body:
--1660130752.cc78E0.23621
Date: Wed, 10 Aug 2022 11:25:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202300

            Bug ID: 1202300
           Summary: libostree fails with glibc 2.36
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:B/libostree/standard/x86_64

due to:
[   50s] In file included from /usr/include/linux/fs.h:19,
[   50s]                  from src/ostree/ot-main.c:31:
[   50s] /usr/include/linux/mount.h:95:6: error: redeclaration of 'enum
fsconfig_command'
[   50s]    95 | enum fsconfig_command {
[   50s]       |      ^~~~~~~~~~~~~~~~
[   50s] In file included from src/ostree/ot-main.c:30:
[   50s] /usr/include/sys/mount.h:189:6: note: originally defined here
[   50s]   189 | enum fsconfig_command
[   50s]       |      ^~~~~~~~~~~~~~~~

summary: libostree fails with glibc 2.36


body:
--1660201497.DAb480.24270
Date: Thu, 11 Aug 2022 07:04:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202321

            Bug ID: 1202321
           Summary: libvirt fails with glibc 2.36
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:B/libvirt/standard/x86_64

due to:
[   50s] In file included from /usr/include/linux/fs.h:19,
[   50s]                  from ../src/util/virfile.c:74:
[   50s] /usr/include/linux/mount.h:95:6: error: redeclaration of ???enum
fsconfig_command???
[   50s]    95 | enum fsconfig_command {
[   50s]       |      ^~~~~~~~~~~~~~~~
[   50s] In file included from ../src/util/virfile.c:46:
[   50s] /usr/include/sys/mount.h:189:6: note: originally defined here
[   50s]   189 | enum fsconfig_command
[   50s]       |      ^~~~~~~~~~~~~~~~

summary: libvirt fails with glibc 2.36


body:
--1660201917.bEAb7FE40.23942
Date: Thu, 11 Aug 2022 07:11:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202323

            Bug ID: 1202323
           Summary: MozillaFirefox & MozillaThunderbird fail with glibc 2.36
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:B/MozillaThunderbird/standard/x86_64

and here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:B/MozillaFirefox/standard/x86_64

But I can't see why exactly from the build logs.

pkgs: MozillaFirefox MozillaThunderbird


--1660235101.1bc00.15728
Date: Thu, 11 Aug 2022 16:25:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202336

            Bug ID: 1202336
           Summary: tor: possible side channel, and congestion related bug fixes
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bwiedemann-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: Andreas.Stieger-at-gmx.de
          Found By: ---
           Blocker: ---

Tor stable release 0.4.5.13, 0.4.6.11 and 0.4.7.9:

>   o Major bugfixes (congestion control):
>     - Implement RFC3742 Limited Slow Start.
[...]
>       to defend against ongoing DoS attacks.

* more congestion control fixes
[...]

>     - Do not propagate either forward or backward a DESTROY remote reason when
>       closing a circuit in order to avoid a possible side channel

https://gitlab.torproject.org/tpo/core/tor/-/issues/40649

I think this warrants a maintenance update as defense in depth.

References:
https://lists.torproject.org/pipermail/tor-announce/2022-August/000243.html
https://forum.torproject.net/t/stable-release-0-4-5-13-0-4-6-11-and-0-4-7-9/4259


body:
--1660248840.2BC46.1756
Date: Thu, 11 Aug 2022 20:14:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202338

            Bug ID: 1202338
           Summary: AUDIT-WHITELIST: cups-pk-helper: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
                CC: bjorn.lie-at-gmail.com, dimstar-at-opensuse.org
          Found By: ---
           Blocker: ---

Move /etc/dbus-1/system.d/org.opensuse.CupsPkHelper.Mechanism.conf to
/usr/share/dbus-1/system.d/org.opensuse.CupsPkHelper.Mechanism.conf

Devel prj: GNOME:Factory
Maintainer: GNOME Maintainers

pkgs: cups-pk-helper rpmlint


--1660249410.Cc12a5221.2359
Date: Thu, 11 Aug 2022 20:23:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202339

            Bug ID: 1202339
           Summary: AUDIT-WHITELIST: tuned: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
                CC: trenn-at-suse.com
          Found By: ---
           Blocker: ---

Move /etc/dbus-1/system.d/com.redhat.tuned.conf to
/usr/share/dbus-1/system.d/com.redhat.tuned.conf

Devel prj: Base:System
Maintainer: Thomas Renninger


--1660249750.D13cB1f6.2442
Date: Thu, 11 Aug 2022 20:29:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202340

            Bug ID: 1202340
           Summary: AUDIT-WHITELIST: system-config-printer: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
                CC: bjorn.lie-at-gmail.com, dimstar-at-opensuse.org
          Found By: ---
           Blocker: ---

Multiple move from /etc/dbus-1/system.d to /usr/share/dbus-1/system.d
* com.redhat.NewPrinterNotification.conf
* com.redhat.PrinterDriversInstaller.conf

Devel prj: GNOME:Factory
Maintainer: GNOME Maintainers


--1660285460.D25B1.3175
Date: Fri, 12 Aug 2022 06:24:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202350

            Bug ID: 1202350
           Summary: VUL-0: CVE-2022-38150: varnish: denial of service via colon-starting reason phrase
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/339553/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2117692

A denial of service attack can be performed against Varnish Cache servers by
specially formatting the reason phrase of the backend response status line. In
order to execute an attack, the attacker would have to be able to influence the
HTTP/1 responses that the Varnish Server receives from its configured backends.
A successful attack would cause the Varnish Server to assert and automatically
restart.

Security advisory:
https://varnish-cache.org/security/VSV00009.html

Upstream issue & fix:
https://github.com/varnishcache/varnish-cache/issues/3830
https://github.com/varnishcache/varnish-cache/commit/c5fd097e5cce8b461c6443af02b3448baef2491d

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2117692
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-38150
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38150
http://www.cvedetails.com/cve/CVE-2022-38150/
https://varnish-cache.org/security/VSV00009.html


--1660287770.86eFe0.6440
Date: Fri, 12 Aug 2022 07:02:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202353

            Bug ID: 1202353
           Summary: kernel: replace mkinitrd wrapper with native dracut
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: antonio.feijoo-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1202351
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1202351 +++

Upstream support removed in March 2021
(https://github.com/dracutdevs/dracut/commit/43df4ee2) and deprecation
announcement on factory mailing list in May 2021
(https://lists.opensuse.org/archives/list/factory-at-lists.opensuse.org/thread/GDAZ7TVXS2BAXENVBAMHVXVHLSR7D7NQ/).

ALP will not ship the mkinitrd wrapper, so it's better to get rid of it in
Tumbleweed first.

Affected packages that need to be updated before (at least):

# zypper se --requires mkinitrd
Loading repository data...
Reading installed packages...

S  | Name                | Summary                                            |
Type
---+---------------------+----------------------------------------------------+--------
   | kernel-debug        | A Debug Version of the Kernel                      |
package
i+ | kernel-default      | The Standard Kernel                                |
package
   | kernel-default-base | The Standard Kernel - base modules                 |
package
   | kernel-kvmsmall     | The Small Developer Kernel for KVM                 |
package
   | kernel-pae          | Kernel with PAE Support                            |
package
   | kernel-vanilla      | The Standard Kernel - without any SUSE patches     |
package
i  | mdadm               | Utility for configuring "MD" software RAID devices |
package


--1660291507.a4EEf0.14397
Date: Fri, 12 Aug 2022 08:05:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202356

            Bug ID: 1202356
           Summary: systemd not trusting rtc if too far in future
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

systemd recently gained an interesting feature:

https://github.com/systemd/systemd/commit/b10abe4bba61aebe4c667c412741193f11886298

it means 15 years after systemd build time, your system time gets reset
automatically into the past. If your business model is selling a long running
operating system for edge usage, this is a problem.

suggest to set clock-valid-range-usec-max everywhere to longer lifecycle, at
least 20 years if not 30 years, before we ship this as an update on any
maintained product.

https://build.opensuse.org/request/show/994525 is doing that


--1660490335.b6CBe1411.15732
Date: Sun, 14 Aug 2022 15:18:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202377

            Bug ID: 1202377
           Summary: "0" file on root directory after clean install
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: pedrohqb-at-gmail.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

I am not sure why, but after installing latest OpenSuse Tumbleweed I've got a
"0" file on root directory (/).

pedro@mope-opensuse:~> cat /etc/os-release
NAME="openSUSE Tumbleweed"
# VERSION="20220812"
ID="opensuse-tumbleweed"
ID_LIKE="opensuse suse"
VERSION_ID="20220812"
PRETTY_NAME="openSUSE Tumbleweed"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:tumbleweed:20220812"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"
DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed"
LOGO="distributor-logo-Tumbleweed"


body:
--1660607696.46c2c0.7838
Date: Mon, 15 Aug 2022 23:54:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202403

            Bug ID: 1202403
           Summary: Tiny Chromium icon
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: 64bit
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: 95kreaninw95-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I install Chromium in the Tumbleweed repo, the app icon is very tiny. I have to
manually replace the default icon with the one here:

https://commons.wikimedia.org/wiki/File:Chromium_Logo.svg

I also install Chromium Flatpak version, there's no issue with the icon size.

summary: Tiny Chromium icon


--1660652074.1D5B01.2434
Date: Tue, 16 Aug 2022 12:14:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202432

            Bug ID: 1202432
           Summary: VUL-0: CVE-2022-24952: EternalTerminal: DoS triggered remotely by invalid sequence numbers
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/339928/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jubalh-at-iodoru.org
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-24952

Several denial of service vulnerabilities exist in Eternal Terminal prior to
version 6.2.0, including a DoS triggered remotely by an invalid sequence number
and a local bug triggered by invalid input sent directly to the IPC socket.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24952
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24952
https://github.com/MisterTea/EternalTerminal/releases/tag/et-v6.2.0
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-8cw3-6r98-g7cw


--1660652323.7ecc1.2282
Date: Tue, 16 Aug 2022 12:18:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202433

            Bug ID: 1202433
           Summary: VUL-0: CVE-2022-24951: EternalTerminal: race condition allows local attacker to hijack IPC socket
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/339929/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jubalh-at-iodoru.org
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-24951

A race condition exists in Eternal Terminal prior to version 6.2.0 which allows
a local attacker to hijack Eternal Terminal's IPC socket, enabling access to
Eternal Terminal clients which attempt to connect in the future.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24951
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24951
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-546v-59j5-g95q
https://github.com/MisterTea/EternalTerminal/releases/tag/et-v6.2.0


--1660652416.F5C08a6.2282
Date: Tue, 16 Aug 2022 12:20:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202434

            Bug ID: 1202434
           Summary: VUL-0: CVE-2022-24950: EternalTerminal: race condition allows authenticated attacker to hijack other users' SSH authorization socket
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/339930/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jubalh-at-iodoru.org
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-24950

A race condition exists in Eternal Terminal prior to version 6.2.0 that allows
an authenticated attacker to hijack other users' SSH authorization socket,
enabling the attacker to login to other systems as the targeted users. The bug
is in UserTerminalRouter::getInfoForId().

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24950
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24950
https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-85gw-pchc-4rf3


--1660652529.cf8dCcE01.3261
Date: Tue, 16 Aug 2022 12:22:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202435

            Bug ID: 1202435
           Summary: VUL-0: CVE-2022-24949: EternalTerminal: privilege escalation to root
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/339931/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jubalh-at-iodoru.org
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-24949

A privilege escalation to root exists in Eternal Terminal prior to version
6.2.0. This is due to the combination of a race condition, buffer overflow, and
logic bug all in PipeSocketHandler::listen().

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24949
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-hxg8-4r3q-p9rv
https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac8480f643c43d3c3
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24949


body:
--1660653204.5C5c40.431
Date: Tue, 16 Aug 2022 12:33:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202438

            Bug ID: 1202438
           Summary: grub2 can no longer boot from an ISO
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: Hansi.Meir-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Long tiem ago, I have build a menu item in 40_custom where I boot Rescuezilla
2.3 from an ISO file.

After the update from 2.06-25.2 to 2.06-26.1, however grub2 no longer finds the
file, the entry is unusable:
---------------------------------------------------------------------------------
#!/bin/sh
exec tail -n +3 $0
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.

menuentry 'Rescuezilla' {
#  load_video
#  insmod loopback
#  insmod iso9660
#  insmod part_gpt
#  insmod part_msdos
#  insmod gzio
#  insmod ntfs
  insmod ext2
  ISO_FILE="/boot/iso/rescuezilla.iso"
  locale_dir=/boot/iso
  search --no-floppy --file $ISO_FILE --set
      loopback loop $ISO_FILE
      echo '... loading linux for rescuezilla'
      linux (loop)/casper/vmlinuz boot=casper isofrom_device=/dev/nvme1n1p5
iso-scan/filename=$ISO_FILE \
       xforcevesa nomodeset vga=791 fsck.mode=skip noprompt edd=on
${locale_opts} --
      echo '... loading initial ramdisk'
      initrd (loop)/casper/initrd.lz
}

menuentry 'System ausschalten' {
echo "System shutdown initiated ..."
halt
}
---------------------------------------------------------------------------------

I tried to change the search (via the UUID) or set root via the device, but no
success.

I restored the old version 2.06-25.2 and now I may boot this ISO file again.

May be there is ab Bug in grub2 2.06-26.1?
Or is there a mistake in my code above?

summary: grub2 can no longer boot from an ISO


body:
--1660654014.cda2C80.6263
Date: Tue, 16 Aug 2022 12:46:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202440

            Bug ID: 1202440
           Summary: Strange stuck in elfutils-debuginfod
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Can't build the package under Leap 15:
https://build.opensuse.org/package/show/openSUSE:infrastructure:debuginfod/elfutils-debuginfod

It's stuck here:
[  121s] ... running 50-check-libtool-deps

Job seems to be stuck here, killed. (after 28800 seconds of inactivity)

If I use 'set -x' in 50-check-libtool-deps I see:

[   28s] ++ for FILE in "$BUILD_ROOT"/etc/profile.d/*.sh
[   28s] ++ echo //etc/profile.d/debuginfod.sh
[   28s] ++ source //etc/profile.d/debuginfod.sh
[   28s] +++ '[' -z '' ']'
[   28s] +++ prefix=/usr
[   28s] ++++ cat
[   28s] ++++ tr '\n' ' '

So it's stuck in /etc/profile.d/debuginfod.sh:

$ cat /etc/profile.d/debuginfod.sh
# $HOME/.profile* or similar files may first set $DEBUGINFOD_URLS.
# If $DEBUGINFOD_URLS is not set there, we set it from system *.url files.
# $HOME/.*rc or similar files may then amend $DEBUGINFOD_URLS.
# See also [man debuginfod-client-config] for other environment variables
# such as $DEBUGINFOD_MAXSIZE, $DEBUGINFOD_MAXTIME, $DEBUGINFOD_PROGRESS.

if [ -z "$DEBUGINFOD_URLS" ]; then
    prefix="/usr"
    DEBUGINFOD_URLS=$(cat "/etc/debuginfod"/*.urls 2>/dev/null | tr '\n' ' ')
    [ -n "$DEBUGINFOD_URLS" ] && export DEBUGINFOD_URLS || unset
DEBUGINFOD_URLS
    unset prefix
fi

But it's unclear why because the command returns immediately if I run it from
'osc chroot':
cat "/etc/debuginfod"/*.urls 2>/dev/null | tr '\n' ' '

Note:
$ ls /etc/debuginfod/*.urls
ls: cannot access '/etc/debuginfod/*.urls': No such file or directory

summary: Strange stuck in elfutils-debuginfod


--1660655050.06e3100.3975
Date: Tue, 16 Aug 2022 13:04:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202443

            Bug ID: 1202443
           Summary: kdump: replace mkinitrd wrapper with native dracut
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: jbohac-at-suse.com
          Reporter: antonio.feijoo-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1202351
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1202351 +++

Upstream support removed in March 2021
(https://github.com/dracutdevs/dracut/commit/43df4ee2) and deprecation
announcement on factory mailing list in May 2021
(https://lists.opensuse.org/archives/list/factory-at-lists.opensuse.org/thread/GDAZ7TVXS2BAXENVBAMHVXVHLSR7D7NQ/).

ALP will not ship the mkinitrd wrapper, so it's better to get rid of it in
Tumbleweed first.

Affected packages that need to be updated before (at least):

# zypper se --requires mkinitrd
Loading repository data...
Reading installed packages...

S  | Name                | Summary                                            |
Type
---+---------------------+----------------------------------------------------+--------
   | kernel-debug        | A Debug Version of the Kernel                      |
package
i+ | kernel-default      | The Standard Kernel                                |
package
   | kernel-default-base | The Standard Kernel - base modules                 |
package
   | kernel-kvmsmall     | The Small Developer Kernel for KVM                 |
package
   | kernel-pae          | Kernel with PAE Support                            |
package
   | kernel-vanilla      | The Standard Kernel - without any SUSE patches     |
package
i  | mdadm               | Utility for configuring "MD" software RAID devices |
package


--1660658020.d0A35b840.11770
Date: Tue, 16 Aug 2022 13:53:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202446

            Bug ID: 1202446
           Summary: mkvtoolnix-gui GUI is completely broken / unusable (see screenshot)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: c.j-at-tuta.io
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 860803
  --> http://bugzilla.opensuse.org/attachment.cgi?id=860803&action=edit
Screenshot of the mkvtoolnix-gui BUG

The rendering of the GUI is completely broken, making the app unusable. Please
look at the attached screenshot.

(This was tested on Gnome X11 and Wayland).

Furthermore:
The official version for Fedora on the mkvtoolnix website/repo is using QT6.

For opensuse, the official website links to the opensuse multimedia apps repo,
which also has this problem. It is built with QT5.

The QT6 version on Fedora works great. You should use this instead.

Thanks.


--1660667836.FC5DDa1.31383
Date: Tue, 16 Aug 2022 16:37:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202454

            Bug ID: 1202454
           Summary: systemd: new D-Bus methods / polkit actions introduced by systemd-oomd
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fbui-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

oomd has been enabled (bsc#1200456) and will be shipped through the sub-package
"systemd-experimental" and this new component introduces new D-Bus methods
which need to be reviewed.

Could you please review them ?

They can be found at
https://github.com/openSUSE/systemd/blob/main/src/oom/org.freedesktop.oom1.conf.

Thanks in advance.


--1660802491.7bd88DB1.15319
Date: Thu, 18 Aug 2022 06:01:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202509

            Bug ID: 1202509
           Summary: VUL-0: chromium: multiple security issues fixed in 104.0.5112.101
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html

Chromium 104.0.5112.101

CVE-2022-2852: Use after free in FedCM.
CVE-2022-2854: Use after free in SwiftShader.
CVE-2022-2855: Use after free in ANGLE.
CVE-2022-2857: Use after free in Blink.
CVE-2022-2858: Use after free in Sign-In Flow.
CVE-2022-2853: Heap buffer overflow in Downloads.
CVE-2022-2856: Insufficient validation of untrusted input in Intents.
CVE-2022-2859: Use after free in Chrome OS Shell.
CVE-2022-2860: Insufficient policy enforcement in Cookies.
CVE-2022-2861: Inappropriate implementation in Extensions API.

Google is aware that an exploit for CVE-2022-2856 exists in the wild.


--1660894377.f3f61.16646
Date: Fri, 19 Aug 2022 07:32:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202548

            Bug ID: 1202548
           Summary: VUL-0: CVE-2022-6083: freeciv: Modpack Installer buffer overflow
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/340192/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2116410

Just released freeciv-2.6.7 & freeciv-3.0.3 fix buffer overflow in
Modpack Installer utility's handling of the modpack URL. Specially
crafted URLs, without any '/' -characters would result in an
underflowing length (unsigned)(-1) string copy, i.e., all of the
NULL-terminated string given as "URL" would get written beyond the
buffer reserved for it.

 Freeciv source tarballs are available from
https://www.freeciv.org/download.html for current 3.0, and from
https://www.freeciv.org/wiki/Old_downloads for 2.6.

 In case you can't make full version update at the moment, bug tracker
ticket has also a patch for this single issue attached:
https://osdn.net/projects/freeciv/ticket/45299

 - ML

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2116410
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-6083


--1660894678.cd82aCeC1.10733
Date: Fri, 19 Aug 2022 07:37:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202553

            Bug ID: 1202553
           Summary: VUL-1: CVE-2022-35164: libredwg: Heap use-after-free via bit_copy_chain
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/340186/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-35164

LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap
use-after-free via bit_copy_chain.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-35164
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35164
https://github.com/LibreDWG/libredwg/issues/497


--1660917948.6deB0f8D4.17996
Date: Fri, 19 Aug 2022 14:05:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202568

            Bug ID: 1202568
           Summary: Gnome Sushi doesn't work on fresh install
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: pureacetone-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hello,

I've just installed OS Leap 15.4 on a new machine and I'm not getting file
previews when I press the space bar.

Package version is 3.34.0, shouldn't it have been updated to version 41 to work
with Gnome 41?

Regards.


--1661151734.56Af80.13202
Date: Mon, 22 Aug 2022 07:02:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202594

            Bug ID: 1202594
           Summary: FTBFS: boost 1.80 fails to build on ppc64le
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

boost fails to build on ppc64le, which results in the media not being
generatable (main consumers like libzypp are unresolvable)

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:PowerPC/boost:base/standard/ppc64le

[ 1412s] error: Installed (but unpackaged) file(s) found:
[ 1412s]
/usr/lib/debug/usr/lib64/libboost_math_c99l.so.1.80.0-1.80.0-1.1.ppc64le.debug
[ 1412s]
/usr/lib/debug/usr/lib64/libboost_math_tr1l.so.1.80.0-1.80.0-1.1.ppc64le.debug
[ 1412s]    /usr/lib64/libboost_math_c99l.so
[ 1412s]    /usr/lib64/libboost_math_c99l.so.1.80.0
[ 1412s]    /usr/lib64/libboost_math_tr1l.so
[ 1412s]    /usr/lib64/libboost_math_tr1l.so.1.80.0


body:
--1661167980.EbD11.13904
Date: Mon, 22 Aug 2022 11:33:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202606

            Bug ID: 1202606
           Summary: MozillaThunderbird: crash in wayland
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: wolfgang-at-rosenauer.org
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I have *lots* of mails on IMAP in many folders and also have virtual folders of
saved server side searches, e.g. to find all mails marked as TODO in any
folder. The Thunderbird UI tends to stall for a few moments sometimes when
navigating though the folders. With Wayland that leads to getting Thunderbird
killed quite frequently. Message is
Gdk-Message: 13:28:42.486: Lost connection to Wayland compositor.

There's an upstream bug stating that they can't do anything about it:
https://bugzilla.mozilla.org/show_bug.cgi?id=1743144

As a workaround it helps to force TB to use the X11 bridge instead of wayland
directly though, eg by unsetting WAYLAND_DISPLAY, setting GDK_BACKEND=x11 or
MOZ_ENABLE_WAYLAND=0

Can we do any of that by default in /usr/bin/thunderbird?

summary: MozillaThunderbird: crash in wayland


--1661325346.1AEbb071.26607
Date: Wed, 24 Aug 2022 07:15:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202662

            Bug ID: 1202662
           Summary: VUL-0: CVE-2020-35511: pngcheck: Buffer overflow in pngcheck 2.4.0 via a crafted png file
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/340566/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: pgajdos-at-suse.com
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-35511

A global buffer overflow was discovered in pngcheck function in
pngcheck-2.4.0(5
patches applied) via a crafted png file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-35511
https://www.cve.org/CVERecord?id=CVE-2020-35511
http://www.libpng.org/pub/png/apps/pngcheck.html


--1661326031.BF407EC6.19519
Date: Wed, 24 Aug 2022 07:27:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202664

            Bug ID: 1202664
           Summary: VUL-0: CVE-2022-37428: pdns-recursor: DoS when protobuf logging is enabled
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/340563/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: amajer-at-suse.com
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2120864

PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf
logging is enabled, has Improper Cleanup upon a Thrown Exception, leading to a
denial of service (daemon crash) via a DNS query that leads to an answer with
specific properties.

https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html
https://docs.powerdns.com/recursor/lua-config/protobuf.html

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2120864
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-37428
https://www.cve.org/CVERecord?id=CVE-2022-37428
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2022-02.html
https://docs.powerdns.com/recursor/lua-config/protobuf.html


body:
--1661326390.1bB620dD0.20382
Date: Wed, 24 Aug 2022 07:33:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202666

            Bug ID: 1202666
           Summary: python3.8 FTBFS-2038
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://bugs.python.org/issue34990
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mcepl-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: dmueller-at-suse.com
          Found By: Development
           Blocker: ---

https://bugs.python.org/issue34990 shows the fix as backported to 3.9 and 3.10,
but not 3.8

Steps to reproduce:
osc co openSUSE:Factory/python-wtf-peewee && cd $_
osc build --vm-type=kvm --noservice --clean \
 --build-opt=--vm-custom-opt="-rtc base=2038-09-04T00:00:00" \
 --alternative-project home:bmwiedemann:reproducible openSUSE_Tumbleweed

Actual results:
[   18s] + python3.8 -m compileall
/home/abuild/rpmbuild/BUILDROOT/python-wtf-peewee-3.0.4-0.0.x86_64/usr/lib/python3.8/site-packages
[   18s] Traceback (most recent call last):
[   18s]   File "/usr/lib64/python3.8/runpy.py", line 194, in
_run_module_as_main
[   18s]     return _run_code(code, main_globals, None,
[   18s]   File "/usr/lib64/python3.8/runpy.py", line 87, in _run_code
[   18s]     exec(code, run_globals)
[   18s]   File "/usr/lib64/python3.8/compileall.py", line 332, in <module>
[   18s]     exit_status = int(not main())
[   18s]   File "/usr/lib64/python3.8/compileall.py", line 314, in main
[   18s]     if not compile_dir(dest, maxlevels, args.ddir,
[   18s]   File "/usr/lib64/python3.8/compileall.py", line 96, in compile_dir
[   18s]     if not compile_file(file, dfile, force, rx, quiet,
[   18s]   File "/usr/lib64/python3.8/compileall.py", line 151, in compile_file
[   18s]     expect = struct.pack('<4sll', importlib.util.MAGIC_NUMBER,
[   18s] struct.error: 'l' format requires -2147483648 <= number <= 2147483647

summary: python3.8 FTBFS-2038


--1661337207.6fd80.13795
Date: Wed, 24 Aug 2022 10:33:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202690

            Bug ID: 1202690
           Summary: peazip .desktop category is wrong (should be in utilities instead of system tools + peazip 8.8.0 update is out (package should be updated)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: c.j-at-tuta.io
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

(posting 2 issues together as they concern the same package and are both very
easy fixes).

ISSUE 1 (peazip .desktop category is wrong with 2 different places for archive
managers in the Applications menu):

File-rooler (Gnome archive manager) is in "Utilities"
> Categories=GTK;GNOME;Utility;Archiving;Compression;X-GNOME-Utilities;

Peazip is also an archive manager , it is in "System Tools". This doesn't make
sense to have both archive managers in different places (and they are both
utilities).

>Categories=Qt;KDE;Utility;System;Archiving;

should be corrected into:
>Categories=Qt;KDE;Utility;Archiving;

ISSUE 2:
peazip 8.7.0 is in the repo but peazip 8.8.0 is out.

It's a very simple update that only requires to change the .spec version number
to 8.8.0 and changing the source file url to
https://github.com/peazip/PeaZip/releases/download/8.8.0/peazip-8.8.0.src.zip

(I forked it myself, it builds perfectly)

QUESTION:
(while I'm here it makes sense to ask this here - I didn't find anything in the
docs/wiki/google)

Where can we flag packages out of date to inform the maintainers of the
updates?

-> Archlinux has a FLAG link on the package's information page for this.
example: https://archlinux.org/packages/extra/x86_64/libreoffice-fresh/flag/

Do we always have to open a bugzilla report ? (this seems overkill, a flag like
arch would make it easier/convenient for everybody imho).

Thanks.


body:
--1661363308.2E241.6019
Date: Wed, 24 Aug 2022 17:48:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202725

            Bug ID: 1202725
           Summary: AUDIT-TRACKER: kdiskmark: polkit, dbus
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jonmagon-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Last year I requested a kdiskmark review:
https://bugzilla.opensuse.org/show_bug.cgi?id=1182521
It was successfully resolved.

But now I have changed the namespace from org.jonmagon to dev.jonmagon (because
I am a person, not an organization). And besides, I want to request a
re-review, because the code has changed and now not only clearing the cache,
but also the testing itself is done through the helper. The helper is started
with KAuth, and opens a new DBus connection.

The fio name is hard-coded in the helper. An user pass numeric parameters and a
string file name. I check the file name to make sure that at least there is no
block device specified. I hope there is no possibility of any CVE here.

The package is placed in benchmark:kdiskmark

[  110s] kdiskmark.x86_64: I: polkit-cant-acquire-privilege
dev.jonmagon.kdiskmark.helper.init (??:no:auth_admin_keep)

[  110s] kdiskmark.x86_64: W: polkit-untracked-privilege
dev.jonmagon.kdiskmark.helper.init (??:no:auth_admin_keep)

[  110s] kdiskmark.x86_64: E: suse-dbus-unauthorized-service (Badness: 10000)
/usr/share/dbus-1/system-services/dev.jonmagon.kdiskmark.helper.service

I'd be grateful for any replacements.

pkgs: polkit-default-privs rpmlint

summary: AUDIT-TRACKER: kdiskmark: polkit, dbus


--1661473152.1cDF80.16782
Date: Fri, 26 Aug 2022 00:19:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202795

            Bug ID: 1202795
           Summary: krita package requires krita-devel probably due to incorrectly packaged libkritatiffpsd.so file
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Problem: the to be installed krita-5.1.0-1.1.x86_64 requires
'libkritatiffpsd.so()(64bit)', but this requirement cannot be provided
  not installable providers: krita-devel-5.1.0-1.1.x86_64[repo-oss]


body:
--1661671521.FDe360.22366
Date: Sun, 28 Aug 2022 07:25:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202848

            Bug ID: 1202848
           Summary: kdenlive, missing packages
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: epistemepromeneur-at-free.fr
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When I first launch kdenlive i get an error message saying ffplay, mediainfo,
MLT glaxnimate are not installed.

summary: kdenlive, missing packages


--1661678978.f51a0.29494
Date: Sun, 28 Aug 2022 09:29:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202849

            Bug ID: 1202849
           Summary: [Build 20220827] usr_sbin_dnsmasq: there are errors in audit.log
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2571698/modules/usr_
                    sbin_dnsmasq/steps/63
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AppArmor
          Assignee: suse-beta-at-cboltz.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

Not much changed in this snapshot from what I can see.

There was an apparmor update, but the patch added was touching php-fpm per
changelog

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-apparmor_profile_dnsmasq@64bit fails in
[usr_sbin_dnsmasq](https://openqa.opensuse.org/tests/2571698/modules/usr_sbin_dnsmasq/steps/63)

## Test suite description
Maintainer: llzhao-at-suse.com

## Reproducible

Fails since (at least) Build
[20220827](https://openqa.opensuse.org/tests/2568759)

## Expected result

Last good: [20220826](https://openqa.opensuse.org/tests/2560700) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit&test=apparmor_profile_dnsmasq&version=Tumbleweed)


--1661688295.eBe1B0.5317
Date: Sun, 28 Aug 2022 12:04:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202850

            Bug ID: 1202850
           Summary: Tearing and slow screen rendering after update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: x86-64
                OS: openSUSE Leap 15.4
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: gfx-bugs-at-suse.de
          Reporter: rgb.mldc-at-gmail.com
        QA Contact: gfx-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Until a few days ago, the graphics were working without problems in my laptop
(system info bellow). After the last update that changed (if I remember right)
some mesa libraries, screen rendering started to go in "jumps" with a lot of
tearing and rendering artifacts.

3D applications are now slow. For example, until last week supertuxkart worked
without problems, but now it's impossible to use.

Many desktop effects are not working anymore. For example, transparency when
dragging windows is not working or even available on Plasma desktop effect
settings, but expos?? effect, highlighting panels and blurring on log-out still
work (a few checkboxes where neither checked nor unchecked, they showed three
dots instead). Everything worked without problems before the update.

System information:

TUXEDO-Book-BC1507.

Graphics (as reported by YaST2 hardware information): intel CoffeeLake-H GT2
(UHD Graphics 630).

Copied from KInfoCenter:

Operating System: openSUSE Leap 15.4
KDE Plasma Version: 5.24.4
KDE Frameworks Version: 5.90.0
Qt Version: 5.15.2
Kernel Version: 5.14.21-150400.24.18-default (64-bit)
Graphics Platform: X11
Processors: 8 ?? Intel?? Core??? i5-8300H CPU @ 2.30GHz
Memory: 15.4 GiB of RAM
Graphics Processor: llvmpipe

The puzzling bit is "llvmpipe". I cannot find anymore an option to set the
graphic motor under Plasma's system settings ??? Screen ??? Compositor.

Bellow the output of

~> sudo lspci -v -s 00:02.0
00:02.0 VGA compatible controller: Intel Corporation CoffeeLake-H GT2 [UHD
Graphics 630] (prog-if 00 [VGA controller])
        Subsystem: CLEVO/KAPOK Computer Device 8555
        Flags: bus master, fast devsel, latency 0, IRQ 128
        Memory at 8d000000 (64-bit, non-prefetchable) [size=16M]
        Memory at 90000000 (64-bit, prefetchable) [size=256M]
        I/O ports at 4000 [size=64]
        [virtual] Expansion ROM at 000c0000 [disabled] [size=128K]
        Capabilities: [40] Vendor Specific Information: Len=0c <?>
        Capabilities: [70] Express Root Complex Integrated Endpoint, MSI 00
        Capabilities: [ac] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [d0] Power Management version 2
        Capabilities: [100] Process Address Space ID (PASID)
        Capabilities: [200] Address Translation Service (ATS)
        Capabilities: [300] Page Request Interface (PRI)
        Kernel driver in use: i915
        Kernel modules: i915


--1661713360.12E50.21438
Date: Sun, 28 Aug 2022 19:02:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202851

            Bug ID: 1202851
           Summary: Shutdown or reboot of VirtualBox guest with usb device attached causes guest to abort
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: David.Boyd49-at-twc.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Tumbleweed server with VirtualBox 6.1.36 installed.

Testing with many guests: Arch Linux, debian, fedora (stable and rawhide),
FreeBSD, Linux Mint, openSUSE LEAP 15.4, openSUSE Tumbleweed.

If a USB device (usually a flash drive) is attached when the guest is shutdown
or rebooted, the guest ends with an "Aborted" status.

This is new with 6.1.36 of VirtualBox from the opensuse Tumbleweed repository.

This problem is a nuisance with shutdown but precludes a successful reboot
requiring user attention.

This issue is not observed when openSUSE LEAP 15.4 is the host.

There are no useful messages in the log(s).

If the user remembers to detach the USB device before rebooting, the problem
can be avoided.  Yeah, like that's going to happen.


--1661758278.14AB6Dc1.25128
Date: Mon, 29 Aug 2022 07:31:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202858

            Bug ID: 1202858
           Summary: VUL-0: CVE-2021-4216: mupdf: division by zero for zero width pages in muraster
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/340936/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-4216

A Floating point exception (division-by-zero) flaw was found in Mupdf for zero
width pages in muraster.c. It is fixed in Mupdf-1.20.0-rc1 upstream.

Upstream fix:
https://github.com/ArtifexSoftware/mupdf/commit/22c47acbd52949421f8c7cb46ea1556827d0fcbf

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-4216
https://www.cve.org/CVERecord?id=CVE-2021-4216
https://bugs.ghostscript.com/show_bug.cgi?id=704834


--1661870045.2B1a50.12467
Date: Tue, 30 Aug 2022 14:34:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202944

            Bug ID: 1202944
           Summary: security/sshguard: Bug buffer overflow detected
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: 3rd party software
          Assignee: meissner-at-suse.com
          Reporter: bruno@ioda-net.ch
        QA Contact: screening-team-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 861196
  --> http://bugzilla.opensuse.org/attachment.cgi?id=861196&action=edit
sshguard conf used

When staring sshguard service a message is emitted

Aug 28 07:24:05 share sshguard[1181]: *** buffer overflow detected ***:
terminated

this lead sshguard in a pseudo working state, the parsing log is working but
the blocker is not, and as such no attack are filtered.

doing a gdb session I have the following result

gdb /usr/libexec/sshg-blocker
GNU gdb (GDB; openSUSE Tumbleweed) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-suse-linux".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://bugs.opensuse.org/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/libexec/sshg-blocker...
Reading symbols from
/usr/lib/debug/usr/libexec/sshg-blocker-2.4.2-5.5.x86_64.debug...
(gdb) run -a 50 -p 3600 -s 7200 -w /etc/sshguard/whitelist -b
100:/var/lib/sshguard/db/blacklist.db
Starting program: /usr/libexec/sshg-blocker -a 50 -p 3600 -s 7200 -w
/etc/sshguard/whitelist -b 100:/var/lib/sshguard/db/blacklist.db
Missing separate debuginfos, use: zypper install
glibc-debuginfo-2.35-6.1.x86_64
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7ffff7d7d640 (LWP 18458)]
*** buffer overflow detected ***: terminated

Thread 1 "sshg-blocker" received signal SIGABRT, Aborted.
0x00007ffff7e2a6bc in __pthread_kill_implementation () from /lib64/libc.so.6
(gdb) thread apply all bt

Thread 2 (Thread 0x7ffff7d7d640 (LWP 18458) "sshg-blocker"):
#0  0x00007ffff7e76b95 in clock_nanosleep@GLIBC_2.2.5 () from /lib64/libc.so.6
#1  0x00007ffff7e7bb67 in nanosleep () from /lib64/libc.so.6
#2  0x00007ffff7e7ba7e in sleep () from /lib64/libc.so.6
#3  0x00005555555587e9 in unblock_loop () at
/usr/src/debug/sshguard-2.4.2-5.5.x86_64/src/blocker/blocklist.c:80
#4  0x00007ffff7e28777 in start_thread () from /lib64/libc.so.6
#5  0x00007ffff7eb2c70 in clone3 () from /lib64/libc.so.6

Thread 1 (Thread 0x7ffff7d7e740 (LWP 18454) "sshg-blocker"):
#0  0x00007ffff7e2a6bc in __pthread_kill_implementation () from
/lib64/libc.so.6
#1  0x00007ffff7dd76f6 in raise () from /lib64/libc.so.6
#2  0x00007ffff7dc0814 in abort () from /lib64/libc.so.6
#3  0x00007ffff7e1d79e in __libc_message () from /lib64/libc.so.6
#4  0x00007ffff7ec289a in __fortify_fail () from /lib64/libc.so.6
#5  0x00007ffff7ec0e96 in __chk_fail () from /lib64/libc.so.6
#6  0x0000555555559083 in memset (__len=10, __ch=0, __dest=0x7fffffffd72b) at
/usr/include/bits/string_fortified.h:59
#7  whitelist_add_block6 (masklen=48, address=0x7fffffffd740 "2001:1620:c89::")
at
/usr/src/debug/sshguard-2.4.2-5.5.x86_64/src/blocker/sshguard_whitelist.c:279
#8  whitelist_add (str=0x55555555d160 <whitelist> "0\347UUUU") at
/usr/src/debug/sshguard-2.4.2-5.5.x86_64/src/blocker/sshguard_whitelist.c:224
#9  whitelist_add (str=str@entry=0x7fffffffd7d0 "2001:1620:c89::/48") at
/usr/src/debug/sshguard-2.4.2-5.5.x86_64/src/blocker/sshguard_whitelist.c:174
#10 0x0000555555559256 in whitelist_file (filename=0x7fffffffe3b7
"/etc/sshguard/whitelist") at
/usr/src/debug/sshguard-2.4.2-5.5.x86_64/src/blocker/sshguard_whitelist.c:164
#11 0x00005555555567c1 in get_options_cmdline (argv=0x7fffffffdfd8, argc=11) at
/usr/src/debug/sshguard-2.4.2-5.5.x86_64/src/blocker/sshguard_options.c:95
#12 main (argc=11, argv=0x7fffffffdfd8) at
/usr/src/debug/sshguard-2.4.2-5.5.x86_64/src/blocker/blocker.c:106
(gdb)


--1661926792.8ccdfdd0.1452
Date: Wed, 31 Aug 2022 06:19:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1202958

            Bug ID: 1202958
           Summary: Neovim LSP errors possibly caused by modified script
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ytriop-at-protonmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Neovim as packaged on OpenSUSE Tumbleweed produces an error when attempting to
start an lsp client with Neovim's Lua interface.

The traceback points to a unbound variable in the runtime script at
/usr/share/nvim/runtime/lua/vim/uri.lua.

In this script, at line 36, there is a line modified from the source:
    tohex = require'bit32'.tohex
where tohex should be a function.

However, the bit32 module doesn't contain a tohex member, leading to errors
whenever the tohex function is invoked to percent-encode a filename.

In the original source code, this line instead calls the 'bit' module which
does contain a tohex function as a member:
    tohex = require('bit').tohex

See source version of this script here:
https://github.com/neovim/neovim/blob/master/runtime/lua/vim/uri.lua


--1661931590.E2fcA1.7281
Date: Wed, 31 Aug 2022 07:39:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1202964

            Bug ID: 1202964
           Summary: VUL-0: chromium: multiple security issues fixed in 105.0.5195.52
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html

Chromium 105.0.5195.52

CVE-2022-3038: Use after free in Network Service. Reported by Sergei Glazunov
of Google Project Zero on 2022-06-28
CVE-2022-3039: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13)
and Guang Gong of 360 Vulnerability Research Institute on 2022-07-11
CVE-2022-3040: Use after free in Layout. Reported by Anonymous on 2022-07-03
CVE-2022-3041: Use after free in WebSQL. Reported by Ziling Chen and Nan
Wang(@eternalsakura13) of 360 Vulnerability Research Institute on 2022-07-20
CVE-2022-3042: Use after free in PhoneHub. Reported by koocola(@alo_cook) and
Guang Gong of 360 Vulnerability Research Institute on 2022-06-22
CVE-2022-3043: Heap buffer overflow in Screen Capture. Reported by
@ginggilBesel on 2022-06-16
CVE-2022-3044: Inappropriate implementation in Site Isolation. Reported by
Lucas Pinheiro, Microsoft Browser Vulnerability Research on 2020-02-12
CVE-2022-3045: Insufficient validation of untrusted input in V8. Reported by
Ben Noordhuis <info-at-bnoordhuis.nl> on 2022-06-26
CVE-2022-3046: Use after free in Browser Tag. Reported by Rong Jian of VRI on
2022-07-21
CVE-2022-3047: Insufficient policy enforcement in Extensions API. Reported by
Maurice Dauer on 2022-07-07
CVE-2022-3048: Inappropriate implementation in Chrome OS lockscreen. Reported
by Andr.Ess on 2022-03-06
CVE-2022-3049: Use after free in SplitScreen. Reported by @ginggilBesel on
2022-04-17
CVE-2022-3050: Heap buffer overflow in WebUI. Reported by Zhihua Yao of KunLun
Lab on 2022-06-17
CVE-2022-3051: Heap buffer overflow in Exosphere. Reported by @ginggilBesel on
2022-07-18
CVE-2022-3052: Heap buffer overflow in Window Manager. Reported by Khalil Zhani
on 2022-07-21
CVE-2022-3053: Inappropriate implementation in Pointer Lock. Reported by Jesper
van den Ende (Pelican Party Studios) on 2021-11-08
CVE-2022-3054: Insufficient policy enforcement in DevTools. Reported by Kuilin
Li on 2022-01-24
CVE-2022-3055: Use after free in Passwords. Reported by Weipeng Jiang (@Krace)
and Guang Gong of 360 Vulnerability Research Institute on 2022-08-11
CVE-2022-3056: Insufficient policy enforcement in Content Security Policy.
Reported by Anonymous on 2022-05-26
CVE-2022-3057: Inappropriate implementation in iframe Sandbox. Reported by
Gareth Heyes on 2022-06-16
CVE-2022-3058: Use after free in Sign-In Flow. Reported by raven at KunLun lab
on 2022-06-20


--1662015185.FDE1baBE0.893
Date: Thu, 1 Sep 2022 06:53:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203003

            Bug ID: 1203003
           Summary: Firefox 104.0.1 is available (new version)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
               URL: https://www.mozilla.org/en-US/firefox/104.0.1/releasen
                    otes/
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: factory-mozilla-at-lists.opensuse.org
          Reporter: jayjayjazz-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

Firefox Version 104.0.1, first offered to Release channel users on August 30,
2022

Changelog:
- Addresses an issue with Youtube video playback that was affecting some users.

[1] https://www.mozilla.org/en-US/firefox/104.0.1/releasenotes/
[2] https://ftp.mozilla.org/pub/firefox/releases/104.0.1/


--1662038447.5c1b13bB0.3052
Date: Thu, 1 Sep 2022 13:20:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203025

            Bug ID: 1203025
           Summary: x11-tools: fix nvidia pre-install script
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 3rd Party Driver
          Assignee: gfx-bugs-at-suse.de
          Reporter: antonio.feijoo-at-suse.com
        QA Contact: sndirsch-at-suse.com
          Found By: ---
           Blocker: ---

The x11-tools/nvidia-pre-install (/usr/lib/nvidia/pre-install) script contains
obsolete parts:

# recreate initrd without KMS, if the use of KMS is enabled in initrd
if grep -q NO_KMS_IN_INITRD=\"no\" /etc/sysconfig/kernel; then
  sed -i 's/NO_KMS_IN_INITRD.*/NO_KMS_IN_INITRD="yes"/g' /etc/sysconfig/kernel
  mkinitrd
fi

- /etc/sysconfig/kernel hasn't been shipped for a long time.
- mkinitrd is deprecated and will be removed in the near future (see bug
#1202351).


--1662104533.7A3d2E0.19178
Date: Fri, 2 Sep 2022 07:42:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203053

            Bug ID: 1203053
           Summary: rc-local.service.8 is in wrong systemd subpackage, error when trying to read it
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

systemd contains the rc-local.service.8 manpage, but this is only a ".so"
reference to systemd-rc-local-generator.8, which is part of systemd-sysvcompat.

This leads to an error when trying to read the manual page:
# Lman rc-local.service
man: can't open /usr/share/man/systemd-rc-local-generator.8: No such file or
directory
No manual entry for rc-local.service

rc-local.service should be moved to systemd-sysvcompat, too.


--1662205831.cbA3c30.14435
Date: Sat, 3 Sep 2022 11:50:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203086

            Bug ID: 1203086
           Summary: package virtualbox-websrv does not contain firewall service defination
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: simon.crute-at-grafana.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,
The package virtualbox-websrv does not contain a firewalld service defination.
This makes is very hard to allow traffic through the firewall using YaST.

Using the following commands created the defination.

```
firewall-cmd --permanent --new-service=vboxweb
firewall-cmd --permanent --service=vboxweb --set-description="service to
remotly manage VirtualBox"
firewall-cmd --permanent --add-port=18083/tcp --zone=internal --service=vboxweb
firewall-cmd --permanent --set-short="vboxweb" --service=vboxweb
```

This created the file

```
cat /etc/firewalld/services/vboxweb.xml
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>vboxweb</short>
  <description>service to remotly manage VirtualBox</description>
  <port port="18083" protocol="tcp"/>
</service>

```

I can't figure out how to submit this to the packaging system as an issue, so i
thought I should log it here.


--1662294693.2e31B1d0.534
Date: Sun, 4 Sep 2022 12:31:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203091

            Bug ID: 1203091
           Summary: BASH(1) Manual Page: Unprocessed macro aq
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: giecrilj@stegny.2a.pl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The manual page says:

> Words of the form $aqstringaq are treated specially.


body:
--1662298339.EFf8d0b0.2959
Date: Sun, 4 Sep 2022 13:32:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203092

            Bug ID: 1203092
           Summary: GNU grep 3.8 egrep / grep warnings and migration to grep -E / grep -F
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Basesystem
          Assignee: schwab-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

GNU grep from 3.8 emitting warnings when invoking egrep/fgrep
https://build.opensuse.org/request/show/1001097

> egrep and fgrep commands, deprecated since 2007, now warn that
  they are obsolescent and should be replaced by grep -E / -F

We should look to eliminate egrep/fgrep from the distribution and replace all
usages of egrep/fgrep with grep -E and grep -F, respectively.

At the moment dropping these items breaks the grep build itself, it's all over
the place.

pkgs: apparmor avahi gnuplot rp-pppoe rpm suse-module-tools


--1662363301.5dbB15A41.30196
Date: Mon, 5 Sep 2022 07:35:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203102

            Bug ID: 1203102
           Summary: VUL-0: chromium: multiple security issues fixed in 105.0.5195.102
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html

Chromium 105.0.5195.102

CVE-2022-3075: Insufficient data validation in Mojo.


--1662462407.aB171d81.18738
Date: Tue, 6 Sep 2022 11:06:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203162

            Bug ID: 1203162
           Summary: VUL-0: CVE-2021-3427: deluge: XSS in webui via crafted torrent file
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/340943/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: andythe_great-at-pm.me
          Reporter: carlos.lopez-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2124452

The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the
data from torrent files is not properly sanitised as it's interpreted directly
as HTML. Someone who supplies the user with a malicious torrent file can
execute arbitrary Javascript code in the context of the user's browser session.

https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
https://dev.deluge-torrent.org/ticket/3459

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2124452
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3427
https://www.cve.org/CVERecord?id=CVE-2021-3427
https://groups.google.com/g/deluge-dev/c/e5zh7wT0rEg
https://dev.deluge-torrent.org/ticket/3459


body:
--1662488680.aCeED0.24227
Date: Tue, 6 Sep 2022 18:24:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203177

            Bug ID: 1203177
           Summary: Firefox 104.0.2 available (new version)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
               URL: https://ftp.mozilla.org/pub/firefox/releases/104.0.2/
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: factory-mozilla-at-lists.opensuse.org
          Reporter: jayjayjazz-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

Firefox version 104.0.2, first offered to Release channel users on September 6,
2022

Changelog:
- Fixed a bug making it impossible to use touch or a stylus to drag the
scrollbar on pages (bug 1787361).
- Fixed an issue causing some users to crash in out-of-memory conditions (bug
1774155).
- Fixed an issue that would sometimes affect video & audio playback when loaded
via a cross-origin iframe src attribute (bug 1781759).
- Fixed an issue that would sometimes affect video & audio playback when served
with Content-Security-Policy: sandbox (bug 1781063).

All bug numbers refer to the Mozilla Bugzilla.

Please consider an update.

[1] https://ftp.mozilla.org/pub/firefox/releases/104.0.2/
[2] https://www.mozilla.org/en-US/firefox/104.0.2/releasenotes/

summary: Firefox 104.0.2 available (new version)


--1662581934.E03B0.8415
Date: Wed, 7 Sep 2022 20:18:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203225

            Bug ID: 1203225
           Summary: Extracting archives in krusader doesn't work
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: 64bit
                OS: openSUSE Leap 15.4
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: 4Z1kk0-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

There is a bug in krusader of version 2.7.2 that does not allow to extract any
archive. Upstream bug report here https://bugs.kde.org/show_bug.cgi?id=441376.
Fix is in master branch. Please, apply patch from upstream to resolve this
issue.


--1662627769.7F2b280.32035
Date: Thu, 8 Sep 2022 09:02:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203245

            Bug ID: 1203245
           Summary: GNUTLS FIPS selfcheck is failing again on tumbleweed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: asn-at-cryptomilk.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

GNUTLS_FORCE_FIPS_MODE=1 GNUTLS_DEBUG_LEVEL=5 certtool
[..]
gnutls[3]: ASSERT: fips.c[load_hmac_file]:318
gnutls[2]: Could not load hmac file: Error while reading file.
gnutls[3]: ASSERT: fips.c[_gnutls_fips_perform_self_checks2]:592
gnutls[1]: FIPS140-2 self testing part 2 failed
gnutls[3]: ASSERT: global.c[_gnutls_global_init]:367
Error in GnuTLS initialization: Error while performing self checks.
global_init: Error while performing self checks.

rpm -q libgnutls-devel
libgnutls-devel-3.7.7-1.3.x86_64


--1662645084.1BC2c0.3686
Date: Thu, 8 Sep 2022 13:51:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203252

            Bug ID: 1203252
           Summary: virt-manager regression - cannot add second virtio-scsi controller
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: jirib79-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

virt-manager regression - cannot add second virtio-scsi controller, it used to
work fine.

ver: virt-manager-4.1.0-1.1.noarch / TW

steps to reproduce:

1. create new vm flow
2. select 'Customize configuration before install'
3. 'Add Hardware' -> Controller - use virtio-scsi controller
4. try to add another virtio-scsi controller as the first one

issue:

- after clicking 'Apply' for the 2nd virtio-scsi controller following error
appers:

---%>---
Error building device XML: unsupported operand type(s) for +: 'NoneType' and
'int'

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/addhardware.py", line 1359, in
_build_device
    dev = self._build_device_page(page_num)
  File "/usr/share/virt-manager/virtManager/addhardware.py", line 1375, in
_build_device_page
    dev = self._build_controller()
  File "/usr/share/virt-manager/virtManager/addhardware.py", line 1571, in
_build_controller
    index_new = max([x.index for x in controller_num]) + 1
TypeError: unsupported operand type(s) for +: 'NoneType' and 'int'
---%<---

notes:

- setup of the 1st virtio-scsi controller is:

---%>---
<controller type="scsi" model="virtio-scsi"/>
---%<---

So is it because of the 1st controller still does not have index and other
generated lines of the definition?

workaround:

- edit 1st virtio-scsi controller (see above) and add "index='0'", then adding
2nd controller works fine


--1662712127.EAd51.3972
Date: Fri, 9 Sep 2022 08:28:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203278

            Bug ID: 1203278
           Summary: VUL-0: CVE-2022-38529: godot: heap-buffer overflow via the component rleUncompress.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/341670/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: cunix-at-mail.de
          Reporter: carlos.lopez-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: maxmitschke-at-fastmail.com
          Found By: Security Response Team
           Blocker: ---

rh#2124778

tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the
component rleUncompress.

https://github.com/syoyo/tinyexr/issues/169

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2124778
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-38529
https://www.cve.org/CVERecord?id=CVE-2022-38529
https://github.com/syoyo/tinyexr/issues/169
http://www.cvedetails.com/cve/CVE-2022-38529/


--1662817400.cbAD0.777
Date: Sat, 10 Sep 2022 13:43:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203306

            Bug ID: 1203306
           Summary: VirtualBox 6.1.38 is available (new version)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
               URL: https://www.virtualbox.org/wiki/Changelog-6.1#v38
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: jayjayjazz-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Community User
           Blocker: ---

VirtualBox 6.1.38 (released September 02 2022)

This is a maintenance release. The following items were fixed and/or added:

- GUI: Improvements in Native Language Support area
- Main: OVF Export: Added support for exporting VMs containing Virtio-SCSI
controllers
- Recording settings: Fixed a regression which could cause not starting the COM
server (VBoxSVC) under certain circumstances (bug #21034)
- Recording: More deterministic naming for recorded files (will now overwrite
old .webm files if present)
- Linux Host and Guest Additions installer: Improved check for systemd presence
in the system (bug #19033)
- Linux Guest Additions: Introduced initial support for kernel 6.0
- Linux Guest Additions: Additional fixes for kernel RHEL 9.1 (bug #21065)
- Windows Guest Additions: Improvements in Drag and Drop area

All bug numbers refer to the VirtualBox Bugzilla

Please consider an update.

[1] https://www.virtualbox.org/wiki/Changelog-6.1#v38


--1662977994.0107b0.29560
Date: Mon, 12 Sep 2022 10:19:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203340

            Bug ID: 1203340
           Summary: AUDIT-0: sendmail: Need to crate /run/sendmail
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Current SR#990515 had been declined due to

sendmail.x86_64: E: systemd-tmpfile-entry-unauthorized (Badness: 10)
/usr/lib/tmpfiles.d/sendmail.conf "a+ /run - - - - u:mail:rwx,g:mail:rwx"
sendmail.x86_64: E: systemd-tmpfile-entry-unauthorized (Badness: 10)
/usr/lib/tmpfiles.d/sendmail.conf "a+ /run/sendmail - - - -
u:mail:rwx,g:mail:rwx"
This package installs a systemd-tmpfiles drop-in configuration file that
contains sensitive configuration entries. If the package is intended for
inclusion in any SUSE product please open a bug report to request review of
the package by the security team. Please refer to
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
more information.

but current package throws warnings during starting its services therefore this
changes seems to be required


--1663066348.6dFC1.24728
Date: Tue, 13 Sep 2022 10:52:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1203362

            Bug ID: 1203362
           Summary: AUDIT-WHITELIST: autofs: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Move /etc/dbus-1/system.d/org.freedesktop.AutoMount.conf to
/usr/share/dbus-1/system.d/org.freedesktop.AutoMount.conf

Devel prj: filesystems
Maintainer: Goldwyn Rodrigues <rgoldwyn-at-suse.com>


--1663076348.AC7BF1.31939
Date: Tue, 13 Sep 2022 13:39:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203370

            Bug ID: 1203370
           Summary: AUDIT-FIND: virtualbox: insecure permissions on /dev/vboxuser
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The udev rule for VirtualBox guests sets the permissions of /dev/vboxuser to
0666. This device node is used for guest-host communication, and while there is
no known attack vector at the moment, it has been subject to security
vulnerabilities in the past: CVE-2018-3055 and CVE-2018-3085 [2].

In my opinion it would be prudent to change it back to 0660 and set the group
to `vboxguest`.

[1] https://build.opensuse.org/request/show/994651
[2] https://github.com/niklasb/3dpwn


--1663142172.185B0.21532
Date: Wed, 14 Sep 2022 07:56:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203394

            Bug ID: 1203394
           Summary: [Build 280.1] fonts are  not rendered correctly for the new svg wallpapeer
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2656761/modules/open
                    suse_welcome/steps/4
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: lubos.kocman-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

We're using Source Sans Pro according to
https://opensuse.github.io/branding-guidelines/

These should come from adobe-sourcesanspro-fonts-2.045-bp154.1.21.noarch
 (from my leap 15.4 installation).

Seems like we have to ensure that these are supplied to desktop-install as
well.

openQA test in scenario opensuse-15.5-DVD-x86_64-gnome@64bit-2G fails in
[opensuse_welcome](https://openqa.opensuse.org/tests/2656761/modules/opensuse_welcome/steps/4)

## Test suite description
Revert schedule to working settings - dleuenberger, 20211117

## Reproducible

Fails since (at least) Build [280.1](https://openqa.opensuse.org/tests/2656761)
(current job)

## Expected result

Last good: [277.3](https://openqa.opensuse.org/tests/2645669) (or more recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit-2G&test=gnome&version=15.5)


--1663163149.CeCe10.11960
Date: Wed, 14 Sep 2022 13:45:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203408

            Bug ID: 1203408
           Summary: oscap xccdf eval notapplicable instead of fail
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pstivanin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- download the latest qcow2 from o3 (e.g.
https://openqa.opensuse.org/tests/2656844/asset/hdd/opensuse-15.5-aarch64-280.1-textmode@aarch64.qcow2)
- zypper in openscap-utils libxslt-tools
- download the xml files from
https://github.com/os-autoinst/os-autoinst-distri-opensuse/tree/master/data/openscap
- check the file with 'oscap info xccdf.xml'
- oscap xccdf eval --profile standard --results out.xml xccdf.xml

output:
Title   Direct root Logins Not Allowed
Rule    no_direct_root_logins
Result  notapplicable

Title   sysctl kernel.sysrq must be 0
Rule    rule_misc_sysrq
Result  notapplicable

expected output:
# oscap xccdf eval --profile standard --results out.xml xccdf.xml
Title   Direct root Logins Not Allowed
Rule    no_direct_root_logins
Result  fail

Title   sysctl kernel.sysrq must be 0
Rule    rule_misc_sysrq
Result  fail


--1663179078.c4cF11.9594
Date: Wed, 14 Sep 2022 18:11:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203419

            Bug ID: 1203419
           Summary: VUL-0: chromium: multiple security issues fixed in 105.0.5195.125 - 105.0.5195.127
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: gmbr3-at-opensuse.org
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html

Fixed in 105.0.5195.125 / 105.0.5195.125/126/127

  * CVE-2022-3195: Out of bounds write in Storage
  * CVE-2022-3196: Use after free in PDF
  * CVE-2022-3197: Use after free in PDF
  * CVE-2022-3198: Use after free in PDF
  * CVE-2022-3199: Use after free in Frames
  * CVE-2022-3200: Heap buffer overflow in Internals
  * CVE-2022-3201: Insufficient validation of untrusted input in DevTools
  * Various fixes from internal audits, fuzzing and other initiatives


--1663247959.a6f1cfFE7.30451
Date: Thu, 15 Sep 2022 13:19:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203460

            Bug ID: 1203460
           Summary: Error detected while processing 02tlib.vim
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I see after very rolling update

 Error detected while processing /usr/share/vim/site/plugin/02tlib.vim:
 line   77: E1208: -complete used without allowing arguments
 Press ENTER or type command to continue

please fix this


--1663314563.7f7a03720.7808
Date: Fri, 16 Sep 2022 07:49:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1203476

            Bug ID: 1203476
           Summary: openjdk-17 Can't work with Eclipse 2022-09 because of missing file in openjdk
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jweberhofer-at-weberhofer.at
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

BUG DESCRIPTION:
Whenever the latest version of Eclipse tries to build a Java 17 based project
using Leap's openjdk-17 it throws errors with the following message:

Errors occurred during the build.
Errors running builder 'Java Builder' on project 'test'.
Cannot invoke
org.eclipse.jdt.internal.compiler.util.JrtFileSystem.walkModuleImage(org.eclipse.jdt.internal.compiler.util.JRTUtil$JrtFileVisitor,
int)"
because the return value of
org.eclipse.jdt.internal.compiler.util.JRTUtil.getJrtSystem(java.io.File,
String)" is null

The reason for this issue is, that Eclipse expects a file
/usr/lib64/jvm/java-17-openjdk-17/release holding some version information. The
file included in the Java installation included in Eclipse contains the
following two lines:

JAVA_VERSION="17.0.4.1"
MODULES="java.base java.compiler java.datatransfer java.xml java.prefs
java.desktop java.instrument java.logging java.management java.security.sasl
java.naming java.rmi java.management.rmi java.net.http java.scripting
java.security.jgss java.transaction.xa java.sql java.sql.rowset java.xml.crypto
java.se java.smartcardio jdk.accessibility jdk.internal.jvmstat jdk.attach
jdk.charsets jdk.compiler jdk.crypto.ec jdk.crypto.cryptoki jdk.dynalink
jdk.internal.ed jdk.editpad jdk.hotspot.agent jdk.httpserver jdk.internal.le
jdk.internal.opt jdk.internal.vm.ci jdk.internal.vm.compiler
jdk.internal.vm.compiler.management jdk.jartool jdk.javadoc jdk.jcmd
jdk.management jdk.management.agent jdk.jconsole jdk.jdeps jdk.jdwp.agent
jdk.jdi jdk.jfr jdk.jlink jdk.jpackage jdk.jshell jdk.jsobject jdk.jstatd
jdk.localedata jdk.management.jfr jdk.naming.dns jdk.naming.rmi jdk.net
jdk.nio.mapmode jdk.random jdk.sctp jdk.security.auth jdk.security.jgss
jdk.unsupported jdk.unsupported.desktop jdk.xml.dom jdk.zipfs"

Copying this file into /usr/lib64/jvm/java-17-openjdk-17/release solves that
issue for me.

EXPECTED ACTION:
The missing file should be included in Leap's openjdk package.

STEPS TO REPRODUCE THE ISSUE:
* Start Eclipse 2022-09
* Add a new JRE pointing to /lib64/jvm/java-17-openjdk-17
* Switch the JavaSE-17 execution environment to use Leap's openjdk instead of
the version coming with Eclipse
* Create/Open a Java 17 based project, using the JavaSE-17 execution
environment
* Whenever Eclipse tries to build the project you should see errors.