--1651842249.0a0DC25.32014
Date: Fri, 6 May 2022 13:04:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199281

            Bug ID: 1199281
           Summary: VUL-0: CVE-2022-29502: slurm,slurmlibs,slurm_20_11,slurm_18_08,slurm_20_02: I/O key validation allows attacker to intercept communication
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/330837/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: hpc-bugs-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2082291

An issue was found with the I/O key validation logic in the srun client
command that could permit an attacker to attach to the user's terminal,
and intercept process I/O. (Slurm 21.08 only.)

https://lists.schedmd.com/pipermail/slurm-announce/2022/000072.html

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2082291
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29502
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29502
https://www.schedmd.com/news.php?id=260
https://lists.schedmd.com/pipermail/slurm-announce/
https://www.schedmd.com/news.php


--1651901797.2EE70.14514
Date: Sat, 7 May 2022 05:36:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199306

            Bug ID: 1199306
           Summary: cryfs  package in opensuse Tumbleweed 20220504 not works
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: stolz-at-rfgs.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,

Package cryfs not works since openSUSE Tumbleweed 20220504.

If I use command:
cryfs --version
I get this:
cryfs: symbol lookup error: cryfs: undefined symbol:
_ZN6spdlog5sinks15basic_file_sinkISt5mutexEC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEb

Version of my cryfs: 0.11.2-1.2-x86_64 from vendor openSUSE

Peter


--1652164919.CcEe3f1.26057
Date: Tue, 10 May 2022 06:41:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1199370

            Bug ID: 1199370
           Summary: VUL-0: CVE-2022-27114: htmldoc: image_load_jpeg can cause integer overflow
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/331095/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: pgajdos-at-suse.com
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2083365

There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function
image.cxx when it calls malloc,'img->width' and 'img->height' they are large
enough to cause an integer overflow. So, the malloc function may return a heap
blop smaller than the expected size, and it will cause a buffer
overflow/Address boundary error in the jpeg_read_scanlines function.

https://github.com/michaelrsweet/htmldoc/commit/31f780487e5ddc426888638786cdc47631687275
https://github.com/michaelrsweet/htmldoc/issues/471

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2083365
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-27114
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27114
https://github.com/michaelrsweet/htmldoc/commit/31f780487e5ddc426888638786cdc47631687275
https://github.com/michaelrsweet/htmldoc/issues/471


--1652167858.D0aaf31.31481
Date: Tue, 10 May 2022 07:30:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1199375

            Bug ID: 1199375
           Summary: PackageHub: atop-daemon-2.4.0-bp154.1.17.x86_64  fails to install due to missing dependency
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-15-SP4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Packages
          Assignee: packagehub-bugs-at-suse.com
          Reporter: Johann.PB.Pickl-at-bmw.de
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

itadell105:~ # zypper install atop-2.4.0-bp154.1.17.x86_64
atop-daemon-2.4.0-bp154.1.17.x86_64
Loading repository data...
Reading installed packages...
Resolving package dependencies...

Problem: nothing provides '/usr/bin/python' needed by the to be installed
atop-daemon-2.4.0-bp154.1.17.x86_64
 Solution 1: do not install atop-daemon-2.4.0-bp154.1.17.x86_64
 Solution 2: break atop-daemon-2.4.0-bp154.1.17.x86_64 by ignoring some of its
dependencies

Choose from above solutions by number or cancel [1/2/c/d/?] (c): c

atop-daemon-2.4.0-bp154.1.17.x86_64 needs /usr/bin/python, but Python2 was
replaced by Python3 - see
https://susedoc.github.io/release-notes/sles-15_SP4/html/release-notes/#development
5.6.7 Python 2 has been removed REPORT DOCUMENTATION BUG#


--1652175384.5D210.14506
Date: Tue, 10 May 2022 09:36:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199381

            Bug ID: 1199381
           Summary: xournalpp: recommended/suggested  LaTeX packages
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: openSUSE Leap 15.4
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: k.c.harke-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

For a working LaTeX-Field in xournalpp some texlive-packages are required which
are not all included in the standard texlive package, according to
/usr/share/xournalpp/resources/default_template.tex:

texlive-standalone
texlive-amsmath
texlive-amssymb: no openSUSE package available
texlive-scontents
texlive-ifthen: no openSUSE-package, only texlive-xifthen. Change in
default-template?
texlive-xcolor

Set them as suggested?


body:
--1652183093.EC554C212.27133
Date: Tue, 10 May 2022 11:44:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199388

            Bug ID: 1199388
           Summary: release-notes-openSUSE fail to build
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Documentation
          Assignee: fs-at-suse.com
          Reporter: lubos.kocman-at-suse.com
        QA Contact: fs-at-suse.com
          Found By: ---
           Blocker: ---

openSUSE Leap 15.4 release notes are failing to build starting by this week
https://build.opensuse.org/package/live_build_log/openSUSE:Leap:15.4/release-notes-openSUSE/standard/x86_64

After initial lookup Max thinks it could be related to the week old update of
daps in SUSE:SLE-15-SP3:Update

summary: release-notes-openSUSE fail to build


--1652218146.2C551.27087
Date: Tue, 10 May 2022 21:29:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199409

            Bug ID: 1199409
           Summary: VUL-0: chromium: multiple security issues fixed in 101.0.4951.64
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html

Fixed in 101.0.4951.64:

CVE-2022-1633: Use after free in Sharesheet
CVE-2022-1634: Use after free in Browser UI
CVE-2022-1635: Use after free in Permission Prompts
CVE-2022-1636: Use after free in Performance APIs
CVE-2022-1637: Inappropriate implementation in Web Contents
CVE-2022-1638: Heap buffer overflow in V8 Internationalization
CVE-2022-1639: Use after free in ANGLE
CVE-2022-1640: Use after free in Sharing
CVE-2022-1641: Use after free in Web UI Diagnostics


--1652350337.2cAccA74.16388
Date: Thu, 12 May 2022 10:12:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199477

            Bug ID: 1199477
           Summary: [Build 20220509] system_role is not fully visualized
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2337286/modules/syst
                    em_role/steps/1
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jeriveramoya-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-remote_vnc_controller@64bit fails in
[system_role](https://openqa.opensuse.org/tests/2337286/modules/system_role/steps/1)

## Test suite description
Controller performs remote installation via vnc to the target

It is missing the bottom part of the transactional system role.
Could be a bug in X, the VNC layers or the client. When trying to click on the
radiobutton the page is not ready and the radiobutton is not selected.
I doubt it will be a YaST bug, after waiting a bit the screen is again ok to
interact with it.

## Expected result

Last good: [20220217](https://openqa.opensuse.org/tests/2195844) (or more
recent)


--1652512967.F6C73AE50.9932
Date: Sat, 14 May 2022 07:22:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199535

            Bug ID: 1199535
           Summary: [Build 20220512] dovecot/poo3 vs apparmor
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2346536/modules/usr_
                    lib_dovecot_pop3/steps/45
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

type=USER_AUTH msg=audit(1652509166.040:1497): pid=11876 uid=0 auid=4294967295
ses=4294967295 subj==dovecot-auth (enforce) msg='op=PAM:authentication
grantors=pam_gnome_keyring,pam_unix acct="recipient"
exe="/usr/lib/dovecot/auth" hostname=::1 addr=::1 terminal=dovecot res=success'
type=USER_ACCT msg=audit(1652509166.044:1498): pid=11876 uid=0 auid=4294967295
ses=4294967295 subj==dovecot-auth (enforce) msg='op=PAM:accounting
grantors=pam_unix acct="recipient" exe="/usr/lib/dovecot/auth" hostname=::1
addr=::1 terminal=dovecot res=success'
type=AVC msg=audit(1652509166.056:1499): apparmor="DENIED" operation="open"
profile="dovecot-pop3" name="/proc/11877/stat" pid=11877 comm="pop3"
requested_mask="r" denied_mask="r" fsuid=1002 ouid=0
type=SYSCALL msg=audit(1652509166.056:1499): arch=c000003e syscall=257
success=no exit=-13 a0=ffffff9c a1=7f56e28a8ea3 a2=0 a3=0 items=0 ppid=11862
pid=11877 auid=4294967295 uid=1002 gid=1002 euid=1002 suid=1002 fsuid=1002
egid=1002 sgid=1002 fsgid=1002 tty=(none) ses=4294967295 comm="pop3"
exe="/usr/lib/dovecot/pop3" subj==dovecot-pop3 (enforce) key=(null)
type=PROCTITLE msg=audit(1652509166.056:1499): proctitle="dovecot/pop3"
openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-apparmor_profile@64bit
fails in
[usr_lib_dovecot_pop3](https://openqa.opensuse.org/tests/2346536/modules/usr_lib_dovecot_pop3/steps/45)

## Test suite description
Maintainer: llzhao-at-suse.de.
Test AppArmor profiles with an existing disk image.

## Reproducible

Fails since (at least) Build
[20220512](https://openqa.opensuse.org/tests/2345963)

## Expected result

Last good: [20220510](https://openqa.opensuse.org/tests/2345146) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit&test=apparmor_profile&version=Tumbleweed)


body:
--1652795413.EABEcF07.24072
Date: Tue, 17 May 2022 13:50:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199630

            Bug ID: 1199630
           Summary: selinux policy blocks nss-systemd
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fcrozat-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

In enforcing mode, the current selinux policy in TW blocks using nss-systemd
for shadow.

To reproduce:
- install openSUSE MicroOS (or set enforcing mode for selinux)
- transactional-update pkg in nss-systemd
- cp /usr/etc/nsswitch.conf /etc/nsswitch.conf
- in /etc/nsswitch.conf, replace the line
shadow: compat
by
shadow: compat systemd
- try to login in another console

BEFORE, once you do that, you won't be able to login unless you are in
permissive selinux mode

summary: selinux policy blocks nss-systemd


--1652839027.fB63Da41.22625
Date: Wed, 18 May 2022 01:57:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199641

            Bug ID: 1199641
           Summary: keepassxc version 2.6.6 lacks natural-sort (Bug:7813) , current is 2.7.1
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: drankinatty-at-suddenlinkmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The version of keepassxc that installs with 15.4 Beta is 2.6.6. There have been
significant bug fixes since that version. Current version is 2.7.1.

One of the most important for usability is Bug 7813 which corrects an issue
preventing a natural-sort of entries (case-insensitive sort). See:
https://github.com/keepassxreboot/keepassxc/issues/7813

Instead, with version 2.6.6 you get A-Za-z sort which make it almost impossible
to find what you are looking for unless you can remember whether you began the
Title with uppercase or lowercase.

This package may get pulled in from SLES according to Carlos. Wherever it comes
from, a version update is needed.


--1652960103.B8C8b2.17889
Date: Thu, 19 May 2022 11:35:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199706

            Bug ID: 1199706
           Summary: NetworkManager 1.38.0 broken on Comet Lake PCH CNVi WiFi
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: os.gnome.maintainers-at-gmail.com
          Reporter: brunopitrus-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: Yes

On Dell Precision 3551 with Comet Lake PCH CNVi WiFi  [8086:06F0] subsystem
8086:4070,

With NetworkManager 1.38.0-1.1 wifi does not work

Fails to detect any network, and temperature probe shows 0.0 C.

After downgrading to 1.36.4-2.2, works again.


--1652963284.5eF40.1972
Date: Thu, 19 May 2022 12:28:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199710

            Bug ID: 1199710
           Summary: NetworkManager 1.38.0 breaks both WiFi and WWAN
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: opensuse-at-syds.eu
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Latest snapshot 20220518 brings NetworkManager 1.38.0.

After a dup on my MicroOS desktop Thinkpad T480s with a Fibocom L830 modem my
wifi and WWAN don't work anymore.

https://paste.opensuse.org/58487955 for the dmesg
Journalctl doesn't seem to show anything out of the ordinary and sudo rfkill
shows both wwan and wlan as unblocked for soft and hard.

Is there something else i can check?


body:
--1653038449.cBB570.14785
Date: Fri, 20 May 2022 09:20:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1199754

            Bug ID: 1199754
           Summary: xmlcharent: post scripts broken
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: werner-at-suse.com
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
                CC: thomas.schraitle-at-suse.com, tiwai-at-suse.com
          Found By: ---
           Blocker: ---

When xmlcharent is updated, one sees:

```
sgml-register-catalog: addition of /usr/share/xmlcharent/xmlcharent.sgml in
/etc/sgml/catalog
sgml-register-catalog: removal of /usr/share/xmlcharent/xmlcharent.sgml from
/etc/sgml/catalog
(1177/2064) Installing: xmlcharent-0.3-428.14.noarch
.............................................................[done]
```

and xmlcharent.sgml is absent from /etc/sgml/catalog.

This is because the %postun of the old version runs after the %post of the new
version and hence xmlcharent.sgml is always removed from the catalog.

You need to guard the calls to sgml-register-catalog with if [ "$1" = 0 ] or
so.

summary: xmlcharent: post scripts broken


body:
--1653039213.71eB30.16395
Date: Fri, 20 May 2022 09:33:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199755

            Bug ID: 1199755
           Summary: amavis fails to start
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: patrick.schaaf-at-yalwa.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

On current tw snapshot 20220516, I had amavis.service not starting

2022-05-20T11:04:50.947286+02:00 phobos systemd[1]:
/usr/lib/systemd/system/amavis.service:1: Assignment outside of section.
Ignoring.
2022-05-20T11:04:52.781084+02:00 phobos systemd[1]: amavis.service: Main
process exited, code=exited, status=2/INVALIDARGUMENT
2022-05-20T11:04:52.781365+02:00 phobos systemd[1]: amavis.service: Failed with
result 'exit-code'.
2022-05-20T11:04:52.781457+02:00 phobos systemd[1]: Failed to start Amavisd-new
Virus Scanner interface.

That first "Assignment outside" ... in amavis.service file is a red herring
(really weird first line, but systemd does not care).

The actual issue shows when trying to run amavisd manually:

host:~ # /usr/sbin/amavisd -P '' foreground
Can't locate IO/Socket/SSL.pm in @INC (you may need to install the
IO::Socket::SSL module) (@INC contains:
/usr/lib/perl5/site_perl/5.34.0/x86_64-linux-thread-multi
/usr/lib/perl5/site_perl/5.34.0
/usr/lib/perl5/vendor_perl/5.34.0/x86_64-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.34.0
/usr/lib/perl5/5.34.0/x86_64-linux-thread-multi /usr/lib/perl5/5.34.0
/usr/lib/perl5/site_perl) at /usr/sbin/amavisd line 8239.
BEGIN failed--compilation aborted at /usr/sbin/amavisd line 8239.

A manual install of perl-IO-Socket-SSL fixes the problem - so packaging of
amavis probably just needs another Requires: on that.

Problematic package: amavisd-new-2.12.2-2.1.noarch (20220516 snapshot)
Older one that worked: amavisd-new-2.12.1-4.3.noarch (20220301 snapshot)

(in the older amavisd, "use IO::Socket::SSL" was commented out it seems)

summary: amavis fails to start


--1653158854.AD0178230.5896
Date: Sat, 21 May 2022 18:47:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199795

            Bug ID: 1199795
           Summary: Texlive fails to build in Factory, perl version problems
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Upgrade Problems
          Assignee: screening-team-bugs-at-suse.de
          Reporter: code-at-bnavigator.de
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Texlive currently does not build in Factory:standard and is thus not updated in
the recent snapshots. This results in:

# zypper in texlive-biber
Loading repository data...
Reading installed packages...
Resolving package dependencies...

Problem: nothing provides 'perl = 5.34.0' needed by the to be installed
texlive-biber-bin-2022.20220321.svn61867-81.3.noarch
 Solution 1: do not install texlive-biber-2022.195.2.17svn61867-50.3.noarch
 Solution 2: break texlive-biber-bin-2022.20220321.svn61867-81.3.noarch by
ignoring some of its dependencies

Relevant messages from the failing build log when compiling
openSUSE:Factory/texlive:

[ 1297s] Building biblatex-biber
[ 1297s] + rm t/remote-files.t
[ 1297s] + LANG=en_US.UTF-8
[ 1297s] + BIBER_DEV_TESTS=1
[ 1297s] + ./Build test
[ 1298s] List::Util version 1.56 required--this is only version 1.55 at
/usr/lib/perl5/vendor_perl/5.34.0/List/AllUtils.pm line 8.
[ 1298s] BEGIN failed--compilation aborted at
/usr/lib/perl5/vendor_perl/5.34.0/List/AllUtils.pm line 8.
[ 1298s] Compilation failed in require at
/home/abuild/rpmbuild/BUILD/biber-2.17/blib/lib/Biber/Config.pm line 15.

There seems to be a perl version mismatch, which manifests in Factory and the
snapshots but not in Staging:

abuild@greinerT450s:~> rpm -qf
/usr/lib/perl5/vendor_perl/5.34.0/List/AllUtils.pm
perl-List-AllUtils-0.19-1.5.noarch
abuild@greinerT450s:~> rpm -qf /usr/lib/perl5/vendor_perl/5.34.1/
perl-5.34.1-1.1.x86_64


body:
--1653265328.fd1bE100.2037
Date: Mon, 23 May 2022 00:22:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199803

            Bug ID: 1199803
           Summary: VirtualBox fails with Kernel 5.18.0
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: Larry.Finger-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

VirtualBox fails to run correctly under kernel 5.18.0. A problem was noticed
early in the 5.18-rcX cycle and bisected to commit 6e8ec2552c7d ("random: use
computational hash for entropy extraction"). That commit has been confirmed as
the one causing the problem.

As soon as I discovered that 5.18 would build OK, but not run correctly, I
placed a ticket at https://www.virtualbox.org/ticket/20914. As you will see in
that ticket, I did not get very swift action on this issue. The Oracle
developer did not get serious until 5.18-rc7 was out (only 1 week ago), and
that has not allowed sufficient time to fix the problem. By the way, although
my subject talks about Windows 10 VMs, ALL VMs are affected!

We now know the cause for the problem. The changes in the random number
generator employ the SSSE3 instructions. which in turn affect the FPU. I have
long believed that the FPU was not used in the kernel, but that is not quite
correct - it does not use any float or double variables; however, it does
affect the unit. Note that this change in the rng also exposed a long-standing
problem with the FPU, which was fixed with commit 59f5ede3bc0f ("x86/fpu:
Prevent FPU state corruption").

The current belief is that the VirtualBox vcpu is not saving the state of the
FPU when a hard IRQ occurs. If the code using SSSE3 runs in the host during
that interrupt, the state of the FPU in the guest is incorrect, and the guest
gets a kernel exception.

It is easy to test for this condition. In the guest start a multi-cpu build of
the kernel, or some other large project. Within a few seconds, gcc will get an
error.

summary: VirtualBox fails with Kernel 5.18.0


--1653293726.ae2e7ed21.3197
Date: Mon, 23 May 2022 08:15:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1199812

            Bug ID: 1199812
           Summary: VUL-1: CVE-2022-29163: User can create a link that is not password protected even if the administrator requires it
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/332466/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-29163

Nextcloud Server is the file server software for Nextcloud, a self-hosted
productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a
link that is not password protected even if the administrator requires links to
be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this
issue. There are currently no known workarounds.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29163
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29163
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx
https://github.com/nextcloud/circles/pull/926
https://github.com/nextcloud/circles/pull/866
https://hackerone.com/reports/1406926


--1653319732.70125b2.9684
Date: Mon, 23 May 2022 15:28:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199841

            Bug ID: 1199841
           Summary: backports violates opensuse review process
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-15-SP4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Factory Source Check
          Assignee: packagehub-bugs-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: packagehub-bugs-at-suse.com
                CC: dleuenberger-at-suse.com, security-team-at-suse.de
          Found By: ---
           Blocker: ---

Looks like packages are neither verified to come from factory, nor reviewed by
the opensuse-review team. That violates the processes used by openSUSE. See  eg
https://build.opensuse.org/request/show/940056


--1653404198.FBaB20.23295
Date: Tue, 24 May 2022 14:56:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199873

            Bug ID: 1199873
           Summary: suse-module-tools: don't rely on files in /boot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: martin.wilck-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1184804
          Found By: ---
           Blocker: ---

suse-module-tools has several scripts that rely on legacy symlinks in /boot:

/usr/lib/module-init-tools/weak-modules2 and
/usr/lib/module-init-tools/driver-check.sh want to access
"/boot/System.map-$krel". Should be be /usr/lib/modules/$krel/System.map
instead. Similar to how it's done for symver.gz in weak-modules2.

driver-check.sh lacks the fallback also for symvers.gz.


--1653414720.6553f537.30160
Date: Tue, 24 May 2022 17:52:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199881

            Bug ID: 1199881
           Summary: [Build 20220523] gnutls: Error while performing self checks.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2370295/modules/dirm
                    ngr_daemon/steps/21
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

Error in GnuTLS initialization: Error while performing self checks.
dirmngr[2329]: Fatal: gnutls_global_init failed: Error while performing self
checks.

openQA test in scenario
opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-fips@64bit_virtio fails in
[dirmngr_daemon](https://openqa.opensuse.org/tests/2370295/modules/dirmngr_daemon/steps/21)

## Test suite description

## Reproducible

Fails since (at least) Build
[mloviska/os-autoinst-distri-opensuse#12966](https://openqa.opensuse.org/tests/1852971)

## Expected result

Last good: (unknown) (or more recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=JeOS-for-kvm-and-xen&machine=64bit_virtio&test=jeos-fips&version=Tumbleweed)


--1653425191.52F5bF300.7892
Date: Tue, 24 May 2022 20:46:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199885

            Bug ID: 1199885
           Summary: [Build 20220523] plasma/Wayland glitches
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2371173/modules/open
                    suse_welcome/steps/4
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

The test logs out and back into a Wayland session, where the display send to
turn black

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-kde-wayland@64bit_virtio
fails in
[opensuse_welcome](https://openqa.opensuse.org/tests/2371173/modules/opensuse_welcome/steps/4)

## Test suite description
Basic KDE installation, but switches to a Wayland session on login. Needs
Virtio (or similiar) GPU.

## Reproducible

Fails since (at least) Build
[20220522](https://openqa.opensuse.org/tests/2365555)

## Expected result

Last good: [20220521](https://openqa.opensuse.org/tests/2364482) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit_virtio&test=kde-wayland&version=Tumbleweed)


--1653462717.8aDE230.26000
Date: Wed, 25 May 2022 07:11:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1199893

            Bug ID: 1199893
           Summary: VUL-0: chromium: multiple security issues fixed in 102.0.5005.61
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: security-team-at-suse.de
          Found By: ---
           Blocker: ---

Please submit the new chromium update.

[$TBD][1324864] Critical CVE-2022-1853: Use after free in Indexed DB. Reported
by Anonymous on 2022-05-12

[$10000][1320024] High CVE-2022-1854: Use after free in ANGLE. Reported by
SeongHwan Park (SeHwa) on 2022-04-27

[$7500][1228661] High CVE-2022-1855: Use after free in Messaging. Reported by
Anonymous on 2021-07-13

[$3000][1323239] High CVE-2022-1856: Use after free in User Education. Reported
by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab  on 2022-05-06

[$2000][1227995] High CVE-2022-1857: Insufficient policy enforcement in File
System API. Reported by Daniel Rhea on 2021-07-11

[$1000][1314310] High CVE-2022-1858: Out of bounds read in DevTools. Reported
by EllisVlad on 2022-04-07

[$1000][1322744] High CVE-2022-1859: Use after free in Performance Manager.
Reported by Guannan Wang (@Keenan7310) of Tencent Security Xuanwu Lab on
2022-05-05

[$TBD][1297209] High CVE-2022-1860: Use after free in UI Foundations. Reported
by @ginggilBesel on 2022-02-15

[$TBD][1316846] High CVE-2022-1861: Use after free in Sharing. Reported by
Khalil Zhani on 2022-04-16

[$5000][1236325] Medium CVE-2022-1862: Inappropriate implementation in
Extensions. Reported by Alesandro Ortiz on 2021-08-04

[$5000][1292870] Medium CVE-2022-1863: Use after free in Tab Groups. Reported
by David Erceg on 2022-02-01

[$5000][1320624] Medium CVE-2022-1864: Use after free in WebApp Installs.
Reported by Yuntao You (@GraVity0) of Bytedance Wuheng Lab on 2022-04-28

[$3000][1289192] Medium CVE-2022-1865: Use after free in Bookmarks. Reported by
Rong Jian of VRI on 2022-01-20

[$3000][1292264] Medium CVE-2022-1866: Use after free in Tablet Mode. Reported
by @ginggilBesel on 2022-01-29

[$3000][1315563] Medium CVE-2022-1867: Insufficient validation of untrusted
input in Data Transfer. Reported by Micha?? Bentkowski of Securitum on
2022-04-12

[$TBD][1301203] Medium CVE-2022-1868: Inappropriate implementation in
Extensions API. Reported by Alesandro Ortiz on 2022-02-28

[$NA][1309467] Medium CVE-2022-1869: Type Confusion in V8. Reported by Man Yue
Mo of GitHub Security Lab on 2022-03-23

[$TBD][1323236] Medium CVE-2022-1870: Use after free in App Service. Reported
by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab  on 2022-05-06

[$7000][1308199] Low CVE-2022-1871: Insufficient policy enforcement in File
System API. Reported by Thomas Orlita  on 2022-03-21

[$7000][1310461] Low CVE-2022-1872: Insufficient policy enforcement in
Extensions API. Reported by ChaobinZhang on 2022-03-26

[$2000][1305394] Low CVE-2022-1873: Insufficient policy enforcement in COOP.
Reported by NDevTK on 2022-03-11

[$500][1251588] Low CVE-2022-1874: Insufficient policy enforcement in Safe
Browsing. Reported by hjy79425575 on 2021-09-21

[$500][1306443] Low CVE-2022-1875: Inappropriate implementation in PDF.
Reported by NDevTK on 2022-03-15

[$TBD][1313600] Low CVE-2022-1876: Heap buffer overflow in DevTools. Reported
by @ginggilBesel on 2022-04-06


--1653463208.aaBcC66B0.27684
Date: Wed, 25 May 2022 07:20:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199895

            Bug ID: 1199895
           Summary: PackageKit does not honor zypper package locks
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: openSUSE Leap 15.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: epistemepromeneur-at-free.fr
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I opened a bug report on 2 Jun 2019.

 https://github.com/PackageKit/PackageKit/issues/325

A pull request has been made for merging a fix on 17 April 2022.

https://github.com/PackageKit/PackageKit/pull/543

3 years !

Stefan Dirsch suggest to me to ask you to
"to add the fix from github to our package, since apparently nobody is looking
into the issue and the fix upstream. :-("

see comment #9 here
https://bugzilla.opensuse.org/show_bug.cgi?id=1199791

Thanks


--1653478799.f0DBE00.14124
Date: Wed, 25 May 2022 11:39:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199907

            Bug ID: 1199907
           Summary: powerdevil  5.24.90  has broken intel backlight
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: fabian@ritter-vogt.de
          Reporter: brunopitrus-at-hotmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After upgrade to powerdevil  5.24.90, screen backlight on a Dell Precision 3551
is capped at 11%, making the screen rather dark.

The laptop uses Intel graphics.

Downgrading powerdevil5 to 5.24.5 and attempting to adjust brightness fixes the
issue without needing to restart anything else. This suggests the problem is
inside `/usr/libexec/kaauth/backlighthelper`, and not inside any persistent
service.


--1653509987.41f2F4.31559
Date: Wed, 25 May 2022 20:19:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199929

            Bug ID: 1199929
           Summary: GNOME:Factory/gnome-calculator: Program no longer launches
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: reiokorn-at-tutanota.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Terminal:
gnome-calculator
*** buffer overflow detected ***: terminated
Aborted (memory dump written)

Linux tumbleweed-pc 5.17.9-1-default #1 SMP PREEMPT Wed May 18 10:03:12 UTC
2022 (eab1a2c) x86_64 x86_64 x86_64 GNU/Linux

NAME="openSUSE Tumbleweed"
# VERSION="20220523"


body:
--1653555398.57bd0.5428
Date: Thu, 26 May 2022 08:56:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1199934

            Bug ID: 1199934
           Summary: Update instlux to be 15.4 default
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: belphegor-at-belbel.or.jp
          Reporter: mlin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

It's time to update instlux to be 15.4 default, @Yasuhiko could you please take
a look this and submit it to Factory and openSUSE:Leap:15.4? btw is this about
change version number in specfile?

summary: Update instlux to be 15.4 default


body:
--1653623890.cD63fED0.1522
Date: Fri, 27 May 2022 03:58:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199963

            Bug ID: 1199963
           Summary: lxd tumbleweed fail
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: werwolf131313-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

> [werwolf@srv] ~
> ??? lxc launch images:opensuse/tumbleweed test
> Creating test
> Starting test
> Error: Load go-lxc struct: Failed to set LXC config: lxc.seccomp.profile=/var/lib/lxd/security/seccomp/test
> Try `lxc info --show-log local:test` for more info
>
> [werwolf@srv] ~
> ??? lxc ls                                                                                ???
> +------+---------+------+------+-----------+-----------+----------+
> | NAME |  STATE  | IPV4 | IPV6 |   TYPE    | SNAPSHOTS | LOCATION |
> +------+---------+------+------+-----------+-----------+----------+
> | test | STOPPED |      |      | CONTAINER | 0         | srv      |
> +------+---------+------+------+-----------+-----------+----------+
>
> [werwolf@srv] ~
> ??? lxc info --show-log local:test
> Name: test
> Status: STOPPED
> Type: container
> Architecture: aarch64
> Location: srv
> Created: 2022/05/27 09:52 +06
>
> Log:
>
>
>
> [werwolf@srv] ~
> ??? sudo ls -lah /var/lib/lxd/security/seccomp/                                                                                ???
> ?????????? 0
> drwx----

summary: lxd tumbleweed fail


--1653627937.C4ddf4530.20616
Date: Fri, 27 May 2022 05:05:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199964

            Bug ID: 1199964
           Summary: Bogus "Limited Connectivity" on ethernet
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: pedrohqb-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Not affecting actual connectivity. It claims there's no connection to internet.
The bogus message started after an update last week. Affects all my TW system
on KDE and Gnome as well.


--1653655694.35e0322.31461
Date: Fri, 27 May 2022 12:48:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199981

            Bug ID: 1199981
           Summary: Sigil EBUP editor terminates with SIGSEGV on startup.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: R.Wentland-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

With Tumbleweed 20220525 sigil 1.9.10-1.1 is crashing on startup.

> sigil
Segmentation fault (core dumped)
>


--1653664303.fF5f0.16556
Date: Fri, 27 May 2022 15:11:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1199987

            Bug ID: 1199987
           Summary: broken/missing HEIF support (and HEIC images)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: sbrabec-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

openSUSE Leap has a broken HEIF image support.

The problem raises, as the latest Apple products has it as default image
format, and moderm Android applications support it as well.

As far as I see, there are following problems:

libheif: gdk-pixbuf-loader does not work: Problem of missing scriptlets.

geeqie: Problem (at least) with ignored HEIF (and many other) formats in the
spec file.

ristretto: Not yet analyzed.

GIMP: gimp-plugin-heif is not part of openSUSE at all. It could be imported
from Packman.


body:
--1653790794.8B6b6620.28803
Date: Sun, 29 May 2022 02:19:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200002

            Bug ID: 1200002
           Summary: [trackerbug] lxd 5.2 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXD 5.2. The full upstream changelog is available from:
  https://discuss.linuxcontainers.org/t/lxd-5-2-has-been-released/14200

  + VPD information in resources API
  * Cross-project profile copy
  * HTTP streaming support in /dev/lxd API
  * Use of server-side filtering in CLI
  * Ceph librbd for virtual machines

summary: [trackerbug] lxd 5.2 update


body:
Build Identifier:

Hello it seems to be exactly the same bug:

https://bugs.kde.org/show_bug.cgi?id=451088

It's the same on the theme panel.
WHen you clic on "online theme/splashscreen" you get "Unknown Error on the
Collaborative Services API (0)"

I am using french translation here on a leap 15.4 updated to the latest.

Reproducible: Always

Steps to Reproduce:
1. Open the "Get new icons" // "Get new Window Decorations" // "Get new Splash
Screens"

Actual Results:
Unknown Error on the Collaborative Services API (0)

Expected Results:
List of the background/theme like before

summary: KDE Settings panel online theme/splash screens api error


--1653915299.eF756A650.8184
Date: Mon, 30 May 2022 12:54:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200028

            Bug ID: 1200028
           Summary: tinyproxy: packaging issues reported by upstream maintainer
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

11:53 <sh4> <sh4> hi. i'm the maintainer of tinyproxy and took a look at
https://build.opensuse.org/package/show/openSUSE:Factory/tinyproxy . there's
quite a few things
            wrong there. for one, the url doesn't exist anymore, there's a
newer release, the patch changing maxclients to 20 is harmful (this counts
connections, not IPs),
            and none of the BuildRequires items are needed anymore.
11:53 <sh4> <sh4> also the CAP things mentioned in the systemd service look
like security issues, none of those should be required afaict
11:53 <sh4> <sh4> sbin is also wrong, since the service is typically run as
non-root


body:
--1653918334.2E6dA0Dd0.19660
Date: Mon, 30 May 2022 13:45:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200030

            Bug ID: 1200030
           Summary: slurmd can't load plugins
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: cgoll-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Sicne some time the slurm rpm packages does not work any more in openSUSE
tumbleweed. If a service should be started one gets following error:
```
slurmd: error: plugin_load_from_file:
dlopen(/usr/lib64/slurm/select_linear.so): /usr/lib64/slurm/select_linear.so:
undefined symbol: gres_ctld_job_build_details
slurmd: error: Couldn't load specified plugin name for select/linear: Dlopen of
plugin file failed
slurmd: fatal: Can't find plugin for select/linear
```
This is not related to slurm itself, as if the package is compiled on the
machine itself, everything works fine. (Used the *exact* same ./configure for
building includng $CFLAGS.)

This must have something to do with the symbol stripping in Tumblweed, the leap
packages work fine.

Any comments?

summary: slurmd can't load plugins


--1653999692.4dDd1.16276
Date: Tue, 31 May 2022 12:21:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200076

            Bug ID: 1200076
           Summary: [Leap 15.4] keepassxc crashes on auto-fill and crashes the whole X session
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: manfred.h-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I use keepassxc for all my passwords. Today I tried to login to OBS using my
stored credentials, but when I used the auto-fill function to fill in my
username and password, the program crashes immediately. Unfortunately this also
kills the whole X session.

Here are some details:

- keepassxc-2.7.1-bp154.3.3.1.x86_64
- keepassxc-lang-2.7.1-bp154.3.3.1.noarch
- patterns-xfce-xfce-20210209-lp154.1.2.x86_64

Not being able to login to any website using the password manager renders
openSUSE Leap 15.4 unusable for me, which is why I see this as critical!


body:
--1654021070.CAeA0.11214
Date: Tue, 31 May 2022 18:17:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200093

            Bug ID: 1200093
           Summary: Jack broken by latest glibc
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: kailed-at-kailed.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hello, jack is broken with the lastest glibc. Maybe other programs are affected
too:

https://sourceware.org/bugzilla/show_bug.cgi?id=29214

summary: Jack broken by latest glibc


--1654078450.7d0a70cD0.7533
Date: Wed, 1 Jun 2022 10:14:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200107

            Bug ID: 1200107
           Summary: suse-module-tools: false positives from driver-check.sh
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

> # cat driver-check-report.txt
> driver-check.sh 0.6 started at Wed, 01 Jun 2022 11:57:33 +0200
> ERROR: kernel-default-5.14.14-1.3 does not look like a SUSE kernel package (wrong %post script)
> ERROR: kernel-default-5.17.9-1.1 does not look like a SUSE kernel package (wrong %post script)
> ERROR: kernel-install-tools-0.3.0-1.2 does not look like a SUSE kernel package (no commit id)
> ERROR: kernel-install-tools-0.3.0-1.2 does not look like a SUSE kernel package (wrong %post script)

These are false positives.


--1654094631.10DCFe1.14497
Date: Wed, 1 Jun 2022 14:43:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200126

            Bug ID: 1200126
           Summary: VUL-0: CVE-2022-31015: python-waitress: uncaught Exception (due to a data race) leads to process termination
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/333262/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

rh#2092246

Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a
socket while the main thread is about to call select(). This will lead to the
main thread raising an exception that is not handled and then causing the
entire application to be killed.

This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI
thread to close the socket. Instead, that is always delegated to the main
thread. There is no work-around for this issue. However, users using waitress
behind a reverse proxy server are less likely to have issues if the reverse
proxy always reads the full response.

https://github.com/Pylons/waitress/pull/377
https://github.com/Pylons/waitress/issues/374
https://github.com/Pylons/waitress/security/advisories/GHSA-f5x9-8jwc-25rw
https://github.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2092246
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31015
https://github.com/Pylons/waitress/pull/377
https://github.com/Pylons/waitress/security/advisories/GHSA-f5x9-8jwc-25rw
https://github.com/Pylons/waitress/commit/4f6789b035610e0552738cdc4b35ca809a592d48
https://github.com/Pylons/waitress/issues/374
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31015


--1654137630.45eAC80.22237
Date: Thu, 2 Jun 2022 02:40:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200139

            Bug ID: 1200139
           Summary: Cannot run any Chromium-based browser with gtk4.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Usability
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mail@h-cheung.cf
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Chromium has gtk4 support, and can be enabled by --gtk-version=4. This is
needed for IME support on wayland. However, in openSUSE, it always uses gtk3.
It seems that the browser failed with gtk4 and then fallbacks to gtk3
automatically.


--1654181803.28Ca41.25720
Date: Thu, 2 Jun 2022 14:56:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200165

            Bug ID: 1200165
           Summary: AUDIT-0: gromox: review of package for rpmlint stoppers
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Please have a look at
https://build.opensuse.org/package/show/server:mail/gromox . I would like to
propose this package for inclusion into Tumbleweed, which incurs two rpmlint
notes that currently block it.

[  521s] gromox.x86_64: E: systemd-tmpfile-entry-unauthorized (Badness: 10)
/usr/lib/tmpfiles.d/tmpfiles-gromox.conf "d /var/tmp/gromox-fpm 0770 gromox
gromox 1d"
[  531s] -gromox.x86_64: E: pam-file-unauthorized (Badness: 10)
/usr/lib64/security/pam_gromox.so (file digest ..)


--1654601819.25a317.11389
Date: Tue, 7 Jun 2022 11:36:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200279

            Bug ID: 1200279
           Summary: VUL-0: CVE-2022-29718: caddy:  unauthenticated open redirect vulnerability
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/333631/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: alexandre.vicenzi-at-suse.com
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-29718

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote
unauthenticated attacker may exploit this vulnerability to redirect users to
arbitrary web URLs by tricking the victim users to click on crafted links.

Upstream fix:
https://github.com/caddyserver/caddy/commit/3fe2c73dd04f7769a9d9673236cb94b79ac45659

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29718
https://github.com/caddyserver/caddy/pull/4499


body:
--1654674088.dF4DAbe0.15120
Date: Wed, 8 Jun 2022 07:41:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200318

            Bug ID: 1200318
           Summary: deepin depends on dead kwayland-server
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: hillwoodroc-at-gmail.com
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

kwayland-server got merged into KWin and is thus no longer part of Plasma 5.25
and later, so it will be dropped from openSUSE:Factory. Currently deepin-kwin
still depends on it.

summary: deepin depends on dead kwayland-server


--1654697947.06bB1.27444
Date: Wed, 8 Jun 2022 14:19:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200342

            Bug ID: 1200342
           Summary: AUDIT-WHITELIST: wpa_supplicant: move dbus system.d file to /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: gmbr3-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
                CC: cfamullaconrad-at-suse.com
          Found By: ---
           Blocker: ---

Move /etc/dbus-1/system.d/wpa_supplicant.conf to
/usr/share/dbus-1/system.d/wpa_supplicant.conf

Devel prj: hardware
Maintainer: Clemens Famulla-Conrad <cfamullaconrad-at-suse.com>


--1654845688.DeEF53.2093
Date: Fri, 10 Jun 2022 07:21:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200403

            Bug ID: 1200403
           Summary: [Build 20220609] tracker search lists files multiple times
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2410056/modules/trac
                    ker_by_command/steps/9
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

# Test died: command 'tracker3 search newfile' timed out at
/usr/lib/os-autoinst/testapi.pm line 1039.

The command lists the search file multiple times, which results in this
specific test case in 'less' showing the output (and thus the command prompt
not being reached again). The issue is, though, that tracker reports the same
file multiple times.

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-desktopapps-other@64bit
fails in
[tracker_by_command](https://openqa.opensuse.org/tests/2410056/modules/tracker_by_command/steps/9)

## Test suite description
Maintainer: Yuan Ren (yuanren10). See
https://progress.opensuse.org/issues/23906

## Reproducible

Fails since (at least) Build
[20220609](https://openqa.opensuse.org/tests/2409000)

## Expected result

Last good: [20220608](https://openqa.opensuse.org/tests/2407326) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=64bit&test=desktopapps-other&version=Tumbleweed)


--1654871572.6d711.5073
Date: Fri, 10 Jun 2022 14:32:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200423

            Bug ID: 1200423
           Summary: VUL-0: chromium: multiple security issues fixed in 102.0.5005.115
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: carlos.lopez-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: Andreas.Stieger-at-gmx.de
          Found By: ---
           Blocker: ---

This update includes 7 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

[$10000][1326210] High CVE-2022-2007: Use after free in WebGPU. Reported by
David Manouchehri on 2022-05-17

[$TBD][1317673] High CVE-2022-2008: Out of bounds memory access in WebGL.
Reported by khangkito - Tran Van Khang (VinCSS) on 2022-04-19

[$NA][1325298] High CVE-2022-2010: Out of bounds read in compositing. Reported
by Mark Brand of Google Project Zero on 2022-05-13

[$TBD][1330379] High CVE-2022-2011: Use after free in ANGLE. Reported by
SeongHwan Park (SeHwa) on 2022-05-31

https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop.html


body:
--1654903654.fCE66c3F4.7047
Date: Fri, 10 Jun 2022 23:27:34 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200441

            Bug ID: 1200441
           Summary: go1.19 release tracking
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jkowalczyk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

go1.19 (expected August 2022) is a major release of Go.
Minor releases of go1.19.x will be provided through August 2023.
This issue tracks go1.19.x releases packaged and submitted initially
to openSUSE:Factory and can be referenced in submissions to
additional repositories.

Go Release Cycle
https://github.com/golang/go/wiki/Go-Release-Cycle

Go Release history
https://golang.org/doc/devel/release.html

summary: go1.19 release tracking


body:
--1655042168.ab1E0.7453
Date: Sun, 12 Jun 2022 13:56:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200456

            Bug ID: 1200456
           Summary: systemd-oomd is currently not built
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: postix-at-posteo.eu
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Curently `systemd-oomd` [1] is not built. It would be convenient if it were
included as an alternative to `earlyoom`.

[1] https://www.freedesktop.org/software/systemd/man/systemd-oomd.service.html

summary: systemd-oomd is currently not built


--1655105273.648DD0F0.22753
Date: Mon, 13 Jun 2022 07:27:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200468

            Bug ID: 1200468
           Summary: [Build 20220610] XFCE does not start up with libX11 1.8.1
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/2411380/modules/fini
                    sh_desktop/steps/5
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: gfx-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: gfx-bugs-at-suse.de
          Found By: openQA
           Blocker: Yes

## Observation

In Snapshot 0610, libX11 has been updated from 1.8 to 1.8.1.

The XFCE desktop failed reliably to start with this update.

For snapshot 0611, libX11 has been reverted to 1.8 (not a single other change
in the snapshot) - and xfce starts up again reliably.

(KDE, also running on X, did not suffer from this problem, which is why it was
not observed in stagings)

openQA test in scenario opensuse-Tumbleweed-Rescue-CD-x86_64-rescue@64bit fails
in
[finish_desktop](https://openqa.opensuse.org/tests/2411380/modules/finish_desktop/steps/5)

## Test suite description

## Reproducible

Fails since (at least) Build
[20220610](https://openqa.opensuse.org/tests/2411179)

## Expected result

Last good: [20220609](https://openqa.opensuse.org/tests/2409217) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=Rescue-CD&machine=64bit&test=rescue&version=Tumbleweed)


body:
--1655117518.c8b6A1611.10761
Date: Mon, 13 Jun 2022 10:51:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200483

            Bug ID: 1200483
           Summary: darktable broken by cmake regression
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-15-SP4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Packages
          Assignee: packagehub-bugs-at-suse.com
          Reporter: mrueckert-at-suse.com
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

Package needs to be rebuild with the following patch applied:

```
Index: darktable.spec
===================================================================
-

summary: darktable broken by cmake regression


--1655190458.2EA35.20771
Date: Tue, 14 Jun 2022 07:07:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200510

            Bug ID: 1200510
           Summary: VUL-0: CVE-2022-2061: chafa: heap-based buffer overflow in function lzw_decode in libnsgif/lzw.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/334364/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: mvetter-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-2061

Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to
1.12.0.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2061
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2061
https://github.com/hpjansson/chafa/commit/e6ce3746cdcf0836b9dae659a5aed15d73a080d8
https://huntr.dev/bounties/365ab61f-9a63-421c-97e6-21d4653021f0


--1655276336.5CeBCb1.11319
Date: Wed, 15 Jun 2022 06:58:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200548

            Bug ID: 1200548
           Summary: VUL-0: CVE-2022-29241: python-jupyter-server: potential access token leak
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/334578/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: code-at-bnavigator.de
          Reporter: carlos.lopez-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-29241

Jupyter Server provides the backend (i.e. the core services, APIs, and REST
endpoints) for Jupyter web applications like Jupyter Notebook. Prior to version
1.17.1, if notebook server is started with a value of `root_dir` that contains
the starting user's home directory, then the underlying REST API can be used to
leak the access token assigned at start time by guessing/brute forcing the PID
of the jupyter server. While this requires an authenticated user session, this
URL can be used from a cross-site scripting payload or from a hooked or
otherwise compromised browser to leak this access token to a malicious third
party. This token can be used along with the REST API to interact with Jupyter
services/notebooks such as modifying or overwriting critical files, such as
.bashrc or .ssh/authorized_keys, allowing a malicious user to read potentially
sensitive data and possibly gain control of the impacted system. This issue is
patched in version 1.17.1.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-29241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29241
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-q874-g24w-4q9g


--1655319584.6CeA0.22665
Date: Wed, 15 Jun 2022 18:59:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200579

            Bug ID: 1200579
           Summary: After upgrading Raspberry Pi4B from 15.3 to 15.4 Grub.cfg has 15.3 not 15.4 on menus
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: aarch64
                OS: openSUSE Leap 15.4
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: llrainey15-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I did 3 raspberry pi4b from 15.3 to 15.4.
Everything boots normally but the grub menu shows 15.3 not 15.4.

This did not happen on the X86-64 upgrades.


--1655373869.382C10.10339
Date: Thu, 16 Jun 2022 10:04:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200603

            Bug ID: 1200603
           Summary: python-paramiko: SSHException: Invalid key with ed25519 key
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jbaier-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Following trace suggests, that the current version of python-paramiko in Leap
15.4 (i.e. python-paramiko 2.4.2-150100.6.12.1) is suffering from a known bug
https://github.com/paramiko/paramiko/issues/1306

File "/usr/lib/python3.6/site-packages/paramiko/client.py", line 749, in _auth
raise saved_exception
File "/usr/lib/python3.6/site-packages/paramiko/client.py", line 720, in _auth
filename, pkey_class, passphrase
File "/usr/lib/python3.6/site-packages/paramiko/client.py", line 571, in
_key_from_filepath
key = klass.from_private_key_file(key_path, password)
File "/usr/lib/python3.6/site-packages/paramiko/pkey.py", line 217, in
from_private_key_file
key = cls(filename=filename, password=password)
File "/usr/lib/python3.6/site-packages/paramiko/ed25519key.py", line 81, in
__init__
signing_key = self._parse_signing_key_data(data, password)
File "/usr/lib/python3.6/site-packages/paramiko/ed25519key.py", line 156, in
_parse_signing_key_data
message = Message(unpad(private_data))
File "/usr/lib/python3.6/site-packages/paramiko/ed25519key.py", line 41, in
unpad
raise SSHException("Invalid key")
paramiko.ssh_exception.SSHException: Invalid key

According to changelog, the solution would be to upgrade to version at least
2.5.1 (we currently have 2.11 in TW). As an alternative, the fix
(https://patch-diff.githubusercontent.com/raw/ploxiln/paramiko-ng/pull/5.patch)
seems to be also back-ported into 2.4 branch as version 2.4.3.


--1655386705.af7c4B0D0.22034
Date: Thu, 16 Jun 2022 13:38:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200614

            Bug ID: 1200614
           Summary: difficult to detect that python3-gobject-Gdk is missing
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ossman-at-cendio.se
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This is an issue that mostly affects third party or user installed programs,
but would still be nice to get fixed.

A Python GTK program generally does:

> import gi
> gi.require_version('Gtk', '3.0')
> from gi.repository import Gtk

Error management should be around gi.require_version() to handle if GTK is
missing.

On all other distributions this works, but not on SUSE. The reason being that
some critical components have been packaged in python3-gobject-Gdk. This causes
the above code to succeed. But things will crash on random places later,
whenever the code hits something that is missing.

This is similar to bug 1179584, but doesn't have a similar obvious fix.

Ideally, GTK's typelib should have a requirement on python3-gobject-Gdk if
python3-gobject is installed. I think this is possible on newer RPM, but I
don't know if openSUSE LEAP 15 has a sufficiently new RPM.

Packages designed specifically for SUSE can solve this by explicitly depending
on python3-gobject-Gdk. But things installed in other ways can't rely on that.


--1655392742.008bD0.5207
Date: Thu, 16 Jun 2022 15:19:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200620

            Bug ID: 1200620
           Summary: dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath /usr/bin/dpdk_example_bond /usr/drivers
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Note R{,UN}PATH can only point to a system library folder, or to /usr/lib{,64}.

The package fails with:

[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_bond /usr/drivers
[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_ethtool /usr/drivers
[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_ip_pipeline /usr/drivers
[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_kni /usr/drivers
[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_l2fwd-crypto /usr/drivers
[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_ntb /usr/drivers
[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_pipeline /usr/drivers
[  148s] dpdk-examples.x86_64: E: binary-or-shlib-defines-rpath
/usr/bin/dpdk_example_vm_power_manager /usr/drivers
[  148s] The binary or shared library defines `RPATH' (or `RUNPATH').


--1655559520.EB1d0Ab0.21369
Date: Sat, 18 Jun 2022 13:38:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200676

            Bug ID: 1200676
           Summary: installing emacs creates a file named 0 in /
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mikko77792-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Other
           Blocker: ---

similar issue to https://bugzilla.opensuse.org/show_bug.cgi?id=1197317
but this time in mailutils (which emacs depends on)

The offender is line 407 here:
https://build.opensuse.org/package/view_file/openSUSE:Factory/mailutils/mailutils.spec?expand=1


body:
--1655623994.4FC8FFc0.25646
Date: Sun, 19 Jun 2022 07:33:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200682

            Bug ID: 1200682
           Summary: rsyslog hangs during shutdown
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: oliver-at-schwabedissen.name
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Since one of the last snapshots my system takes very log to shutdown. I found
that there is a 90 second timeout when trying to stop system logging services.

The message I see is

"A stop job is running for system logging service (1 min 30 sec)"

After 90 seconds rsyslog is killed and shutdown continues.

I also see this when trying to stop rsyslog on a running system (systemctl stop
rsyslog.service):

Jun 19 09:03:14 frodo systemd[1]: Stopping System Logging Service...
Jun 19 09:04:44 frodo systemd[1]: rsyslog.service: State 'stop-sigterm' timed
out. Killing.
Jun 19 09:04:44 frodo systemd[1]: rsyslog.service: Killing process 1783
(rsyslogd) with signal SIGKILL.
Jun 19 09:04:44 frodo systemd[1]: rsyslog.service: Killing process 1787
(in:imklog) with signal SIGKILL.
Jun 19 09:04:44 frodo systemd[1]: rsyslog.service: Killing process 1788
(rs:main Q:Reg) with signal SIGKILL.
Jun 19 09:04:44 frodo systemd[1]: rsyslog.service: Main process exited,
code=killed, status=9/KILL
Jun 19 09:04:44 frodo systemd[1]: rsyslog.service: Failed with result
'timeout'.
Jun 19 09:04:44 frodo systemd[1]: Stopped System Logging Service.

I found a thread about this in the openSUSE forums:
https://forums.opensuse.org/showthread.php/571409-Ninety-second-shutdown-delay-quot-A-stop-job-is-running-for-system-logging-service-quot?p=3135179

Some tried to replace rsyslog with syslog-ng which solved the problem. But this
is a workaround and I think a fix should be found.

summary: rsyslog hangs during shutdown


body:
--1655672367.a4BfEE0.26117
Date: Sun, 19 Jun 2022 20:59:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200688

            Bug ID: 1200688
           Summary: kdenlive crashes when loading clip
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: freek-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After upgrading Tumbleweed lately, kdenlive crashes when loading the first
clip.
DRKonqi does not produce crashinformation.
I started kdenlive with gdb and got the following:
/////////// found list
(QUrl("file:///home/xxxxx/Videos/2012Suriname/20120719-083840.mp4"))
/////////// creatclipsfromlist
(QUrl("file:///home/xxxxx/Videos/2012Suriname/20120719-083840.mp4")) true "-1"
/////////// createClipFromFile
"/home/xxxxx/Videos/2012Suriname/20120719-083840.mp4" "-1"
=== GOT DROPPED MIME:  "video/mp4"
/////////// final xml "<producer>\n <property
name=\"resource\">/home/xxxxx/Videos/2012Suriname/20120719-083840.mp4</property>\n</producer>\n"
[New Thread 0x7fff59a2b640 (LWP 25561)]
============STARTING LOAD TASK FOR:
"/home/xxxxx/Videos/2012Suriname/20120719-083840.mp4"

:::::::::::::::::::
/////////// creatclipsfromlist return false
*** buffer overflow detected ***: terminated

Thread 31 "Thread (pooled)" received signal SIGABRT, Aborted.

summary: kdenlive crashes when loading clip


--1655720383.AEF1Ff380.17644
Date: Mon, 20 Jun 2022 10:19:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200710

            Bug ID: 1200710
           Summary: dracut-initqueue[581]: mount.nfs: No such device
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: dracut-maintainers-at-suse.de
          Reporter: schwab-at-suse.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This appears to be a missing synchronisation with NFS root:

[   10.481118][  T371] mmc_spi spi1.0: SD/MMC host mmc0, no DMA, no WP, no
poweroff
[   10.518721][   T17] mmc0: host does not support reading read-only switch,
assuming write-enable
[   10.526746][   T17] mmc0: new SDHC card on SPI
[   10.528219][  T368] macb 10090000.ethernet: Registered clk switch
'sifive-gemgxl-mgmt'
[   10.539131][  T368] macb 10090000.ethernet: GEM doesn't support hardware
ptp.
[   10.608768][  T373] mmcblk0: mmc0:0000 SD32G 29.9 GiB
[   10.643933][  T373]  mmcblk0: p1 p2 p3 p4 p5
[   10.659954][  T399] MACsec IEEE 802.1AE
[   10.751273][  T368] macb 10090000.ethernet eth0: Cadence GEM rev 0x10070109
at 0x10090000 irq 16 (70:b3:d5:92:f1:07)
[   12.570426][  T441] macb 10090000.ethernet eth0: PHY
[10090000.ethernet-ffffffff:00] driver [Microsemi VSC8541 SyncE] (irq=POLL)
[   12.581251][  T441] macb 10090000.ethernet eth0: configuring for phy/gmii
link mode
[   16.151411][   T17] macb 10090000.ethernet eth0: Link is Up - 1Gbps/Full -
flow control tx
[   16.158934][   T17] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   16.196121] dracut-initqueue[548]: wicked: eth0: Request to acquire DHCPv4
lease with UUID 8a5a9562-2808-0600-2402-000001000000
[   16.413613][  T549] NET: Registered PF_PACKET protocol family
[   17.110211] dracut-initqueue[548]: wicked: eth0: Committed DHCPv4 lease with
address 10.168.4.88 (lease time 1296000 sec, renew in 648000 sec, rebind in
1134000 sec)
[   17.747339][  T582] FS-Cache: Loaded
[   17.939969] dracut-initqueue[581]: mount.nfs: No such device
[   18.855132] dracut-initqueue[602]: mount.nfs: No such device
[  179.792006] dracut-initqueue[384]: Warning: dracut-initqueue: timeout, still
waiting for following initqueue hooks:
[  179.797072] dracut-initqueue[384]: Warning:
/lib/dracut/hooks/initqueue/finished/nfsroot.sh: "[ -e $NEWROOT/proc ]"
[  179.804241] dracut-initqueue[384]: Warning: dracut-initqueue: starting
timeout scripts

The only dracut related updates were dracut-kiwi-lib and
dracut-kiwi-oem-repart.


--1655829230.3b621e0.20596
Date: Tue, 21 Jun 2022 16:33:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200767

            Bug ID: 1200767
           Summary: Amarok doesn't start due to missing dbus service file
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: All
                OS: openSUSE Leap 15.3
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: mpost-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Running a Gnome desktop, if I navigate to the Amarok application and click on
the icon, it fails to start. Entering "amarok" from a shell works as expected.
A significant amount of debugging led to the conclusion that
/usr/share/dbus-1/services/org.kde.amarok.service was no longer part of the
rpm. Copying from an older backup allows Amarok to be started through the
menus.

I had noticed previously that this file was no longer included with Amarok, but
didn't think much about it, until I started trying to figure this out. Was this
file dropped intentionally? If so, is there something else I need to do as a
user to be able to start Amarok from the menu?


--1655834538.6Dc7bA00.22127
Date: Tue, 21 Jun 2022 18:02:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200769

            Bug ID: 1200769
           Summary: VirtualBox utility vboximage-mount is missing
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: x86-64
                OS: openSUSE Leap 15.4
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: llrainey15-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The utility described in manual on 5.11 is not present and cannot be found.


body:
--1655839911.4eCa51360.27628
Date: Tue, 21 Jun 2022 19:31:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200772

            Bug ID: 1200772
           Summary: php8-devel lacks requires
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: lars.vogdt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

As discussed in https://build.opensuse.org/project/show/server:php:extensions :

In Leap 15.4 somehow php8-devel lacks the following lines:

Requires:       %{php_name}-pear
Requires:       %{php_name}-pecl

This means that required packages to build the PECL extensions are not
available for build. As result, a lot of extensions (16 in total, if I counted
correctly) are failing to build.

Here is a list:
php-APCu
php-gmagick
php-gnupg
php-ice
php-imagick
php-lzf
php-maxminddb
php-memcache
php-memcached
php-psr
php-redis
php-smbclient
php-ssh2
php-uploadprogress
php-uuid
php-xdebug

As you might notice, some of them (like redis, memcached, imagick, APCu) are
used very often in the wild world. Having them not available for 15.4 blocks
now - for example - the migration of openSUSE infrastructure machines.

summary: php8-devel lacks requires


--1655842020.5c86CA0.3994
Date: Tue, 21 Jun 2022 20:07:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200774

            Bug ID: 1200774
           Summary: network:telephony/libsrtp2: Version in 15.4 outdated
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: nix-at-opensuse.org
          Reporter: reichwald@b1-systems.de
        QA Contact: screening-team-bugs-at-suse.de
                CC: jengelh-at-inai.de
          Found By: ---
           Blocker: ---

Moin,

I was trying to build dino against 15.4 and found that libsrtp2 is not recent
enough.
I built it against the newer libsrtp2 in my home:
home:reichwald:testing/dino and succeeded with libsrtp2 v2.4.2

Can you please consider updating libsrtp2 in 15.4?

Thanks!
Fritz


--1655878717.0b5AAB1.4931
Date: Wed, 22 Jun 2022 06:18:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200783

            Bug ID: 1200783
           Summary: VUL-0: chromium: multiple security issues fixed in 103.0.5060.53
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: carlos.lopez-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: gmbr3-at-opensuse.org
          Found By: ---
           Blocker: ---

This update includes 14 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

[$NA][1335458] Critical CVE-2022-2156: Use after free in Base. Reported by Mark
Brand of Google Project Zero on 2022-06-11

[$20000][1327312] High CVE-2022-2157: Use after free in Interest groups.
Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab  on
2022-05-19

[$7500][1321078] High CVE-2022-2158: Type Confusion in V8. Reported by Bohan
Liu (@P4nda20371774) of Tencent Security Xuanwu Lab on 2022-04-29

[$3000][1116450] Medium CVE-2022-2160: Insufficient policy enforcement in
DevTools. Reported by David Erceg on 2020-08-14

[$3000][1330289] Medium CVE-2022-2161: Use after free in WebApp Provider.
Reported by Zhihua Yao of KunLun Lab on 2022-05-30

[$2000][1307930] Medium CVE-2022-2162: Insufficient policy enforcement in File
System API. Reported by Abdelhamid Naceri (halov) on 2022-03-19

[$7000][1308341] Low CVE-2022-2163: Use after free in Cast UI and Toolbar.
Reported by Chaoyuan Peng (@ret2happy) on 2022-03-21

[$1000][1268445] Low CVE-2022-2164: Inappropriate implementation in Extensions
API. Reported by Jos? Miguel Moreno Computer Security Lab (COSEC) at UC3M on
2021-11-10

[$500][1250993] Low CVE-2022-2165: Insufficient data validation in URL
formatting. Reported by Rayyan Bijoora on 2021-09-19

https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html


--1655888052.245820.22349
Date: Wed, 22 Jun 2022 08:54:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1200796

            Bug ID: 1200796
           Summary: [JeOS] No jeos-firstboot-rpiwifi installed by default
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dheidler-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: guillaume.gardet-at-opensuse.org
          Found By: ---
           Blocker: ---

On the default opensuse jeos images there is no jeos-firstboot-rpiwifi
installed by default (on the sle images it is).

This means that a user without LAN access wouldn't be able to install that
package to configure wifi.


--1655990913.34b54.30318
Date: Thu, 23 Jun 2022 13:28:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200880

            Bug ID: 1200880
           Summary: claws-mail's /etc/skel/.claws-mail/clawsrc contains [Plugins_GTK2] but the program uses GTK3
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: x86-64
                OS: openSUSE Leap 15.4
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: d_werner-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Info from the claws-mail homepage:
https://www.claws-mail.org/releases.php
"The 4.x.x releases are built with GTK+ 3, the 3.x.x releases are built with
GTK+ 2."

The version in openSUSE Leap 15.4 is therefore with GTK+ 3.

rpm -qf /etc/skel/.claws-mail/clawsrc
claws-mail-4.0.0-bp154.2.126.x86_64

cat  /etc/skel/.claws-mail/clawsrc
[Plugins_GTK2]
/usr/lib64/claws-mail/plugins/pgpcore.so
/usr/lib64/claws-mail/plugins/pgpinline.so
/usr/lib64/claws-mail/plugins/pgpmime.so
/usr/lib64/claws-mail/plugins/smime.so

opening claws-mail in Leap 15.4: no plugins are preselected (like they were in
Leap 15.3 and before).
After adding them manually they appear in the user's local
~/.claws-mail/clawsrc as:

[Plugins_GTK3]
/usr/lib64/claws-mail/plugins/pgpcore.so
/usr/lib64/claws-mail/plugins/pgpinline.so
/usr/lib64/claws-mail/plugins/pgpmime.so
/usr/lib64/claws-mail/plugins/smime.so

That means the file /etc/skel/.claws-mail/clawsrc should be updated to:

[Plugins_GTK3]
/usr/lib64/claws-mail/plugins/pgpcore.so
/usr/lib64/claws-mail/plugins/pgpinline.so
/usr/lib64/claws-mail/plugins/pgpmime.so
/usr/lib64/claws-mail/plugins/smime.so

to make the program actually load the plugins.

BTW: claws-mail 4.1.0 is out containing some bug fixes, among them "resource
leaks; memory corruption" and I have the impression that
claws-mail-4.0.0-bp154.2.126.x86_64 suffers from a memory leak.


--1656055187.357aCFc1.23100
Date: Fri, 24 Jun 2022 07:19:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1200898

            Bug ID: 1200898
           Summary: VUL-0: CVE-2022-33025: libredwg: Multiple issues were discovered in LibreDWG v0.12.4.4608
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/335427/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

SUSE:Factory:Head/libredwg

Multiple issues were discovered in LibreDWG v0.12.4.4608

CVE-2022-33025 - heap-use-after-free via the function decode_preR13_section at
decode_r11.c
CVE-2022-33026 - heap buffer overflow via the function bit_calc_CRC at bits.c
CVE-2022-33027 - heap-use-after-free via the function dwg_add_handleref at
dwg.c
CVE-2022-33028 - heap buffer overflow via the function dwg_add_object at
decode.c
CVE-2022-33032 - heap-buffer-overflow via the function
decode_preR13_section_hdr at decode_r11.c
CVE-2022-33033 - double-free via the function dwg_read_file at dwg.c
CVE-2022-33034 - stack overflow via the function copy_bytes at decode_r2007.c

References:
https://nvd.nist.gov/vuln/detail/CVE-2022-33025
https://nvd.nist.gov/vuln/detail/CVE-2022-33026
https://nvd.nist.gov/vuln/detail/CVE-2022-33027
https://nvd.nist.gov/vuln/detail/CVE-2022-33028
https://nvd.nist.gov/vuln/detail/CVE-2022-33032
https://nvd.nist.gov/vuln/detail/CVE-2022-33033
https://nvd.nist.gov/vuln/detail/CVE-2022-33034