--1560591837.65bE1.21307
Date: Sat, 15 Jun 2019 09:43:57 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138354

            Bug ID: 1138354
           Summary: VUL-0: CVE-2019-5439: vlc: A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/235136/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: dimstar-at-opensuse.org
          Reporter: meissner-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-5439

A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly
be further developed into a remote code execution exploit.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-5439
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-5439.html
http://www.cvedetails.com/cve/CVE-2019-5439/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5439
https://hackerone.com/reports/484398


body:
--1560688061.b13B5D1c0.17890
Date: Sun, 16 Jun 2019 12:27:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138369

            Bug ID: 1138369
           Summary: libevent file conflicts
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: meissner-at-suse.com
          Reporter: schwab@linux-m68k.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

A shared libary with the soname libevent-2.1.so.6 must be put in a package
named libevent-2_1-6.

Detected 5 file conflicts:

File /usr/lib64/libevent-2.1.so.6
  from install of
     libevent-2_1-10-2.1.10-1.1.riscv64 (openSUSE-Ports-Tumbleweed-repo-oss)
  conflicts with file from package
     libevent-2_1-8-2.1.8-3.1.riscv64 (@System)

File /usr/lib64/libevent_core-2.1.so.6
  from install of
     libevent-2_1-10-2.1.10-1.1.riscv64 (openSUSE-Ports-Tumbleweed-repo-oss)
  conflicts with file from package
     libevent-2_1-8-2.1.8-3.1.riscv64 (@System)

File /usr/lib64/libevent_extra-2.1.so.6
  from install of
     libevent-2_1-10-2.1.10-1.1.riscv64 (openSUSE-Ports-Tumbleweed-repo-oss)
  conflicts with file from package
     libevent-2_1-8-2.1.8-3.1.riscv64 (@System)

File /usr/lib64/libevent_openssl-2.1.so.6
  from install of
     libevent-2_1-10-2.1.10-1.1.riscv64 (openSUSE-Ports-Tumbleweed-repo-oss)
  conflicts with file from package
     libevent-2_1-8-2.1.8-3.1.riscv64 (@System)

File /usr/lib64/libevent_pthreads-2.1.so.6
  from install of
     libevent-2_1-10-2.1.10-1.1.riscv64 (openSUSE-Ports-Tumbleweed-repo-oss)
  conflicts with file from package
     libevent-2_1-8-2.1.8-3.1.riscv64 (@System)

summary: libevent file conflicts


--1560778943.ef2E71.22011
Date: Mon, 17 Jun 2019 13:42:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138457

            Bug ID: 1138457
           Summary: clang-devel's CMake module refers to /usr/bin/clang-7 which does not exists
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: marius.kittler-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The CMake find module "Clang" provided by the package `clang-devel`
(clang-devel-7.0.1-lp151.1.1) refers to the binary `/usr/bin/clang-7` which
does not exists.

This leads to the following configuration error if a CMake projects tries to
make use of libTooling via `find_package(Clang ...)`:

```
[   84s] CMake Error at /usr/lib64/cmake/clang/ClangTargets.cmake:296
(message):
[   84s]   The imported target "clang" references the file
[   84s]
[   84s]      "/usr/bin/clang-7"
[   84s]
[   84s]   but this file does not exist.  Possible reasons include:
[   84s]
[   84s]   * The file was deleted, renamed, or moved to another location.
[   84s]
[   84s]   * An install or uninstall procedure did not complete successfully.
[   84s]
[   84s]   * The installation package was faulty and contained
[   84s]
[   84s]      "/usr/lib64/cmake/clang/ClangTargets.cmake"
[   84s]
[   84s]   but not all the files it references.
[   84s]
[   84s] Call Stack (most recent call first):
[   84s]   /usr/lib64/cmake/clang/ClangConfig.cmake:18 (include)
[   84s]   generator/CMakeLists.txt:43 (find_package)
[   84s]
[   84s]
[   85s]


body:
--1560805561.DBe5CdA0.4013
Date: Mon, 17 Jun 2019 21:06:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138500

            Bug ID: 1138500
           Summary: Major functionalities of "Pulseeffects" is not available without other packages.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86
                OS: openSUSE Factory
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Sound
          Assignee: tiwai-at-suse.com
          Reporter: andythe_great-at-pm.me
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Pulseeffects is an audio effects for Pulseaudio applications.

https://github.com/wwmm/pulseeffects

The current dependencies and recommendations of Pulseeffects does not include
packages that would enable most of the functionalities.

The currently missing functionalities are

limiter
compressor
filter
equalizer
reverb
bass enhancer
exciter
maximizer
mutiband compressor
loudness
gate
pitch
multiband gate
deesser
stereo tools
delay

To enable it, the following packagess must be include as recommended packages

lsp-plugins (https://github.com/sadko4u/lsp-plugins)
lsp-plugins-jack
lsp-plugins-ladspa
lsp-plugins-lv2
lsp-plugins-vst
calf (found in packman)
lv2-calf (found in packman)
zam-plugins (https://github.com/zamaudio/zam-plugins)
mda-lv2 (https://drobilla.net/software/mda-lv2)

pkgs: lsp-plugins mda-lv2 pulseeffects zam-plugins


--1560839976.8f855dE10.5520
Date: Tue, 18 Jun 2019 06:39:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138529

            Bug ID: 1138529
           Summary: Bazel 0.19.2 fails to build on some workers (ThunderX1)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Java
          Assignee: bnc-team-java-at-forge.provo.novell.com
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 807818
  --> http://bugzilla.opensuse.org/attachment.cgi?id=807818&action=edit
Build log - Build failed on obs-arm-3

Bazel 0.19.2 fails to build on some workers.
Workers ok:
* obs-arm-8 (TX2)
Workers broken:
* obs-arm-3 (TX1)


--1560861279.3ECeAc0.7079
Date: Tue, 18 Jun 2019 12:34:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138572

            Bug ID: 1138572
           Summary: VUL-0: CVE-2019-12816: znc: remote code execution in Modules.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/235206/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: mpluskal-at-suse.com
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-12816

Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users
to escalate privileges and execute arbitrary code by loading a module with a
crafted name.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12816
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12816.html
http://www.debian.org/security/2019/dsa-4463
http://www.cvedetails.com/cve/CVE-2019-12816/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12816
https://github.com/znc/znc/commit/8de9e376ce531fe7f3c8b0aa4876d15b479b7311
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=925285
https://github.com/znc/znc/compare/be1b6bc...d1997d6
https://seclists.org/bugtraq/2019/Jun/23


--1560890381.AB6D780.29724
Date: Tue, 18 Jun 2019 20:39:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138614

            Bug ID: 1138614
           Summary: VUL-0: MozillaFirefox: vulnerability fixed on 67.0.3 / 60.7.1 (MFSA 2019-18)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: wolfgang-at-rosenauer.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Mozilla released a "chemspill" security fix for Firefox:
https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/


--1560929938.AA5abF4.26100
Date: Wed, 19 Jun 2019 07:38:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1138666

            Bug ID: 1138666
           Summary: A build cycle found: python-py and python-pytest
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mlin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: mcepl-at-suse.com, mimi.vx-at-gmail.com, tchvatal-at-suse.com
          Found By: ---
           Blocker: ---

While bootstrapping a staging, I see a build cycle between python-py and
python-pytest.

python*-pytest RPM requires python*-py for installable, however python-py
package has buildrequires python-pytest.


--1560947776.32B03.17725
Date: Wed, 19 Jun 2019 12:36:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138719

            Bug ID: 1138719
           Summary: Kernel 4.12.14-lp150.12.64 disallows NFSv4 mounting with -o minorversion=2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: neyers-at-geod.uni-bonn.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hello,

this kernel update made changes to limit the max minor version for NFSv4 mounts
[0,1].

Now I cannot mount --previously (correctly?) working


body:
--1560949213.f4C3a83a1.26183
Date: Wed, 19 Jun 2019 13:00:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138725

            Bug ID: 1138725
           Summary: Add Ignition to Tumbleweed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: MicroOS
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: iforster-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Ignition (https://github.com/coreos/ignition) is supposed to replace cloud-init
as a minimal alternative for several system images
(https://en.opensuse.org/Kubic:MicroOS#Configuration). This bug tracks the
necessary changes done to include the project into the distribution.

summary: Add Ignition to Tumbleweed


--1560950767.BB8aafD13.3989
Date: Wed, 19 Jun 2019 13:26:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138728

            Bug ID: 1138728
           Summary: The service file in package ntpsec has a typo
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: maikel.grep-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

After installing ntpsec you have to manually edit the following file, otherwise
systemd can not start the service.

`/usr/lib/systemd/system/ntpd.service `

Had to change:
ExecStart=/usr/ssbin/ntpd -g -N -u ntp:ntp
To:
ExecStart=/usr/sbin/ntpd -g -N -u ntp:ntp Than reload systemctl daemon:

`sudo systemctl daemon-reload
`
After this you should be able to start ntpsec through:
`sudo systemctl start ntpd`


body:
--1560964807.F5dfE8C4.19809
Date: Wed, 19 Jun 2019 17:20:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138751

            Bug ID: 1138751
           Summary: Gajim complains about "object has no attribute" (Leap 15)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: stakanov-at-freenet.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Versions
- OS: Linux
- GTK+ Version: 3.22.30
- PyGObject Version: 3.26.1
- python-nbxmpp Version: 0.6.6
- Gajim Version: 1.0.3

## Traceback
```
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/gajim/app_actions.py", line 275, in
on_open_event
    dict_['type_'])
  File "/usr/lib/python3.6/site-packages/gajim/gui_interface.py", line 1747, in
handle_event
    session=session)
  File "/usr/lib/python3.6/site-packages/gajim/gui_interface.py", line 2157, in
new_chat
    fjid = contact.jid
AttributeError: 'NoneType' object has no attribute 'jid'

```

How to reproduce:
open a session of gajim. Let it run for a while and change user in the
meanwhile. When coming back, the app will have crashed and may have restarted
(giving way to multiple instances in that userspace).
Reproducible: sometimes (but with a 70-80 % chance if the session is long
enough.
Effects: the app will not be able to connect although, when quit and restarted,
it will connect instantly and w/o problem.
There is a similar error I am experiencing on TW, which I will file however in
a different report (if you deem it useful). I think it might be the same error
message but I am not sure (it is on another machine).

Special settings:
I do use a hidden service via tor to use gajim with xmmp/jabber. As long as the
aforementioned situation has not taken place, the app works flawlessly.

pkgs: gajim python-nbxmpp


body:
--1560999167.3eBd0.14370
Date: Thu, 20 Jun 2019 02:52:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1138769

            Bug ID: 1138769
           Summary: lxd Leap 15.1 binary segfaults
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I'm not sure what's going on here, but *only* the /usr/bin/lxd binary is
broken. It appears to be static, but when you run it you get a segfault on
_start().

  % file /usr/bin/lxd
  /usr/bin/lxd: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV),
statically linked, for GNU/Linux 3.2.0, Go
BuildID=GdZOLKvg63lc6Boba78R/4Q52DzbZrTOD6CDev-XO/ANxY6iT7BnPJTXDp5YrJ/ZwqyxJJe4211lTaWHUAX,
BuildID[sha1]=689a0978ba58d4940530b894289cf8b02f0fad57, stripped
  % /usr/bin/lxd
  [1]    29170 segmentation fault (core dumped)  /usr/bin/lxd
  % gdb /usr/bin/lxd
  (gdb) r
  Starting program: /usr/bin/lxd
  Missing separate debuginfo for /lib64/ld-linux-x86-64.so.2
  Try: zypper install -C
"debuginfo(build-id)=4175850776c31925732d83c534fdef41821fccfb"

  Program received signal SIGSEGV, Segmentation fault.
  0x000000000055e030 in _start ()

It looks to me like some of the weird 15-bprm-strip errors are the cause so I
will disable them (I was under the impression "nodebuginfo" was already doing
that but I guess I need to use %go_strip again).

summary: lxd Leap 15.1 binary segfaults


body:
--1560999303.fFaA0.16403
Date: Thu, 20 Jun 2019 02:55:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1138770

            Bug ID: 1138770
           Summary: [trackerbug] lxd 3.14 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXD 3.14. The full upstream changelog is available from:
  https://discuss.linuxcontainers.org/t/lxd-3-14-has-been-released/5045
  + Cluster: Re-worked DNS forwarding
  + Script to factory reset LXD
  + Improvements to syscall interception
  * Lots of bug fixes...

summary: [trackerbug] lxd 3.14 update


body:
--1561023150.30D52EaD11.26136
Date: Thu, 20 Jun 2019 09:32:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138796

            Bug ID: 1138796
           Summary: LTO: elftuils build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/elfutils/standard/x86_64

due to symbol versioning.

summary: LTO: elftuils build fails


body:
--1561023314.d7ff8Ce4.29688
Date: Thu, 20 Jun 2019 09:35:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138797

            Bug ID: 1138797
           Summary: LTO: expect build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/expect/standard/x86_64

it's due to a static library in tcl that should use fat LTO objects.

summary: LTO: expect build fails


body:
--1561024055.3Ac110.2449
Date: Thu, 20 Jun 2019 09:47:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138803

            Bug ID: 1138803
           Summary: LTO: fuse3 build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails due to symbol versioning in:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/fuse3/standard/x86_64

summary: LTO: fuse3 build fails


body:
--1561024521.D10dFa15.2449
Date: Thu, 20 Jun 2019 09:55:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138807

            Bug ID: 1138807
           Summary: LTO: glibc build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/glibc/standard/x86_64

I'm going to disable LTO for the package.

summary: LTO: glibc build fails


body:
--1561025359.4dc7Ba11.12658
Date: Thu, 20 Jun 2019 10:09:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138809

            Bug ID: 1138809
           Summary: LTO: gmp build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails in the following test-case:

abuild@marxinbox:~/rpmbuild/BUILD/gmp-6.1.2/tests/mpz> ./t-get_d_2exp
mpz_get_d_2exp wrong on 2**54-1
result out of range, expect 0.5 <= got < 1.0
   rnd_mode = 0
   data[i]  = 54
   z    =0x3FFFFFFFFFFFFF
   got  =[00 00 00 00 00 00 F0 3F] 1
   got exp  54
Aborted (core dumped)

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/gmp/standard/x86_64

For not I'm going to disable LTO for it.

summary: LTO: gmp build fails


body:
--1561026058.f2cDFC111.13435
Date: Thu, 20 Jun 2019 10:20:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138812

            Bug ID: 1138812
           Summary: LTO: libsemanage build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/libsemanage/standard/x86_64

due to a symbol versioning issue.

summary: LTO: libsemanage build fails


body:
--1561026281.E66Bc4.17922
Date: Thu, 20 Jun 2019 10:24:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138813

            Bug ID: 1138813
           Summary: LTO: libsepol build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails due to symbol versioning:

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/libsepol/standard/x86_64

summary: LTO: libsepol build fails


body:
--1561031331.EFe44.7733
Date: Thu, 20 Jun 2019 11:48:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138833

            Bug ID: 1138833
           Summary: LTO: libxcrypt build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails due to symbol versioning:

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/libxcrypt/standard/x86_64

summary: LTO: libxcrypt build fails


body:
--1561031516.befD4.12192
Date: Thu, 20 Jun 2019 11:51:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138834

            Bug ID: 1138834
           Summary: LTO: post-build-checks build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/post-build-checks/standard/x86_64

summary: LTO: post-build-checks build fails


--1561054337.6c5C2.28286
Date: Thu, 20 Jun 2019 18:12:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138872

            Bug ID: 1138872
           Summary: VUL-0:  CVE-2019-11708: MozillaFirefox: sandbox escape using Prompt:Open fixed in 67.0.4, 60.7.2 ESR (MFSA 2019-19)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: cgrobertson-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: wolfgang-at-rosenauer.org
          Found By: Security Response Team
           Blocker: ---

https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/

CVE-2019-11708: sandbox escape using Prompt:Open

Reporter: Coinbase Security
Impact: high

Insufficient vetting of parameters passed with the Prompt:Open IPC message
between child and parent processes can result in the non-sandboxed parent
process opening web content chosen by a compromised child process. When
combined with additional vulnerabilities this could result in executing
arbitrary code on the user's computer.

Fixed in Firefox 67.0.4, Firefox ESR 60.7.2

References:
https://bugzilla.mozilla.org/show_bug.cgi?id=1559858


--1561055464.7506c0.30252
Date: Thu, 20 Jun 2019 18:31:04 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1138874

            Bug ID: 1138874
           Summary: Update Leap 15.1-28.4 -> 15.1-28.7, QLA2xxx crashed
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: holger@fam-schranz.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 808098
  --> http://bugzilla.suse.com/attachment.cgi?id=808098&action=edit
DMESG, LEAP 15.1-28.7

Hello,

after update from

opensuse 15.1: Linux_4.12.14-lp151.28.4
opensuse 15.1: Linux_4.12.14-lp151.28.7

the driver qla2xxx run into a dump.

With issue the work with the virtual environment is no longer
possible. More than 60 virtual systems (150 virtual machines)
are involved over 5 virtual hosts.

To continue the work we switched back to Linux_4.12.14-lp151.28.4.

May be others are also involved.

I attached the journalctl, dmesg and a rpm -qa list.

The journalctl are from Linux_4.12.14-lp151.28.4 (o.k. version)
and Linux_4.12.14-lp151.28.7 (bad version)

I opened this issue report as a privat report. If necessary I will
opened an urgent call via FUJITSU as a customer from SuSE.

Best regards

Holger


--1561123468.EfCbdb31.30188
Date: Fri, 21 Jun 2019 13:24:28 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1138933

            Bug ID: 1138933
           Summary: VUL-1: CVE-2019-12874: vlc: double free in zlib_decompress_extra in modules/demux/mkv/util.cpp
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/235378/
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Security
          Assignee: dimstar-at-opensuse.org
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-12874

An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp
in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while
parsing a malformed MKV file type, has a double free.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12874
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12874.html
http://www.cvedetails.com/cve/CVE-2019-12874/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12874
http://git.videolan.org/?p=vlc.git;a=commit;h=81023659c7de5ac2637b4a879195efef50846102


body:
Build Identifier:

When updating Tumbleweed using zypper dup -dl, the following error is reported:

Problem: gparted-0.33.0-1.4.x86_64 requires btrfsprogs >= 4.1, but this
requirement cannot be provided
  not installable providers: btrfsprogs-5.1-1.3.i586[download.opensuse.org-oss]
                   btrfsprogs-5.1-1.3.x86_64[download.opensuse.org-oss]
 Solution 1: Following actions will be done:
  remove lock to allow installation of
btrfsprogs-5.1-1.3.i586[download.opensuse.org-oss]
  install btrfsprogs-5.1-1.3.i586 despite the inferior architecture
  install libreiserfscore0-3.6.27-4.3.i586 despite the inferior architecture
  install libzstd1-1.4.0-2.1.i586 despite the inferior architecture
 Solution 2: deinstallation of gparted-0.33.0-1.2.x86_64
 Solution 3: keep obsolete gparted-0.33.0-1.2.x86_64
 Solution 4: remove lock to allow installation of
btrfsprogs-5.1-1.3.x86_64[download.opensuse.org-oss]
 Solution 5: break gparted-0.33.0-1.4.x86_64 by ignoring some of its
dependencies

Choose from above solutions by number or cancel [1/2/3/4/5/c] (c):

I do not use btfrs, and have no btrfs packages installed. Gparted is usable
without btrfs-progs if no btrfs filesystems are used, so btrfs-progs should be
in the "recommends" list for gparted, not the "requires" list.

btrfs-progs should, of course, be required by btrfs.

Reproducible: Always

Steps to Reproduce:
1. Uninstall btrfs/btrfs-progs
2. Attempt to update system with gparted installed.
3.

Expected Results:
btrfsprogs should not be required by gparted - only recommended.

summary: Gparted requires btrfs-progs - should be recommends, not requires.


--1561369941.e2fdDAf80.10936
Date: Mon, 24 Jun 2019 09:52:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139094

            Bug ID: 1139094
           Summary: VUL-0: CVE-2018-18836: netdata: JSON injection
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/235364/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-18836

An issue was discovered in Netdata 1.10.0. JSON injection exists via the
api/v1/data tqx parameter because of web_client_api_request_v1_data in
web/api/web_api_v1.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18836
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18836.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18836
https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L403
https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca
https://github.com/netdata/netdata/pull/4521
https://www.red4sec.com/cve/netdata_json_injection.txt
https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L388


--1561369946.d0750A620.11310
Date: Mon, 24 Jun 2019 09:52:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139095

            Bug ID: 1139095
           Summary: VUL-0: CVE-2018-18837: netdata: HTTP Header Injection
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/235365/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-18837

An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the
api/v1/data filename parameter because of web_client_api_request_v1_data in
web/api/web_api_v1.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18837
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18837.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18837
https://www.red4sec.com/cve/netdata_header_injection.txt
https://github.com/netdata/netdata/pull/4521
https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca
https://github.com/netdata/netdata/blob/798c141c49ee85bddc8f48f25d2cb593ec96da07/web/api/web_api_v1.c#L367-L370


--1561370175.6DBdC0Af3.11816
Date: Mon, 24 Jun 2019 09:56:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139098

            Bug ID: 1139098
           Summary: VUL-0: CVE-2018-18838: netdata: Log Injection
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/235366/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2018-18838

An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery)
exists
via a %0a sequence in the url parameter to api/v1/registry.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-18838
http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-18838.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18838
https://www.red4sec.com/cve/netdata_log_injection.txt
https://github.com/netdata/netdata/commit/92327c9ec211bd1616315abcb255861b130b97ca
https://github.com/netdata/netdata/pull/4521


--1561426302.eA6e2bFb0.10186
Date: Tue, 25 Jun 2019 01:31:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139210

            Bug ID: 1139210
           Summary: go1.12 - doesn't install /usr/lib64/go/1.12/misc/wasm/wasm_exec.js and others
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: palica-at-liguros.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

For example, programs such as https://github.com/vugu/vugu and
documentation such as https://github.com/golang/go/wiki/WebAssembly
expect to find wasm_exec.js at "$(go env GOROOT)/misc/wasm/wasm_exec.js".

reference https://github.com/vugu/vugu/issues/33


body:
--1561483059.86f0680.30118
Date: Tue, 25 Jun 2019 17:17:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139359

            Bug ID: 1139359
           Summary: After update to openSUSE Leap 15.1, some important KDE areas no longer translated into Lithuanian
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Translations
          Assignee: ke-at-suse.com
          Reporter: opensuse.lietuviu.kalba-at-gmail.com
        QA Contact: ke-at-suse.com
          Found By: ---
           Blocker: ---

Compared to openSUSE Leap 42.3 and 15.0, openSUSE Leap 15.1 has very visible
areas where KDE has missing translation into Lithuanian, e.g. in Dolphin. Some
Dolphin translations comes from kio-lang-5.55.0.

Indeed, some KDE translations done for KDE Frameworks 5.56.0, however openSUSE
Leap 15.1 shipped KDE Frameworks 5.55.0. Thus it would be nice to backport some
translations.

pkgs: dolphin kio spectacle


--1561492822.8eb7fB0.13612
Date: Tue, 25 Jun 2019 20:00:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1139369

            Bug ID: 1139369
           Summary: multipath-tools: post-0.8.1 upstream bug fixes
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Upstream multipath-tools fixes from dm-devel, post 0.8.1

1) libmultipath: make vector_foreach_slot_backwards work as expected
- Matters only for foreign/NVMe code (also for "multipath -W", but without user
noticeable impact)
  => Factory/SLE15-SP1 only

QA test case: Use NVMe native multipath and run multipathd. Remove one or more
NVMe paths. => multipathd crashes.

2) multipathd: fix REALLOC_REPLY with max length reply
- fix for cd5a9797e "libmpathcmd(coverity): limit reply length"
- Factory/SLE15-SP1 only, the others don't contain the broken commit

QA test case: None, corner case which occurs only if a client command gets a
reply with >= 32768 bytes.

3) multipath: call store_pathinfo with DI_BLACKLIST
- performance; cli_add_path() may add blacklisted path
- Factory, SLE15, SLE15-SP1, SLE12-SP3/4

QA test case: Blacklist some paths (by any mechanism other than devnode).
Verify that "multipathd show paths" doesn't list the blacklisted devices
Run "multipathd add path $X" where $X is one of the blacklisted paths.
 => ok (expected: fail with msg "blacklisted").

4) multipathd: fix client response for socket activation
- minor corner-case fix
- Factory/SLE15-SP1 only

QA test case: stop multipathd on a system with some multipath maps. Run
"multipathd show topology"
=> success with empty output (expected: success with correct topology output)

5) libmultipath: get_prio(): really don't reset prio for inaccessible paths
- Factory, SLE15, SLE12-SP4, SLE15-SP1

QA test case: perhaps reproducible with a setup with lots of pass
loss/reinstate events, by monitoring the topology with "group_by_prio". It's a
rare condition though which happens only if a path becomes inaccessible in the
small time windw between the state check and the get_prio() call in pathinfo().
See bug 1118495.


--1561629875.Cc4AaF40.20498
Date: Thu, 27 Jun 2019 10:04:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139561

            Bug ID: 1139561
           Summary: Checkmedia on opensuse 15.0 reports corrupt installation DVD
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: x86-64
                OS: All
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: bob-at-vickers.simplyms.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I've marked this as critical because one explanation of what I am seeing is
that you are distributing a DVD image that has been tampered with. Hopefully
the real explanation is less serious.

I have just downloaded the opensuse 15.1 installation DVD and naturally checked
it before using it. But checkmedia from the command line and Yast both report
sha256sum wrong.

However, the commands md5sum and sha256sum both report values exactly matching
those given on the download page
https://download.opensuse.org/distribution/leap/15.1/iso/openSUSE-Leap-15.1-DVD-x86_64.iso?mirrorlist
which strongly suggests no corruption occurred during the download process.

So either something very bad has happened on your download pages, or checkmedia
is telling fibs.

Here is a transcript of what happened:

$ md5sum openSUSE-Leap-15.1-DVD-x86_64.iso
5095682b8aafd540975388704cc8ae1a  openSUSE-Leap-15.1-DVD-x86_64.iso
$ sha256sum openSUSE-Leap-15.1-DVD-x86_64.iso
c6d3ed19fe5cc25c4667bf0b46cc86aebcfbca3b0073aed0a288834600cb8b97
openSUSE-Leap-15.1-DVD-x86_64.iso
$ rpm -q checkmedia
checkmedia-3.7-lp150.1.3.x86_64
$ checkmedia --verbose openSUSE-Leap-15.1-DVD-x86_64.iso
    raw: key = "check", value = "1"
    raw: key = "pad", value = "150"
    raw: key = "sha256sum", value =
"421118e428b81edf9f2e76c3aafae286bcf507954f57f86b48029e9b83bf8d44"
    raw: key = "partition", value =
"10572,7913140,c8ff72ac0fe126106bf42dff8eacb33b25bfc3f519f5a54b2d6598cf2a1b46ef"
    app: openSUSE-Leap-15.1-DVD-x86_64-Build470.1-Media
  media: DVD1
   size: 3961474 kB
 hybrid: 3961856 kB
    pad: 300 kB
    ref: 10570279131400c8ff72ac0fe126106bf42dff8eacb33b25bfc3f519f5a54b2d
  check: 100%
  check: sha256sum wrong
sha256*: 421118e428b81edf9f2e76c3aafae286bcf507954f57f86b48029e9b83bf8d44
 sha256: c6d3ed19fe5cc25c4667bf0b46cc86aebcfbca3b0073aed0a288834600cb8b97


--1561638723.5f1aDA0.4377
Date: Thu, 27 Jun 2019 12:32:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139584

            Bug ID: 1139584
           Summary: LLVM8: inconsistent configuration exposed between cmake and llvm-config
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This issue surfaced while I tried upgrading meson to version 0.51.0 - where a
new LLVM test suite has been added

The test validates that it makes no difference by what means one would interact
with llvm, i.e be it by querying llvm-config or using cmake. Sadly, only
openSUSE. said test fails with:

[  621s] meson.build:41:4: ERROR: Assert failed: RTTI information for cmake and
config tools disagree

And indeed, when inspecting the internas, one gets:

> llvm-config --has-rtti
YES

> grep RTTI /usr/lib64/cmake/llvm/LLVMConfig.cmake
set(LLVM_ENABLE_RTTI OFF)

So in this case it would actually make a difference to the consumer if they
were to use cmake or llvm-config to detect what capabilities our LLVM8
provides. Certainly that is not meant to be like this.


--1561714767.cEdE41.13801
Date: Fri, 28 Jun 2019 09:39:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1139692

            Bug ID: 1139692
           Summary: Let's move xorg.conf.d snippets from /etc/X11/xorg.conf.d to /usr/share/X11/xorg.conf.d
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: sndirsch-at-suse.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Let's move xorg.conf.d snippets from /etc/X11/xorg.conf.d to
/usr/share/X11/xorg.conf.d.

Related:
https://github.com/thkukuk/atomic-updates_and_etc/blob/master/README.md#proposals


--1561721777.f8737.19804
Date: Fri, 28 Jun 2019 11:36:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139721

            Bug ID: 1139721
           Summary: kdepim-runtime built without OAuth2 support
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Missing build dependencies, but both are available in Leap 15.1.


--1561986999.Cec7812.14765
Date: Mon, 1 Jul 2019 13:16:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139928

            Bug ID: 1139928
           Summary: lyx preview with eps picture not working
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: c.chalu-at-free.fr
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Dear maintainers,
The preview of an picture in *.eps format does not work in lyx.
By installing the kimageformats-eps package the preview is ok.
No problem with other picture formats such as png or jpeg.
Can you add the package kimageformats-eps to the list of required packages for
lyx ?

System : Leap 15.1
Desktop : kde 5.12.8
Kernel : 4.12.14-lp151.28.7-default
Lyx : 2.3.2-lp151.2.1


--1561991093.CDBbFC529.19414
Date: Mon, 1 Jul 2019 14:24:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1139939

            Bug ID: 1139939
           Summary: kernel does not contain version information
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: S/390-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: gunreben@t-online.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The current kernel rpm (5.1.10-1.2) does not contain a kernel version string.
Unfortunately, this makes the install fail, because get_kernel_version does not
return the version string.

To reproduce, run get_kernel_version on the kernel binary
To get the rpm, run:

osc getbinaries openSUSE:Factory:zSystems kernel-default standard s390x

Another possibility to check is to run the command strings on the kernel which
is found on DVD1 below /boot/s390x/linux.


--1562007196.FcC8eB31.18244
Date: Mon, 1 Jul 2019 18:53:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1139962

            Bug ID: 1139962
           Summary: Certain text appears in other language (not English)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: i586
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AutoYaST
          Assignee: yast2-maintainers-at-suse.de
          Reporter: forumino-at-riseup.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

My system is installed and configured in English.

However I notice that in YaST > Miscellaneous > Autoinstallation Configuration
certain text appears in some other language. Examples:

Groups: Software, Modules: the 3d item is "Pemilihan Paket"
Groups: Hardware, Modules: 2nd item is "Partisi" (should be Partitions)
Groups: System, Modules: 4th item is "Laporan & Pencatatan"
Groups: Miscellaneous, Modules: "Berkas Konfigurasi Lengkap" and "Skrip Khusus"

I don't know what language that is.

There may be other items too. These are just the onese which I saw.

I am testing this in text mode.


body:
Build Identifier:

Tumbleweed (VERSION_ID="20190626") with gnome-shell-classic-3.32.1-2.2.noarch

The window-list extension does not show up on the desktop like it should.

Run journalctl and look for "window-list". It should be reporting an error.
Mine was complaining about "Convenience" being undefined.

/usr/share/gnome-shell/extensions/window-list@gnome-shell-extensions.gcampax.github.com/extension.js
references "Convenience", which looks like it used to be part of this
extension, but has been removed in the current builds.

Around line 62 of extension.js, change:

this._settings = Convenience.getSettings();

to:

this._settings = ExtensionUtils.getSettings();

Restart Gnome and window-list shows up correctly.

Reproducible: Always

Steps to Reproduce:
1. Log in to Gnome desktop using Classic mode
2. Run applications.
3. Notice that the "window-list" extension is not showing applications in the
status bar, bottom of the screen.
Actual Results:
The window-list extension shows no applications.

Expected Results:
The window-list extension should be showing applications.

summary: window-list extension for gnome-shell-classic references convenience.js has been removed.


--1562059582.1ef5b9.21535
Date: Tue, 2 Jul 2019 09:26:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140037

            Bug ID: 1140037
           Summary: [Build 20190701] openQA test fails in yast2_i: Cannot install packages with 1GiB of RAM
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/972266/modules/yast2
                    _i/steps/33
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: YaST2
          Assignee: yast2-maintainers-at-suse.de
          Reporter: fvogt-at-suse.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Installing packages on JeOS inside a VM with 1GiB RAM from YaST fails.

Spawning the RPM process fails as it runs out of memory as the kernel's default
overcommit policy does not allow forking the YaST process due a lot of private
memory being used.

## Observation

openQA test in scenario
opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos@64bit_virtio fails in
[yast2_i](https://openqa.opensuse.org/tests/972266/modules/yast2_i/steps/33)

## Test suite description
Maintainer: fvogt, mnowak

Start JeOS from the HDD image, configure it using the firstboot wizard and then
run basic tests. console=tty0 added as needed for aarch64.

## Reproducible

Fails since (at least) Build
[20190329](https://openqa.opensuse.org/tests/895647)

## Expected result

Last good: (unknown) (or more recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?version=Tumbleweed&distri=opensuse&arch=x86_64&test=jeos&flavor=JeOS-for-kvm-and-xen&machine=64bit_virtio)


body:
--1562072257.5Dfc2AE0.11919
Date: Tue, 2 Jul 2019 12:57:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140084

            Bug ID: 1140084
           Summary: VirtualBox constantly steals focus
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: o.beiter-at-googlemail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Summary: VirtualBox VM immediately steals back focus.

Reproduce: Set up and launch a VBox VM, open a text editor on the host, try to
write in it.

Expected behavior: Writing appears in the text editor.

Actual behavior: Focus is on the VM, writing appears there, if a text field was
last selected.

See for a possible explanation and workaround:
https://bugreports.qt.io/browse/QTBUG-76742

summary: VirtualBox constantly steals focus


--1562114659.5be74.20635
Date: Wed, 3 Jul 2019 00:44:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1140151

            Bug ID: 1140151
           Summary: AUDIT-0: libvirt: new polkit permissions for networkport
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jfehlig-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

libvirt 5.5.0 got some new polkit permissions for the networkport object via
commit e69444e1793, which cause the following lint failures

[  732s] libvirt-daemon.x86_64: E: polkit-unauthorized-privilege (Badness:
10000) org.libvirt.api.network-port.getattr (yes:yes:yes)
[  732s] libvirt-daemon.x86_64: E: polkit-unauthorized-privilege (Badness:
10000) org.libvirt.api.network-port.read (yes:yes:yes)
[  732s] The package allows unprivileged users to carry out privileged
operations
[  732s] without authentication. This could cause security problems if not done
[  732s] carefully. If the package is intended for inclusion in any SUSE
product please
[  732s] open a bug report to request review of the package by the security
team.
[  732s] Please refer to
[  732s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[  732s] more information.
[  732s]
[  732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.libvirt.api.network-port.create (no:no:no)
[  732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.libvirt.api.network-port.delete (no:no:no)
[  732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.libvirt.api.network-port.write (no:no:no)
[  732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000)
org.libvirt.api.network.search-ports (no:no:no)
[  732s] The privilege is not listed in /etc/polkit-default-privs.* which makes
it
[  732s] harder for admins to find. Furthermore polkit authorization checks can
easily
[  732s] introduce security issues. If the package is intended for inclusion in
any
[  732s] SUSE product please open a bug report to request review of the package
by the
[  732s] security team. Please refer to
[  732s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[  732s] more information.


--1562142230.17E8500.10493
Date: Wed, 3 Jul 2019 08:23:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140193

            Bug ID: 1140193
           Summary: Salt "pkg.downloaded" state is crashing because unexpected "fromrepo" argument
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Salt
          Assignee: salt-maintainers-at-suse.de
          Reporter: pablo.suarezhernandez-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The latest "salt-2019.2.0-7.1" package released on Tumbleweed contains an issue
with "pkg.downloaded" state.

Given the following example SLS file at /srv/salt/test_pkg.sls:

test_pkg_downloaded:
  pkg.downloaded:
    - name: salt

When running "salt-call --local state.apply test_pkg" is going to produce a
traceback:

local:
----------
          ID: test_pkg_downloaded
    Function: pkg.downloaded
        Name: salt
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call
last):
                File "/usr/lib/python3.7/site-packages/salt/state.py", line
1939, in call
                  ret = self.states[cdata['full']](*cdata['args'],
**cdata['kwargs'])
                File "/usr/lib/python3.7/site-packages/salt/loader.py", line
1982, in wrapper
                  return f(*args, **kwargs)
                File "/usr/lib/python3.7/site-packages/salt/states/pkg.py",
line 2068, in downloaded
                  **kwargs)
                File "/usr/lib/python3.7/site-packages/salt/states/pkg.py",
line 268, in _find_download_targets
                  cur_pkgs = __salt__['pkg.list_downloaded'](**kwargs)
              TypeError: list_downloaded() got an unexpected keyword argument
'fromrepo'
     Started: 09:20:36.896878
    Duration: 0.843 ms
     Changes:

Summary for local
------------
Succeeded: 0
Failed:    1
------------
Total states run:     1
Total run time:   0.843 ms


body:
--1562144874.F03a10.31311
Date: Wed, 3 Jul 2019 09:07:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1140203

            Bug ID: 1140203
           Summary: luatex 2019 crashes in Sphinx tests
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: werner-at-suse.com
          Reporter: tchvatal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

As per $SUMMARY the luatex crashes when building stuff in Sphinx testsuite.

The test boils down to call:

lualatex --halt-on-error --interaction=nonstopmode -output-directory=lualatex
lualatex/sphinxtests.tex

I will attach the output and the tex file here.

The command worked fine with 2018 lualatex.

summary: luatex 2019 crashes in Sphinx tests


--1562157691.6b8fAa3A0.2011
Date: Wed, 3 Jul 2019 12:41:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140254

            Bug ID: 1140254
           Summary: VUL-0: CVE-2019-7165,CVE-2019-12594: dosbox: Parsing buffer overflow and access control issue
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/236074/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

We received the following email from Debian upstream:

Source: dosbox
Version: 0.74-2-3
Severity: important
Tags: security upstream
Control: found -1 0.74-4.2+deb9u1
Control: found -1 0.74-4

Hi,

The following vulnerabilities were published for dosbox.

> From https://www.dosbox.com/news.php?show_news=1
>
> DOSBox 0.74-3 has been released!
>
> A security release for DOSBox 0.74:
>
>     Fixed that a very long line inside a bat file would overflow the
>     parsing buffer. (CVE-2019-7165 by Alexandre Bartel)

>     Added a basic permission system so that a program running inside
>     DOSBox can't access the contents of /proc (e.g. /proc/self/mem)
>     when / or /proc were (to be) mounted. (CVE-2019-12594 by Alexandre
>     Bartel)

>     Several other fixes for out of bounds access and buffer overflows.

>     Some fixes to the OpenGL rendering.
>
>
> The game compatibility should be identical to 0.74 and 0.74-2.
> It's recommended to use config -securemode when dealing with
> untrusted files.
>
>
> Ideally, 0.75 should have been released by now, but some bugs took a
> lot longer than expected.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-7165
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7165
[1] https://security-tracker.debian.org/tracker/CVE-2019-12594
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12594

------------------------------------------------------------------------
PoC: https://github.com/Alexandre-Bartel/CVE-2019-12594


--1562158357.CF13e0.3354
Date: Wed, 3 Jul 2019 12:52:37 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140256

            Bug ID: 1140256
           Summary: VUL-0: CVE-2019-13178: calamares: race condition in modules/luksbootkeyfile/main.py
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/236135/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: opensuse.lietuviu.kalba-at-gmail.com
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-13178

modules/luksbootkeyfile/main.py in Calamares through 3.2.4 has a race condition
between the time when the LUKS encryption keyfile is created and when secure
permissions are set.

Reference:
https://github.com/calamares/calamares/issues/1190
https://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/
https://www.pavelkogan.com/2015/01/25/linux-mint-encryption/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1726565
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13178
http://www.cvedetails.com/cve/CVE-2019-13178/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13178
https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835096
https://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/
https://www.pavelkogan.com/2015/01/25/linux-mint-encryption/
https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1835095
https://github.com/calamares/calamares/issues/1190


body:
--1562514070.eD7DB0.10348
Date: Sun, 7 Jul 2019 15:41:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140595

            Bug ID: 1140595
           Summary: linphone is broken
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: stakanov-at-freenet.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

linphone is broken and cannot start on TW.
linphone
[17:34:42:072][0x5599290cd800][Fatal]/home/abuild/rpmbuild/BUILD/linphoneqt-4.1.1/src/app/App.cpp:487:
Unable to install default translator.
KCrash: Application 'linphone' crashing...
KCrash: Attempting to start /usr/lib64/libexec/drkonqi from kdeinit
sock_file=/run/user/1000/kdeinit5__0

[1]+  Fermato                 linphone

Tried to install debug packages but the process in konqi aborts without
apparent reason for a library that he searches but does not find.

As a result this program cannot be used any more.

summary: linphone is broken


--1562566156.Bf8AE213.14989
Date: Mon, 8 Jul 2019 06:09:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140614

            Bug ID: 1140614
           Summary: Error loading Applications menu extension in SLE-Classic
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: qkzhu-at-suse.com
          Reporter: qkzhu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: gwang-at-suse.com, xiaoguang.wang-at-suse.com,
                    yfjiang-at-suse.com, zcjia-at-suse.com
          Found By: ---
           Blocker: ---

apps-menu disappeared in TW-20190704, and journalctl shows:
> gnome-shell[2369]: Extension "apps-menu@gnome-shell-extensions.gcampax.github.com" had error: Error: Requiring GMenu, version none: Typelib file for namespace 'GMenu' (any version) not found


body:
--1562582179.bbFCceC3.27326
Date: Mon, 8 Jul 2019 10:36:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140688

            Bug ID: 1140688
           Summary: Raspberry 3B+ no bluetooth device
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: SUSE Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: vatprc_cyq-at-outlook.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 809672
  --> http://bugzilla.opensuse.org/attachment.cgi?id=809672&action=edit
dmesg log

I have RPI 3B+ with Tumbleweed 20190607
Found bluetooth is unusable.
hciconfig no output,bluetoothctl is not responding,'hcitool dev'show no
devices,
and dmesg|grep bth / dmesg|grep bluetooth is no results:

hcitool output:suse-pi:~ # hcitool dev
Devices:

suse-pi:~ # hciconfig

summary: Raspberry 3B+ no bluetooth device


--1562584083.0D1ec5d4.23559
Date: Mon, 8 Jul 2019 11:08:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1140697

            Bug ID: 1140697
           Summary: [TRACKERBUG] update osc to version 0.165.2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: marco.strigl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This is a trackerbug for the version update of osc to version 0.165.2


body:
--1562615621.CFBc6aaD0.5008
Date: Mon, 8 Jul 2019 19:53:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140772

            Bug ID: 1140772
           Summary: openconnect: please update  vpnc-script
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: gernot-at-hillier.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Current openconnect package from openSUSE:factory still includes a vpnc-script
dating back at least 2 years (file date according to OBS: 2017-09-22, see
https://build.opensuse.org/package/show/network/openconnect).

Please update this file to a current version from the vpnc-script repository of
David Woodhouse (openconnect author), see
http://git.infradead.org/users/dwmw2/vpnc-scripts.git/blob/refs/heads/master:/vpnc-script.

This brings a lot of improvements for non-trivial network setups, IPv6 etc.,
see http://git.infradead.org/users/dwmw2/vpnc-scripts.git/shortlog - including
necessary extensions we need for using OpenConnect at Siemens. :)

Thanks!

summary: openconnect: please update  vpnc-script


body:
--1562684123.FDcfEda0.29373
Date: Tue, 9 Jul 2019 14:55:23 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1140899

            Bug ID: 1140899
           Summary: kvm_stat SyntaxError: Invalid Syntax
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Tools
          Assignee: virt-bugs-at-suse.de
          Reporter: jose.gomez-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

My setup is openSUSE Leap 15.1

# cat /etc/*release*
NAME="openSUSE Leap"
VERSION="15.1 "
ID="opensuse-leap"
ID_LIKE="suse opensuse"
VERSION_ID="15.1"
PRETTY_NAME="openSUSE Leap 15.1"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:15.1"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/

And kvm_stat throws an error when invoked.

# kvm_stat
  File "/usr/bin/kvm_stat", line 1177
    print '%-42s%10d%10d' % (key, values[0], values[1])
                        ^
SyntaxError: invalid syntax

---

I found the problem, the error suggest that there is python2 code not
compatible with python3 which is forced by the shebang line in the script.

diff:
- #!/usr/bin/python3
+ #!/usr/bin/python2

and magically it works!

summary: kvm_stat SyntaxError: Invalid Syntax


--1562753509.a383F813.31306
Date: Wed, 10 Jul 2019 10:11:49 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1140994

            Bug ID: 1140994
           Summary: iputils: Add permissions for arping and clockdiff
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: petr.vorel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Permissions should be the same as for ping:
root:root 0755 +capabilities cap_net_raw=p

PR solving this was prepared (fixing more than this bug):
https://github.com/openSUSE/permissions/pull/24


--1562754640.caFED0.12036
Date: Wed, 10 Jul 2019 10:30:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1140998

            Bug ID: 1140998
           Summary: GStreamer-WARNING External plugin loader failed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Sound
          Assignee: tiwai-at-suse.com
          Reporter: freek-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

In ~/.local/share/sddm/xorg-session.log I found:
(ksmserver:2456): GStreamer-WARNING **: 11:37:35.701: External plugin loader
failed. This most likely means that the plugin loader helper binary was not
found or could not be run. You might need to set the GST_PLUGIN_SCANNER
environment variable if your setup is unusual. This should normally not be
required though.

The setup can't be unusual; it is in principle a standard Tumbleweed system.
I found /usr/lib/gstreamer-1.0/gst-plugin-scanner-x86_64
I can't find the environment variable GST_PLUGIN_SCANNER which should contain
the above path.


--1562768660.fF134EE5.18097
Date: Wed, 10 Jul 2019 14:24:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141025

            Bug ID: 1141025
           Summary: VUL-1: enigmail: mitigation against SKS Keyserver Network Attack
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: bnc-team-gnome-at-forge.provo.novell.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: wolfgang-at-rosenauer.org
          Found By: Security Response Team
           Blocker: ---

Due to an implementation of the SKS keyserver network, malicious users could
poison specific keys with many key signature packages. The specific keys would
then become unusable due to their size and number of signatures.

Enigmail 2.0.12 changes the default keyserver to keys.openpgp.org in order to
mitigate the SKS Keyserver Network Attack.

References:
https://enigmail.net/index.php/en/download/changelog#enig2.0.12
https://gitlab.com/enigmail/enigmail/commit/5868fa72d3d04e73258a7f1417bd8552bf3e60e3
https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f


--1562792892.5AF08Ea44.23304
Date: Wed, 10 Jul 2019 21:08:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1141059

            Bug ID: 1141059
           Summary: Recent zlib changes cause build failure of qemu-linux-user on ppc64le
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: brogers-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

At:https://build.opensuse.org/package/show/Virtualization:Staging/qemu
building qemu-linux-user for ppc64le,

I get the following build error now:
[  757s]
/usr/lib64/gcc/powerpc64le-suse-linux/9/../../../../powerpc64le-suse-linux/bin/ld:
/usr/lib64/gcc/powerpc64le-suse-linux/9/../../../../lib64/libc.a(dl-sysdep.o)
and
/usr/lib64/gcc/powerpc64le-suse-linux/9/../../../../lib64/libc.a(libc-start.o):
warning: multiple common of `__cache_line_size'
[  757s] crc32.c:247:15: error: type of 'crc32_vpmsum' does not match original
declaration [-Werror=lto-type-mismatch]
[  757s] contrib/power8-crc/vec_crc32.c:73:14: note: return value type mismatch
[  757s] contrib/power8-crc/vec_crc32.c:73:14: note: type 'unsigned int' should
match type 'long unsigned int'
[  757s] contrib/power8-crc/vec_crc32.c:73:14: note: 'crc32_vpmsum' was
previously declared here
[  757s] contrib/power8-crc/vec_crc32.c:73:14: note: code may be misoptimized
unless '-fno-strict-aliasing' is used
[  757s] lto1: all warnings being treated as errors
[  757s] lto-wrapper: fatal error: c++ returned 1 exit status
[  757s] compilation terminated.
[  757s]
/usr/lib64/gcc/powerpc64le-suse-linux/9/../../../../powerpc64le-suse-linux/bin/ld:
error: lto-wrapper failed
[  757s] collect2: error: ld returned 1 exit status
[  757s] make[1]: *** [Makefile:218: qemu-aarch64_be] Error 1
[  757s] make[1]: Leaving directory
'/home/abuild/rpmbuild/BUILD/qemu-4.1.0-rc0/aarch64_be-linux-user'
[  757s] make: *** [Makefile:472: aarch64_be-linux-user/all] Error 2
[  757s] error: Bad exit status from /var/tmp/rpm-tmp.yplz4T (%build)

It appears to be related to our settings that warnings are errors, and recent
lto enabling activity in zlib. At least, that is my analysis so far.
Please investigate.


body:
--1562835327.0ddee7aB0.19470
Date: Thu, 11 Jul 2019 08:55:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141102

            Bug ID: 1141102
           Summary: chromium 75 segfaults on startup
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: tchvatal-at-suse.com
          Reporter: okurz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Observation

```
$ chromium
[31924:31924:0711/104159.052682:ERROR:sandbox_linux.cc(368)]
InitializeSandbox() called with multiple th
Received signal 11 SEGV_MAPERR 000000000028
#0 0x5567f20906f9 <unknown>
#1 0x5567f1fd6eb6 <unknown>
#2 0x5567f208eec3 <unknown>
#3 0x5567f2090675 <unknown>
#4 0x7f5e32851300 <unknown>
#5 0x5567f1c397b3 <unknown>
#6 0x5567f1c39090 <unknown>
#7 0x5567f1c38cdf <unknown>
#8 0x5567f1c39332 <unknown>
#9 0x5567f2034819 <unknown>
#10 0x5567f204150b <unknown>
#11 0x5567f20439f0 <unknown>
#12 0x5567f1ff7bd1 <unknown>
#13 0x5567f203f9cf <unknown>
#14 0x5567f201e061 <unknown>
#15 0x5567f1b0db17 <unknown>
#16 0x5567f010a678 <unknown>
#17 0x5567f010a765 <unknown>
#18 0x5567f00f715c <unknown>
#19 0x5567f1ae36a7 <unknown>
#20 0x5567f1ae3788 <unknown>
#21 0x5567f1ae3b8d <unknown>
#22 0x5567f1aed2ea <unknown>
#23 0x5567f1ae1fba <unknown>
#24 0x5567ef17d94d ChromeMain
#25 0x7f5e288b9f8a __libc_start_main
#26 0x5567ef17d7aa _start
  r8: 00007ffd19397e70  r9: 0000000000000001 r10: 00007ffd19397800 r11:
0000000000000001
 r12: 000025672b8e1100 r13: 00007ffd19397e34 r14: 00007ffd19397eb0 r15:
0000000000000000
  di: 0000000000000040  si: 00005567f8f33600  bp: 00007ffd19397e20  bx:
0000000000000000
  dx: 000025672bb05e20  ax: 000025672b942420  cx: 000025672bb05e20  sp:
00007ffd19397dc0
  ip: 00005567f1c397b3 efl: 0000000000010202 cgf: 002b000000000033 erf:
0000000000000004
 trp: 000000000000000e msk: 0000000000000000 cr2: 0000000000000028
[end of stack trace]
Calling _exit(1). Core file will not be generated.
[31924:31924:0711/104201.292356:ERROR:buffer_manager.cc(488)]
[.DisplayCompositor]GL ERROR :GL_INVALID_OPERATION : glBufferData: <- error
from previous GL command

$ zypper info chromium
Loading repository data...
Reading installed packages...

Information for package chromium:
---------------------------------
Repository     : Main Update Repository
Name           : chromium
Version        : 75.0.3770.90-lp151.2.9.3
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 230.1 MiB
Installed      : Yes
Status         : up-to-date
Source package : chromium-75.0.3770.90-lp151.2.9.3.src
```

## Reproducible

crashes often on startup but not always, seems to be a race-condition.

## Expected result

Probably last working was about one week ago. Force-installing the old version
chromium-74.0.3729.157-lp151.2.3.1 from the maintenance update repo works fine
however shows the same error messages:

```
$ chromium
[5049:5049:0711/104723.748049:ERROR:sandbox_linux.cc(368)] InitializeSandbox()
called with multiple threads in process gpu-process.
[5020:5042:0711/104724.741748:ERROR:appcache_database.cc(1076)] Failed to open
the appcache database.
[5049:5049:0711/104725.431959:ERROR:buffer_manager.cc(488)]
[.DisplayCompositor]GL ERROR :GL_INVALID_OPERATION : glBufferData: <- error
from previous GL command
```

The problem can also be reproduced with the intermediate version
chromium-75.0.3770.80-lp151.2.6.1.x86_64

summary: chromium 75 segfaults on startup


--1562866467.ac6B40.30403
Date: Thu, 11 Jul 2019 17:34:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141190

            Bug ID: 1141190
           Summary: LTO: mpfr make check failure for ppc64le
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: normand-at-linux.vnet.ibm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 810182
  --> http://bugzilla.opensuse.org/attachment.cgi?id=810182&action=edit
mpfr_standard_ppc64le_201907091620.log

LTO: mpfr make check failure for ppc64le

problem reported in Rings:0-Bootstrap (1) but not yet in Factory:PowerPC (2)
I verified that no more failure if %define _lto_cflags %{nil} in spec.

extract from attached mpfr_standard_ppc64le_201907091620.log

```
[  328s] ../test-driver: line 107: 31157 Segmentation fault      "$@" >
$log_file 2>&1
[  328s] FAIL: tset_ld
...
[  344s] Testsuite summary for MPFR 4.0.2
[  344s] ================================
[  344s] # TOTAL: 180
[  344s] # PASS:  179
[  344s] # SKIP:  0
[  344s] # XFAIL: 0
[  344s] # FAIL:  1
[  344s] # XPASS: 0
[  344s] # ERROR: 0
```

(1)
https://build.opensuse.org/package/show/openSUSE:Factory:PowerPC:Rings:0-Bootstrap/mpfr
(2) https://build.opensuse.org/package/show/openSUSE:Factory:PowerPC/mpfr


body:
--1562937778.CC6Bb5.11951
Date: Fri, 12 Jul 2019 13:22:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141323

            Bug ID: 1141323
           Summary: packages embed CFLAGS with -flto
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: martin.liska-at-suse.com
          Reporter: bwiedemann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: kgronlund-at-suse.com, matthias.gerstner-at-suse.com,
                    max-at-suse.com, pgajdos-at-suse.com
            Blocks: 1081754
          Found By: Development
           Blocker: ---

While working on reproducible builds for openSUSE, I found that
since the introduction of -flto=%jobs
several packages started to vary between builds
because they embed the CFLAGS somewhere in the rpm:
fldigi gmp haproxy ImageMagick lyx neovim tboot tcl

Not all packages have been tested yet.

Steps to Reproduce:
osc co openSUSE:Factory/fldigi && cd $_
for i in 1 2 ; do
  osc build --vm-type=kvm -j$i --disable-debuginfo --keep-pkg=.rpm$i
done
/usr/lib/build/pkg-diff.sh .rpm{1,2}/fldigi-*-0.x86_64.rpm

summary: packages embed CFLAGS with -flto


body:
--1563008126.B5ebADB4.18849
Date: Sat, 13 Jul 2019 08:55:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141369

            Bug ID: 1141369
           Summary: Package update for GNU Health and Tryton
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: axel.braun-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Bugfix release.....

pkgs: gnuhealth-client gnuhealth-thalamus tryton trytond trytond_account trytond_stock


--1563035505.C2D1d5C1.8253
Date: Sat, 13 Jul 2019 16:31:45 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141377

            Bug ID: 1141377
           Summary: nothing provides libprotobuf.so.17 needed by libusbguard0-0.7.4-5.3.i586
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: i586
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: forumino-at-riseup.net
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

Created attachment 810375
  --> http://bugzilla.opensuse.org/attachment.cgi?id=810375&action=edit
console output

usbguard cannot be installed - neither during fresh OS installation nor after
that due to a failed dependency:

Problem: nothing provides libprotobuf.so.17 needed by
libusbguard0-0.7.4-5.3.i586

Attaching zypper output.


--1563179587.f1bc10.11552
Date: Mon, 15 Jul 2019 08:33:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141430

            Bug ID: 1141430
           Summary: VUL-1: CVE-2019-12746: unknowingly session ID disclosure by link sharing
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/237106/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: chris-at-computersalat.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-12746

Security Advisory 2019-10: Security Update for OTRS Framework

Security Advisory Details:
ID: OSA-2019-10
Date: 2019-07-12
Title: Session ID Disclosure
Severity: 3.1. low
Product: OTRS 6.0.x, OTRSBusiness 6.0.x, OTRS 5.0.x
Fixed in: OTRS 6.0.20, OTRSBusiness 6.0.21, OTRS 5.0.37
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
References: CVE-2019-12746

Vulnerability Description:
This advisory covers vulnerabilities discovered in the OTRS framework.

Privilege Escalation:
A user logged into OTRS as an agent might unknowingly disclose their session ID
by sharing the link of an embedded ticket article with third parties. This
identifier can be then potentially abused in order to impersonate the agent
user.

Affected by this vulnerability are all releases of OTRS 6.0.x up to and
including 6.0.19, OTRSBusiness 6.0.x up to and including 6.0.20 and OTRS 5.0.x
up to and including 5.0.36.

This vulnerability is fixed in the latest versions of OTRS, and it is
recommended to upgrade to the latest patch level.

Fixed releases can be found at:
https://www.otrs.com/category/release-and-security-notes-en/

Detailed information about the changes:

OTRS 6:
https://github.com/OTRS/otrs/commit/fab16a8e54aaf033f460e5f98c673248f29ea49c
https://github.com/OTRS/otrs/commit/cc08cb7df9f6dde05de2f8c6cbd59cd5d0952627

OTRS 5:
https://github.com/OTRS/otrs/commit/7ab33e51a4db9f712e979040f644d0d0c39ff0af

Thanks to akosiaris AT gmail DOT com for discovering and reporting this issue.

References:
https://community.otrs.com/security-advisory-2019-10-security-update-for-otrs-framework/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12746
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12746.html


--1563179590.DdBD56224.11552
Date: Mon, 15 Jul 2019 08:33:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141431

            Bug ID: 1141431
           Summary: VUL-1: CVE-2019-13457: otrs: information disclosure from "company" tickets
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/237105/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: chris-at-computersalat.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-13457

Security Advisory 2019-11: Security Update for OTRS Framework

Security Advisory Details:
ID: OSA-2019-11
Date: 2019-07-12
Title: Information Disclosure
Severity: 3.8. Low
Product: OTRS 7.0.x
Fixed in: OTRS 7.0.9
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
References: CVE-2019-13457

Vulnerability Description:
This advisory covers vulnerabilities discovered in the OTRS framework.

Privilege Escalation:
A customer user can use the search results to disclose information from their
“company” tickets (with the same CustomerID), even when
CustomerDisableCompanyTicketAccess setting is turned on.

Affected by this vulnerability are all releases of OTRS 7.0.x up to and
including OTRS 7.0.8.

This vulnerability is fixed in the latest versions of OTRS, and it is
recommended to upgrade to the latest patch level.

Fixed releases can be found at:
https://www.otrs.com/category/release-and-security-notes-en/

Thanks to Tobias Kirchner for discovering and reporting this issue.

References:
https://community.otrs.com/security-advisory-2019-11-security-update-for-otrs-framework/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13458
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13458.html


body:
--1563179594.Cf1848.11552
Date: Mon, 15 Jul 2019 08:33:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141432

            Bug ID: 1141432
           Summary: VUL-1: CVE-2019-13458:
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/237105/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: chris-at-computersalat.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-13458

Security Advisory 2019-12: Security Update for OTRS Framework

Security Advisory Details:
ID: OSA-2019-12
Date: 2019-07-12
Title: Information Disclosure
Severity: 2.4. Low
Product: OTRS 7.0.x, OTRS 6.0.x, OTRS 5.0.x
Fixed in: OTRS 7.0.9, OTRS 6.0.20, OTRS 5.0.37
FULL CVSS v3 VECTOR: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
References: CVE-2019-13458

Vulnerability Description:
This advisory covers vulnerabilities discovered in the OTRS framework.

Privilege Escalation:
An attacker who is logged into OTRS as an agent user with appropriate
permissions can leverage OTRS tags in templates in order to disclose hashed
user passwords.

Affected by this vulnerability are all releases of OTRS 7.0.x up to and
including 7.0.8, OTRS 6.0.x up to and including 6.0.19, OTRS 5.0.x up to and
including 5.0.36.

This vulnerability is fixed in the latest versions of OTRS, and it is
recommended to upgrade to the latest patch level.

Fixed releases can be found at:
https://www.otrs.com/category/release-and-security-notes-en/

Detailed information about the changes:
OTRS 6.0
https://github.com/OTRS/otrs/commit/69430f260d52e5a7afc185048da0cfc2eef2659a
OTRS 5.0
https://github.com/OTRS/otrs/commit/0e26066dfff8efff0039da13e29609ca7f00d9a2

However, to avoid unwanted side effects, we recommend a complete update.

Thanks to Marvin Voormann for discovering and reporting this issue.

References:
https://community.otrs.com/security-advisory-2019-12-security-update-for-otrs-framework/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13458
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13458.html

summary: VUL-1: CVE-2019-13458:


--1563179835.8dd8D412.15384
Date: Mon, 15 Jul 2019 08:37:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141433

            Bug ID: 1141433
           Summary: Get no hint that network connection is made by NetworkManager when start YaST Networkmanagement
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: bnacht-at-web.de
        QA Contact: qa-bugs-at-suse.de
                CC: guillaume.gardet-at-arm.com
          Found By: Community User
           Blocker: ---

Start YaST module LAN. Then I miss a hint (like in openSUSE for x86_64) that
the network connections are managed by NetworkManager.

This leads to an improper network configuration with a IP from DHCP (via
NetworkManager) and a secondary IP address which is inserted via YaST lan.


--1563204591.4aF4b32F1.13234
Date: Mon, 15 Jul 2019 15:29:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141522

            Bug ID: 1141522
           Summary: VUL-0: CVE-2019-13602: An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c allows remote attackers to cause a denial of service (heap-based buffer overflow and crash)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.0
          Hardware: Other
               URL: https://smash.suse.de/issue/237119/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dimstar-at-opensuse.org
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-13602

An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in
VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a
denial of service (heap-based buffer overflow and crash) or possibly have
unspecified other impact via a crafted .mp4 file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13602
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13602
http://www.cvedetails.com/cve/CVE-2019-13602/
https://git.videolan.org/?p=vlc.git;a=commit;h=b2b157076d9e94df34502dd8df0787deb940e938
https://git.videolan.org/?p=vlc.git;a=commit;h=8e8e0d72447f8378244f5b4a3dcde036dbeb1491


body:
--1563266777.8bdE55.20010
Date: Tue, 16 Jul 2019 08:46:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1141599

            Bug ID: 1141599
           Summary: prosody: add latest 0.11 fixes
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: bnc-team-screening-at-forge.provo.novell.com
          Reporter: mvetter-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Prosodys 0.11 branch has some nice fixes and performance improvements since
last 0.11.2 release.
See https://hg.prosody.im/0.11/rss-log

Lets add them.

summary: prosody: add latest 0.11 fixes


body:
--1563267656.C41A75c0.8294
Date: Tue, 16 Jul 2019 09:00:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1141604

            Bug ID: 1141604
           Summary: KDE:Applications/akonadi-server: Bug
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: SUSE Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: 3rd party software
          Assignee: lbeltrame-at-kde.org
          Reporter: Mathias.Homann-at-opensuse.org
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

akonadiserver 5.11.3 is seriously broken when talking to a mysql server via
tcp/ip, see https://bugs.kde.org/show_bug.cgi?id=409853

would it be possible to temporarily roll back the akonadiserver package to the
previous version?

summary: KDE:Applications/akonadi-server: Bug