--1563280082.20eb071F0.13009
Date: Tue, 16 Jul 2019 12:28:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141649

            Bug ID: 1141649
           Summary: VUL-0: CVE-2019-5847,CVE-2019-5848: chromium: two security issues fixed in 75.0.3770.142
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop.html

Fixed in 75.0.3770.142:

* CVE-2019-5847: V8 sealed/frozen elements cause crash
* CVE-2019-5848: Font sizes may expose sensitive information


body:
--1563295908.858E35.15470
Date: Tue, 16 Jul 2019 16:51:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141688

            Bug ID: 1141688
           Summary: go1.11 release tracking
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: jkowalczyk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

go1.11 (released 2018/08/24) is a major release of Go.
Minor releases of go1.11.x will be provided through August 2019.
This issue tracks go1.11.x releases packaged and submitted initially
to OpenSUSE:Factory and can be referenced in submissions to
additional repositories.

Go Release Cycle
https://github.com/golang/go/wiki/Go-Release-Cycle

Go Release history
https://golang.org/doc/devel/release.html

summary: go1.11 release tracking


body:
--1563296365.70b5C35.15900
Date: Tue, 16 Jul 2019 16:59:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141689

            Bug ID: 1141689
           Summary: go1.12 release tracking
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: jkowalczyk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

go1.12 (released 2019/02/25) is a major release of Go.
Minor releases of go1.12.x will be provided through February 2020.
This issue tracks go1.12.x releases packaged and submitted initially
to OpenSUSE:Factory and can be referenced in submissions to
additional repositories.

Go Release Cycle
https://github.com/golang/go/wiki/Go-Release-Cycle

Go Release history
https://golang.org/doc/devel/release.html

summary: go1.12 release tracking


body:
--1563345033.D6B7EfD0.24628
Date: Wed, 17 Jul 2019 06:30:33 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141762

            Bug ID: 1141762
           Summary: qjackctl segfaults
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: kill_it-at-mail.ru
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

since 20190913 qjackctl crashes with next output:

Thread 1 "qjackctl" received signal SIGSEGV, Segmentation fault.
0x00007ffff7d94b57 in ?? () from /usr/lib64/libjack.so.0
(gdb) bt
#0  0x00007ffff7d94b57 in ?? () from /usr/lib64/libjack.so.0
#1  0x00007ffff7d95475 in ?? () from /usr/lib64/libjack.so.0
#2  0x00007ffff7d9c617 in ?? () from /usr/lib64/libjack.so.0
#3  0x00007ffff7d9e5b5 in jack_client_open () from /usr/lib64/libjack.so.0
#4  0x00005555555cc658 in qjackctlMainForm::startJackClient(bool) ()
#5  0x00005555555a6193 in qjackctlMainForm::qt_static_metacall(QObject*,
QMetaObject::Call, int, void**) [clone .part.0] ()
#6  0x00007ffff6aba8a8 in QMetaObject::activate(QObject*, int, int, void**) ()
from /usr/lib64/libQt5Core.so.5
#7  0x00007ffff6ac76eb in ?? () from /usr/lib64/libQt5Core.so.5
#8  0x00007ffff6abb255 in QObject::event(QEvent*) () from
/usr/lib64/libQt5Core.so.5
#9  0x00007ffff7764c42 in QApplicationPrivate::notify_helper(QObject*, QEvent*)
() from /usr/lib64/libQt5Widgets.so.5
#10 0x00007ffff776dec0 in QApplication::notify(QObject*, QEvent*) () from
/usr/lib64/libQt5Widgets.so.5
#11 0x00007ffff6a8f692 in QCoreApplication::notifyInternal2(QObject*, QEvent*)
() from /usr/lib64/libQt5Core.so.5
#12 0x00007ffff6ae50ab in QTimerInfoList::activateTimers() () from
/usr/lib64/libQt5Core.so.5
#13 0x00007ffff6ae5924 in ?? () from /usr/lib64/libQt5Core.so.5
#14 0x00007ffff57f9683 in g_main_context_dispatch () from
/usr/lib64/libglib-2.0.so.0
#15 0x00007ffff57fb430 in ?? () from /usr/lib64/libglib-2.0.so.0
#16 0x00007ffff57fb46f in g_main_context_iteration () from
/usr/lib64/libglib-2.0.so.0
#17 0x00007ffff6ae5cd1 in
QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
from /usr/lib64/libQt5Core.so.5
#18 0x00007ffff6a8e2eb in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from
/usr/lib64/libQt5Core.so.5
#19 0x00007ffff6a95e62 in QCoreApplication::exec() () from
/usr/lib64/libQt5Core.so.5
#20 0x0000555555594002 in main ()

temporary switched jack and jacklib0 to 1.9.12~git20190619T124043-159 from
home:X0F

summary: qjackctl segfaults


--1563347856.85b6Aade0.18257
Date: Wed, 17 Jul 2019 07:17:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141777

            Bug ID: 1141777
           Summary: VUL-1: CVE-2019-1010048: upx: 3.95 is affected by: Integer Overflow. The impact is: attacker can cause a denial of service. The component is: src/p_lx_elf.cpp PackLinuxElf32:PackLinuxElf32help1() Line 262.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/237313/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dleuenberger-at-suse.com
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-1010048

UPX 3.95 is affected by: Integer Overflow. The impact is: attacker can cause a
denial of service. The component is: src/p_lx_elf.cpp
PackLinuxElf32::PackLinuxElf32help1() Line 262. The attack vector is: the
victim
must open a specially crafted ELF file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010048
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010048
https://github.com/upx/upx/pull/190


--1563355732.8C81d00.26080
Date: Wed, 17 Jul 2019 09:28:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141801

            Bug ID: 1141801
           Summary: - VUL-0: virtualbox: Oracle 2019 July CPU
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: Larry.Finger-at-gmail.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

Oracle Virtualization Risk Matrix

All issues are affecting virtualbox prior to 5.2.32 and prior to 6.0.10.

CVE-2019-2859
CVE-2019-2867
CVE-2019-2866
CVE-2019-2864
CVE-2019-2865
CVE-2019-1543
CVE-2019-2863
CVE-2019-2848
CVE-2019-2877
CVE-2019-2873
CVE-2019-2874
CVE-2019-2875
CVE-2019-2876
CVE-2019-2850

References:
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html#AppendixOVIR


body:
--1563399245.A35C02aC0.25623
Date: Wed, 17 Jul 2019 21:34:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141913

            Bug ID: 1141913
           Summary: libbfd link problem
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: marcelo.jimenez-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Consider the following program:

#include <bfd.h>

int main(void)
{
    bfd_close(0);

    return 0;
}

Compilation results:
$ gcc -Wall -lbfd bfdtest.c
/usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld:
/tmp/ccN0TVRu.o: in function `main':
bfdtest.c:(.text+0xa): undefined reference to `bfd_close'
collect2: error: ld returned 1 exit status
$
$ gcc -Wall -lbfd-2.32 bfdtest.c
$

Is there a missing link in the latest RPM package? I can no longer find
libbfd.so in my system.

summary: libbfd link problem


body:
--1563411685.6bA8fADD0.797
Date: Thu, 18 Jul 2019 01:01:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141928

            Bug ID: 1141928
           Summary: python-acme will break on November 1st
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: bmw-at-eff.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This bug affects the python*-acme packages in Leap 15.0 and 15.1. If there is
already a version of python*-acme frozen in Leap 15.2, it is affected if it is
not version 0.34.0 or greater.

The python*-acme packages will no longer work with Let’s Encrypt’s “ACMEv2”
endpoint which is their RFC 8555 compliant endpoint starting November 1st. See
https://community.letsencrypt.org/t/acme-v2-scheduled-deprecation-of-unauthenticated-resource-gets/74380
for more details about this change.

As one of the upstream maintainers of this library, I would recommend
backporting python-acme 0.34.0 or greater to all supported versions of
openSUSE. There are no breaking changes to the Python API and no dependencies
should have to be updated.

If you do this, to flag a couple changes for you that you may want to know
about:

* Some of the code in the library has been deprecated in recent versions and
while it still works just fine it is causing Python DeprecationWarnings. See
https://docs.python.org/3/library/warnings.html if you're not familiar with
this.
* There is an extremely minor change in the requests sent by the library. The
previous versions were not RFC 8555 compliant and there are no known ACME CAs
that rely on this non-standard behavior, but it's something you may want to
know about. More details about this change are at
https://github.com/certbot/certbot/pull/6975.

If either of these changes are especially worrisome to you, I could tell you
the changes that need to be backported to an earlier version of python-acme,
however, I do not recommend this as it will result packages that have been less
thoroughly tested.

pkgs: python-acme python-certbot python-certbot-apache python-certbot-dns-google python-certbot-dns-luadns python-certbot-dns-nsone python-certbot-nginx python-dns-lexicon

summary: python-acme will break on November 1st


body:
Build Identifier:

32 bit iconv doesn't process CP1251 encoding

Reproducible: Always

Steps to Reproduce:
small example:
#include <iconv.h>
#include <stdio.h>

int main()
{
    iconv_t cvt = iconv_open("UTF-8", "CP1251");
    if (cvt == (iconv_t)(-1))
    {
        printf("iconv_open (CP1251 -> UTF-8): failed\n");
        return 1;
    }

    printf("iconv_open (CP1251 -> UTF-8): ok\n");
    return 0;
}

g++ iconv_test.cpp -o iconv_test
./iconv_test output: "iconv_open (CP1251 -> UTF-8): ok\n"

g++ -m32 iconv_test.cpp -o iconv_test
./iconv_test output: "iconv_open (CP1251 -> UTF-8): failed\n"
Actual Results:
as I described with '-m32' conversion init failed

Expected Results:
on Debian, CentOS, Gentoo all ok

CP1251 <-> UTF8 conversion is highly important to our current products.

summary: iconv doesn't work correctly for i686 target


--1563525709.DeDaf1.27016
Date: Fri, 19 Jul 2019 08:41:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142161

            Bug ID: 1142161
           Summary: VUL-1: CVE-2019-13962: vlc: lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/237689/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: dimstar-at-opensuse.org
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-13962

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player
through 3.0.7 has a heap-based buffer over-read because it does not properly
validate the width and height.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13962
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13962
http://www.cvedetails.com/cve/CVE-2019-13962/
https://trac.videolan.org/vlc/ticket/22240
http://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509


--1563671252.4eaEEcAD0.29743
Date: Sun, 21 Jul 2019 01:07:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142267

            Bug ID: 1142267
           Summary: gzdoom-4.1.3-22.5.x86_64 fails with a segmentation fault
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martinjungblut-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 811094
  --> http://bugzilla.opensuse.org/attachment.cgi?id=811094&action=edit
stdout

When trying to run gzdoom from the 'games' repository, I get a segmentation
fault. Using the Freedom 1 WAD, running on the latest Tumbleweed
snapshot(2019-07-18), all updates applied.

If I rebuild gzdoom using the source rpm, it works normally.

stdout is attached.


--1563708786.BBAB641.16760
Date: Sun, 21 Jul 2019 11:33:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142270

            Bug ID: 1142270
           Summary: dri config fix for gsteamer apps required
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: ensonic-at-sonicpulse.de
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

See #1113211 for context. Totem suffers the same. I added a
/usr/share/drirc.d/10-mesa-defaults-user.conf
containing
<driconf>
    <!


--1563772944.Bf5dE0.24099
Date: Mon, 22 Jul 2019 05:22:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142281

            Bug ID: 1142281
           Summary: VUL-1: CVE-2019-12815: proftpd: arbitrary file copy in mod_copy allows for remote code execution and information disclosure without authentication
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/237778/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: chris-at-computersalat.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-12815

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows
for remote code execution and information disclosure without authentication, a
related issue to CVE-2015-3306.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12815
http://www.cvedetails.com/cve/CVE-2019-12815/
http://bugs.proftpd.org/show_bug.cgi?id=4372
https://github.com/proftpd/proftpd/pull/816
https://tbspace.de/cve201912815proftpd.html


--1563782817.cFeFbf1.4317
Date: Mon, 22 Jul 2019 08:06:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142306

            Bug ID: 1142306
           Summary: saphanabootstrap-formula and haboostrapformula installs the files with the wrong persmissions
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-15-SP1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Packages
          Assignee: packagehub-bugs-at-suse.com
          Reporter: dakechi-at-suse.com
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

The two mentioned formulas install the files with 0750 permissions, while SUSE
Manager needs the files with 0755. This causes an error on the entire UI and
makes SUMA not render the UI.

As a workaroung changing the permissions on the /usr/share/salt-formulas files
to 0755 solves the problem.


--1563862875.cdd1eF880.17283
Date: Tue, 23 Jul 2019 06:21:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142433

            Bug ID: 1142433
           Summary: VUL-1: CVE-2019-1010222: aubio: null pointer in filterbank by passing invalid arguments to new_aubio_filterbank
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/237819/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: tiwai-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-1010222

aubio 0.4.8 and earlier is affected by: null pointer. The impact is: crash. The
component is: filterbank. The attack vector is: pass invalid arguments to
new_aubio_filterbank. The fixed version is: after commit
eda95c9c22b4f0b466ae94c4708765eaae6e709e.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010222
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010222
https://github.com/aubio/aubio/commit/eda95c9c22b4f0b466ae94c4708765eaae6e709e
https://github.com/aubio/aubio/blob/0.4.8/src/spectral/mfcc.c#L79


--1563863248.4F3A00.22715
Date: Tue, 23 Jul 2019 06:27:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142435

            Bug ID: 1142435
           Summary: VUL-1: CVE-2019-1010224: aubio:  null pointer in onset leading to DOS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/237821/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tiwai-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-1010224

aubio 0.4.8 and earlier is affected by: null pointer. The impact is: crash
(DoS). The component is: onset. The fixed version is: after commit
e4e0861cffbc8d3a53dcd18f9ae85797690d67c7.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010224
https://github.com/aubio/aubio/commit/e4e0861cffbc8d3a53dcd18f9ae85797690d67c7
https://github.com/aubio/aubio/blob/0.4.8/src/onset/onset.c#L59


--1563863418.e7FD010.23499
Date: Tue, 23 Jul 2019 06:30:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142436

            Bug ID: 1142436
           Summary: VUL-0: CVE-2019-1010223: aubio buffer overflow in tempo
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/237820/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: tiwai-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-1010223

aubio 0.4.8 and earlier is affected by: Buffer Overflow. The impact is: buffer
overflow in strcpy. The component is: tempo. The fixed version is: after commit
b1559f4c9ce2b304d8d27ffdc7128b6795ca82e5.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010223
https://github.com/aubio/aubio/blob/0.4.8/src/tempo/tempo.c#L208
https://github.com/aubio/aubio/commit/b1559f4c9ce2b304d8d27ffdc7128b6795ca82e5


--1563881084.db3ED3.385
Date: Tue, 23 Jul 2019 11:24:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1142496

            Bug ID: 1142496
           Summary: sky2 ethernet card does not work after resume from sleep
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: m.seyfarth-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I encounter the same symptoms as reported over in the following Ubuntu
Bugtracker entry, my sky2 ethernet card does not work after resuming from sleep
(S3). I use a custom compiled Kernel (tested with 5.2.2 and 5.3-RC1) from the
Suse Github sources:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1798921

By the way, in my custom config I didn't use the module version but compiled in
the sky2 driver. Hence a "modprobe -r sky2; modprobe -i sky2" (which was
mentioned as a workaround) results in a "modprobe: FATAL: Module sky2 is
builtin."

It was reported that adding "pci=nomsi,noaer" as Kernel parameters could
workaround the issue, but I haven't tested it yet myself. This could have
negative performance implications though and hope this can be fixed finally
upstream in a less invasive way.


--1563907868.1eE0f05C0.21823
Date: Tue, 23 Jul 2019 18:51:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142542

            Bug ID: 1142542
           Summary: ansible-playbook on localhost: python3-xml missing
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: thalunil-at-kallisti.at
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Example Task:
- package: name='python3-xml'

Does not work on localhost, installed with "zypper install ansible".

Error:
TASK [pkg_install : package]
*****************************************************************************************************
An exception occurred during task execution. To see the full traceback, use
-vvv. The error was: ImportError: No module named xml
fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback
(most recent call last):\n  File
\"/root/.ansible/tmp/ansible-tmp-1563905149.0829937-112643037486051/AnsiballZ_zypper.py\",
line 114, in <module>\n    _ansiballz_main()\n  File
\"/root/.ansible/tmp/ansible-tmp-1563905149.0829937-112643037486051/AnsiballZ_zypper.py\",
line 106, in _ansiballz_main\n    invoke_module(zipped_mod, temp_path,
ANSIBALLZ_PARAMS)\n  File
\"/root/.ansible/tmp/ansible-tmp-1563905149.0829937-112643037486051/AnsiballZ_zypper.py\",
line 49, in invoke_module\n    imp.load_module('__main__', mod, module,
MOD_DESC)\n  File \"/tmp/ansible_zypper_payload_Nyy8Ow/__main__.py\", line 195,
in <module>\nImportError: No module named xml\n", "module_stdout": "", "msg":
"MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

python3-xml is missing, I suggest adding this dependency.

Installation was done with "zypper install ansible"
The following 35 NEW packages are going to be installed:
  ansible libsodium23 python3-Babel python3-Jinja2 python3-MarkupSafe
python3-PyNaCl
  python3-PySocks python3-PyYAML python3-asn1crypto python3-bcrypt
python3-certifi
  python3-cffi python3-chardet python3-cryptography python3-dnspython
python3-ecdsa
  python3-httplib2 python3-idna python3-keyczar python3-ndg-httpsclient
  python3-ntlm-auth python3-paramiko python3-passlib python3-py
python3-pyOpenSSL
  python3-pyasn1 python3-pycparser python3-pycrypto python3-pytz
python3-pywinrm
  python3-requests python3-requests_ntlm python3-urllib3 python3-xmltodict
sshpass

The following 12 recommended packages were automatically selected:
  python3-PySocks python3-cryptography python3-dnspython python3-ecdsa
python3-httplib2
  python3-idna python3-keyczar python3-ndg-httpsclient python3-pyOpenSSL
  python3-pycrypto python3-pywinrm sshpass

35 new packages to install.
Overall download size: 19.6 MiB. Already cached: 0 B. After the operation,
additional
123.9 MiB will be used.


body:
--1563953488.da2fFe834.31297
Date: Wed, 24 Jul 2019 07:31:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1142582

            Bug ID: 1142582
           Summary: python package updates for weblate to keep working
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mcalabkova-at-suse.com
          Reporter: tchvatal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: sbrabec-at-suse.com, tchvatal-at-suse.com
          Found By: ---
           Blocker: ---

When we update weblate for l10n.opensuse.org we need to update various python
modules to keep it running.

This bug is for tracking purposes of such bumps.

With update 3.7.1 we need:
python3-bleach >= 3.10
python3-pycairo >= 1.10.0
python3-translation-finder >= 1.4
translate-toolkit >= 2.4.0

pkgs: python-bleach python-cairo python-cheroot python-translation-finder translate-toolkit


--1563960018.7b1F0.21430
Date: Wed, 24 Jul 2019 09:20:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142609

            Bug ID: 1142609
           Summary: VUL-0: CVE-2019-14249: libdwarf: division by zero in dwarf_elf_load_headers.c leading to DoS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/237917/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-14249

dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to
cause a denial of service (division by zero) via an ELF file with a zero-size
section group (SHT_GROUP), as demonstrated by dwarfdump.

Upstream patch:

https://sourceforge.net/p/libdwarf/code/merge-requests/4/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1732719
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14249
https://sourceforge.net/u/rkx1209/libdwarf1/ci/1db3a60d4c0b990f50c95478129b2f9e2f921227/


body:
--1563971872.20aE7Df4.19164
Date: Wed, 24 Jul 2019 12:37:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1142654

            Bug ID: 1142654
           Summary: libstdc++.so misses SDT probes
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: tdevries-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

There's a gdb feature (since v7.10, 2015) that allows to set a catchpoint using
a regexp.

There's a limitation mentioned in the docs (
https://sourceware.org/gdb/current/onlinedocs/gdb/Set-Catchpoints.html#Set-Catchpoints
):
...
The regular expression feature and the $_exception convenience variable rely on
the presence of some SDT probes in libstdc++. If these probes are not present,
then these features cannot be used. These probes were first available in the
GCC 4.8 release, but whether or not they are available in your GCC also depends
on how it was built.
...

AFAICT, on my Leap 15.0 system, libstdc++.so does not have these SDT probes,
which is why I ran into this (
https://sourceware.org/bugzilla/show_bug.cgi?id=24830 ) gdb testsuite failure.

summary: libstdc++.so misses SDT probes


--1563974419.e42B1c04.3759
Date: Wed, 24 Jul 2019 13:20:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1142662

            Bug ID: 1142662
           Summary: [TRACKERBUG] update osc to version 0.165.3
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: marco.strigl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

important fixes:

- fixed broken TLS certificate handling (boo#1142518, CVE-2019-3685)
- switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing
  old behavior results in non working osc diff, ci and rq on packages


body:
--1563978961.Ad46502.29305
Date: Wed, 24 Jul 2019 14:36:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1142670

            Bug ID: 1142670
           Summary: LLADDR in bridge configuration ignored.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: nsinger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: azouhr-at-opensuse.org, gschlotter-at-suse.com,
                    ihno-at-suse.com, mfilka-at-suse.com, mgriessmeier-at-suse.de,
                    mt-at-suse.com, wicked-maintainers-at-suse.de,
                    wolfgang.engel-at-suse.com
        Depends on: 1042123
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1042123 +++

I've a simple network setup for my local workstation. I physical interface
belonging to a bridge. To receive the same IP from DHCP I tried to change the
mac of the physical interface to something (random) and the mac of the bridge
to the initial mac of the physical interface. I've two ifcfgs for that:

```
root@1a251:/etc/sysconfig/network # cat ifcfg-p3p1
# Original config
#BOOTPROTO='dhcp'
#STARTMODE='auto'
#ZONE=public
#HWADDR=b4:96:91:16:bb:e6 <- this is the burnt in mac of the physical interface
LLADDR=68:05:ca:2f:c7:87
BOOTPROTO='none'
NETMASK=''
STARTMODE='auto'
BRIDGE=br0
ZONE=public
```

```
root@1a251:/etc/sysconfig/network # cat ifcfg-br0
BOOTPROTO='dhcp'
BRIDGE='yes'
LLADDR=b4:96:91:16:bb:e6
BRIDGE_FORWARDDELAY='0'
BRIDGE_PORTS='p3p1'
BRIDGE_STP='off'
BROADCAST=''
ETHTOOL_OPTIONS=''
IPADDR=''
MTU=''
NETMASK=''
NETWORK=''
REMOTE_IPADDR=''
STARTMODE='auto'
USERCONTROL='no'
ZONE=public
```

after restarting the network/wicked the interfaces look like this:

```
2: p3p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state
UP group default qlen 1000
    link/ether 68:05:ca:2f:c7:87 brd ff:ff:ff:ff:ff:ff
13: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
group default qlen 1000
    link/ether 8a:5c:dd:d0:92:b7 brd ff:ff:ff:ff:ff:ff
    […snip…]
```

As you can see: p3p1 has the correct mac, br0 just got ignored. There is
nothing at all in my systems journal.

I remember that this worked in the past with the option "HWADDR" but stopped
working after some update (guess the option got deprecated).

According to `man 5 ifcfg`, this should work: "LLADDR Set an individual link
layer address (MAC address)."

summary: LLADDR in bridge configuration ignored.


body:
--1564020958.6cC42F40.32113
Date: Thu, 25 Jul 2019 02:15:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142714

            Bug ID: 1142714
           Summary: pari-gp not compiled for multithreading
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: thehans-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I have some PARI scripts which make use of parallel computation, but the repo
package is not built to support threads.

Steps to reproduce:
1) run "gp --version"

Actual results:
GP/PARI CALCULATOR Version 2.11.1 (released)

amd64 running linux (x86-64/GMP-6.1.2 kernel) 64-bit version
                                                            compiled: openSUSE,
gcc version 9.1.1 20190611 [gcc-9-branch revision 272147] (SUSE Linux)

             threading engine: single

 (readline v8.0 disabled, extended help enabled)

Expected Results:
...
threading engine: pthread
...

summary: pari-gp not compiled for multithreading


--1564041460.a1561.13423
Date: Thu, 25 Jul 2019 07:57:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142762

            Bug ID: 1142762
           Summary: Add drbd-formulas to support build DRBD on top of NFS with salt
    Classification: openSUSE
           Product: openSUSE Backports
           Version: SLE-15-SP1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Packages
          Assignee: packagehub-bugs-at-suse.com
          Reporter: nwang-at-suse.com
        QA Contact: packagehub-bugs-at-suse.com
          Found By: ---
           Blocker: ---

SUSE/openSUSE support set up a DRBD cluster and a NFS share on top of it,
and/or with pacemaker HA cluster.

Provide NFS share is quite important in many area, implement a salt formula
module to support the automatic setup.


--1564119101.5DE55d6.1332
Date: Fri, 26 Jul 2019 05:31:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142941

            Bug ID: 1142941
           Summary: VUL-1: CVE-2019-11922: race condition in one-pass compression functions could allow out of bounds write
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238018/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: bwiedemann-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-11922

A race condition in the one-pass compression functions of Zstandard prior to
version 1.3.8 could allow an attacker to write bytes out of bounds if an output
buffer smaller than the recommended size was used.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-11922
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11922
https://www.facebook.com/security/advisories/cve-2019-11922
https://github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0


--1564132985.eFcD34.31636
Date: Fri, 26 Jul 2019 09:23:05 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142988

            Bug ID: 1142988
           Summary: networking problems using cloud-init in leap 15.1 images
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: choeger@open-xchange.com
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Created attachment 811728
  --> http://bugzilla.opensuse.org/attachment.cgi?id=811728&action=edit
/var/log/cloud-init.log

Using the image from 2019-07-24:
http://download.opensuse.org/repositories/Cloud:/Images:/Leap_15.1/images/openSUSE-Leap-15.1-OpenStack.aarch64-0.0.4-Build6.7.qcow2

opensuse@buildservice:~> rpm -qa | grep cloud-init
cloud-init-config-suse-19.1-lp151.6.1.x86_64
cloud-init-19.1-lp151.6.1.x86_64

in bootcmd of cloud-init there's a ping -c 1 build.opensuse.org, see below
it fails resolving the hostname.

after cloud-init is done, resolving that host is working

opensuse@buildservice:~> ping -c 1 build.opensuse.org
PING login.opensuse.org (195.135.221.133) 56(84) bytes of data.
64 bytes from login.opensuse.org (195.135.221.133): icmp_seq=1 ttl=56 time=11.5
ms

-


body:
--1564135063.51F43301.13863
Date: Fri, 26 Jul 2019 09:57:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1142995

            Bug ID: 1142995
           Summary: Virtualization/virtualbox: Bug
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: Larry.Finger-at-gmail.com
          Reporter: dcermak-at-suse.com
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

The vboxdrv service is broken in the latest Tumbleweed snapshot: `systemctl
start vboxdrv` results in an error and the following output to the system log:

Jul 26 11:54:06 localhost systemd[1]: Starting VirtualBox Linux kernel
module...
Jul 26 11:54:06 localhost vboxdrv.sh[8394]: vboxdrv.sh: Starting VirtualBox
services.
Jul 26 11:54:06 localhost vboxdrv.sh[8410]: Starting VirtualBox services.
Jul 26 11:54:06 localhost vboxdrv.sh[8394]: /usr/lib/virtualbox/vboxdrv.sh:
line 213: setup: command not found
Jul 26 11:54:06 localhost vboxdrv.sh[8394]: vboxdrv.sh: failed: modprobe
vboxdrv failed. Please use 'dmesg' to find out why.
Jul 26 11:54:06 localhost vboxdrv.sh[8417]: failed: modprobe vboxdrv failed.
Please use 'dmesg' to find out why.

I've checked the file vboxdrv.sh and the function setup() is indeed not defined
anywhere.

summary: Virtualization/virtualbox: Bug


--1564142649.F73Dbe0.5423
Date: Fri, 26 Jul 2019 12:04:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143032

            Bug ID: 1143032
           Summary: VUL-0: CVE-2019-14274: mcpp: heap-based buffer overflow in the do_msg() function in support.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238074/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-14274

MCPP 2.7.2 has a heap-based buffer overflow in the do_msg() function in
support.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14274
https://sourceforge.net/p/mcpp/bugs/13/


--1564144924.E26dbc0.2127
Date: Fri, 26 Jul 2019 12:42:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143033

            Bug ID: 1143033
           Summary: dracut fails on filesystem resize for aarch64 JeOS-efi
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
               URL: https://openqa.opensuse.org/tests/992140/modules/prepa
                    re_firstboot/steps/5
                OS: Linux
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

openQA test in scenario
opensuse-Tumbleweed-JeOS-for-AArch64-aarch64-jeos@aarch64-HD24G fails in
[prepare_firstboot](https://openqa.opensuse.org/tests/992140/modules/prepare_firstboot/steps/5)

The suspicious part of the error message is:
  dracut-pre-mount[398]: /lib/kiwi-filesystem-lib.sh: line 34: rmdir: command
not found

And 'rmdir' is indeed missing, whereas 'rm' is present (both from coreutils
package).
In snapshot 20190607, 'rmdir' was present and there was no such bug.


--1564151861.D2609.26567
Date: Fri, 26 Jul 2019 14:37:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1143055

            Bug ID: 1143055
           Summary: <END>+<HOME> not working in screen anymore
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: doerges@pre-sense.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The problem is very similar to bug 1095661, but the regression occurs when
going from openSUSE Leap 15.0 to 15.1.

Everything is working as expected in Leap 15.0 (with or without screen).
In Leap 15.1 only the setup without screen is working.

Inside screen I get this output:
-


body:
--1564158116.bAACF0F15.26205
Date: Fri, 26 Jul 2019 16:21:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143065

            Bug ID: 1143065
           Summary: Regression in TeXLive 2019 (font problems)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: Yvan.Velenik-at-hispeed.ch
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Since updating to TeXLive 2019 (last week or so), many tex files are not
compiling anymore, due to some font problems. Below are a minimal latex file
that shows up the error, and the actual error message on compilation.

Note: all these files were compiling properly on TeXLive 2018 (that is, before
the recent update).

%%%%%%%%%

\documentclass{article}

\usepackage[condensed]{roboto}
\usepackage[T1]{fontenc}
\usepackage[utf8]{inputenc}

\begin{document}

\textsf{Aa}

\end{document}

%%%%%%%%%

When compiling this file (with pdflatex), I get the following error message:

[...]
LaTeX Font Warning: Font shape `T1/cmr/regular/n' undefined
(Font) using `T1/cmr/m/n' instead on input line 7.

(/usr/share/texmf/tex/latex/roboto/T1RobotoCondensed-LF.fd)
[1{/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map}] (./test.aux)

LaTeX Font Warning: Some font shapes were not available, defaults substituted.

){/usr/share/texmf/fonts/enc/dvips/cm-super/cm-super-t1.enc}
!pdfTeX error: pdflatex (file rbto_idpkzy.enc): cannot open encoding file for
reading
==> Fatal error occurred, no output PDF file produced!

The file rbto_idpkzy.enc indeed does not exist in my tree (but many other
rbto_xxxxxx.enc files do).
I have the same problem replacing roboto by many other sans serif fonts.

pkgs: texlive-specs-a texlive-specs-b texlive-specs-c texlive-specs-d texlive-specs-e texlive-specs-f texlive-specs-g texlive-specs-h texlive-specs-i texlive-specs-j texlive-specs-k texlive-specs-l texlive-specs-m texlive-specs-n texlive-specs-o texlive-specs-p texlive-specs-q texlive-specs-r texlive-specs-s texlive-specs-t texlive-specs-u texlive-specs-v texlive-specs-w texlive-specs-x texlive-specs-y texlive-specs-z


--1564338035.6e4eD860.15593
Date: Sun, 28 Jul 2019 18:20:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143144

            Bug ID: 1143144
           Summary: Opensuse should save journalctl log since the begin - not only the current boot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE 42.3
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: prueba_hola-at-outlook.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Because like how it work now by default, is not useful if you get a freeze or
something

using this, you can fix this
https://doc.opensuse.org/documentation/leap/reference/html/book.opensuse.reference/cha.journalctl.html#sec.journalctl.persistent

but this should be fixed by default


--1564376233.5cfcFdf0.12312
Date: Mon, 29 Jul 2019 04:57:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1143155

            Bug ID: 1143155
           Summary: OCFS2: o2locktop can not display the full hostname with python3
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: High Availability
          Assignee: ha-bugs-at-suse.de
          Reporter: ghe-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

o2locktop can work well with python2 on openSUSE Tumbleweed or SLE12/15, but
o2locktop can not display the full hostname(only one node in the cluster) with
python3. It looks Weikang did not test this program on python3, since the
default python interpreter is always python2.


--1564394949.8a6bF860.25715
Date: Mon, 29 Jul 2019 10:09:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1143216

            Bug ID: 1143216
           Summary: AUDIT-0: mousepad: New PolKit rules added
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: tux93-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 811924
  --> http://bugzilla.suse.com/attachment.cgi?id=811924&action=edit
Full build log

mousepad update 0.4.2 has added polkit rules

[   84s] RPMLINT report:
[   84s] ===============
[   85s] mousepad.x86_64: I: polkit-cant-acquire-privilege org.xfce.mousepad
(no:auth_admin:auth_admin)
[   85s] Usability can be improved by allowing users to acquire privileges via
[   85s] authentication. Use e.g. 'auth_admin' instead of 'no' and make sure to
define
[   85s] 'allow_any'. This is an issue only if the privilege is not listed in
[   85s] /etc/polkit-default-privs.*
[   85s]
[   85s] mousepad.x86_64: W: package-with-huge-docs  55%
[   85s] More than half the size of your package is documentation. Consider
splitting
[   85s] it into a -doc subpackage.
[   85s]
[   85s] mousepad.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.xfce.mousepad (no:auth_admin:auth_admin)
[   85s] The privilege is not listed in /etc/polkit-default-privs.* which makes
it
[   85s] harder for admins to find. Furthermore polkit authorization checks can
easily
[   85s] introduce security issues. If the package is intended for inclusion in
any
[   85s] SUSE product please open a bug report to request review of the package
by the
[   85s] security team. Please refer to
[   85s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[   85s] more information.
[   85s]
[   85s] (none): E: badness 10000 exceeds threshold 1000, aborting.
[   85s] 3 packages and 0 specfiles checked; 1 errors, 1 warnings.

OBS Repo:
https://build.opensuse.org/package/show/home:tux93:branches:X11:xfce/mousepad


--1564402936.DE65B3cC0.19885
Date: Mon, 29 Jul 2019 12:22:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143249

            Bug ID: 1143249
           Summary: LTO: kdelibs4 ppc64 build failure: undefined reference to `LTHUNK3.lto_priv.0'
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: normand-at-linux.vnet.ibm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

LTO: kdelibs4 ppc64 build failure: undefined reference to `LTHUNK3.lto_priv.0'
as per attached file kdelibs4_openSUSE_Factory_PowerPC_ppc64_201907241301.log
```
[ 1442s] cd /home/abuild/rpmbuild/BUILD/kdelibs-4.14.38/build/kded &&
/usr/bin/cmake -E cmake_link_script CMakeFiles/kbuildsycoca4.dir/link.txt
--verbose=1
[ 1442s] /usr/bin/c++  -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong
-funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -flto=4
-g -Wnon-virtual-dtor -Wno-long-long -Wundef -Wcast-align -Wchar-subscripts
-Wall -W -Wpointer-arith -Wformat-security -fno-exceptions -DQT_NO_EXCEPTIONS
-fno-check-new -fno-common -Woverloaded-virtual -fno-threadsafe-statics
-fvisibility=hidden -Werror=return-type -fvisibility-inlines-hidden -O2
-DNDEBUG -DQT_NO_DEBUG  -Wl,--enable-new-dtags -Wl,-Bsymbolic-functions
-rdynamic CMakeFiles/kbuildsycoca4.dir/kbuildsycoca4_dummy.cpp.o  -o
../bin/kbuildsycoca4 ../lib/libkdeinit4_kbuildsycoca4.so
../lib/libkdeui.so.5.14.38 ../lib/libkdecore.so.5.14.38 /usr/lib64/libQtDBus.so
/usr/lib64/libQtCore.so -lpthread /usr/lib64/libQtGui.so /usr/lib64/libQtSvg.so
/usr/lib64/libQtXml.so
[ 1443s]
/usr/lib64/gcc/powerpc64-suse-linux/9/../../../../powerpc64-suse-linux/bin/ld:
../lib/libkdeinit4_kbuildsycoca4.so: undefined reference to
`LTHUNK3.lto_priv.0'
[ 1443s] collect2: error: ld returned 1 exit status
```

if build w/o LTO then no such failure as per second attached file.
home_michel_mno_branches_KDE_Applications/kdelibs4_openSUSE_Factory_PowerPC_ppc64_201907291345.log


body:
--1564428580.FAfd1d3.13776
Date: Mon, 29 Jul 2019 19:29:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1143315

            Bug ID: 1143315
           Summary: virt-manager: Fix detection for SLE15
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: carnold-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The allstores object in the _build_distro_list function in urldetect.py is
missing an entry for _SLEDistro. This results in detection not being able to
find SLE15 or SLE15-SP1.

summary: virt-manager: Fix detection for SLE15


--1564444329.CfDBeaAD3.30811
Date: Mon, 29 Jul 2019 23:52:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143331

            Bug ID: 1143331
           Summary: kernel-firmware-20190618-lp151.2.6.1 fails to boot
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: hansper@t-online.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 812019
  --> http://bugzilla.opensuse.org/attachment.cgi?id=812019&action=edit
Screenshot of the system hanging (camera picture)

Hi

after upgrading to the latetest firmware on openSuSE 15.1
(firmware-20190618-lp151.2.6.1) my system is no longer able to boot.

No hard disk are found anymore. Attached is a screenshot of the system hanging
during boot.

As soon as I revert the firmware back to kernel-firmware-20190312-lp151.2.3.1
I'm able to boot the latest (and previous) kernel(s) again.

Older kernels fail to boot too, if the latest version of the firmware is
installed.

MD5sum of the faulty firmware is: 8093153dc5b29f3e1f8c0633ee9d24a2

Mainboard:
    Manufacturer: Gigabyte Technology Co., Ltd.
    Product Name: X99-UD4-CF
        RAM: 128GB RAM installed
CPU:
        Intel(R) Core(TM) i7-6850K CPU
Hard-Disks:
        8 Disks installed, 4 SSDs, 4 HDDs
Boot:
        Booting from /dev/md0, Raid1 device, 2 members

This seems to be a rather nasty bug, as all BIOS settings will be set to their
respective defaults, after the system hangs. After a hard reset (only thing
that seems to work) the Mainboard BIOS says it experienced boot failure and
loads factory defaults (and deletes all saved profiles...).

Yours,

Jochen


--1564494775.34800.10126
Date: Tue, 30 Jul 2019 13:52:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1143454

            Bug ID: 1143454
           Summary: New system-user for tftp, so this tftp user is handled only in a single place.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dcassany-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The tftp user is currently provided by multiple packages

* atftp
* python-kiwi
* dnsmasq
* tftp

And having the user defined in multiple places tends to cause glitches and
deviations among all these packages as it happened in bsc#1135449, where home
permissions were not consistent (/srv/tftpboot). Within the mentioned bug
discussion is was suggested move tftp user to a central package and then
require it from the above packages. This way issues like bsc#1135449 will not
occur in the future.


--1564514244.78040.8683
Date: Tue, 30 Jul 2019 19:17:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143492

            Bug ID: 1143492
           Summary: VUL-0: chromium: multiple security issues fixed in 76.0.3809.87
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2019/07/stable-channel-update-for-desktop_30.html

* CVE-2019-5850: Use-after-free in offline page fetcher
* CVE-2019-5860: Use-after-free in PDFium
* CVE-2019-5853: Memory corruption in regexp length check
* CVE-2019-5851: Use-after-poison in offline audio context
* CVE-2019-5859: res: URIs can load alternative browsers
* CVE-2019-5856: Insufficient checks on filesystem: URI permissions
* CVE-2019-5855: Integer overflow in PDFium
* CVE-2019-5865: Site isolation bypass from compromised renderer
* CVE-2019-5858: Insufficient filtering of Open URL service parameters
* CVE-2019-5864: Insufficient port filtering in CORS for extensions
* CVE-2019-5862: AppCache not robust to compromised renderers
* CVE-2019-5861: Click location incorrectly checked
* CVE-2019-5857: Comparison of -0 and null yields crash
* CVE-2019-5854: Integer overflow in PDFium text rendering
* CVE-2019-5852: Object leak of utility functions
* Various fixes from internal audits, fuzzing and other initiatives

Not affected:
* CVE-2019-5863: Use-after-free in WebUSB on Windows


--1564557811.c5aeE5.9320
Date: Wed, 31 Jul 2019 07:23:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143547

            Bug ID: 1143547
           Summary: VUL-1: CVE-2019-5460: vlc: Double Free in VLC leads to a crash
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238362/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dimstar-at-opensuse.org
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-5460

Double Free in VLC versions <= 3.0.6 leads to a crash.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5460
http://www.cvedetails.com/cve/CVE-2019-5460/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5460
https://hackerone.com/reports/503208


--1564557960.5CdC2a1.12617
Date: Wed, 31 Jul 2019 07:26:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143549

            Bug ID: 1143549
           Summary: VUL-1: CVE-2019-5459: vlc: integer underflow in VLC Media Player versions leads to an out-of-band read
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238361/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dimstar-at-opensuse.org
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-5459

An Integer underflow in VLC Media Player versions < 3.0.7 leads to an
out-of-band read.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5459
http://www.cvedetails.com/cve/CVE-2019-5459/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5459
https://hackerone.com/reports/502816


--1564613625.dcA04.11185
Date: Wed, 31 Jul 2019 22:53:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143725

            Bug ID: 1143725
           Summary: qemu-aarch64-binfmt, from qemu-linux-user, not working (no output)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dfaggioli-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Context: I want to run an ARM64 (aarch64) container on an x86 host. This is
possible using qemu Linux user emulation and Linux binfmt. It is supposed to
work like this:

//Fetching an ARM container on x86 (long story)
$ skopeo --override-arch arm64 copy docker://opensuse/leap
docker-daemon:opensuse-arm64/leap:latest

//Install qemu Linux user, and setup binfmt for aarch64
# zypper install qemu-linux-user
$ cp /usr/bin/qemu-aarch64-binfmt .
# echo -1 > /proc/sys/fs/binfmt_misc/qemu-aarch64
# echo
':qemu-aarch64:M:0:\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\xb7\x00:\xff\xff\xff\xff\xff\xff\xff\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-aarch64-binfmt:POCF'
> /proc/sys/fs/binfmt_misc/register

//Build our container
$ cat << EOF > Dockerfile
FROM opensuse-arm64/leap
COPY qemu-aarch64-binfmt /usr/bin/qemu-aarch64-binfmt
EOF
docker build -t qemu-leap .

//Now I should be able to run the ARM container, like this:
# docker run -it qemu-leap-aarch64-binfmt /bin/sh

But, basically, nothing happens. No output at all, and I'm definitely not
inside an ARM container. Actually, it appears the container exited:

$ docker ps --all
CONTAINER ID        IMAGE                      COMMAND                  CREATED
            STATUS                       PORTS               NAMES
ea2252caf90a        qemu-leap                  "/bin/sh"                4
seconds ago       Exited (255) 3 seconds ago
relaxed_goodall

Now, if I, instead of qemu-aarch64-binfmt, use a qemu-aarch64-static binary
copied from a Debian unstable box I have in my home network, i.e., this one:

# ./qemu-aarch64-static -version
qemu-aarch64 version 3.1.0 (Debian 1:3.1+dfsg-8)

Things work! In fact:

$ docker run -it --rm qemu-leap uname -a
Linux bf12752f6a51 5.1.16-1-default #1 SMP Wed Jul 3 12:37:47 UTC 2019
(2af8a22) aarch64 aarch64 aarch64 GNU/Linux

Note the *aarch64*. Of course, we need to change the aarch64 interpreter file
too, in /proc/sys/fs/binfmt

So, basically, it looks like the procedure is correct, or at least can work.
But our qemu-linux-user packages contain binaries that are not adequate for
being used for this use case.

Things/differences to check:
- QEMU version (the debian stolen from Debian, that makes things works is from
QEMU 3.1.0, while we ship 4.0.0
- our patch queue
- our configuration and compile options


--1564644742.eBBF20.8704
Date: Thu, 1 Aug 2019 07:32:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143763

            Bug ID: 1143763
           Summary: VUL-0: CVE-2019-5057: SDL2_image:  code execution vulnerability in the PCX image-rendering functionality of SDL2_image
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238548/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-5057

An exploitable code execution vulnerability exists in the PCX image-rendering
functionality of SDL2_image 2.0.4. A specially crafted PCX image can cause a
heap overflow, resulting in code execution. An attacker can display a specially
crafted image to trigger this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5057
http://www.cvedetails.com/cve/CVE-2019-5057/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5057
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0841


body:
--1564658106.7CA5306d14.31234
Date: Thu, 1 Aug 2019 11:15:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1143813

            Bug ID: 1143813
           Summary: kubelet sometimes starting too fast
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kubic
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

kubelet is sometimes starting to fast, before wicked did setup the network
fully, including the real hostname. In this cases, kubelet uses "localhost",
which of course will fail.

summary: kubelet sometimes starting too fast


--1564645351.F25b6.11286
Date: Thu, 1 Aug 2019 07:42:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143764

            Bug ID: 1143764
           Summary: VUL-0: CVE-2019-5058: SDL2_image: heap overflow in XCF image rendering can lead to code execution
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/238549/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-5058

An exploitable code execution vulnerability exists in the XCF image rendering
functionality of SDL2_image 2.0.4. A specially crafted XCF image can cause a
heap overflow, resulting in code execution. An attacker can display a specially
crafted image to trigger this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5058
http://www.cvedetails.com/cve/CVE-2019-5058/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5058
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0842


--1564645995.AD750.19638
Date: Thu, 1 Aug 2019 07:53:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143768

            Bug ID: 1143768
           Summary: VUL-1: CVE-2019-5060: SDL2_image: integer overflow in the XPM image
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238551/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-5060

An exploitable code execution vulnerability exists in the XPM image rendering
function of SDL2_image 2.0.4. A specially crafted XPM image can cause an
integer
overflow in the colorhash function, allocating too small of a buffer. This
buffer can then be written out of bounds, resulting in a heap overflow,
ultimately ending in code execution. An attacker can display a specially
crafted
image to trigger this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5060
http://www.cvedetails.com/cve/CVE-2019-5060/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5060
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0844


--1564645604.3726ca0.17762
Date: Thu, 1 Aug 2019 07:46:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143766

            Bug ID: 1143766
           Summary: VUL-0: CVE-2019-5059: SDL2_image:  heap overflow in XPM image
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238550/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-5059

An exploitable code execution vulnerability exists in the XPM image rendering
functionality of SDL2_image 2.0.4. A specially crafted XPM image can cause an
integer overflow, allocating too small of a buffer. This buffer can then be
written out of bounds resulting in a heap overflow, ultimately ending in code
execution. An attacker can display a specially crafted image to trigger this
vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5059
http://www.cvedetails.com/cve/CVE-2019-5059/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5059
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0843


--1564665208.BbbcEE1.823
Date: Thu, 1 Aug 2019 13:13:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143839

            Bug ID: 1143839
           Summary: VUL-1: CVE-2019-14296: upx: denial of service in canUnpack in p_vmlinx.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/238127/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: crrodriguez-at-opensuse.org
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-14296

A vulnerability was found in canUnpack in p_vmlinx.cpp in UPX 3.95 allows
remote attackers to cause a denial of service (SEGV or buffer overflow, and
application crash) or possibly have unspecified other impact via a crafted UPX
packed file.

Reference:
https://github.com/upx/upx/issues/287

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1735671
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14296
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-14296.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14296
http://www.cvedetails.com/cve/CVE-2019-14296/
https://github.com/upx/upx/issues/287


body:
--1564737302.F1f1e63.31565
Date: Fri, 2 Aug 2019 09:15:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1143959

            Bug ID: 1143959
           Summary: Reduce kernel firmware file installations
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: tiwai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Currently kernel-firmware package contains the full contents of uncompressed
files and its footprint is significant large, over 400MB.
For reducing this installation size, we can try the following:

- Compress firmware files:
5.3 kernel got a new feature to support loading the XZ-compressed firmware
files.  We can package the compressed files instead of the raw files.

- Split kernel-firmware package to several packages:
Instead of the all-in-one package, we may split per functionality or such.

Some more details:
* We still need to provide the plain kernel-firmware package for compatibility
with the older kernels and older releases.  The new split-and-compress packages
will be a multibuild or such one.

* A new package, kernel-firmware-all, contains only Requires of all f/w
subpackages.  And this contains the following tags:

  Provides: kernel-firmware = %{version}
  Obsoletes: kernel-firmware <= %{version}
  Conflicts: kernel < 5.3

so that it'll replace the old kernel-firmware once when the system has only new
kernels that support the compressed format.

* kernel-$binary.spec contains currently "Recommends: kernel-firmware", and
this will be dropped.
Instead, we provide Supplements: modalias(...) in each f/w subpackage.

The problem of Supplements was that we generated the list dynamically at the
package build time from the kernel-binary RPMs in the same project.  This
depends on the architecture and the config at the moment, so it would be
incomplete or broken for other releases.

The new approach I'm thinking is to provide a static mapping in the package,
and the mapping is updated manually (or semi-automatically) at each kernel
package update.  A script to generate / update the mapping is provided in
kernel-firmware package.

Also, this would require the changes in install patterns.  We may keep
kernel-firmware-all at start, then drop the Recommends, and change to the
minimalistic subpackages.

pkgs: kernel-firmware kernel-source


body:
--1564762389.aFaaD40.3605
Date: Fri, 2 Aug 2019 16:13:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1144068

            Bug ID: 1144068
           Summary: grpc: update to 1.22.0
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: chitty_cloud-at-me.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

latest stable: 1.22.0
Changelog: https://github.com/grpc/grpc/releases/tag/v1.22.0

summary: grpc: update to 1.22.0


--1564824470.655dDFAC3.25038
Date: Sat, 3 Aug 2019 09:27:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1144135

            Bug ID: 1144135
           Summary: Remove google-roboto-fonts from patterns-base-x11
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Patterns
          Assignee: dimstar-at-opensuse.org
          Reporter: i-at-guoyunhe.me
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

google-roboto-fonts was added to patterns-base.sepc because Bug 951898 want to
make openSUSE look nicer. But Roboto fonts isn't a good choice.

1. It doesn't follow openSUSE's design guidelines

Roboto fonts is designed for Google's operating system: Android, Chrome OS. It
is from Google's material design language.

openSUSE has its own design guideline. The fonts used are: Open Sans and Source
Sans Pro. https://opensuse.github.io/branding-guidelines/

Open Sans is mainly for web. Source Sans Pro can be a good choice. But Roboto
fonts don't have a reason to be here.

2. It is not required or recommended by any DE and applications

In GNOME you cannot change UI fonts by default. KDE uses Noto Fonts in UI by
default. So even if we install Roboto fonts by default, it won't be used
anywhere.

3. It has metrics issue.

It is designed for Android and Chrome OS. The font metrics is weird. If you set
it as default UI fonts in KDE, panel, widgets and Qt applications will have
ugly layout change. It is not designed or tested with Qt at all.

4. It is not liked.

I talked with KDE VDG people yesterday, and most of them don't like Roboto. And
recently they don't even try to pick a unique fonts for KDE. The reason is that
people all have different tastes and their devices are different, too. Noto
Sans is balanced choice.

--------------

So I suggest to remove google-roboto-fonts from patterns-base-x11. Only keep
Noto Sans (good for all) and DejaVu Sans (for some old applications).


--1564859146.1DDB03.14568
Date: Sat, 3 Aug 2019 19:05:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1144162

            Bug ID: 1144162
           Summary: No sendfile system call on AMD x86_64 CPUs
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: SUSE Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: jan-at-telliq.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

It seems that the sendfile system call is not working on AMD CPUs. I found that
out when trying to get apache to work, luckily the sendfile support can be
disabled in the apache configuration. I found it by running apache under
strace:

20:31:03 openat(AT_FDCWD, "/srv/www/htdocs/index.html", O_RDONLY|O_CLOEXEC) =
10
20:31:03 setsockopt(9, SOL_TCP, TCP_CORK, [1], 4) = 0
20:31:03 writev(9, [{iov_base="HTTP/1.1 200 OK\r\nDate: Sat, 03 A"...,
iov_len=273}], 1) = 273
20:31:03 sendfile(9, 10, [0], 24371)    = -1 EOPNOTSUPP (Operation not
supported)
20:31:03 setsockopt(9, SOL_TCP, TCP_CORK, [0], 4) = 0

Tested two on tho Athlon X2 machines and on one Ryzen 2400G, sendfile returns
EOPNOTSUPP error. Thus it succeeds to send the headers, but no data. Oddly
enough the sendfile syscall works for client on localhost or on the servers own
network interface. The clients used when it fails sits on the same 192.168.xx
subnet as the server.

However on an Intel core i3 sendfile works as expected.

On all machines kernel-default-4.12.14-lp151.28.10.1.x86_64 is used.


--1564987862.d24Dbd4.30797
Date: Mon, 5 Aug 2019 06:51:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144211

            Bug ID: 1144211
           Summary: [TRACKERBUG] update osc to version 0.165.3
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: marco.strigl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

0.165.4
   - allow optional fork when creating a maintenance request
   - fix RPMError fallback
   - fix local caching for all package formats
   - fix appname for trusted cert store
   - osc -h does not break anymore when using plugins


body:
--1564995729.54614.16210
Date: Mon, 5 Aug 2019 09:02:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144232

            Bug ID: 1144232
           Summary: Drop jasper dependency from Digikam
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Regarding bsc#1130404.

We plan to drop libjasper from the repos.
Let's remove the build dependcy on libjasper from Digikam, and thus disable
JPEG2000 support.

Upstream bug about moving from jasper to openjpeg:
https://bugs.kde.org/show_bug.cgi?id=364231

summary: Drop jasper dependency from Digikam


--1564996400.Ec0365.21677
Date: Mon, 5 Aug 2019 09:13:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144240

            Bug ID: 1144240
           Summary: Drop jasper dependency from GraphicsMagic
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Regarding bsc#1130404.

We plan to drop libjasper from the repos.
Let's remove the build dependcy on libjasper from GraphicsMagic, and thus
disable JPEG2000 support.


body:
--1564996929.C7023cE15.30068
Date: Mon, 5 Aug 2019 09:22:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144245

            Bug ID: 1144245
           Summary: Drop jasper dependency from libdevil
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Regarding bsc#1130404.

We plan to drop libjasper from the repos.
Let's remove the build dependcy on libjasper from libdevil, and thus disable
JPEG2000 support.

summary: Drop jasper dependency from libdevil


--1564997399.eA20Bd5.31160
Date: Mon, 5 Aug 2019 09:29:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144249

            Bug ID: 1144249
           Summary: Drop jasper dependency from libqt5-qtimageformats
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Regarding bsc#1130404.

We plan to drop libjasper from the repos.
Let's remove the build dependcy on libjasper from libqt5-qtimageformats, and
thus disable JPEG2000 support.


body:
--1564997549.7D31A5.1849
Date: Mon, 5 Aug 2019 09:32:29 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144252

            Bug ID: 1144252
           Summary: Drop jasper dependency from libraw
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Regarding bsc#1130404.

We plan to drop libjasper from the repos.
Let's remove the build dependcy on libjasper from libraw, and thus disable
JPEG2000 support.

summary: Drop jasper dependency from libraw


body:
--1564997672.21B8ef254.6321
Date: Mon, 5 Aug 2019 09:34:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144253

            Bug ID: 1144253
           Summary: Drop jasper dependency from mtpaint
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: LXDE
          Assignee: andrea-at-opensuse.org
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Regarding bsc#1130404.

We plan to drop libjasper from the repos.
Let's remove the build dependcy on libjasper from mtpaint, and thus disable
JPEG2000 support.

summary: Drop jasper dependency from mtpaint


--1564998097.fA6000.31090
Date: Mon, 5 Aug 2019 09:41:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1144261

            Bug ID: 1144261
           Summary: VUL-0: CVE-2019-14524: An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238883/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-14524

An issue was discovered in Schism Tracker through 20190722. There is a
heap-based buffer overflow via a large number of song patterns in
fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14524
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14524
https://github.com/schismtracker/schismtracker/issues/201


--1564998280.0CcDEeEf0.32162
Date: Mon, 5 Aug 2019 09:44:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1144266

            Bug ID: 1144266
           Summary: VUL-1: CVE-2019-14523: schismtracker: An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/238882/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-14523

An issue was discovered in Schism Tracker through 20190722. There is an integer
underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser
in
fmt/okt.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14523
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14523
https://github.com/schismtracker/schismtracker/issues/202


--1565006864.07DDC3.4878
Date: Mon, 5 Aug 2019 12:07:44 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144316

            Bug ID: 1144316
           Summary: VUL-1: CVE-2019-1010301: jhead: Stack buffer overflow in gpsinfo.c when running jhead
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: sbrabec-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2019-1010301

jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service.
The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is:
Open a specially crafted JPEG file.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1679952
https://nvd.nist.gov/vuln/detail/CVE-2019-1010301
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-1010301.html


body:
Build Identifier:

Hello. I get an error when compiling.

FileNotFoundError: [Errno 2] No such file or directory:
'/usr/bin/x86_64-suse-linux-gnu-pkg-config':
'/usr/bin/x86_64-suse-linux-gnu-pkg-config'

The pkgconf-pkg-conf provides

'/usr/bin/x86_64-suse-linux-pkg-config'

instead of

'/usr/bin/x86_64-suse-linux-gnu-pkg-config'

Please provide '/usr/bin/x86_64-suse-linux-gnu-pkg-config'

---

pkgconf-pkg-config  1.6.1-2.1  opensuse-tumbleweed-oss

Reproducible: Always

make[2]: Entering directory '/builddir/build/BUILD/nimf-2019.07.27/docs'
  DOC   Preparing build
  DOC   Building XML
  DOC   Scanning header files
  DOC   Introspecting gobjects
  DOC   Building XML
./nimf-unused.txt:1: warning: 4 unused declarations. They should be added to
nimf-sections.txt in the appropriate place.
  DOC   Building HTML
  DOC   Fixing cross-references
Traceback (most recent call last):
  File "/usr/bin/gtkdoc-fixxref", line 57, in <module>
    fixxref.Run(options)
  File "/usr/share/gtk-doc/python/gtkdoc/fixxref.py", line 55, in Run
    LoadIndicies(options.module_dir, options.html_dir, options.extra_dir)
  File "/usr/share/gtk-doc/python/gtkdoc/fixxref.py", line 77, in LoadIndicies
    dir = common.GetModuleDocDir('glib-2.0')
  File "/usr/share/gtk-doc/python/gtkdoc/common.py", line 107, in
GetModuleDocDir
    path = subprocess.check_output([config.pkg_config, '--variable=prefix',
module_name], universal_newlines=True)
  File "/usr/lib64/python3.7/subprocess.py", line 395, in check_output
    **kwargs).stdout
  File "/usr/lib64/python3.7/subprocess.py", line 472, in run
    with Popen(*popenargs, **kwargs) as process:
  File "/usr/lib64/python3.7/subprocess.py", line 775, in __init__
    restore_signals, start_new_session)
  File "/usr/lib64/python3.7/subprocess.py", line 1522, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory:
'/usr/bin/x86_64-suse-linux-gnu-pkg-config':
'/usr/bin/x86_64-suse-linux-gnu-pkg-config'
make[2]: Leaving directory '/builddir/build/BUILD/nimf-2019.07.27/docs'
make[2]: *** [Makefile:756: html-build.stamp] Error 1
make[1]: *** [Makefile:512: all-recursive] Error 1
make[1]: Leaving directory '/builddir/build/BUILD/nimf-2019.07.27'
make: *** [Makefile:444: all] Error 2
error: Bad exit status from /var/tmp/rpm-tmp.objkj8 (%build)

summary: missing /usr/bin/x86_64-suse-linux-gnu-pkg-config


--1565018767.6a5D4.7378
Date: Mon, 5 Aug 2019 15:26:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1144346

            Bug ID: 1144346
           Summary: Incomplete Mate menu after upgrade to Leap 15
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: gostal-at-foi.se
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When hitting Menu the following message is displayed:
---
Traceback (most recent call last):

  File "/usr/lib/mate-menu/mate-menu.py", line 209, in PopulatePlugins
    MyPlugin = MyPluginClass.pluginclass(self, self.toggle)

  File "/usr/lib/python3.6/site-packages/mate_menu/plugins/applications.py",
line 309, in __init__
    mymenu = Menu( mainitems )

  File "/usr/lib/python3.6/site-packages/mate_menu/plugins/applications.py",
line 113, in __init__
    self.tree = MateMenu.Tree.new( MenuToLookup,
MateMenu.TreeFlags.SORT_DISPLAY_NAME)

GLib.GError: g-invoke-error-quark: Could not locate matemenu_tree_new:
'matemenu_tree_new': /usr/lib64/libmate-menu.so.2: undefined symbol:
matemenu_tree_new (1)
---
Indeed,

readelf -s /usr/lib64/libmate-menu.so.2|grep new

yields
     7: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND g_string_new
    24: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND g_key_file_new
    36: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND g_file_new_for_path
    54: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND g_hash_table_new
    67: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND
g_hash_table_new_full


--1565020758.Fa820.32326
Date: Mon, 5 Aug 2019 15:59:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1144354

            Bug ID: 1144354
           Summary: VUL-1: CVE-2019-1010302: jhead: incorrect access control in iptc.c Line 122 show_IPTC() causing denial of service
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: sbrabec-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2019-1010302

jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of
service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is:
the victim must open a specially crafted JPEG file.

References

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010302
https://bugzilla.redhat.com/show_bug.cgi?id=1679978
https://bugzilla.redhat.com/show_bug.cgi?id=1735703
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-1010302.html


body:
--1565083678.6624fACE0.28704
Date: Tue, 6 Aug 2019 09:27:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1144453

            Bug ID: 1144453
           Summary: VUL-0: CVE-2019-10217: ansible: gcp modules do not flag sensitive data fields properly
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/239035/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mcepl-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-10217

Fields managing sensitive data should be set as such by no_log feature. Some of
these fields in GCP modules are not set properly. service_account_contents()
which is common class for all gcp modules is not setting no_log to True. Any
sensitive data managed by that function would be leak as an output when running
ansible playbooks.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1733509
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-10217

pkgs: ansible ansible+nagios