11:01 <0> install(3439) [Ruby]
binary/Yast.cc(ycp_module_call_ycp_function):291 Namespace created from UI
2018-09-08 10:11:01 <0> install(3439) [ui]
YUINamespace.cc(createFunctionCall):1035 overloaded WidgetExists, 2@46
2018-09-08 10:11:01 <0> install(3439) [Ruby]
binary/Yast.cc(ycp_module_call_ycp_function):326 Call WidgetExists
2018-09-08 10:11:01 <0> install(3439) [Ruby]
binary/Yast.cc(ycp_module_call_ycp_function):332 Append parameter
`progressCurrentPackage
2018-09-08 10:11:01 <0> install(3439) [ui]
YUINamespace.cc(finishParameters):915 Actual type: <unspec> (symbol)
2018-09-08 10:11:01 <0> install(3439) [ui]
YUINamespace.cc(finishParameters):932 Candidate: boolean WidgetExists (symbol)
MATCH: 0
2018-09-08 10:11:01 <1> install(3439) [Ruby] modules/PackageCallbacks.rb:455
DonePackage(error: 3, reason: 'Subprocess failed. Error: RPM failed: error:
unpacking of archive failed on file
/usr/lib/python3.6/site-packages/appdirs-1.4.3-py3.6.egg-info: cpio: File from
package already exists as a directory in system
error: python3-appdirs-1.4.3-2.1.noarch: install failed
error: python3-appdirs-1.4.3-lp150.1.6.noarch: erase skipped
')


--1536647529.8c608ceB1.23716
Date: Tue, 11 Sep 2018 06:32:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1107930

            Bug ID: 1107930
           Summary: SYSCONFIG_FILE variable not defined in /usr/share/apache2/script-helpers
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Apache
          Assignee: bnc-team-apache-at-forge.provo.novell.com
          Reporter: luipugs-at-yahoo.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The /usr/share/apache2/script-helpers script is provided by the apache2
package. Inside it are the functions find_mpm and load_sysconfig. find_mpm
calls load_sysconfig to get the value of the APACHE_MPM variable in
/etc/sysconfig/apache2. However, since the SYSCONFIG_FILE variable is not
defined then the load_sysconfig function does not work as expected.

/usr/sbin/start-apache2 uses the script /usr/share/apache2/script-helpers, but
it defines the SYSCONFIG_FILE variable so it works. However, other scripts
don't set it, like the post install script of the apache2-worker package. Its
post install script tries to set the /usr/sbin/httpd link according to the
value of the APACHE_MPM variable. If it is set to "worker", for example, then
it should have created the link /usr/sbin/httpd -> /usr/sbin/httpd-worker. As
mentioned this does not work.


--1536850066.B5310c0.19579
Date: Thu, 13 Sep 2018 14:47:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108329

            Bug ID: 1108329
           Summary: Plasma lockscreen can't unlock if there is no display manager installed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: equeim-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Other distros provide PAM file with plasma-workspace package (e.g.
https://src.fedoraproject.org/rpms/plasma-workspace/blob/master/f/kde or
https://git.archlinux.org/svntogit/packages.git/tree/trunk/kde.pam?h=packages/plasma-workspace),
but on openSUSE you need to install a display manager for this (you don't need
use it, you just need its PAM file). If you don't, Plasma's lockscreen will
refuse to unlock.


body:
--1536921088.4Bdd77511.19313
Date: Fri, 14 Sep 2018 10:31:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108450

            Bug ID: 1108450
           Summary: gnutls fails in handshake
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: lhenriques-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After last TW upgrade, where libgnutls got updated, I'm seeing my weechat
failing to connect to my local znc instance with:

gnutls: certificate fingerprint matches
irc: TLS handshake failed
irc: error: The operation was cancelled due to user error

I found this issue https://github.com/weechat/weechat/issues/1231 that seems to
point the finger at gnutls and presents a backport of a fix from Fedora.

summary: gnutls fails in handshake


--1536931522.EFE73f670.18499
Date: Fri, 14 Sep 2018 13:25:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108480

            Bug ID: 1108480
           Summary: VUL-1: CVE-2018-16554: jhead: Interger overflow while running jhead
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/214399/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: sbrabec-at-suse.com
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-16554

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907925

e: jhead
Version: 3.00-7

Interger overflow while running jhead. There is an interger overflow in
exif.c line 530. When OffseVal=0xffff0014, ByteCount=0xffff,
ExifLength=0X13e, this check will be passed. So when executing strncpy
function it will lead to a segmentation fault. It may allow a remote
attacker to cause unspecified impact including denial-of-service attack.Deatil
log as follow:

zhang123@ubuntu:~/Desktop/jhead-3.00$ ./jhead ./testfile
ASAN:SIGSEGV
=================================================================
==21157==ERROR: AddressSanitizer: SEGV on unknown address
0x6130ffffde90 (pc 0x7efd4499e900 bp 0x7fffcbe95d50 sp 0x7fffcbe954d8
T0)
    #0 0x7efd4499e8ff in strnlen (/lib/x86_64-linux-gnu/libc.so.6+0x8b8ff)
    #1 0x7efd4505c4e2 in __interceptor_strncpy
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x764e2)
    #2 0x40efad in ProcessExifDir
(/home/zhang123/Desktop/jhead-3.00/jhead+0x40efad)
    #3 0x410399 in process_EXIF
(/home/zhang123/Desktop/jhead-3.00/jhead+0x410399)
    #4 0x40830d in ReadJpegSections.part.0
(/home/zhang123/Desktop/jhead-3.00/jhead+0x40830d)
    #5 0x4087dd in ReadJpegFile
(/home/zhang123/Desktop/jhead-3.00/jhead+0x4087dd)
    #6 0x4049f6 in ProcessFile
(/home/zhang123/Desktop/jhead-3.00/jhead+0x4049f6)
    #7 0x402575 in main (/home/zhang123/Desktop/jhead-3.00/jhead+0x402575)
    #8 0x7efd4493382f in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #9 0x403998 in _start (/home/zhang123/Desktop/jhead-3.00/jhead+0x403998)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 strnlen
==21157==ABORTING

This bug was found by Hanfang Zhang at Sichuan University. Request a
CVE ID. Thanks.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16554
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-16554.html


--1536964570.6Ca2fe1.9083
Date: Fri, 14 Sep 2018 22:36:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108549

            Bug ID: 1108549
           Summary: startx unsets DBUS_SESSION_BUS_ADDRESS, which breaks user dbus session launched by systemd
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: equeim-at-gmail.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

startx unsets DBUS_SESSION_BUS_ADDRESS environment variable, which makes
gnome-session (and probably other DEs or programs, except of Plasma) launch a
new D-Bus session, while systemd has already launched its own. It breaks user
systemd services that use D-Bus (e.g. PulseAudio), because X uses another D-Bus
session.

Debian fixed this by providing /etc/X11/Xsession.d/20dbus_xdg-runtime
(https://sources.debian.org/src/dbus/1.12.10-1/debian/20dbus_xdg-runtime)
script that restores DBUS_SESSION_BUS_ADDRESS, and Arch Linux devs just patched
startx to not unset it
(https://git.archlinux.org/svntogit/packages.git/tree/trunk/fs46369.patch?h=packages/xorg-xinit).


--1537038758.2dDee0.24152
Date: Sat, 15 Sep 2018 19:12:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108562

            Bug ID: 1108562
           Summary: rsync to btrfs destination: random errors
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: matwey.kornilov-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hello,

I am trying to use rsync as the following:

rsync -aAv --sparse --preallocate --numeric-ids --info=progress2
--delete-excluded --delete

My destination is local btrfs filesystem. After upgrade to 15.0 I see random
errors like the following:

rsync: [sender] write error: Broken pipe (32)
rsync: write failed on
"/run/media/matwey/3ec252ae-e1a4-429f-b52e-90f37dd05702/backup/oak/matwey/.local/share/Steam/config/htmlcache/Cache/f_0005c5":
No such file or directory (2)
rsync error: error in file IO (code 11) at receiver.c(374) [receiver=3.1.3]

or

rsync: write failed on
"/run/media/matwey/3ec252ae-e1a4-429f-b52e-90f37dd05702/backup/oak/matwey/.local/share/Steam/friends/icon_chatFailed.tga":
No data available (61)
rsync error: error in file IO (code 11) at receiver.c(374) [receiver=3.1.3]

When rerun, the issue at this file is gone. Is it known issue?

rsync 3.1.3
kernel 4.12.14-lp150.12.16-default


--1537071553.24dfdc0.3909
Date: Sun, 16 Sep 2018 04:19:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108567

            Bug ID: 1108567
           Summary: qBittorrent crashes in latest Tumbleweed snapshot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: yunhe.guo-at-protonmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

In the recent Tumbleweed snapshot, since 2018-09-10 or 2018-09-11, qBittorrent
doesn't work anymore. It crashes on start:

*************************************************************
Please file a bug report at http://bug.qbittorrent.org and provide the
following information:

qBittorrent version: v4.1.2

Caught signal: SIGSEGV
Stack trace:
  /usr/lib64/libtorrent-rasterbar.so.9 : ()+0x180f95  [0x7fac11e4cf95]
  /usr/lib64/libtorrent-rasterbar.so.9 : ()+0x2f9603  [0x7fac11fc5603]
  /usr/lib64/libtorrent-rasterbar.so.9 : ()+0x1d3eb8  [0x7fac11e9feb8]
  /usr/lib64/libtorrent-rasterbar.so.9 : ()+0xeb56f  [0x7fac11db756f]
  /lib64/libpthread.so.0 : ()+0x7554  [0x7fac11ab4554]
  /lib64/libc.so.6 : clone()+0x3f  [0x7fac100cbccf]
[1]    18306 segmentation fault (core dumped)  qbittorrent

They already reported it to upstream, but it seems not their problem (no user
of other distributions reports similar issues):

https://github.com/qbittorrent/qBittorrent/issues/9485


body:
--1537137020.aaAb7070.2534
Date: Sun, 16 Sep 2018 22:30:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108577

            Bug ID: 1108577
           Summary: Gmail authentication fails in kmail
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: cornelis-at-solcon.nl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

For some time gmail fails in kmail. After some searching I came across this
bug:

https://bugs.kde.org/show_bug.cgi?id=375410

Comment 3 and 4 suggests making a symlink (or installing some devel package,
don't know which) so that libkdexoauth2.so is present. I did the symlink and
got working gmail again. (I removed and re-added my gmail account after adding
the symlink, because of everything I've tried).

Packaging error??

summary: Gmail authentication fails in kmail


--1537176965.8FA83ab10.11871
Date: Mon, 17 Sep 2018 09:36:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108630

            Bug ID: 1108630
           Summary: VUL-1: CVE-2018-17096: soundtouch: remote denial of service (assertion failure and application exit) in the BPMDetect class in BPMDetect.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/214907/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-17096

The BPMDetect class in BPMDetect.cpp in libSoundTouch.a in Olli Parviainen
SoundTouch 2.0 allows remote attackers to cause a denial of service (assertion
failure and application exit), as demonstrated by SoundStretch.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17096
http://www.cvedetails.com/cve/CVE-2018-17096/
https://gitlab.com/soundtouch/soundtouch/issues/14
https://github.com/TeamSeri0us/pocs/tree/master/soundtouch/2018_09_03


--1537176969.d2FFcb84.11871
Date: Mon, 17 Sep 2018 09:36:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108631

            Bug ID: 1108631
           Summary: VUL-1: CVE-2018-17097: soundtouch: remote denial of service (double free) in the WavFileBase class in WavFile.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/214908/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-17097

The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows
remote attackers to cause a denial of service (double free) or possibly have
unspecified other impact, as demonstrated by SoundStretch.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17097
http://www.cvedetails.com/cve/CVE-2018-17097/


--1537176974.0b7cAf5a0.12625
Date: Mon, 17 Sep 2018 09:36:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108632

            Bug ID: 1108632
           Summary: VUL-1: CVE-2018-17098: soundtouch: remote denial of service (heap corruption from size inconsistency) in the WavFileBase class in WavFile.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/214909/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-17098

The WavFileBase class in WavFile.cpp in Olli Parviainen SoundTouch 2.0 allows
remote attackers to cause a denial of service (heap corruption from size
inconsistency) or possibly have unspecified other impact, as demonstrated by
SoundStretch.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17098
http://www.cvedetails.com/cve/CVE-2018-17098/
https://github.com/TeamSeri0us/pocs/blob/master/soundtouch/2018_09_03


body:
Build Identifier:

For slurm and slurm-torque version: 17.11.9-lp150.5.11.1 in opensuse leap 15.0.

qsub submits jobs but gives error:
/usr/bin/perl: symbol lookup error:
/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Slurm/Slurm.so:
undefined symbol: slurm_xmalloc

qstat gives error:
Can't load
'/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Slurmdb/Slurmdb.so'
for module Slurmdb:
/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Slurmdb/Slurmdb.so:
undefined symbol: slurmdb_destroy_selected_step at
/usr/lib/perl5/5.26.1/x86_64-linux-thread-multi/DynaLoader.pm line 193, <DATA>
line 614.
 at /usr/bin/qstat line 52.
Compilation failed in require at /usr/bin/qstat line 52, <DATA> line 614.
BEGIN failed--compilation aborted at /usr/bin/qstat line 52, <DATA> line 614.

qdel does not kill jobs, with error:
/usr/bin/perl: symbol lookup error:
/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Slurm/Slurm.so:
undefined symbol: slurm_kill_job

Reproducible: Always

Steps to Reproduce:
1. Install slurm and its derivatives
2. type any of: qstat, qdel or qsub
Actual Results:
qsub submits job but prints error
qstat and qdel do not work

Expected Results:
Show list of queuing jobs, or delete jobs

summary: slurm-torque-17.11.9-lp150.5.11.1 error with Torque/PBS wrappers to SLURM


--1537193855.fbFcC0.11935
Date: Mon, 17 Sep 2018 14:17:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108672

            Bug ID: 1108672
           Summary: VUL-0: CVE-2018-17088: jhead: Integer overflow in gpsinfo.c while running jhead
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/214938/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#1629662

The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a
remote attacker to cause a denial-of-service attack or unspecified other impact
via a malicious JPEG file, because there is an integer overflow during a check
for whether a location exceeds the EXIF data length. This is analogous to the
CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is
unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1629662
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907925


--1537252383.cfDe0.6225
Date: Tue, 18 Sep 2018 06:33:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108741

            Bug ID: 1108741
           Summary: VUL-0: CVE-2018-13982: Trusted-Directory Bypass via Path Traversal
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/214972/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: factory-repo-checker-at-kulow.org
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-13982

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13982
http://seclists.org/oss-sec/2018/q3/246
https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180420-01_Smarty_Path_Traversal


--1537262242.0A2cfcE60.30066
Date: Tue, 18 Sep 2018 09:17:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108774

            Bug ID: 1108774
           Summary: VUL-0: Chromium: Fixes from internal audits, fuzzing and other initiatives fixed in 69.0.3497.100
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

https://chromereleases.googleblog.com/2018/09/stable-channel-update-for-desktop_17.html

Fixed in Chromium 69.0.3497.100:

- Fixes from internal audits, fuzzing and other initiatives
https://crbug.com/884726


body:
Build Identifier:

When I slowly move a file in dolphin using mouse (drag and drop) to a another
folder in the left folder panel, next file after the moved is spontaneously
renamed to the name of the moved file.
In dolphin i have on the right detailed view, on the left folders view and
places view.
dolphin-17.12.3-lp150.1.23.x86_64
KDE Plasma 5 desktop

Reproducible: Always

summary: Dolphin accidentally rename file when other file is drag-and-drop moved


--1537272375.18B413.9934
Date: Tue, 18 Sep 2018 12:06:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108803

            Bug ID: 1108803
           Summary: ncpmount not working in kernel 4.4.155-68-default
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: marararam-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Mounting a novell filesystem via ncpmount in opensuse 42.3 with the latest
kernel is not working. With the previous kernel version
4.4.143-65-default it works.

$ uname -a
Linux XXXX 4.4.155-68-default #1 SMP Tue Sep 11 13:07:19 UTC 2018 (4ecc783)
x86_64 x86_64 x86_64 GNU/Linux

journalctl says:
---8<---
Sep 18 13:38:40 XXXX kernel: Unexpected op at ncp_file_mmap_fault+0x152/0x1e0
[ncpfs] [ffffffffa09dd802] (0f 1f 44 00 00) ../arch/x86/kernel/jump_label.c:85
Sep 18 13:38:40 XXXX kernel: ------------[ cut here ]------------
Sep 18 13:38:40 XXXX kernel: kernel BUG at ../arch/x86/kernel/jump_label.c:36!
Sep 18 13:38:40 XXXX kernel: invalid opcode: 0000 [#1] SMP
Sep 18 13:38:40 XXXX kernel: Modules linked in: ncpfs(+) xt_nat xt_tcpudp veth
ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink nfnetlink xfrm_user
xfrm_algo iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype
iptable_filter ip_tables xt_conntrack x_tables nf_nat nf_conntrack br_netfilter
bridge stp llc af_packet vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O)
iscsi_ibft iscsi_boot_sysfs msr nls_iso8859_1 nls_cp437 vfat fat
snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel
snd_hda_codec snd_hda_core snd_hwdep snd_pcm hp_wmi sparse_keymap iTCO_wdt
iTCO_vendor_support rfkill intel_rapl x86_pkg_temp_thermal intel_powerclamp
coretemp kvm_intel snd_timer kvm irqbypass snd e1000e ptp pps_core i2c_i801
soundcore pcspkr wmi tpm_infineon acpi_pad fjes processor dm_crypt
Sep 18 13:38:40 XXXX kernel:  btrfs
Sep 18 13:38:40 XXXX kernel:  xor
Sep 18 13:38:40 XXXX kernel:  raid6_pq
Sep 18 13:38:40 XXXX kernel:  sd_mod
Sep 18 13:38:40 XXXX kernel:  uas
Sep 18 13:38:40 XXXX kernel:  usb_storage
Sep 18 13:38:40 XXXX kernel:  hid_generic
Sep 18 13:38:40 XXXX kernel:  usbhid
Sep 18 13:38:40 XXXX kernel:  crct10dif_pclmul
Sep 18 13:38:40 XXXX kernel:  crc32_pclmul
Sep 18 13:38:40 XXXX kernel:  crc32c_intel
Sep 18 13:38:40 XXXX kernel:  ghash_clmulni_intel
Sep 18 13:38:40 XXXX kernel:  jitterentropy_rng
Sep 18 13:38:40 XXXX kernel:  drbg
Sep 18 13:38:40 XXXX kernel:  ansi_cprng
Sep 18 13:38:40 XXXX kernel:  aesni_intel
Sep 18 13:38:40 XXXX kernel:  aes_x86_64
Sep 18 13:38:40 XXXX kernel:  glue_helper
Sep 18 13:38:40 XXXX kernel:  lrw
Sep 18 13:38:40 XXXX kernel:  gf128mul
Sep 18 13:38:40 XXXX kernel:  ablk_helper
Sep 18 13:38:40 XXXX kernel:  cryptd
Sep 18 13:38:40 XXXX kernel:  ahci
Sep 18 13:38:40 XXXX kernel:  libahci
Sep 18 13:38:40 XXXX kernel:  xhci_pci
Sep 18 13:38:40 XXXX kernel:  i915(O)
Sep 18 13:38:40 XXXX kernel:  i2c_algo_bit
Sep 18 13:38:40 XXXX kernel:  drm_kms_helper(O)
Sep 18 13:38:40 XXXX kernel:  syscopyarea
Sep 18 13:38:40 XXXX kernel:  sysfillrect
Sep 18 13:38:40 XXXX kernel:  sysimgblt
Sep 18 13:38:40 XXXX kernel:  fb_sys_fops
Sep 18 13:38:40 XXXX kernel:  xhci_hcd
Sep 18 13:38:40 XXXX kernel:  libata
Sep 18 13:38:40 XXXX kernel:  usbcore
Sep 18 13:38:40 XXXX kernel:  drm(O)
Sep 18 13:38:40 XXXX kernel:  usb_common
Sep 18 13:38:40 XXXX kernel:  video
Sep 18 13:38:40 XXXX kernel:  button
Sep 18 13:38:40 XXXX kernel:  dm_mirror
Sep 18 13:38:40 XXXX kernel:  dm_region_hash
Sep 18 13:38:40 XXXX kernel:  dm_log
Sep 18 13:38:40 XXXX kernel:  dm_mod
Sep 18 13:38:40 XXXX kernel:  sg
Sep 18 13:38:40 XXXX kernel:  scsi_mod
Sep 18 13:38:40 XXXX kernel:  efivarfs
Sep 18 13:38:40 XXXX kernel:  autofs4
Sep 18 13:38:40 XXXX kernel:
Sep 18 13:38:40 XXXX kernel: CPU: 3 PID: 2950 Comm: modprobe Tainted: G
  O     4.4.155-68-default #1
Sep 18 13:38:40 XXXX kernel: Hardware name: HP HP EliteDesk 800 G2 DM 35W/8055,
BIOS N21 Ver. 02.20 08/08/2016
Sep 18 13:38:40 XXXX kernel: task: ffff880406d9c2c0 ti: ffff8803fdf70000
task.ti: ffff8803fdf70000
Sep 18 13:38:40 XXXX kernel: RIP: 0010:[<ffffffff8107eefa>]
Sep 18 13:38:40 XXXX kernel:  [<ffffffff8107eefa>] bug_at+0x46/0x48
Sep 18 13:38:40 XXXX kernel: RSP: 0018:ffff8803fdf73c60  EFLAGS: 00010282
Sep 18 13:38:40 XXXX kernel: RAX: 000000000000007f RBX: ffffffffa09dd802 RCX:
ffff8803fdf70000
Sep 18 13:38:40 XXXX kernel: RDX: 0000000000000000 RSI: 0000000000000246 RDI:
0000000000000246
Sep 18 13:38:40 XXXX kernel: RBP: ffff8803fdf73c8b R08: 0000000000000003 R09:
ffff880406d9c2c0
Sep 18 13:38:40 XXXX kernel: R10: 0000000000000000 R11: 0000000001e4978d R12:
ffffffff81802964
Sep 18 13:38:40 XXXX kernel: R13: 0000000000000000 R14: ffffffff81e92600 R15:
ffff8800ac96f8e0
Sep 18 13:38:40 XXXX kernel: FS:  00007f3ff7fc8700(0000)
GS:ffff88043f580000(0000) knlGS:0000000000000000
Sep 18 13:38:40 XXXX kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Sep 18 13:38:40 XXXX kernel: CR2: 00007f3ff7f87fa8 CR3: 00000004023ee000 CR4:
0000000000360670
Sep 18 13:38:40 XXXX kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
Sep 18 13:38:40 XXXX kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
Sep 18 13:38:40 XXXX kernel: Stack:
Sep 18 13:38:40 XXXX kernel:  ffffffff00000000
Sep 18 13:38:40 XXXX kernel:  ffffffff00000000
Sep 18 13:38:40 XXXX kernel:  ffffffff81a007d8
Sep 18 13:38:40 XXXX kernel:  ffffffff00000055
Sep 18 13:38:40 XXXX kernel:
Sep 18 13:38:40 XXXX kernel:  ffffffff8101cbd8
Sep 18 13:38:40 XXXX kernel:  0000003fe911530e
Sep 18 13:38:40 XXXX kernel:  ffffffffa09e6018
Sep 18 13:38:40 XXXX kernel:  ffffffffa09e6018
Sep 18 13:38:40 XXXX kernel:
Sep 18 13:38:40 XXXX kernel:  ffffffff81e92600
Sep 18 13:38:40 XXXX kernel:  ffffffffa09e6018
Sep 18 13:38:40 XXXX kernel:  ffffffff81198582
Sep 18 13:38:40 XXXX kernel:  ffffffff81e92600
Sep 18 13:38:40 XXXX kernel:
Sep 18 13:38:40 XXXX kernel: Call Trace:
Sep 18 13:38:40 XXXX kernel:  [<ffffffff8101cbd8>]
arch_jump_label_transform+0xd8/0xf0
Sep 18 13:38:40 XXXX kernel:  [<ffffffff81198582>]
__jump_label_update+0x72/0x80
Sep 18 13:38:40 XXXX kernel:  [<ffffffff81198ec6>]
jump_label_module_notify+0x266/0x2e0
Sep 18 13:38:40 XXXX kernel:  [<ffffffff810a51b7>]
notifier_call_chain+0x47/0x70
Sep 18 13:38:40 XXXX kernel:  [<ffffffff810a54e7>]
__blocking_notifier_call_chain+0x47/0x60
Sep 18 13:38:40 XXXX kernel:  [<ffffffff81118176>] load_module+0x1b86/0x2830
Sep 18 13:38:40 XXXX kernel:  [<ffffffff81118ff0>] SYSC_finit_module+0x70/0xa0
Sep 18 13:38:40 XXXX kernel:  [<ffffffff816455c7>]
entry_SYSCALL_64_fastpath+0x22/0xbb
Sep 18 13:38:40 XXXX kernel:
Sep 18 13:38:40 XXXX kernel: DWARF2 unwinder stuck at
entry_SYSCALL_64_fastpath+0x22/0xbb
Sep 18 13:38:40 XXXX kernel:
Sep 18 13:38:40 XXXX kernel: Leftover inexact backtrace:
Sep 18 13:38:40 XXXX kernel: Code:
Sep 18 13:38:40 XXXX kernel: 89
Sep 18 13:38:40 XXXX kernel: fa
Sep 18 13:38:40 XXXX kernel: 48
Sep 18 13:38:40 XXXX kernel: c7
Sep 18 13:38:40 XXXX kernel: 44
Sep 18 13:38:40 XXXX kernel: 24
Sep 18 13:38:40 XXXX kernel: 10
Sep 18 13:38:40 XXXX kernel: d8
Sep 18 13:38:40 XXXX kernel: 07
Sep 18 13:38:40 XXXX kernel: a0
Sep 18 13:38:40 XXXX kernel: 81
Sep 18 13:38:40 XXXX kernel: 0f
Sep 18 13:38:40 XXXX kernel: b6
Sep 18 13:38:40 XXXX kernel: 47
Sep 18 13:38:40 XXXX kernel: 04
Sep 18 13:38:40 XXXX kernel: 48
Sep 18 13:38:40 XXXX kernel: 89
Sep 18 13:38:40 XXXX kernel: fe
Sep 18 13:38:40 XXXX kernel: 89
Sep 18 13:38:40 XXXX kernel: 44
Sep 18 13:38:40 XXXX kernel: 24
Sep 18 13:38:40 XXXX kernel: 08
Sep 18 13:38:40 XXXX kernel: 0f
Sep 18 13:38:40 XXXX kernel: b6
Sep 18 13:38:40 XXXX kernel: 47
Sep 18 13:38:40 XXXX kernel: 03
Sep 18 13:38:40 XXXX kernel: 48
Sep 18 13:38:40 XXXX kernel: c7
Sep 18 13:38:40 XXXX kernel: c7
Sep 18 13:38:40 XXXX kernel: 98
Sep 18 13:38:40 XXXX kernel: 07
Sep 18 13:38:40 XXXX kernel: a0
Sep 18 13:38:40 XXXX kernel: 81
Sep 18 13:38:40 XXXX kernel: 89
Sep 18 13:38:40 XXXX kernel: 04
Sep 18 13:38:40 XXXX kernel: 24
Sep 18 13:38:40 XXXX kernel: 31
Sep 18 13:38:40 XXXX kernel: c0
Sep 18 13:38:40 XXXX kernel: e8
Sep 18 13:38:40 XXXX kernel: 4a
Sep 18 13:38:40 XXXX kernel: bb
Sep 18 13:38:40 XXXX kernel: 11
Sep 18 13:38:40 XXXX kernel: 00
Sep 18 13:38:40 XXXX kernel: <0f>
Sep 18 13:38:40 XXXX kernel: 0b
Sep 18 13:38:40 XXXX kernel: 0f
Sep 18 13:38:40 XXXX kernel: 1f
Sep 18 13:38:40 XXXX kernel: 44
Sep 18 13:38:40 XXXX kernel: 00
Sep 18 13:38:40 XXXX kernel: 00
Sep 18 13:38:40 XXXX kernel: 83
Sep 18 13:38:40 XXXX kernel: ff
Sep 18 13:38:40 XXXX kernel: 05
Sep 18 13:38:40 XXXX kernel: 48
Sep 18 13:38:40 XXXX kernel: c7
Sep 18 13:38:40 XXXX kernel: c0
Sep 18 13:38:40 XXXX kernel: 22
Sep 18 13:38:40 XXXX kernel: 01
Sep 18 13:38:40 XXXX kernel: a1
Sep 18 13:38:40 XXXX kernel: 81
Sep 18 13:38:40 XXXX kernel: 74
Sep 18 13:38:40 XXXX kernel: 4e
Sep 18 13:38:40 XXXX kernel: 7f
Sep 18 13:38:40 XXXX kernel: 1b
Sep 18 13:38:40 XXXX kernel:
Sep 18 13:38:40 XXXX kernel: RIP
Sep 18 13:38:40 XXXX kernel:  [<ffffffff8107eefa>] bug_at+0x46/0x48
Sep 18 13:38:40 XXXX kernel:  RSP <ffff8803fdf73c60>
Sep 18 13:38:40 XXXX kernel: ---[ end trace fc4fccff254006e8 ]---
--->8---


--1537359997.ecAAa8Bd8.29519
Date: Wed, 19 Sep 2018 12:26:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108976

            Bug ID: 1108976
           Summary: graphviz/fdp: Warning: Overlap value "prism" unsupported - ignored
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: sndirsch-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

# fdp -Tpng l6.dot > l6-fdp.png
Warning: Overlap value "prism" unsupported - ignored

Seems we're building graphviz without gts support. Could we address that issue
somehow? I guess it's related to extras not being built by default.

<specfile>
[...]
# Build with extras or not, determines pulling additional dependencies
# and breaks build cycle
%bcond_with extras
[...]


--1537360471.C32a0B4.30000
Date: Wed, 19 Sep 2018 12:34:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108978

            Bug ID: 1108978
           Summary: graphviz/sfdp: Error: remove_overlap: Graphviz not built with triangulation library
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: sndirsch-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

# sfdp -Tpng l6.dot > l6-sfdp.png
Error: remove_overlap: Graphviz not built with triangulation library

Probably the same as with #1108976. It appears to be built without gts support.


body:
--1537360769.50Ec7e0.29759
Date: Wed, 19 Sep 2018 12:39:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108981

            Bug ID: 1108981
           Summary: jack: fix return value check of mmap()
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Sound
          Assignee: tiwai-at-suse.com
          Reporter: tom.mbrt-at-googlemail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

mmap() returns MAP_FAILED on failure. However jack is incorrectly checking for
NULL. This causes applications using jack to crash randomly, due to jack
dereferencing an invalid pointer.

summary: jack: fix return value check of mmap()


--1537367036.2A1dCEBd1.19720
Date: Wed, 19 Sep 2018 14:23:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108992

            Bug ID: 1108992
           Summary: VUL-0: CVE-2018-17144: remote denial of service (application crash) exploitable by miners
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/215127/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: mpluskal-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-17144

Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before
0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote
denial of service (application crash) exploitable by miners via duplicate
input.
An attacker can make bitcoind or Bitcoin-Qt crash.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17144
https://github.com/bitcoinknots/bitcoin/blob/v0.16.3.knots20180918/doc/release-notes.md
https://github.com/bitcoin/bitcoin/blob/v0.16.3/doc/release-notes.md
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17144


--1537369432.Fe07114.30589
Date: Wed, 19 Sep 2018 15:03:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1108999

            Bug ID: 1108999
           Summary: [transactional-server] zypper not able to perform configuration operation on a read-only filesystem
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: slindomansilla-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

How to reproduce:

- Leap 15.0 as transactional server
- sudo zypper ar obs://devel:openQA/openSUSE_Leap_$LEAP_VERSION devel-openQA

Error:

This is a transactional-server, please use transactional-update to update or
modify the
system.

- Example from openQA on Tumbleweed:
https://openqa.opensuse.org/tests/754175#step/first_boot/16
- Bug introduced in: https://github.com/openSUSE/zypper/pull/201

Expected:

Since adding a repository only affects /etc/zypp/repos.d/, it should not
conflict with the read-only filesystem.


--1537428662.aBE5c3C4.8006
Date: Thu, 20 Sep 2018 07:31:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109084

            Bug ID: 1109084
           Summary: CVE-2018-17141 fixes JPEG vulnerabilities (18 Sep 2018)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: axel.braun-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hylafax+ version 5.6.1


body:
--1537446804.A71F526.7268
Date: Thu, 20 Sep 2018 12:33:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1109141

            Bug ID: 1109141
           Summary: Release nodejs8 on openSUSE Leap 42.3
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: amajer-at-suse.com
          Reporter: tchvatal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: astieger-at-suse.com
          Found By: ---
           Blocker: ---

There is currently only nodejs6 present, but sadly new chromium releases (to be
shipped around December) will require newer node to even compile.

I've already bumped the requirement in network:chromium.

summary: Release nodejs8 on openSUSE Leap 42.3


--1537458067.423Fa0.9945
Date: Thu, 20 Sep 2018 15:41:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109179

            Bug ID: 1109179
           Summary: VUL-1: CVE-2018-17175: python-marshmallow: Information leak due to invalid usage of the schema "only" option
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/215034/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#1631411

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the
schema "only" option treats an empty list as implying no "only" option, which
allows a request that was intended to expose no fields to instead expose all
fields (if the schema is being filtered dynamically using the "only" option,
and
there is a user role that produces an empty value for "only").

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1631411
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17175
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-17175.html
https://github.com/marshmallow-code/marshmallow/issues/772
https://github.com/marshmallow-code/marshmallow/pull/777
https://github.com/marshmallow-code/marshmallow/pull/782


--1537539686.d4ba233b1.4637
Date: Fri, 21 Sep 2018 14:21:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109310

            Bug ID: 1109310
           Summary: Install yast icons with module, instead of yast-theme
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: hellcp-at-mailbox.org
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Space-saving measure, would also allow for finally completing YaST's icon
theme, considering it uses icons from other themes (all the package_ icons).
yast-theme would still exist for external YaST modules that aren't in-house and
can't be adapted.


body:
--1537558463.b5c60.8707
Date: Fri, 21 Sep 2018 19:34:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109355

            Bug ID: 1109355
           Summary: Gajim package is missing dependencies
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: opensuse-at-trummer.xyz
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fresh installation of openSUSE Tumbleweed, currently on
openSUSE Tumbleweed 20180919

Gajim won't start due to missing dependencies. Through trial and error, I found
out that it is currently missing the following dependencies:

python3-cairo
python3-gobject-cairo
python3-gobject-Gdk

After installing these manually, Gajim launches fine.

summary: Gajim package is missing dependencies


--1537599329.1Ee8eD814.16774
Date: Sat, 22 Sep 2018 06:55:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1109373

            Bug ID: 1109373
           Summary: [HPC, slurm] slurm-node & slurm-config not setup right in %pre/%post scriptlets due to missing Requires(pre/post)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: CONFIRMED
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: hpc-maintainer-bugs-at-forge.provo.novell.com,
                    nicolas.bock-at-suse.com
          Found By: Development
           Blocker: ---

Symptoms: when installed during initial system installation, the slurm user may
not be set up correctly.

Reason:
'slurm-config' requires 'shadow' during pre-install. This is however wrongly
added as Requires(pre) to 'slurm'.

Fix:
Move the requires from 'slurm' to 'slurm-node'.
Moreover, it should have access to systemd due to the use of 'systemd-tmpfiles'
(or the correspondig macro if available).

'slurm-node' should have the access to systemd during %pre/%post.


--1537634641.44A774761.9700
Date: Sat, 22 Sep 2018 16:44:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109379

            Bug ID: 1109379
           Summary: Thunderbird 60.0 displays wrong date format
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: bnc-team-mozilla-at-forge.provo.novell.com
          Reporter: carlos.e.r-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Since the update to Thunderbird 60.0, dates are getting the wrong format. Like
this:

   On 22/09/2018 03.36, xxx wrote:

It is doing "day/month/year  hour.minute", instead of what it was doing on the
previous version:  "year-month-day  hour:minute".

There is a new setting under Settings,  Advanced, general: use application
language or regional locale (English (Denmark)). But it is ignored.

My locale is this:

cer@Legolas:~> locale
LANG=en_US.UTF-8
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME=en_DK.UTF-8    <=======
LC_COLLATE="en_US.UTF-8"
LC_MONETARY=es_ES@euro
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE=es_ES@euro
LC_MEASUREMENT=es_ES@euro
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=
cer@Legolas:~>

It is ignoring the setting, which was working previously.


--1537796905.77b6245.30908
Date: Mon, 24 Sep 2018 13:48:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109453

            Bug ID: 1109453
           Summary: osdlyrics can not launch with the Unable to start daemon bug
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: hillwoodroc-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Because python-curl and python-chardet can not be installed automatically. It
can be fixed in rpm spec.

hillwood@linux-raq2:~> /usr/bin/osdlyrics-daemon
Traceback (most recent call last):
  File "/usr/lib64/osdlyrics/daemon/main.py", line 32, in <module>
    import lyrics
  File "/usr/lib64/osdlyrics/daemon/lyrics.py", line 31, in <module>
    import chardet
ImportError: No module named chardet

hillwood@linux-raq2:~> /usr/bin/osdlyrics-daemon
Traceback (most recent call last):
  File "/usr/lib64/osdlyrics/daemon/main.py", line 29, in <module>
    from osdlyrics.metadata import Metadata
  File "/usr/lib/python2.7/site-packages/osdlyrics/metadata.py", line 26, in
<module>
    from . import utils
  File "/usr/lib/python2.7/site-packages/osdlyrics/utils.py", line 29, in
<module>
    import pycurl
ImportError: No module named pycurl


--1537801481.AAEBB4612.15313
Date: Mon, 24 Sep 2018 15:04:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109470

            Bug ID: 1109470
           Summary: noarch post-build-checks contains arch-dependent /etc/suse-ignored-rpaths.conf
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Development
          Assignee: ro-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: adrian-at-suse.com, matz-at-suse.com
          Found By: Development
           Blocker: ---

When using osc build
to build zziplib or 4ti2 (or ~760 others)
it can happen that in build-root there is
cat /etc/suse-ignored-rpaths.conf
/usr/lib
/usr/local/lib
lib
/usr/lib/Xaw3d
/usr/x86_64-suse-linux/lib
/opt/kde3/lib

instead of
/usr/lib64
/usr/local/lib64
lib64
/usr/lib64/Xaw3d
/usr/x86_64-suse-linux/lib
/opt/kde3/lib64

This is related to
https://github.com/openSUSE/open-build-service/issues/5784

This caused local `osc build` to produce binaries with readelf -aW
showing an extra
 0x000000000000001d (RUNPATH)      Library runpath: [/usr/lib64]

IMHO /etc/suse-ignored-rpaths.conf should not be in a noarch package.
We could split it off into an arch-dependent package and Require it in
post-build-checks (or somewhere else)


--1537848795.0CC23.27146
Date: Tue, 25 Sep 2018 04:13:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109534

            Bug ID: 1109534
           Summary: trackerbug: arch-dependent noarch packages
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Development
          Assignee: bwiedemann-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: adrian-at-suse.com, dleuenberger-at-suse.com,
                    lnussel-at-suse.com
        Depends on: 1109470
            Blocks: 1081754
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found
a new class of issues that can be very hard to trace down.
You have to know that OBS builds every noarch package for every architecture,
publishes only one (the first in prj metadata), but uses all of them for
further builds in their respective architecture in OBS.

https://github.com/openSUSE/open-build-service/issues/5784

So within OBS, noarch packages are treated pretty much like
architecture-dependant packages.
Things only start to break once you use osc build or use the packages on a user
machine and your architecture is not the one listed first in `osc meta prj`

I wrote a 'noarchcheck' script that fetches noarch rpms for 2 architectures and
uses build-compare to see if they are similar.
Of 10899 total Factory source packages,
1218/3802 noarch packages did not pass that test.

Many of the diffs seem to be harmless, so I will review the diffs and file bugs
for the uglier ones and maybe file group-bugs by class of issue for the less
severe diffs.


--1537855882.D23DD45.31229
Date: Tue, 25 Sep 2018 06:11:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109548

            Bug ID: 1109548
           Summary: shadowsocks-libev: main process should exit with a non-zero returned value if plugin failed to start
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: hillwoodroc-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Forward from https://github.com/shadowsocks/shadowsocks-libev/issues/1974

What version of shadowsocks-libev are you using?
3.1.3

What operating system are you using?
linux

What did you do?
start ss-server with plugin mode obfs-server, which will fail as expected.

What did you expect to see?
ss-server exit with non-zero value

What did you see instead?
ss-server exit with 0

What is your config in detail (with all sensitive info masked)?
N/A


--1537856160.EAcB5.31158
Date: Tue, 25 Sep 2018 06:16:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109550

            Bug ID: 1109550
           Summary: shadowsocks-libev: unsafe stripping of port from hostname in http.c (incompatibility SNI sniffing with IPv6)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: hillwoodroc-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Forward form https://github.com/shadowsocks/shadowsocks-libev/issues/1945

What version of shadowsocks-libev are you using?
Latest

What operating system are you using?
Linux

What did you do?
I've send the following request to [2001:470:1:18::119]:
GET /ip/?callback=?&testdomain=test-ipv6.com&testname=test_ipv6
HTTP/1.1\r\nHost: [2001:470:1:18::119]\r\n\r\n
with atyp=4 (IPv6)

What did you expect to see?
INFO connect to [2001:470:1:18::119]:80

What did you see instead?
Pure IPv6 address truncated:
INFO connect to [2001:470:1:18::80

What is your config in detail (with all sensitive info masked)?
No matter. Problem in SNI sniffing (parse_http_header() func in http.c).
IPv6 address without port has been truncated by the last colon.


--1537856683.1DedD05.2115
Date: Tue, 25 Sep 2018 06:24:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109556

            Bug ID: 1109556
           Summary: shadowsocks-libev: UDP datagrams are NOT honouring the -b Bind address to set the source IP address, TCP source address is correctly set to -b Bind address
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: hillwoodroc-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Forward from: https://github.com/shadowsocks/shadowsocks-libev/issues/1915

What version of shadowsocks-libev are you using?
Master

What operating system are you using?
Debian

What did you do?
Connected from Shadowsocks client on Android, testing UDP relay

What did you expect to see?
on SS-Server when a bind address is specified with -b then TCP connections
outbound will use this address. I would also expect UDP outbound connections to
also use this address but they do not.

What did you see instead?
Source address of UDP datagrams leaving the ss-server are using the default IP
address NOT the -b Bind address.
Please could you fix so that UDP datagrams are always sent from the -b Bind
address just like TCP connections are.
There is a call to bind_to_address() when TCP sockets are created in server.c ,
but this is NOT called in udprelay.c when UDP sockets are created.
Thank you!


--1537882440.BFbd30.31334
Date: Tue, 25 Sep 2018 13:34:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109660

            Bug ID: 1109660
           Summary: Claws-Mail segfaults on changing folder in Protonmail with ProtonMail Bridge
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: info-at-karmasailing.uk
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When changing folder in ProtonMail account in Claws-Mail using ProtonMail
Bridge, Claws-Mail segfaults. Claws-Mail devs advise using an up to date
version of libetpan. See their bug
http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=4016


body:
--1537882905.D3c4FE49.31748
Date: Tue, 25 Sep 2018 13:41:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109665

            Bug ID: 1109665
           Summary: Disabling f2fs
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: nborisov-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This issue is to be used as a collection of all discussions regarding disabling
the compilation of f2fs in various opensuse distributions. Currently this
filesystem received only sporadic CVE-related backports. In the process of
doing said backports I have also identified several drawbacks which make it
rather hard to support and provide sensible experience:

1. There are a bunch of validation checks which are not being backported since
they are not linked to a particular CVE as such the stability of the filesystem
is questionable even with CVE backports.

2. Currently the filesystem doesn't have a way to disable mounting of
filesystems created with newer kernels, containing on-disk incompatible
changes. I have talked with one of the maintainers and they recognize this fact
but so far no one is working on this. This is a pretty major since newer images
could potentially crash older kernels not being able to properly parse them.

3. All in all this leads me to believe that f2fs requires a rather controller
environment in terms of kernel/tools versions so is not a good candidate to be
included in a community-based distribution kernel.

I've already spoken to release manager for leap/tumbleweed and they are fine
with disabling it.

summary: Disabling f2fs


body:
--1537888983.bda5B37.4429
Date: Tue, 25 Sep 2018 15:23:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109687

            Bug ID: 1109687
           Summary: gnome-news differs between architectures
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: bnc-team-gnome-at-forge.provo.novell.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: os.gnome.maintainers-at-gmail.com
            Blocks: 1109534
          Found By: Development
           Blocker: ---

see bug 1109534 for background

/usr/bin/gnome-news differs (Python script, ASCII text executable)
-

pkgs: gnome-sound-recorder gnome-weather


--1537960906.77105f30.6373
Date: Wed, 26 Sep 2018 11:21:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109822

            Bug ID: 1109822
           Summary: VUL-1: CVE-2018-16586: otrs: Loading External Image or CSS Resources (OSA-2018-04)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/215505/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: chris-at-computersalat.de
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

https://community.otrs.com/security-advisory-2018-05-security-update-for-otrs-framework/

Severity: 3.7. low
Product: OTRS 6.0.x, OTRS 5.0.x, OTRS 4.0.x
Fixed in: OTRS 6.0.11, OTRS 5.0.30, OTRS 4.0.32
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:R
References: CVE-2018-16586

An attacker could send a malicious email to an OTRS system. If a user with
admin permissions opens it, it causes deletions of arbitrary files that the
OTRS web server user has write access to.

Affected by this vulnerability are all releases of OTRS 6.0.x up to and
including 6.0.10, OTRS 5.0.x up to and including 5.0.29, and OTRS 4.0.x up to
and including 4.0.31.

This vulnerability is fixed in the latest versions of OTRS, and it is
recommended to upgrade to the latest patch level.

Fixed releases can be found at:

    https://www.otrs.com/category/release-and-security-notes-en/

Detailed information about the changes:

    OTRS 6:
https://github.com/OTRS/otrs/commit/09e80c7752b0d9080688e4597c7495dd109e0963
    OTRS 5:
https://github.com/OTRS/otrs/commit/a808859a75c59ae3b7568f5cc4708c53462aa4c7
    OTRS 4:
https://github.com/OTRS/otrs/commit/baa92df09145b8ae2702a3a0e85d8ba55ec96302

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16586
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-16586.html


--1537961217.a3A840.7658
Date: Wed, 26 Sep 2018 11:26:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109823

            Bug ID: 1109823
           Summary: VUL-0: CVE-2018-16587: otrs: Remote File Deletion (OSA-2018-04)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/215507/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: chris-at-computersalat.de
          Reporter: astieger-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

https://community.otrs.com/security-advisory-2018-04-security-update-for-otrs-framework/

Title: Remote File Deletion
Severity: 5.6. Medium
Product: OTRS 6.0.x, OTRS 5.0.x, OTRS 4.0.x
Fixed in: OTRS 6.0.11, OTRS 5.0.30, OTRS 4.0.32
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:R
References: CVE-2018-16587

An attacker could send a malicious email to an OTRS system. If a user with
admin permissions opens it, it causes deletions of arbitrary files that the
OTRS web server user has write access to.

Affected by this vulnerability are all releases of OTRS 6.0.x up to and
including 6.0.10, OTRS 5.0.x up to and including 5.0.29, and OTRS 4.0.x up to
and including 4.0.31.

This vulnerability is fixed in the latest versions of OTRS, and it is
recommended to upgrade to the latest patch level.

Fixed releases can be found at:

    https://www.otrs.com/category/release-and-security-notes-en/

Detailed information about the changes:

    OTRS 6:
https://github.com/OTRS/otrs/commit/a4a1a01f84fac7ab032570ee50b660e2ebb15c01
    OTRS 5:
https://github.com/OTRS/otrs/commit/d9db0c6a15caafda7689320ecf61777993c33711
    OTRS 4:
https://github.com/OTRS/otrs/commit/d8cae00b0f78c2a07bb10cedb817304139395843

Thanks to Francesco Sirocco for discovering and reporting this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16587
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-16587.html


--1537980087.2555116.3178
Date: Wed, 26 Sep 2018 16:41:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109895

            Bug ID: 1109895
           Summary: .pc files in noarch -devel pkg differ from architecture
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: bnc-team-gnome-at-forge.provo.novell.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1109534
          Found By: Development
           Blocker: ---

see bug 1109534 for background

affects 4 packages:
ibus-table-extraphrase
mobile-broadband-provider-info
spice-protocol
xtrans

diffs look like
/usr/share/pkgconfig/mobile-broadband-provider-info.pc
@@ -1,6 +1,6 @@
 prefix=/usr
 exec_prefix=/usr
-libdir=/usr/lib64
+libdir=/usr/lib
 datarootdir = ${prefix}/share
 pkgdatadir=${datarootdir}/mobile-broadband-provider-info
 includedir=/usr/include

And come from
mobile-broadband-provider-info-20170310/mobile-broadband-provider-info.pc.in:
libdir=@libdir@

Can/should the libdir just be dropped from the .pc file, because the linker
will include that dir anyway?


body:
--1538041168.12bb9.23234
Date: Thu, 27 Sep 2018 09:39:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109976

            Bug ID: 1109976
           Summary: ImageMagick maintenance update breaks builds
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: pgajdos-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: maintenance-at-opensuse.org
          Found By: ---
           Blocker: ---

https://build.opensuse.org/package/live_build_log/openSUSE:Leap:15.1/ddd/standard/x86_64

[  125s] + make html
[  125s] cd ddd && make html
[  125s] make[1]: Entering directory
'/home/abuild/rpmbuild/BUILD/ddd-3.3.12/ddd'
[  125s] (cd `dirname ../ddd/PICS/disclaimer.fig` && fig2dev -L eps `basename
../ddd/PICS/disclaimer.fig` ) > ../ddd/PICS/disclaimer.eps
[  125s] convert -geometry 800 -quality 100 ../ddd/PICS/disclaimer.eps
../ddd/PICS/disclaimer.jpg
[  125s] convert: not authorized `../ddd/PICS/disclaimer.eps' @
error/constitute.c/ReadImage/428.
[  125s] convert: no images defined `../ddd/PICS/disclaimer.jpg' @
error/convert.c/ConvertImageCommand/3275.
[  125s] make[1]: *** [Makefile:2969: ../ddd/PICS/disclaimer.jpg] Error 1

pkgs: ImageMagick ddd gri sdcc


--1538048596.E6DBFA5.19666
Date: Thu, 27 Sep 2018 11:43:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1109998

            Bug ID: 1109998
           Summary: python3-base without AF_BLUETOOTH support
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: bon-at-elektron.ikp.physik.tu-darmstadt.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hello,

python3-base does not have AF_BLUETOOTH support. You can check with
> python3
>> import sysconfig
>> print(sysconfig.get_config_vars()['HAVE_BLUETOOTH_BLUETOOTH_H'])
>> print(sysconfig.get_config_vars()['HAVE_BLUETOOTH_H'])
>> quit()

Both print() commands will print 0. This is caused by a missing bluetooth.h
header. Installing bluez-devel will install /usr/include/bluetooth/bluetooth.h.

Rebuild of python3-base with bluez-devel installed will result in a
AF_BLUETOOTH enabled python3. Please add bluez-devel as build requirement.

== Additional information==

I tried to rebuild from python3-base-3.4.6-12.6.1.src.rpm, but a stack overflow
like https://github.com/scikit-learn-contrib/hdbscan/issues/149 happens.

Running
rpmbuild -bi --nocheck python3-base.spec

aborts with:
Checking for unpackaged file(s): /usr/lib/rpm/check-files
/usr/src/packages/BUILDROOT/python3-base-3.4.6-12.6.1.x86_64
warning: Installed (but unpackaged) file(s) found:
   /usr/lib64/python3.4/lib-dynload/_curses.cpython-34m.so
   ...

even so I added
%define         _unpackaged_files_terminate_build  0
according to
https://docs.fedoraproject.org/en-US/Fedora_Draft_Documentation/0.1/html/RPM_Guide/ch09s05s07.html

Does opensuse rpm support unpackaged_files_terminate_build  0?


body:
--1538057676.BaAa0.19669
Date: Thu, 27 Sep 2018 14:14:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1110016

            Bug ID: 1110016
           Summary: Opera 56.0.3051.31 maintenance update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: sor.alexei-at-meowr.ru
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

An update of Opera from 54.0.2952.41 to 56.0.3051.31 for openSUSE Leap 42.3 and
Leap 15.0.

summary: Opera 56.0.3051.31 maintenance update