--1515662153.F15BffBf0.3697
Date: Thu, 11 Jan 2018 09:15:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1075541

            Bug ID: 1075541
           Summary: vim repoorts error when edit a file(with .sh extension)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: lchen-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

"test.sh" 36L, 332C
Error detected while processing BufRead Auto commands for "*.sh":
E117: Unknown function: dist#ft#SetFileTypeSH
Error detected while processing /usr/share/vim/vim80/scripts.vim:
line   69:
E117: Unknown function: dist#ft#SetFileTypeSH
Press ENTER or type command to continue

tw-2:~/deploy-ocfs2-test # rpm -qi vim
Name        : vim
Version     : 8.0.1417
Release     : 1.1
Architecture: x86_64
Install Date: Thu 11 Jan 2018 02:41:30 PM CST
Group       : Productivity/Editors/Vi
Size        : 3333305
License     : Vim
Signature   : RSA/SHA256, Sat 30 Dec 2017 02:46:47 AM CST, Key ID
b88b2fd43dbdc284
Source RPM  : vim-8.0.1417-1.1.src.rpm
Build Date  : Wed 20 Dec 2017 08:00:00 PM CST
Build Host  : lamb13
Relocations : (not relocatable)
Packager    : https://bugs.opensuse.org
Vendor      : openSUSE
URL         : http://www.vim.org/
Summary     : Vi IMproved
Description :
Vim (Vi IMproved) is an almost compatible version of the UNIX editor
vi. Almost every possible command can be performed using only ASCII
characters. Only the 'Q' command is missing (you do not need it). Many
new features have been added: multilevel undo, command line history,
file name completion, block operations, and editing of binary data.
Distribution: openSUSE Tumbleweed


--1515683653.4Ff7e20.23821
Date: Thu, 11 Jan 2018 15:14:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1075614

            Bug ID: 1075614
           Summary: neovim does not open files if the path contains spaces
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: kacper.pluta-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

There is a bug in neovim.desktop or in xdg-utils (see neovim.desktop) due to
which it is impossible to open files (by clicking) with neovim if the path
contains spaces.

To reproduce:

1. create a directory with a space in its name
2. create a file in the directory
3. click on the file and try to open it with Neovim


body:
--1515836340.80a7c3.25108
Date: Sat, 13 Jan 2018 09:39:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1075876

            Bug ID: 1075876
           Summary: Kernel
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: admin-at-fph.physik.uni-karlsruhe.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

From time to time I encounter a kernel panic on my Laptop. Systemlog is always:

Jan 13 10:14:54 fphnbam3 kernel: BUG: unable to handle kernel NULL pointer
dereference at           (null)
Jan 13 10:14:54 fphnbam3 kernel: IP: [<ffffffff811038ff>]
timecounter_read+0xf/0x50
Jan 13 10:14:54 fphnbam3 kernel: PGD 0
Jan 13 10:14:54 fphnbam3 kernel: Oops: 0000 [#1] SMP

My impression is: The upstream fix
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=f7116e115acdd74bc75a4daf6492b11d43505125
is missing in the opensuse 42.3 kernels: kernel 4.4.103-36-default and in
4.4.104-39-default.

Thanks, Achim

summary: Kernel


body:
--1515867459.7eff0.5589
Date: Sat, 13 Jan 2018 18:17:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.novell.com/show_bug.cgi?id=1075882

            Bug ID: 1075882
           Summary: Munchlist doesn't run at all
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: geoff-at-cs.hmc.edu
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Somebody who doesn't understand shell scripting broke munchlist completely.
Fortunately the fix is trivial.

Reproduce by:

echo a | munchlist

Expected output: a

Actual output: nothing, plus a leftover /tmp/munch* directory.

Reason: somebody added "set -e" to the script, apparently thinking that they
were doing a wise thing.

Result: munchlist depends in many places on commands that might harmlessly exit
with nonzero status.  Now any of those commands aborts the script before it can
complete.  In the current test, the egrep at line 685 of the script generates
no matches, which is precisely what it is supposed to do, but that causes a
nonzero exit status and aborts the script--without even cleaning up /tmp.

Fix: Delete the "set -e" at line 277 of the script.  And since the original
author (me) is available albeit busy, next time it might be worth asking
whether a proposed fix for a perceived problem has pitfalls.

summary: Munchlist doesn't run at all


--1515867919.F7EDAF0.2823
Date: Sat, 13 Jan 2018 18:25:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1075883

            Bug ID: 1075883
           Summary: rust-std does not get updated together with rust
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mbrugger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I just updated rust to the newest version (1.22.1) but rust-std didn't get
updated. This led to a not working rustc. Compiling a simple hello world
crashed with:

mbrugger@ziggy:~/src/rust/projects/hello_world> rustc main.rs
error[E0514]: found crate `std` compiled by an incompatible version of rustc
  |
  = help: please recompile that crate using this compiler (rustc 1.22.1)
  = note: crate `std` path #1:
/usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd_unicode-24d077784ff294bb.rlib
compiled by "rustc 1.21.0"
  = note: crate `std` path #2:
/usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-93d5378bceaf3688.rlib
compiled by "rustc 1.21.0"
  = note: crate `std` path #3:
/usr/lib/rustlib/x86_64-unknown-linux-gnu/lib/libstd-93d5378bceaf3688.so
compiled by "rustc 1.21.0"

error: aborting due to previous error

Solution:
After updating rust-std by hand, I was able to compile the hello world.

Expected behaviour:
rust-std should be always updated whenever you update rust


body:
--1515996764.68A6b8f2.24619
Date: Mon, 15 Jan 2018 06:12:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1075921

            Bug ID: 1075921
           Summary: VUL-0: transmission: security update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/198289/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: os.gnome.maintainers-at-gmail.com
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

via oss-sec

Hello, the transmission bittorrent client uses a client/server
architecture, the user interface is the client and a daemon runs in the
background managing the downloading, seeding, etc.

Clients interact with the daemon using JSON RPC requests to a web server
listening on port 9091. The daemon will only accept requests from localhost
by default, but it's common to configure NAS devices to accept remote
clients.

A sample RPC session looks like this:

$ curl -sI http://localhost:9091/transmission/rpc
HTTP/1.1 409 Conflict
Server: Transmission
X-Transmission-Session-Id: JL641xTn2h53UsN6bVa0kJjRBLA6oX1Ayl06AJwuhHvSgE6H
Date: Wed, 29 Nov 2017 21:37:41 GMT

$ curl -H 'X-Transmission-Session-Id:
JL641xTn2h53UsN6bVa0kJjRBLA6oX1Ayl06AJwuhHvSgE6H'  -d
'{"method":"session-set","arguments":{"download-dir":"/home/user"}}' -si
http://localhost:9091/transmission/rpc
HTTP/1.1 200 OK
Server: Transmission
Content-Type: application/json; charset=UTF-8
Date: Wed, 29 Nov 2017 21:38:57 GMT
Content-Length: 36

{"arguments":{},"result":"success"}

As with all HTTP RPC schemes like this, any website can send requests to
the daemon listening on localhost with XMLHttpRequest(), but the theory is
they will be ignored because clients must prove they can read and set a
specific header, X-Transmission-Session-Id.

Unfortunately, this design doesn't work because of an attack called "DNS
rebinding". Any website can simply create a dns name that they are
authorized to communicate with, and then make it resolve to localhost.

The attack works like this:

1. A user visits http://attacker.com, which has an <iframe> to a subdomain
the attacker controls.
2. The attacker configures their DNS server to respond alternately with
127.0.0.1 and 123.123.123.123 (an address they control) with a very low TTL.
3. When the browser resolves to 123.123.123.123, they serve HTML that waits
for the DNS entry to expire (or force it to expire by flooding the cache
with lookups), then they have permission to read and set headers.

I have a domain I use for testing dns rebinding called rbndr.us, you can
use this page to generate hostnames (source code is here:
https://github.com/taviso/rbndr):

https://lock.cmpxchg8b.com/rebinder.html

Here I want to alternate between 127.0.0.1 and 199.241.29.227, so I use
7f000001.c7f11de3.rbndr.us:

$ host 7f000001.c7f11de3.rbndr.us
7f000001.c7f11de3.rbndr.us has address 127.0.0.1
$ host 7f000001.c7f11de3.rbndr.us
7f000001.c7f11de3.rbndr.us has address 199.241.29.227
$ host 7f000001.c7f11de3.rbndr.us
7f000001.c7f11de3.rbndr.us has address 127.0.0.1

Here you can see the resolution alternates between the two addresses I want
(note that depending on caching it might take a while to switch, the TTL is
set to minimum but some servers round up).

I just wait for the cached response to expire, and then POST commands to
the server.

Exploitation is simple, you could set script-torrent-done-enabled and run
any command, or set download-dir to /home/user/ and then upload a torrent
for ".bashrc".

Here is my (simple) demo, it's slow, but could be made very fast:

http://lock.cmpxchg8b.com/Asoquu3e.html

I've verified it works on Chrome and Firefox on Windows and Linux (I tried
Fedora and Ubuntu), I expect other platforms and browsers are affected. There
are screenshots of how the attack is supposed to look on the bug report
here:

https://github.com/transmission/transmission/pull/468

Tavis.

summary: VUL-0: transmission: security update


--1516005613.A8f231e0.29495
Date: Mon, 15 Jan 2018 08:40:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1075936

            Bug ID: 1075936
           Summary: VUL-0: CVE-2018-5686: mupdf: In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang inthe pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered.Remote attackers could leverage this vulnerability to cause
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/198274/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: idonmez-at-suse.com
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-5686

In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang
in
the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered.
Remote attackers could leverage this vulnerability to cause a denial of service
via a crafted pdf file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5686
https://bugs.ghostscript.com/show_bug.cgi?id=698860


--1516014516.d3C61.27188
Date: Mon, 15 Jan 2018 11:08:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1075971

            Bug ID: 1075971
           Summary: update-alternatives - settings being reset
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: bingmybong-at-btinternet.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

[opensuse-factory] New Tumbleweed snapshot 20180110 released!

This snapshot changed my manual settings in "alternatives" with regards
to "default-displaymanager" and "postgres" back to "auto" and hence the
overriding my choices of "kdm" and "postgresql96".

This has happened a few times with new snapshots.


--1516118238.044FBD1B0.17106
Date: Tue, 16 Jan 2018 15:57:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076219

            Bug ID: 1076219
           Summary: Pkg aspell-de is missing for x86_64 tumbleweed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Translations
          Assignee: ke-at-suse.com
          Reporter: dheidler-at-suse.com
        QA Contact: ke-at-suse.com
          Found By: ---
           Blocker: ---

The package search lists aspell-de, but only the i586-version is available:
https://software.opensuse.org/package/aspell-de

Besides the fact that a dictionary-pkg should be noarch,
it is missing for x86_64.

The aspell-en pkg as well as many others are not missing for x86_64.


body:
--1516089816.E46E4fb24.28308
Date: Tue, 16 Jan 2018 08:03:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076134

            Bug ID: 1076134
           Summary: blueberry requires /usr/sbin/rfkill
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: sbrabec-at-suse.com, sor.alexei-at-meowr.ru
          Found By: Development
           Blocker: ---

related to bug 1074250

IMHO the easiest is to add a /usr/sbin/rfkill symlink back to util-linux
because there might be other user-created code out there using it.

summary: blueberry requires /usr/sbin/rfkill


--1516126197.a3F8aE254.19693
Date: Tue, 16 Jan 2018 18:09:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076244

            Bug ID: 1076244
           Summary: nextcloud client still 2.3.1 but 2.3.2 has fixes
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: simon.herrmann-at-posteo.ch
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The nextcloud client on Leap 42.3 tells me to update to a newer version. Leap
42.3 has 2.3.1 now and the changelog on github for 2.3.2 lists some fixes for
crashes. Could we get those for Leap 42.3?


body:
--1516198318.28e58CC64.18864
Date: Wed, 17 Jan 2018 14:11:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076393

            Bug ID: 1076393
           Summary: fix nVidia KMP build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: msuchanek-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

fix the macro kernel_module_package is using the "-f" option to use an
alternate filelist

summary: fix nVidia KMP build


--1516216183.d2a18F0.5602
Date: Wed, 17 Jan 2018 19:09:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076443

            Bug ID: 1076443
           Summary: [scalapack, HPC] Don't make module package arch independent
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Customer
           Blocker: ---

The module package for the HPC variant of scalapack is not arch independent as
it contains arch specific paths. If it is set to be arch independent, one of
the build results of one of the archs builds will be pulled and be used across
all archs.


--1516278981.a7662200.20505
Date: Thu, 18 Jan 2018 12:36:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076577

            Bug ID: 1076577
           Summary: installation-images: default-43.png in grub2-branding-openSUSE no longer exists
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: snwint-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: jsrain-at-suse.com
                CC: fvogt-at-suse.com
          Found By: ---
           Blocker: ---

The new branding for Leap no longer contains a default-43.png but
data/boot/theme.file_list refers to it.

$ rpm -ql grub2-branding-openSUSE
/boot/grub2
/boot/grub2/themes
/boot/grub2/themes/openSUSE
/usr/share/grub2
/usr/share/grub2/themes
/usr/share/grub2/themes/openSUSE
/usr/share/grub2/themes/openSUSE/COPYING.CC-BY-SA-3.0
/usr/share/grub2/themes/openSUSE/DejaVuSans-Bold14.pf2
/usr/share/grub2/themes/openSUSE/DejaVuSans10.pf2
/usr/share/grub2/themes/openSUSE/DejaVuSans12.pf2
/usr/share/grub2/themes/openSUSE/README
/usr/share/grub2/themes/openSUSE/activate-theme
/usr/share/grub2/themes/openSUSE/ascii.pf2
/usr/share/grub2/themes/openSUSE/highlight_c.png
/usr/share/grub2/themes/openSUSE/logo.png
/usr/share/grub2/themes/openSUSE/slider_c.png
/usr/share/grub2/themes/openSUSE/slider_n.png
/usr/share/grub2/themes/openSUSE/slider_s.png
/usr/share/grub2/themes/openSUSE/theme.txt


--1516349000.6CE7f0.23180
Date: Fri, 19 Jan 2018 08:03:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076726

            Bug ID: 1076726
           Summary: devel:languages:python/python-openqa_review: python-openqa_review fails on unknown bugref 'bgo'
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: okurz-at-suse.com
          Reporter: okurz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: astieger-at-suse.com
        Depends on: 1059661
          Found By: ---
           Blocker: ---

## Observation

```
Traceback (most recent call last):
  File "/usr/bin/openqa-review", line 9, in <module>
    load_entry_point('openqa-review==0.0.0', 'console_scripts',
'openqa-review')()
  File "/usr/lib/python2.7/site-packages/openqa_review/openqa_review.py", line
1193, in main
    report = generate_report(args)
  File "/usr/lib/python2.7/site-packages/openqa_review/openqa_review.py", line
1129, in generate_report
    return Report(browser, args, root_url, job_groups)
  File "/usr/lib/python2.7/site-packages/openqa_review/openqa_review.py", line
1079, in __init__
    self.report[k] = self._one_report(v)
  File "/usr/lib/python2.7/site-packages/openqa_review/openqa_review.py", line
1090, in _one_report
    return ProductReport(self.browser, job_group_url, self.root_url, self.args)
  File "/usr/lib/python2.7/site-packages/openqa_review/openqa_review.py", line
910, in __init__
    self.reports[arch] = ArchReport(arch, results, args, root_url,
progress_browser, bugzilla_browser, browser)
  File "/usr/lib/python2.7/site-packages/openqa_review/openqa_review.py", line
759, in __init__
    self._search_for_bugrefs_for_softfailures(results)
  File "/usr/lib/python2.7/site-packages/openqa_review/openqa_review.py", line
811, in _search_for_bugrefs_for_softfailures
    v['bugref_href'] = issue_tracker[bugref](bug_id)
KeyError: u'bgo'
```

## Suggestion

Fix available in version 1.8.3, needs update of version.

## Further details

The according changes adding support for newer version of openQA are described
in the changelog of python-openqa_review:

- Update to version 1.8.3:
  * Add 'bgo' bugref
  * Handle unknown bugtrackers gracefully

- Update to version 1.8.2:
  * browser: Status code is not always available on error
  * setup.py: Correct name of tests_require
  * Project is no production stable
  * Only require separate configparser for python2
  * Fix require of configparser for python3

- Provide singlespec file with update-alternatives including self-test
  * Better multibuild-evaluation with valid syntax allowing local use of
    '-M test'
  * Complete runtime requirements including "python-setuptools"
  * Complete set of scripts for both python2 and python3
  * Package self-test for all repositories and python2/python3

- Update to version 1.8.0:
  * Provide job references in failed soft-fail parsing
  * Add review wrapper script for 'functional' group on openqa.suse.de
  * Handle disconnects by remote end on API get gracefully

- Update version to support more recent openQA web structure (boo#1059661)


--1516370316.D7DCD4.8070
Date: Fri, 19 Jan 2018 13:58:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1076819

            Bug ID: 1076819
           Summary: debugedit: Couldn't update relocation: invalid data (KMP build failure)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: sndirsch-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

How to reproduce:

$ alias iosc='osc -A https://api.suse.de'
$ iosc co Proprietary:X11:Drivers/nvidia-gfxG04
$ linux32 bash
$ cd Proprietary:X11:Drivers/nvidia-gfxG04
$ osc build openSUSE_Tumbleweed i586
[...]
[  294s] + /usr/lib/rpm/find-debuginfo.sh -j12 --build-id-seed 384.111-3.4
--unique-debug-suffix -384.111-3.4.i386 --unique-debug-src-base
nvidia-gfxG04-384.111-3.4.i386 --run-dwz --dwz-low-mem-die-limit 10000000
--dwz-max-die-limit 50000000 -S debugsourcefiles.list
/home/abuild/rpmbuild/BUILD/nvidia-gfxG04-384.111
[  294s] extracting debug info from
/home/abuild/rpmbuild/BUILDROOT/nvidia-gfxG04-384.111-3.4.i386/lib/modules/4.14.13-1-default/updates/nvidia-modeset.ko
[  294s] extracting debug info from
/home/abuild/rpmbuild/BUILDROOT/nvidia-gfxG04-384.111-3.4.i386/lib/modules/4.14.13-1-default/updates/nvidia-drm.ko
[  294s] extracting debug info from
/home/abuild/rpmbuild/BUILDROOT/nvidia-gfxG04-384.111-3.4.i386/lib/modules/4.14.13-1-pae/updates/nvidia-drm.ko
[  294s] extracting debug info from
/home/abuild/rpmbuild/BUILDROOT/nvidia-gfxG04-384.111-3.4.i386/lib/modules/4.14.13-1-pae/updates/nvidia-modeset.ko
[  294s] extracting debug info from
/home/abuild/rpmbuild/BUILDROOT/nvidia-gfxG04-384.111-3.4.i386/lib/modules/4.14.13-1-default/updates/nvidia.ko
[  294s] extracting debug info from
/home/abuild/rpmbuild/BUILDROOT/nvidia-gfxG04-384.111-3.4.i386/lib/modules/4.14.13-1-pae/updates/nvidia.ko
[  294s] /usr/lib/rpm/debugedit: Couldn't update relocation: invalid data
[  294s] /usr/lib/rpm/debugedit: Couldn't update relocation: invalid data
[  294s] /usr/lib/rpm/debugedit: Couldn't update relocation: invalid data
[  294s] /usr/lib/rpm/debugedit: Couldn't update relocation: invalid data
[  294s] /usr/lib/rpm/debugedit: Couldn't update relocation: invalid data
[  294s] /usr/lib/rpm/debugedit: Couldn't update relocation: invalid data
[  294s] /usr/lib/rpm/find-debuginfo.sh: line 511:
/tmp/find-debuginfo.fibvwE/res.*: No such file or directory


--1516377290.b6ea1.11125
Date: Fri, 19 Jan 2018 15:54:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076839

            Bug ID: 1076839
           Summary: [Build 20180117] installer startup: kexec failed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: i586
               URL: https://openqa.opensuse.org/tests/586185/modules/welco
                    me/steps/4
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario opensuse-Tumbleweed-NET-i586-install_only@32bit fails
in
[welcome](https://openqa.opensuse.org/tests/586185/modules/welcome/steps/4)

## Reproducible

Fails since (at least) Build
[20180117](https://openqa.opensuse.org/tests/585467)

## Expected result

Last good: [20180116](https://openqa.opensuse.org/tests/583935) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?flavor=NET&machine=32bit&version=Tumbleweed&test=install_only&distri=opensuse&arch=i586)

A local reproducer seems quite easy: download the NET ISO and try to start the
installation (even by pointing it at download.o.o)

On one of the consoles you can see the text 'kexec failed'
This only happens on the i586 NET ISO, the x86_64 one works as expected


body:
--1516381324.c1dE5.8950
Date: Fri, 19 Jan 2018 17:02:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076854

            Bug ID: 1076854
           Summary: Don't set LC_CTYPE by default
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: sbrabec-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: kstreitova-at-suse.com
          Found By: ---
           Blocker: ---

Most GNU/Linux manuals say: If you want to change locale, set LANG variable.

It is not true for SUSE. In SUSE, one has always unset or set LC_CTYPE as well,
otherwise it may break. The breakage has a very low visibility for UTF-8
locales, but it can cause unexpected behavior in non-UTF-8 locales.

If LC_CTYPE is unset, it is inherited from LANG.

That is why I propose:

As long as LC_CTYPE is not explicitly requested by /etc/sysconfig/language,
don't set it.

Non root:
RC_LC_CTYPE == "" => LC_CTYPE is unset
RC_LC_CTYPE != "" => LC_CTYPE=$RC_LC_TYPE

Root:
(ROOT_USES_LANG == yes) OR (ROOT_USES_LANG == no) => LC_CTYPE is unset
(ROOT_USES_LANG == ctype) AND (RC_LC_CTYPE == "") => LC_CTYPE=$LANG
(ROOT_USES_LANG == ctype) AND (RC_LC_CTYPE != "") => LC_CTYPE=$RC_LC_TYPE

summary: Don't set LC_CTYPE by default


--1516459696.80bC0.29533
Date: Sat, 20 Jan 2018 14:48:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076898

            Bug ID: 1076898
           Summary: Regression: bluetooth headset not connecting since last update, workaround included
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: PVince81-at-yahoo.fr
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Before upgrading, connecting to bluetooth headset from TaoTronics worked
correctly. I also have a cheap bluetooth watch and connecting to it with
bluetoothctl worked fine.

Today I updated Tumbleweed to snapshot 20180117 and I observe the following
behavior:

1) Connecting to bluetooth headset does not work any more even after a fresh
boot. It connects shortly then disconnects. Both with the Plasma widget and
with bluetoothctl.
2) Sometimes even after a fresh boot, the plasma widget doesn't show any of the
known bluetooth devices
3) Strangely connecting to my bluetooth watch still works with bluetoothctl.

From what I remember, before the update I had bluez-5.47 and now it has been
updated to 5.48.

Furthermore there is a similar report here for Fedora:
https://bugzilla.redhat.com/show_bug.cgi?id=1534857

The workaround, as indicated in that link, is to restart the bluetooth service
with "systemctl restart bluetooth". After that the headset can connect again.

This is on a Dell XPS 13 9333 (different model than the above).

There are already logs in the Fedora ticket, I'll reboot now to try and gather
some from here.

Please let me know if you need further information.


body:
--1516463611.Bacbb50.15316
Date: Sat, 20 Jan 2018 15:53:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076900

            Bug ID: 1076900
           Summary: ptpd package has multiple issues
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: avsco-at-mail.ru
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Although the development of PTPd seems to have stalled a couple of years ago,
the package that ships with openSUSE 42.3 appears to lag even that stage:

* original current: 2.3.2 (2015-10)
* original release: 2.3.1 (2015-06)
* openSUSE package: 2.3.0 (2013-11)

According to their changelog, there was a ton of improvements and bug fixes
since 2.3.0; particularly for me, the show-stopper is IP-vs-Ethernet bug:
https://sourceforge.net/p/ptpd/bugs/66/

Also the openSUSE-provided package is flawed in its own way:

1. Systemd unit file refers to /usr/bin/ptpd2 while the actual program file
is located at /usr/sbin directory as one would expect.

2. Stock configuration file /etc/ptpd2.conf has syntax errors that come
as a result of unnecessary word wrapping at 78 character boundary: namely,
lines 2, 7, 16, 20, 24, 46. Note that, to get a complete and syntactically
correct configuration file for further tweaking, it is usually sufficient
to just run: ptpd2 --default-config

Please, consider updating and fixing the package.

summary: ptpd package has multiple issues


--1516475286.EE6D71.4502
Date: Sat, 20 Jan 2018 19:08:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1076907

            Bug ID: 1076907
           Summary: package MozillaFirefox does not provide mimehandler(text/html)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Firefox
          Assignee: bnc-team-mozilla-at-forge.provo.novell.com
          Reporter: giecrilj@stegny.2a.pl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

{
let i=0
for package in konqueror MozillaFirefox
do
echo "$package provides:"
zypper info --provides "$package" | grep -F 'mimehandler' || let 'i^=1'
echo
done
let i && echo 'Test failed: only one package provides a media handler!' &&
false
}


body:
--1516488422.73B80.3132
Date: Sat, 20 Jan 2018 22:47:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1076909

            Bug ID: 1076909
           Summary: bash segfaults when filesystem is full
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: richard-at-nod.at
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

While my filesystem ran out of space I noticed that bash segfaulted.
It turned out that your SUSE specific patch "bash-4.3-pathtemp.patch"
introduced this bug.

In the patch you do a "goto enospace" if mkstemp() fails with ENOSPC.
At this point filename is already free()'ed and NULL, but the label enospace is
right _after_ xmalloc()...

Please fix. B-)

summary: bash segfaults when filesystem is full


--1516622360.FE7Df42b0.7181
Date: Mon, 22 Jan 2018 11:59:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077027

            Bug ID: 1077027
           Summary: server:database:postgresql/postgresql: Bug - initdb without LC settings
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: max-at-suse.com
          Reporter: linreg-at-gmx.net
        QA Contact: opensuse-communityscreening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

The first creation of an database cluster use no language settings from
/etc/sysconfig/postgresql or language. So the database clsuter has ever locale
C.

/usr/share/postgresql/postgresql-script <


--1516624163.3CB6e3770.13004
Date: Mon, 22 Jan 2018 12:29:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1077037

            Bug ID: 1077037
           Summary: /usr/include/ipset/libipset/types.h requires libipset/args.h
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: jengelh-at-inai.de
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Found while fixing ipset support in keepalived.

As a side note ... why the extra subdirectory /usr/include/ipset/libipset/
instead of just /usr/include/libipset/?


--1516690672.a2BFa6f3.18030
Date: Tue, 23 Jan 2018 06:57:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077145

            Bug ID: 1077145
           Summary: [regression] osc build uses wrong changes file
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: adrian-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: coolo-at-suse.com
          Found By: Development
           Blocker: ---

I found this when working on reproducible builds for openSUSE.
Regression occurring since at least 2018-01-19
Using the /usr/lib/build/changelog2spec script from
build-20171128-278.1 from openSUSE:Tools repo

When building packages like antlr openssh qemu python-pandas
that have multiple .changes files
sometimes the wrong one will end up in the resulting .src.rpm
and binary rpms

Steps To Reproduce:
osc co openSUSE:Factory/antlr ; cd $_
time osc build --keep-pkg=test.2/ --noservice antlr.spec
rpm -qp --changelog test.2/antlr-2.7.7-0.src.rpm|head -2

Actual Result:
* Thu Dec 07 2017 dimstar-at-opensuse.org
- Escape the usage of %{VERSION} when calling out to rpm.

Expected Result:
* Fri Jan 12 2018 tchvatal-at-suse.com
- Add condition about python2 module, the rewrite happened in antlr4

Reproducible: Sometimes

on another build host I got build-20171027 and could not reproduce the problem.


--1516693955.7BEbFd0.27765
Date: Tue, 23 Jan 2018 07:52:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077154

            Bug ID: 1077154
           Summary: VUL-0: CVE-2018-1000003: pdns-recursor: input validation bugs in DNSSEC validators components
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/198758/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: amajer-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-1000003

Improper input validation bugs in DNSSEC validators components in PowerDNS
version 4.1.0 allow attacker in man-in-the-middle position to deny existence of
some data in DNS via packet replay.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000003
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-1000003.html
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-01.html


--1516697608.c5Aa0.5517
Date: Tue, 23 Jan 2018 08:53:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077161

            Bug ID: 1077161
           Summary: VUL-0: CVE-2017-17858: Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.cin Artifex MuPDF 1.12.0 allows a remote attacker to potentially executearbitrary code via a crafted PDF file, because xref subsection obj
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/198756/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2017-17858

Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c
in Artifex MuPDF 1.12.0 allows a remote attacker to potentially execute
arbitrary code via a crafted PDF file, because xref subsection object numbers
are unrestricted.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-17858
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-17858.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17858
https://github.com/mzet-/Security-Advisories/blob/master/mzet-adv-2017-01.md
https://bugs.ghostscript.com/show_bug.cgi?id=698819
http://git.ghostscript.com/?p=mupdf.git;a=commit;h=55c3f68d638ac1263a386e0aaa004bb6e8bde731


--1516701656.bbfB0.23789
Date: Tue, 23 Jan 2018 10:00:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1077177

            Bug ID: 1077177
           Summary: spec-cleaner 1.0.2 update to fix various issues
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: tchvatal-at-suse.com
          Reporter: tchvatal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Brings few small fixes and most notably breakage of otherprovides removal.


--1516714671.BB18c10.9203
Date: Tue, 23 Jan 2018 13:37:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077230

            Bug ID: 1077230
           Summary: python3: build python3-xml as part of python3-base
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

With the python2 packages, python-xml (aka python2-xml) was built as part of
python-base.

With python3, this is part of the 'full' python3 package.

This, in turn, results in a build cycle like shown in the attached image

Is it possible to produce python3-xml as part (embedded, I don't mind) of
python3-base (without moving the cycle to bython3-base)


body:
--1516736426.D1f7c0.17792
Date: Tue, 23 Jan 2018 19:40:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077294

            Bug ID: 1077294
           Summary: ISDS support update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: tchvatal-at-suse.com
          Reporter: astieger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Tracker bug for an update for ISDS support
(Informační systém datových schránek / Data Box Information System)

Submitted:

https://build.opensuse.org/request/show/566965 libisds 0.10.1 to 0.10.7
https://build.opensuse.org/request/show/566966 datovka 4.6.0 to 4.10.1

summary: ISDS support update


--1516742917.0BAf0.11823
Date: Tue, 23 Jan 2018 21:28:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077300

            Bug ID: 1077300
           Summary: GnuCash no longer retrieves price information
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: GeoBaltz-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

In November 2017 YAHOO killed off their legacy API for retrieving stock/mutual
fund price quotes, which GnuCash utilized via the Perl-Finance-Quote module.
That package has since been updated(in CPAN) to use one of several new methods.

None of the current openSUSE products has been updated to the current
(functional) version 1.47 - Leap ships 1.37, TW 1.38; although there are some
in various repos, I am loathe to use random personally produced packages for
financial purposes.

Please update P::F::Q to 1.47, if possible for 42.3, certainly for TW and 15.


--1516800336.3aAce7AA0.23714
Date: Wed, 24 Jan 2018 13:25:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077407

            Bug ID: 1077407
           Summary: VUL-0: CVE-2018-6187: In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackerscould leverage the vulnerability to cause a denial of serv
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/198891/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-6187

In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in
the do_pdf_save_document function in the pdf/pdf-write.c file. Remote attackers
could leverage the vulnerability to cause a denial of service via a crafted pdf
file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6187
https://bugs.ghostscript.com/show_bug.cgi?id=698908


body:
--1516814967.AfF1aEc4.22990
Date: Wed, 24 Jan 2018 17:29:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077468

            Bug ID: 1077468
           Summary: KDE:Extra/cantata: Bug
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: cornelis-at-solcon.nl
          Reporter: ottwolt-at-gmail.com
        QA Contact: opensuse-communityscreening-at-forge.provo.novell.com
                CC: kde-maintainers-at-suse.de
          Found By: Customer
           Blocker: ---

cantata-2.2.0-9.7.x86_64 and
cantata-2.2.0-9.8.x86_64 crash when the 4th letter is entered in library search
box.

Cantata 2.2.50 (compiled from https://github.com/CDrummond/cantata.git) works
fine.

My OS is Tumbleweed (not Factory)

summary: KDE:Extra/cantata: Bug


--1516873785.bC16B30.4835
Date: Thu, 25 Jan 2018 09:49:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1077571

            Bug ID: 1077571
           Summary: VUL-0: chromium: stable channel update to 64.0.3282.119
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: tchvatal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

As per $SUBJ:

[$3000][780450] High CVE-2018-6031: Use after free in PDFium. Reported by
Anonymous on 2017-11-01
[$2000][787103] High CVE-2018-6032: Same origin bypass in Shared Worker.
Reported by Jun Kokatsu (@shhnjk) on 2017-11-20
[$1000][793620] High CVE-2018-6033: Race when opening downloaded files.
Reported by Juho Nurminen on 2017-12-09
[$4000][784183] Medium CVE-2018-6034: Integer overflow in Blink. Reported by
Tobias Klein (www.trapkit.de) on 2017-11-12
[$2500][797500] Medium CVE-2018-6035: Insufficient isolation of devtools from
extensions. Reported by Rob Wu on 2017-12-23
[$2000][789952] Medium CVE-2018-6036: Integer underflow in WebAssembly.
Reported by The UK's National Cyber Security Centre (NCSC) on 2017-11-30
[$1000][753645] Medium CVE-2018-6037: Insufficient user gesture requirements in
autofill. Reported by Paul Stone of Context Information Security on 2017-08-09
[$1000][774174] Medium CVE-2018-6038: Heap buffer overflow in WebGL. Reported
by cloudfuzzer on 2017-10-12
[$1000][775527] Medium CVE-2018-6039: XSS in DevTools. Reported by Juho
Nurminen on 2017-10-17
[$1000][778658] Medium CVE-2018-6040: Content security policy bypass. Reported
by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-26
[$500][760342] Medium CVE-2018-6041: URL spoof in Navigation. Reported by Luan
Herrera on 2017-08-29
[$500][773930] Medium CVE-2018-6042: URL spoof in OmniBox. Reported by Khalil
Zhani on 2017-10-12
[$500][785809] Medium CVE-2018-6043: Insufficient escaping with external URL
handlers. Reported by 0x09AL on 2017-11-16
[$TBD][797497] Medium CVE-2018-6045: Insufficient isolation of devtools from
extensions. Reported by Rob Wu on 2017-12-23
[$TBD][798163] Medium CVE-2018-6046: Insufficient isolation of devtools from
extensions. Reported by Rob Wu on 2017-12-31
[$TBD][799847] Medium CVE-2018-6047: Cross origin URL leak in WebGL. Reported
by Masato Kinugawa on 2018-01-08
[$500][763194] Low CVE-2018-6048: Referrer policy bypass in Blink. Reported by
Jun Kokatsu (@shhnjk) on 2017-09-08
[$500][771848] Low CVE-2017-15420: URL spoofing in Omnibox. Reported by Drew
Springall (@_aaspring_) on 2017-10-05
[$500][774438] Low CVE-2018-6049: UI spoof in Permissions. Reported by WenXu Wu
of Tencent's Xuanwu Lab on 2017-10-13
[$500][774842] Low CVE-2018-6050: URL spoof in OmniBox. Reported by Jonathan
Kew on 2017-10-15
[$N/a][441275] Low CVE-2018-6051: Referrer leak in XSS Auditor. Reported by
Antonio Sanso (@asanso) on 2014-12-11
[$N/A][615608] Low CVE-2018-6052: Incomplete no-referrer policy implementation.
Reported by Tanner Emek on 2016-05-28
[$N/A][758169] Low CVE-2018-6053: Leak of page thumbnails in New Tab Page.
Reported by Asset Kabdenov on 2017-08-23
[$N/A][797511] Low CVE-2018-6054: Use after free in WebUI. Reported by Rob Wu
on 2017-12-24

https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html


--1516892180.A0E3b3Df0.2811
Date: Thu, 25 Jan 2018 14:56:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077633

            Bug ID: 1077633
           Summary: pk-update-icon does not request to relogin
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/590662/modules/updat
                    es_packagekit_kde/steps/8
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

As seen in openQA there is a software stack update available:

[updates_packagekit_kde](https://openqa.opensuse.org/tests/590662/modules/updates_packagekit_kde/steps/8)

the update applet installs it but does not ask to relogin as expected. Follow
up updates also require to reboot the computer which it doesn't tell either.


body:
--1516902905.42C1B7f1.1681
Date: Thu, 25 Jan 2018 17:55:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077654

            Bug ID: 1077654
           Summary: clunky font in grub2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/591755/modules/grub_
                    test/steps/2
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Bootloader
          Assignee: letcp-at-protonmail.com
          Reporter: lnussel-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

I didn't pay much attention in staging but now that I have it in... Are you
sure this is the font we want? Looks a bit clunky...
[grub_test](https://openqa.opensuse.org/tests/591755/modules/grub_test/steps/2)

summary: clunky font in grub2


body:
--1516934552.5D7Bb50.12599
Date: Fri, 26 Jan 2018 02:42:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1077702

            Bug ID: 1077702
           Summary: kronosnet-1.0 is available now
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: High Availability
          Assignee: ha-bugs-at-suse.de
          Reporter: bliu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Kronosnet, often referred to as knet, is a network abstraction layer designed
for High Availability use cases, where redundancy, security, fault tolerance
and fast fail-over are the core requirements of your application.

It is under lay of corosync-3.0

Corosync 3.0 contains many interesting features mostly related to usage
of Kronosnet (https://kronosnet.org/) as a default (and preferred)
network transport.

Short list of high-level changes:
- Knet
  * Support for 8 links which can be dynamically reconfigured without
restart of corosync daemon
  * MTU auto-configuration
  * Support for NSS or OpenSSL encryption of packets
  * Compression
  * Higher throughput and lower latency (yes, it's really possible to
get both of these at once ;) )
  * And many more

summary: kronosnet-1.0 is available now


--1516960333.BCf40.15065
Date: Fri, 26 Jan 2018 09:52:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077722

            Bug ID: 1077722
           Summary: Chromium 64.0.3282.119 segfault - [Build 20180126-2] openQA test fails
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/592655/modules/chrom
                    ium/steps/18
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: tchvatal-at-suse.com
          Reporter: astieger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Chromium built for Leap 42.3 maintenance does not start:

openQA test in scenario opensuse-42.3-UpdateTest-x86_64-gnome@uefi-2G fails in
[chromium](https://openqa.opensuse.org/tests/592655/modules/chromium/steps/18)

chromium
Received signal 11 SEGV_MAPERR 000000000000
#0 0x561196c6c17e <unknown>
#1 0x561194c6b908 <unknown>
#2 0x561196c6c537 <unknown>
#3 0x7fd25cfbfb20 <unknown>
#4 0x561198cf2dcf <unknown>
#5 0x561198bd3929 <unknown>
#6 0x561198ad093c <unknown>
#7 0x561198af1902 <unknown>
#8 0x561198af3f69 <unknown>
#9 0x561198af4313 <unknown>
#10 0x561198af48a4 <unknown>
#11 0x561198aef85a <unknown>
#12 0x561198af0945 <unknown>
#13 0x561198af11f0 <unknown>
#14 0x561196b87fe2 <unknown>
#15 0x561196b8894c <unknown>
#16 0x5611955bc022 <unknown>
#17 0x5611959d62d2 <unknown>
#18 0x5611955be1a4 <unknown>
#19 0x5611955c1f3b <unknown>
#20 0x5611955bb63c <unknown>
#21 0x5611968fecca <unknown>
#22 0x56119690b25a <unknown>
#23 0x5611968fd795 <unknown>
#24 0x561194c8c48d <unknown>
#25 0x7fd2568dd6d5 __libc_start_main
#26 0x561194c8c239 <unknown>
  r8: 000019f2e9e5d2f0  r9: 000019f2e9e477b0 r10: 000019f2e9712080 r11:
ffffe60fa690e6d4
 r12: 00007fffadbdc2d0 r13: 00007fffadbdc3e8 r14: 0000000000000000 r15:
000019f2e9756f00
  di: 0000000000000040  si: 0000000000000001  bp: 00007fffadbdc3d0  bx:
000019f2e9df9900
  dx: 0000000000000080  ax: 0000000000000000  cx: 0000000000000000  sp:
00007fffadbdc2b0
  ip: 0000561198cf2dcf efl: 0000000000010206 cgf: 0000000000000033 erf:
0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]
Calling _exit(1). Core file will not be generated.


--1516964971.138ADEB0.31457
Date: Fri, 26 Jan 2018 11:09:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077728

            Bug ID: 1077728
           Summary: k3b doesn't build with libmad and lame even though they are available.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: davejplater-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When starting k3b it states that mad decoder isn't available even though it is.
This is because it isn't built against them.


body:
--1516975290.D6bc540.31687
Date: Fri, 26 Jan 2018 14:01:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077744

            Bug ID: 1077744
           Summary: [evaluate] info has prereq on bash
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

texlive.spec contains this section:

%package     -n info
Summary:        A Stand-Alone Terminal-Based Info Browser
Group:          Productivity/Publishing/Texinfo
Requires(pre):  bash

paired with this pre script:

%preun -n info
%install_info_delete --info-dir=%{_infodir}
%{_infodir}/info-stnd.info%{ext_info}

%post -n info
%install_info --info-dir=%{_infodir} %{_infodir}/info-stnd.info%{ext_info}

with install_info expanding into:

    ALL_ARGS=()
    NUM_ARGS=${#ALL_ARGS[@]}
    if test -x /sbin/install-info ; then
    if test -e "${ALL_ARGS[$((NUM_ARGS-1))]}" ; then
        /sbin/install-info "${ALL_ARGS[@]}"
    fi
    fi ;

the pre-scriptlet is using, by default /bin/sh as the interpreter (as can be
seen by rpm -q --scripts)

So imho, either the requires on bash is wrong (/bin/sh is added as script
interprter, and is not guaranteed to be bash) or, if right, then the script
should be forced to use bash (but that is the least favorable option)

The best option would be to drop the Requires(pre) bash

summary: [evaluate] info has prereq on bash


--1516978149.018b3eb50.3932
Date: Fri, 26 Jan 2018 14:49:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077755

            Bug ID: 1077755
           Summary: VUL-0: CVE-2018-6192: In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c allowsremote attackers to cause a denial of service (segmentation violation andapplication crash) via a crafted pdf file.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/198938/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: idonmez-at-suse.com
          Reporter: vpereira-at-microfocus.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-6192

In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf-xref.c
allows
remote attackers to cause a denial of service (segmentation violation and
application crash) via a crafted pdf file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6192
http://www.cvedetails.com/cve/CVE-2018-6192/
https://bugs.ghostscript.com/show_bug.cgi?id=698916


--1517067860.Ce1e70.22717
Date: Sat, 27 Jan 2018 15:44:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077851

            Bug ID: 1077851
           Summary: Missing German Translation in KDE Plasma5 Software Updates Applet for PackageKit
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: fkrueger-at-mailbox.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After upgrading to KDE 5.11.95 within a German environment, the plasma applet
for software updates has no German translation for "Checking for updates
failed". All the recommended *-lang packages are installed (TW 20180125).


--1517076453.eB77e20b0.16744
Date: Sat, 27 Jan 2018 18:07:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077854

            Bug ID: 1077854
           Summary: [Build 109.3] openQA test fails in zdup from openSUSE Leap 42.1 - file conflict between plasma5-defaults-openSUSE and kdebase4-runtime-branding-openSUSE
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/592185/modules/zdup/
                    steps/200
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Upgrade Problems
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: okurz-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario opensuse-15.0-DVD-x86_64-zdup-Leap-42.1-kde@64bit fails
in
[zdup](https://openqa.opensuse.org/tests/592185/modules/zdup/steps/200)

## Reproducible

Fails since (at least) Build [101.1](https://openqa.opensuse.org/tests/587612)

## Expected result

Last good: [97.1](https://openqa.opensuse.org/tests/585258) (or more recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?version=15.0&flavor=DVD&machine=64bit&arch=x86_64&test=zdup-Leap-42.1-kde&distri=opensuse)


body:
--1517091197.00d680.26471
Date: Sat, 27 Jan 2018 22:13:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077857

            Bug ID: 1077857
           Summary: Linphone hangs on splash screen
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: psychonaut-at-nothingisreal.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After a recent update of the Linphone libraries, the Linphone GUI no longer
works.  Specifically, the splash screen appears but remains there indefinitely
(or until clicked).  The main program window or system tray icon never appear.
The following is printed to the console:

$ usr/bin/linphone
[22:58:55:764][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:106:
"Use locale: en_CA"
[22:58:55:788][0x56268ce5e070][Info]:0: "Running app..."
[22:58:55:788][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:170:
"Library paths:" ("/usr/lib64/qt5/plugins", "/usr/bin")
[22:58:55:788][0x56268d1d0c80][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/components/core/CoreManager.cpp:200:
"Launch async linphone core creation."
[22:58:55:789][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:181:
"Activated selectors:" ("custom", "en_CA", "unix", "linux", "opensuse")
[22:58:55:789][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:355:
"Registering types..."
[22:58:55:789][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:389:
"Registering shared types..."
[22:58:55:789][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:401:
"Registering tool types..."
[22:58:55:789][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:409:
"Registering shared tool types..."
[22:58:55:879][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:134:
"Open splash screen..."
[22:58:55:905][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:213:
"Loading main view..."
[22:58:55:940][0x56268d1d0c80][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/components/core/CoreManager.cpp:170:
"Set `Friends` path: `/home/psy/.local/share/linphone/friends.db`"
[22:58:55:962][0x56268d1d0c80][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/components/core/CoreManager.cpp:171:
"Set `CallLogs` path: `/home/psy/.local/share/linphone/call-history.db`"
[22:58:55:985][0x56268d1d0c80][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/components/core/CoreManager.cpp:172:
"Set `Chat` path: `/home/psy/.local/share/linphone/message-history.db`"
[22:58:56:118][0x56268ce5e070][Info]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/components/core/CoreManager.cpp:49:
"Core created. Enable iterate."

The problem occurs even when starting from a clean configuration (i.e.,
deleting all Linphone-related directories in ~/.config and ~/.local/share).

I'm running linphone-4.1.1-2.4.x86_64.  This package was working fine a few
days ago, but no longer works as of yesterday, when the following updates
(among many others) were applied:

liblinphone-data: 3.12.0-4.2 -> 3.12.0-5.1
liblinphone9: 3.12.0-4.2 -> 3.12.0-5.1
liblinphone-lang: 3.12.0-4.2 -> 3.12.0-5.1
liblinphone-cli: 3.12.0-4.2 -> 3.12.0-5.1
liblinphone++9: 3.12.0-4.2 -> 3.12.0-5.1

summary: Linphone hangs on splash screen


--1517162164.4b03fd60.7702
Date: Sun, 28 Jan 2018 17:56:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077881

            Bug ID: 1077881
           Summary: libfltk1: doesn't show correct cursor/pointer  at least in tigervnc-viewer
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: 64bit
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: M.Traxler-at-gsi.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Something is wrong with the libfltk1 libraries.
When using them for example with tigervnc-vncviewer, the cursor (mouse pointer)
is not changing according to the window wishes from the vncserver as expected.
Only an arrow is shown!
One would expect that this is a problem of tigervnc-viewer, but when I just
copy all /usr/lib/x86_64-linux-gnu/libfltk* from a Ubuntu 17.10 to my OpenSuSE
Tumbleweed, all works great again.

This problem also persists if I compile fltk-1.3.4-2 from the sources.
Also a self compiled version of tiger-vncviewer shows the problem, and also the
problem vanishes with the fltk-library from Ubuntu.

The strange thing: the fltk/test/cursor application works well with the
Tumbleweed-FLTK and all different mouse cursors are show.

Any hint, what could be the problem?


--1517206944.100DC80.2730
Date: Mon, 29 Jan 2018 06:22:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077894

            Bug ID: 1077894
           Summary: VUL-0: CVE-2018-6360: mpv through 0.28.0 allows remote attackers to execute arbitrary code via acrafted web site, because it reads HTML documents containing VIDEO elements, andaccepts arbitrary URLs in a src attribute without a protocol w
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/199095/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: tchvatal-at-suse.com
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-6360

mpv through 0.28.0 allows remote attackers to execute arbitrary code via a
crafted web site, because it reads HTML documents containing VIDEO elements,
and
accepts arbitrary URLs in a src attribute without a protocol whitelist in
player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies
that the product should call dlopen on a shared object file located at an
arbitrary local pathname. The issue exists because the product does not
consider
that youtube-dl can provide a potentially unsafe URL.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6360
http://www.cvedetails.com/cve/CVE-2018-6360/
https://github.com/mpv-player/mpv/commit/e6e6b0dcc7e9b0dbf35154a179b3dc1fcfcaff43
https://github.com/mpv-player/mpv/issues/5456


--1517177150.0C4E3.10265
Date: Sun, 28 Jan 2018 22:05:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077885

            Bug ID: 1077885
           Summary: GPU hang (Intel Mobile 4 Series Integrated Graphics Controller)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: x86-64
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: carlos.e.r-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This is similar to "Bug 1050256 - GPU hang", but different GPU. The symptoms
are the same, but being different GPU I was told to create new report.

I have this issue after upgrading my laptop to 42.3 from 42.2, using the
offline or DVD upgrade method.

CPU:
  Model: 6.23.10 "Pentium(R) Dual-Core CPU       T4300  @ 2.10GHz"
Video:
  Model: "Intel Mobile 4 Series Chipset Integrated Graphics Controller"
  Vendor: pci 0x8086 "Intel Corporation"
  Device: pci 0x2a42 "Mobile 4 Series Chipset Integrated Graphics Controller"
  SubVendor: pci 0x103c "Hewlett-Packard Company"
  SubDevice: pci 0x3069
  Revision: 0x07
  Driver: "i915"
  Driver Modules: "i915"

(hwinfo output will be attached)

Crash log:

<3.6> 2018-01-27 12:47:05 minas-tirith systemd 1 - -  Started Postfix Mail
Transport Agent.
<0.6> 2018-01-27 12:47:17 minas-tirith kernel - - - [ 1128.808879] [drm] GPU
HANG: ecode 4:0:0xfdefffff, in X [2154], reason: Hang on render ring, action:
reset
<0.6> 2018-01-27 12:47:17 minas-tirith kernel - - - [ 1128.808883] [drm] GPU
hangs can indicate a bug anywhere in the entire gfx stack, including userspace.
<0.6> 2018-01-27 12:47:17 minas-tirith kernel - - - [ 1128.808884] [drm] Please
file a _new_ bug report on bugs.freedesktop.org against DRI -> DRM/Intel
<0.6> 2018-01-27 12:47:17 minas-tirith kernel - - - [ 1128.808884] [drm]
drm/i915 developers can then reassign to the right component if it's not a
kernel issue.
<0.6> 2018-01-27 12:47:17 minas-tirith kernel - - - [ 1128.808885] [drm] The
gpu crash dump is required to analyze gpu hangs, so please always attach it.
<0.6> 2018-01-27 12:47:17 minas-tirith kernel - - - [ 1128.808885] [drm] GPU
crash dump saved to /sys/class/drm/card0/error
<0.5> 2018-01-27 12:47:17 minas-tirith kernel - - - [ 1128.808914] drm/i915:
Resetting chip after gpu hang
<0.5> 2018-01-27 12:47:26 minas-tirith kernel - - - [ 1137.820965] drm/i915:
Resetting chip after gpu hang
<0.5> 2018-01-27 12:47:36 minas-tirith kernel - - - [ 1147.820140] drm/i915:
Resetting chip after gpu hang

I commented this on the openSUSE mail list, and Dave Plater suggested
nomodeset. This works, but the video mode changes to something like 800*600,
which is pretty bad. He also suggested to reopen this Bugzilla.

At that moment I had kernel 4.4.104-39, and drm-kmp-default
4.9.33_k4.4.79_4-5.2. I updated to his version,
drm-kmp-default-4.9.33_k4.4.104_39-7.24.x86_64.rpm; this is more stable, but in
the end the X environment froze: mouse moves, but no response. I could
ctrl-alt-f1.

I see in the log several entries like this (different PID), don't know if
related:

<3.6> 2018-01-27 19:58:34 minas-tirith console-kit-daemon 3128 - -
(process:10750): GLib-CRITICAL **: g_slice_set_config: assertion 'sys_page_size
== 0' failed

I hibernated the machine and went back home. Restored (not restarted) and I see
this in the log:

<3.6> 2018-01-27 21:16:36 minas-tirith systemd-sleep 10886 - -  System resumed.
<3.6> 2018-01-27 21:16:36 minas-tirith systemd-sleep 10886 - -  INFO: running
/usr/lib/systemd/system-sleep/grub2.sleep for hibernate
<3.6> 2018-01-27 21:16:36 minas-tirith systemd-sleep 10886 - -  INFO: Running
grub-once-restore ..
<3.6> 2018-01-27 21:16:36 minas-tirith systemd-sleep 10886 - -  2018-01-27
21:16:36+01:00 - Thawing the system now...
<3.4> 2018-01-27 21:16:36 minas-tirith systemd-sh - - -  Thawing the system
now...
<3.6> 2018-01-27 21:16:37 minas-tirith systemd 1 - -  Stopped Deferred
execution scheduler.
<3.6> 2018-01-27 21:16:37 minas-tirith systemd 1 - -  Started Deferred
execution scheduler.
<3.6> 2018-01-27 21:16:37 minas-tirith laptop-mode - - -  Laptop mode
<3.6> 2018-01-27 21:16:37 minas-tirith laptop-mode - - -  enabled, not active
[unchanged]
<3.6> 2018-01-27 21:16:37 minas-tirith systemd-sleep 10886 - -  INFO: Done.
<3.6> 2018-01-27 21:16:37 minas-tirith laptop-mode - - -  Laptop mode
<3.6> 2018-01-27 21:16:37 minas-tirith laptop-mode - - -  enabled, not active
[unchanged]
<3.6> 2018-01-27 21:16:37 minas-tirith systemd-sleep 10886 - -  tput: No value
for $TERM and no -T specified
<0.6> 2018-01-27 21:16:48 minas-tirith kernel - - - [13685.816731] [drm] GPU
HANG: ecode 4:0:0xfdeffdfb, in X [2171], reason: Hang on render ring, action:
reset
<0.6> 2018-01-27 21:16:48 minas-tirith kernel - - - [13685.816736] [drm] GPU
hangs can indicate a bug anywhere in the entire gfx stack, including userspace.
<0.6> 2018-01-27 21:16:48 minas-tirith kernel - - - [13685.816736] [drm] Please
file a _new_ bug report on bugs.freedesktop.org against DRI -> DRM/Intel
<0.6> 2018-01-27 21:16:48 minas-tirith kernel - - - [13685.816737] [drm]
drm/i915 developers can then reassign to the right component if it's not a
kernel issue.
<0.6> 2018-01-27 21:16:48 minas-tirith kernel - - - [13685.816737] [drm] The
gpu crash dump is required to analyze gpu hangs, so please always attach it.
<0.6> 2018-01-27 21:16:48 minas-tirith kernel - - - [13685.816738] [drm] GPU
crash dump saved to /sys/class/drm/card0/error
<0.5> 2018-01-27 21:16:48 minas-tirith kernel - - - [13685.816792] drm/i915:
Resetting chip after gpu hang
<0.5> 2018-01-27 21:17:00 minas-tirith kernel - - - [13697.816112] drm/i915:
Resetting chip after gpu hang

I will attach gpu.2.log, and messages log since machine upgrade, and hwinfo
--cpu and --gfxcard

My desktop is XFCE and I have 4 GiB of RAM.


--1517227268.dB7Da4414.16350
Date: Mon, 29 Jan 2018 12:01:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1077975

            Bug ID: 1077975
           Summary: syslog-ng fails to start on boot in case network source is configured
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: jobbara.artalmatlan-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Similar to this one: 921252

In case you set up a network source then upon boot syslog-ng fails to start
because network.target has not been reached yet.
Once you log in and start it manually it starts up just fine.

I had to add network.target to the systemd service file once I copied it into
/etc/systemd/system

[Unit]
...
After=var-run.mount network.target
...

There is nothing extraordinary in syslog-ng's conf. Just add a network() source
to any given log path, then reboot the system.


body:
--1517228097.ab2f6a728.21466
Date: Mon, 29 Jan 2018 12:14:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1077978

            Bug ID: 1077978
           Summary: p7zip contains non-free unrar code
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: kstreitova-at-suse.com
          Reporter: kstreitova-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

According to DOCS/License.txt, "CPP/7zip/Compress/Rar* files" have GNU LGPL +
unRAR restriction licence. We should remove these RAR files from the p7zip
package for both openSUSE Tumbleweed and SLE12/openSUSE Leap.

summary: p7zip contains non-free unrar code


--1517246268.3cc66e76.7937
Date: Mon, 29 Jan 2018 17:17:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078030

            Bug ID: 1078030
           Summary: gdm ignores /etc/gdm/custom.conf and starts Wayland session
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: bnc-team-gnome-at-forge.provo.novell.com
          Reporter: arvidjaar-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Due to apparent bug in QEMU packaged version I used (keys lost or duplicated in
Wayland) I disabled Wayland using /etc/gdm/custom.conf. Since the last update
of gdm (gdm-3.26.2.1-4.1) it seems to ignore it and starts Wayland anyway.
There is no /run/gdm/custom.conf. VM is started using

~/src/qemu/build/x86_64-softmmu/qemu-system-x86_64 -machine q35 -cpu kvm64 -m
1G -device virtio-scsi-pci -drive
file=$HOME/vm/tw/hd0.qcow2,if=none,id=hd0,discard=on,format=qcow2 -device
scsi-hd,drive=hd0 -net user -net nic,model=virtio -enable-kvm -virtfs
local,path=$HOME,security_model=none,mount_tag=home -drive
file=$HOME/vm/tw/test.qcow2,if=none,id=hd1,discard=on,format=qcow2 -device
scsi-hd,drive=hd1 -drive
file=$HOME/vm/tw/test2.qcow2,if=none,id=hd2,discard=on,format=qcow2 -device
scsi-hd,drive=hd2 &

journal, ps list and lspci attached.

I now switched to QEMU compiled from upstream that works.


--1517269410.eECFCc530.24726
Date: Mon, 29 Jan 2018 23:43:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078173

            Bug ID: 1078173
           Summary: Kactivitymanager coredumps without the package libQt5Sql5-sqlite
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: maciek.krawiec-at-zoho.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After the update to plasma 5.12 beta, on a system configured with
--no-recommends the desktop becomes unresponsive, because of a missing
dependency.

It seems that since the update kactivitymanagerd requires libQt5Sql5-sqlite to
be able to run. Without it the process repeatedly coredumps which can be
observed in journalctl and that in turns leads to performance degradation.


--1517308363.FB2e10.28108
Date: Tue, 30 Jan 2018 10:32:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.novell.com/show_bug.cgi?id=1078261

            Bug ID: 1078261
           Summary: Can't run steam without Mesa-dri-32bit installed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: w01dnick-at-gmail.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Mesa now requires Mesa-dri to run properly x86_64 apps, but Mesa-dri-32bit is
not required by Mesa-32bit, so ATM steam (and possible other 32bit apps with
OpenGL) fails with error [1][2]

After installing Mesa-dri-32bit it runs properly.

1. https://lists.opensuse.org/opensuse-factory/2018-01/msg00635.html
2. Steam error log:
Running Steam on opensuse 20180125 64-bit
STEAM_RUNTIME is enabled automatically
Installing breakpad exception handler for appid(steam)/version(1513371133)
libGL error: unable to load driver: i965_dri.so
libGL error: driver pointer missing
libGL error: failed to load driver: i965
libGL error: unable to load driver: i965_dri.so
libGL error: driver pointer missing
libGL error: failed to load driver: i965
libGL error: unable to load driver: swrast_dri.so
libGL error: failed to load driver: swrast


--1517318955.B331c650.11345
Date: Tue, 30 Jan 2018 13:29:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078298

            Bug ID: 1078298
           Summary: VUL-1: CVE-2016-10711 Pound: request smuggling via crafted headers
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/199137/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

Apsis Pound before 2.8a allows request smuggling via crafted headers, a
different vulnerability than CVE-2005-3751.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1540187
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10711
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-10711.html
http://www.apsis.ch/pound/pound_list/archive/2016/2016-10/1477235279000


--1517327699.8E4710.14145
Date: Tue, 30 Jan 2018 15:54:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078326

            Bug ID: 1078326
           Summary: python-devel has dependency on /usr/bin/python3
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Another bug discovered by accident - sh** happens :)

python-devel (python2 variant) has a dependency on /usr/bin/python3 - which
sounds just weird

digging a bit into the files and their headers, the offending file seems to be
(in pyton-devel):

/usr/lib64/python2.7/test/bisect.py:#!/usr/bin/python3

It being installed in py2.7 directories should imply it also wants to use
python2.7

There is a 2nd file in python-devel that references python3, but that is likely
less damaging:

/usr/lib64/python2.7/config/Makefile.pre:PYTHON_FOR_REGEN=python3


--1517334509.0F860c0.22137
Date: Tue, 30 Jan 2018 17:48:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1078346

            Bug ID: 1078346
           Summary: socat transient tests failures UNIXLISTENFORK, EXECPTYKILL for PowerPC
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: normand-at-linux.vnet.ibm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 758107
  --> http://bugzilla.suse.com/attachment.cgi?id=758107&action=edit
socat_trial1_1.log

socat transient tests failures UNIXLISTENFORK, EXECPTYKILL for PowerPC

$grep FAILED /tmp/socat*
/tmp/socat_trial1_1.log:[  107s] test 156 UNIXLISTENFORK: UNIX listen handles 2
concurrent connections... FAILED
/tmp/socat_trial1_1.log:[  140s] test 225 EXECPTYKILL: exec:...,pty explicitely
kills sub process... FAILED
/tmp/socat_trial1_1.log:[  156s] FAILED:  156 225


--1517341489.1Bfd0.5416
Date: Tue, 30 Jan 2018 19:44:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1078362

            Bug ID: 1078362
           Summary: kpartx: don't delete partitions from partitions
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

cherry-pick upstream patch
"85e368309e87 kpartx: don't delete partitions from partitions"

Otherwise error messages are generated during udev rule processing if the
"del_part_nodes" feature is active.


--1517341905.3B1D15.7706
Date: Tue, 30 Jan 2018 19:51:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1078363

            Bug ID: 1078363
           Summary: Add latest upstream hwtable updates to multipath-tools (2018-01)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Cherry-picks:

ad206af17164 mutipath: updated Huawei storage config
055659b43c11 multipath-tools: add AccelStor/NeoSapphire to hardware table
23523e4d7003 multipath-tools: add TMS/RamSan to hardware table
084a83067f0b multipath-tools: add XIV/NEXTRA to hardware table
dab02959860d multipath-tools: add XIOtech/Magnitude to hardware table


--1517342164.c7aFbf04.9864
Date: Tue, 30 Jan 2018 19:56:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078364

            Bug ID: 1078364
           Summary: [HPC] mpitest fails after changes to gnu-compilers-hpc
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: nmoreychaisemartin-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

mpivars.(c)sh hard codes the 'module load' command for the compiler. This
changes in how the compiler version granularity is handled is not reflected
automatically in this script.
This can be fixed by using the %hpc_setup_compiler macro instead.
This needs to be fixed in all the HPC enabled MPI packages.


--1517391166.4AaB0.12604
Date: Wed, 31 Jan 2018 09:32:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078463

            Bug ID: 1078463
           Summary: VUL-0: CVE-2018-6406: chromium: The function ParseVP9SuperFrameIndex in libwebm does not validate the child_frame_length data obtained from a.webm file allowing for information leak and/or DoS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/199246/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: kbabioch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-6406

The function ParseVP9SuperFrameIndex in common/libwebm_util.cc in libwebm
through 2018-01-30 does not validate the child_frame_length data obtained from
a
.webm file, which allows remote attackers to cause an information leak or a
denial of service (heap-based buffer over-read and later out-of-bounds write),
or possibly have unspecified other impact.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6406
http://www.cvedetails.com/cve/CVE-2018-6406/
https://github.com/dwfault/PoCs/blob/master/libwebm%20ParseVP9SuperFrameIndex%20memory%20corruption/libwebm%20ParseVP9SuperFrameIndex%20OOB%20read.md
https://bugs.chromium.org/p/webm/issues/detail?id=1492


--1517396198.AD6b560.3793
Date: Wed, 31 Jan 2018 10:56:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1078485

            Bug ID: 1078485
           Summary: python-base test_multiprocessing on self.assertTrue(got_signal[0]) failure ppc64le
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: normand-at-linux.vnet.ibm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 758227
  --> http://bugzilla.suse.com/attachment.cgi?id=758227&action=edit
python_base_ring1_failure_20180131.log.gz

python-base test_multiprocessing on self.assertTrue(got_signal[0]) failure
ppc64le in ring1 (1)

(1)
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:PowerPC:Rings:1-MinimalX/python-base/standard/ppc64le
===
[ 3443s] 0:06:51 load avg: 0.63 [223/395] test_multiprocessing
[ 3443s] /home/abuild/rpmbuild/BUILD/Python-2.7.14/Lib/threading.py:846:
DeprecationWarning: sys.exc_clear() not supported in 3.x; use except clauses
[ 3443s]   self.__exc_clear()
[ 3505s] test test_multiprocessing failed


--1517397972.B0C015c40.12576
Date: Wed, 31 Jan 2018 11:26:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078488

            Bug ID: 1078488
           Summary: VUL-0: CVE-2018-6392: ffmpeg: The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1allows remote attackers to cause a denial of service (out-of-array access) via acrafted MP4 file.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/199143/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: vpereira-at-microfocus.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-6392

The filter_slice function in libavfilter/vf_transpose.c in FFmpeg through 3.4.1
allows remote attackers to cause a denial of service (out-of-array access) via
a
crafted MP4 file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-6392
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-6392.html
http://www.cvedetails.com/cve/CVE-2018-6392/
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c6939f65a116b1ffed345d29d8621ee4ffb32235
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/3f621455d62e46745453568d915badd5b1e5bcd5


--1517416875.f03D0acA1.7201
Date: Wed, 31 Jan 2018 16:41:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078557

            Bug ID: 1078557
           Summary: remove NameVirtualHost examples from listen.conf
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Apache
          Assignee: bnc-team-apache-at-forge.provo.novell.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

According to apache documentation NameVirtualHost is deprecated:
http://httpd.apache.org/docs/current/en/mod/core.html#namevirtualhost

so should be removed from the listen.conf we ship


--1517419578.EaEc764.13765
Date: Wed, 31 Jan 2018 17:26:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078564

            Bug ID: 1078564
           Summary: unable to  paste into vi in the installation system
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: per-at-computer.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

It's a little complicated to explain -

I have started an installation via ssh.
I have yast running in one console, I swap to another and run 'vi somefile'.
Clicking mouse button 3 then inserts the most recently deleted line instead of
pasting what I had previously selected.


--1517504844.ddeDB0F12.29452
Date: Thu, 1 Feb 2018 17:07:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1078841

            Bug ID: 1078841
           Summary: FTBFS: openSUSE:Factory/jack-rack fails to build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package jack-rack fails to build in openSUSE:Factory. Earlier notifications
by email to the bugowner and Maintainer have remained without reaction / fix.
If the package is not being fixed within 2 weeks, it will be scheduled for
removal from Tumbleweed