--1647418441.5be4c5EF1.16915
Date: Wed, 16 Mar 2022 08:14:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197163

            Bug ID: 1197163
           Summary: VUL-0: chromium: multiple security issues fixed in 99.0.4844.74
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: security-team-at-suse.de
          Found By: ---
           Blocker: ---

This update includes 11 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

[$NA][1299422] Critical CVE-2022-0971: Use after free in Blink Layout.
Reported by Sergei Glazunov of Google Project Zero on 2022-02-21

[$NA][1301320] High CVE-2022-0972: Use after free in Extensions.
Reported by Sergei Glazunov of Google Project Zero on 2022-02-28

[$15000][1297498] High CVE-2022-0973: Use after free in Safe Browsing.
Reported by avaue and Buff3tts at S.S.L. on 2022-02-15

[$7000][1291986] High CVE-2022-0974 : Use after free in Splitscreen.
Reported by @ginggilBesel on 2022-01-28

[$7000][1295411] High CVE-2022-0975: Use after free in ANGLE.
Reported by SeongHwan Park (SeHwa) on 2022-02-09

[$7000][1296866] High CVE-2022-0976: Heap buffer overflow in GPU.
Reported by Omair on 2022-02-13

[$3000][1299225] High CVE-2022-0977: Use after free in Browser UI.
Reported by Khalil Zhani on 2022-02-20

[$TBD][1299264] High CVE-2022-0978: Use after free in ANGLE.
Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications
Corp. Ltd. on 2022-02-20

[$TBD][1302644] High CVE-2022-0979: Use after free in Safe Browsing.
Reported by anonymous on 2022-03-03

[$TBD][1302157] Medium CVE-2022-0980: Use after free in New Tab Page.
Reported by Krace on 2022-03-02

We would also like to thank all security researchers that worked with us during
the development cycle to prevent security bugs from ever reaching the stable
channel.
As usual, our ongoing internal security work was responsible for a wide range
of fixes:

[1305655] Various fixes from internal audits, fuzzing and other initiatives


--1647434606.470C45C2.24020
Date: Wed, 16 Mar 2022 12:43:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197178

            Bug ID: 1197178
           Summary: agetty should give a sensible name when "-" is passed as tty port
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: fbui-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

agetty allows to pass "-" as tty port argument and in this case it assumes that
its stdin is already connected to a tty.

However instead of figuring out the real name of "-", it keeps "-" as tty name
internally which leads to uses of '\l' specifier in /etc/issue being
substituted with '-', which is not meaningful.

Can this be fixed so when "-" is passed as argument to agetty, '\l' in
/etc/issue is substituted with the actual name of the tty device being
connected ?

Thanks.


body:
--1647525946.74cc0.16725
Date: Thu, 17 Mar 2022 14:05:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197233

            Bug ID: 1197233
           Summary: Wine fails to build on aarch64
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
                CC: meissner-at-suse.com
          Found By: ---
           Blocker: ---

Wine fails to build on aarch64 since update to 7.4
https://build.opensuse.org/request/show/961715

The error message is:
[  136s] configure: error: PE cross-compilation is required for ARM64, please
install clang/llvm-dlltool/lld, or llvm-mingw.

summary: Wine fails to build on aarch64


--1647537680.Cb3AF1.17862
Date: Thu, 17 Mar 2022 17:21:20 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197256

            Bug ID: 1197256
           Summary: VUL-0: CVE-2021-23556: guake: possible command injection through dbus interface
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 42.3
          Hardware: Other
               URL: https://smash.suse.de/issue/326571/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: badshah400-at-gmail.com
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-23556

The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or
Function due to the exposure of execute_command and execute_command_by_uuid
methods via the d-bus interface, which makes it possible for a malicious user
to
run an arbitrary command via the d-bus method. **Note:** Exploitation requires
the user to have installed another malicious program that will be able to send
dbus signals or run terminal commands.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-23556
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23556
https://github.com/Guake/guake/pull/2017/commits/e3d671120bfe7ba28f50e256cc5e8a629781b888
https://github.com/Guake/guake/releases
https://github.com/Guake/guake/pull/2017
https://github.com/Guake/guake/issues/1796
https://snyk.io/vuln/SNYK-PYTHON-GUAKE-2386334


body:
Build Identifier:

Desktop environment: xfce, with activated komposit

```
grep EE.*flip /var/log/Xorg.0.log | wc -l
405912

itnbltest154:/icpers/ms/home # grep EE.*flip /var/log/Xorg.0.log | tail
[ 88161.296] (EE) modeset(0): Failed to get GBM bo for flip to new front.
[ 88161.296] (EE) modeset(0): present flip failed
[ 88161.308] (EE) modeset(0): Failed to get GBM bo for flip to new front.
[ 88161.308] (EE) modeset(0): present flip failed
[ 88161.372] (EE) modeset(0): Failed to get GBM bo for flip to new front.
[ 88161.372] (EE) modeset(0): present flip failed
[ 88161.524] (EE) modeset(0): Failed to get GBM bo for flip to new front.
[ 88161.524] (EE) modeset(0): present flip failed
[ 88162.133] (EE) modeset(0): Failed to get GBM bo for flip to new front.
[ 88162.133] (EE) modeset(0): present flip failed

itnbltest154:/icpers/ms/home # hwinfo --gfxcard
27: PCI 02.0: 0300 VGA compatible controller (VGA)
  [Created at pci.386]
  Unique ID: _Znp.Hd7BnpKZdtA
  SysFS ID: /devices/pci0000:00/0000:00:02.0
  SysFS BusID: 0000:00:02.0
  Hardware Class: graphics card
  Model: "Intel VGA compatible controller"
  Vendor: pci 0x8086 "Intel Corporation"
  Device: pci 0x9a60
  SubVendor: pci 0x1028 "Dell"
  SubDevice: pci 0x0a67
  Revision: 0x01
  Driver: "i915"
  Driver Modules: "i915"
  Memory Range: 0x6052000000-0x6052ffffff (rw,non-prefetchable)
  Memory Range: 0x4000000000-0x400fffffff (ro,non-prefetchable)
  I/O Ports: 0x3000-0x303f (rw)
  Memory Range: 0x000c0000-0x000dffff (rw,non-prefetchable,disabled)
  IRQ: 166 (3901402 events)
  Module Alias: "pci:v00008086d00009A60sv00001028sd00000A67bc03sc00i00"
  Driver Info #0:
    Driver Status: i915 is active
    Driver Activation Cmd: "modprobe i915"
  Config Status: cfg=new, avail=yes, need=no, active=unknown

Primary display adapter: #27

```

with deaktivated komposit the massive output of this message stops. See also
following:
*
https://dwaves.de/2019/08/14/debian-10-mate-gnome2-desktop-failed-to-get-gbm-bo-for-flip-to-new-front/
* https://bugzilla.redhat.com/show_bug.cgi?id=1645553
* https://community.parrotsec.org/t/self-reseting-to-loging-screen/3368

Reproducible: Always

Steps to Reproduce:
1. gfx driver i915
2. X11 not wayland
3. use xfce desktop
4. default activated komposit

Expected Results:
no massive messages

summary: Failed to get GBM bo for flip to new front.... spamming forever on Xorg.0.log


body:
--1647621059.E1F7D1841.24990
Date: Fri, 18 Mar 2022 16:30:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197298

            Bug ID: 1197298
           Summary: Virtualization/qemu: How to properly enable bin_fmt for e.g. docker buildx or podman multi-arch containers
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: li.zhang-at-suse.com
          Reporter: opensuse_buildservice-at-ojkastl.de
        QA Contact: screening-team-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi everyone,

as this could not be solved via kubic and factory mailinglists, either I am
missing a step or the binfmt integration is broken on openSUSE.

How to setup binfmt properly so one can build multi-arch containers with
buildah/podman or docker buildx?
https://podman.io/blogs/2021/10/11/multiarch.html

I enabled the persistent configuration for system by running
"/sbin/qemu-binfmt-conf.sh --persistent yes --systemd ALL".

I restarted the systemd-binfmt service.
I checked for new "files" in /proc/sys/fs/binfmt_misc/, all of them having the
correct flags (apparently P for persistent).

I got a different error message than before, but still neither podman nor
buildah nor docker buildx were successful.

$ buildah bud --arch arm64 .
STEP 1/2: FROM registry.access.redhat.com/ubi8:latest
STEP 2/2: RUN uname -a
error building at STEP "RUN uname -a": error while running runtime: exit status
255
ERRO[0003] exit status 255

Full details are here:
https://lists.opensuse.org/archives/list/factory-at-lists.opensuse.org/message/K573UTWM3VPG5UO6723WTSWKN66XH4FS/

Please assign this bug to the correct maintainers, if the root cause is not
qemu-linux-user and the binfmt script, but rather in both podman and buildah.

Thanks in advance!
Johannes

pkgs: build qemu


--1647774978.Be770.25320
Date: Sun, 20 Mar 2022 11:16:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197317

            Bug ID: 1197317
           Summary: mailx %pre creates file named "0" in "/"
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: beppe85-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

It was noticed in some installations a file named "0" existing at "/".

Troubleshooting led to mailx, this line in particular:

 86+if [ "$1" > 0 ] && [ -f %{_sbindir}/update-alternatives ] ; then


--1647788130.EFCD170.839
Date: Sun, 20 Mar 2022 14:55:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197319

            Bug ID: 1197319
           Summary: Firefox 98.0+ opens files after download without any inquiries
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Firefox
          Assignee: mozilla-bugs-at-suse.de
          Reporter: simon.vogl-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

openSUSE Tumbleweed's firefox build opens most files after downloading since
version 98.0 without any inquiries.

Steps to reproduce:
1. Install latest openSUSE Tumbleweed KDE x86_64 (or load up live iso)
2. Install the MozillaFirefox package from openSUSE Tumbleweed repos
3. Launch FirefFox.
4. Go to https://www.mozilla.org/en-US/firefox/download/thanks/

Expected behavior:
Firefox downloads firefox and does nothing thereafter.

Observed behavior:
Firefox downloads firefox and automatically opens the bz2 archive in Ark/some
other Archive manager without a single inquiry.

Notes:
- This result does not happen with Mozilla's official firefox builds, with the
same configuration.
- If WINE is installed on the system this can get quite dangerous as some .exe
file you download could automatically get executed with wine without any
inquiries whatsoever in some cases.
- Builds from the regular mozilla repo also seem to be affected.

Any idea what might be causing this? Maybe some customization from openSUSE?


--1647853115.2bB8C00.25086
Date: Mon, 21 Mar 2022 08:58:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197332

            Bug ID: 1197332
           Summary: VUL-0: chromium: Upgrade to 99.0.4844.82
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gianluca.gabrielli-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: security-team-at-suse.de
          Found By: ---
           Blocker: ---

Stable Channel Update for Desktop
Sunday, March 20, 2022

The Stable channel has been updated to 99.0.4844.82 for Windows, Linux and
99.0.4844.83 for Mac which will roll out over the coming days/weeks.

A full list of changes in this build is available in the log [0]. Interested in
switching release channels? Find out how here [1].

[0]
https://chromium.googlesource.com/chromium/src/+log/99.0.4844.74..99.0.4844.83?pretty=fuller&n=10000
[1] https://www.chromium.org/getting-involved/dev-channel


--1647871942.dfA4E4.4489
Date: Mon, 21 Mar 2022 14:12:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197350

            Bug ID: 1197350
           Summary: Gnome 42 from Gnome:NEXT repo crashes when closing window in activity overview
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: minava@t-online.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,

I'm using/testing Gnome 42 from the Gnome:Next repository on tumbleweed.

When I open the activity overview and click on X to close a window, gnome
crashes and falls back to the gdm login screen.

journalctl shows this:

M?r 21 15:03:44 pc6 gnome-shell[2033]: Bail out!
Clutter:ERROR:../clutter/clutter/clutter-actor.c:1275:clutter_actor_set_mapped:
assertion failed: (!CLUTTER_ACTOR_IS_MAPPED (self))
M?r 21 15:03:44 pc6 gnome-shell[2033]: == Stack trace for context
0x55e9f6a95300 ==
M?r 21 15:03:44 pc6 gnome-shell[2033]: #0   55e9f7788028 i
resource:///org/gnome/shell/ui/windowPreview.js:369 (a8c12d081f0 @ 12)
M?r 21 15:03:44 pc6 gnome-shell[2033]: #1   7fff8f29e0e0 b
resource:///org/gnome/shell/ui/environment.js:134 (21b4c0acc4c0 @ 98)
M?r 21 15:03:44 pc6 gnome-shell[2033]: #2   7fff8f29e1a0 b
resource:///org/gnome/shell/ui/environment.js:221 (21b4c0acc830 @ 14)


--1647877915.dB404b142.20520
Date: Mon, 21 Mar 2022 15:51:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197355

            Bug ID: 1197355
           Summary: VUL-0: CVE-2021-32434: abcm2ps: multiple security vulnerabilities
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/325980/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

Three new CVEs were found in abcm2ps package version 8.14.11:

CVE-2021-32434

abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the
function calculate_beam at draw.c.

https://github.com/leesavide/abcm2ps/commit/2f56e1179cab6affeb8afa9d6c324008fe40d8e3
https://github.com/leesavide/abcm2ps/issues/83

CVE-2021-32435

Stack-based buffer overflow in the function get_key in parse.c of abcm2ps
v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via
unspecified vectors.

https://github.com/leesavide/abcm2ps/commit/3169ace6d63f6f517a64e8df0298f44a490c4a15
https://github.com/leesavide/abcm2ps/issues/84

CVE-2021-32436

An out-of-bounds read in the function write_title() in subs.c of abcm2ps
v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via
unspecified vectors.

https://github.com/leesavide/abcm2ps/commit/2f56e1179cab6affeb8afa9d6c324008fe40d8e3
https://github.com/leesavide/abcm2ps/issues/85

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2063268
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32434
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32434
https://github.com/leesavide/abcm2ps/commit/2f56e1179cab6affeb8afa9d6c324008fe40d8e3
https://github.com/leesavide/abcm2ps/issues/83


body:
--1647886443.2F8dBa0.5846
Date: Mon, 21 Mar 2022 18:14:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197367

            Bug ID: 1197367
           Summary: Some texlive doc packages are dependency for non-doc packages
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: petr.vorel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

These 3 texlive packages are dependency for non-doc packages:
texlive-luatex-doc-2021.186.svn58702-45.4.noarch
texlive-pdftex-doc-2021.186.svn57973-44.4.noarch
texlive-texlive.infra-doc-2021.188.svn58646-47.3.noarch

NOTE: I found them when I was trying to remove all texlive doc packages (to
remove unneeded packages) with zypper rm $(rpm -qa | grep 'texlive.*-doc-')

# zypper rm texlive-luatex-doc
Reading installed packages...
Resolving package dependencies...

The following 66 packages are going to be REMOVED:
  texlive-collection-basic texlive-collection-binextra
texlive-collection-context texlive-collection-fontsrecommended
texlive-collection-fontutils texlive-collection-langczechslovak
  texlive-collection-langeuropean texlive-collection-langfrench
texlive-collection-langgerman texlive-collection-langpolish
texlive-collection-langportuguese texlive-collection-langspanish
  texlive-collection-latex texlive-collection-latexrecommended
texlive-collection-luatex texlive-collection-metapost
texlive-collection-plaingeneric texlive-collection-xetex texlive-context
  texlive-context-account texlive-context-algorithmic texlive-context-animation
texlive-context-annotation texlive-context-bnf texlive-context-cmscbf
texlive-context-cmttbf
  texlive-context-construction-plan texlive-context-cyrillicnumbers
texlive-context-degrade texlive-context-fancybreak texlive-context-filter
texlive-context-french texlive-context-fullpage
  texlive-context-gantt texlive-context-gnuplot texlive-context-handlecsv
texlive-context-chromato texlive-context-inifile texlive-context-layout
texlive-context-letter texlive-context-lettrine
  texlive-context-mathsets texlive-context-notes-zh-cn texlive-context-rst
texlive-context-ruby texlive-context-simplefonts texlive-context-simpleslides
texlive-context-title
  texlive-context-transliterator texlive-context-typearea
texlive-context-typescripts texlive-context-vim texlive-context-visualcounter
texlive-cslatex texlive-ctex texlive-latex-bin texlive-luahbtex
  texlive-luajittex texlive-luatex-doc texlive-platex texlive-platex-tools
texlive-uplatex texlive-xecjk texlive-xelatex-dev texlive-xetex texlive-xpinyin

66 packages to remove.

# zypper rm texlive-luatex-doc-2021.186.svn58702-45.4.noarch
Reading installed packages...
Resolving package dependencies...

The following 66 packages are going to be REMOVED:
  texlive-collection-basic texlive-collection-binextra
texlive-collection-context texlive-collection-fontsrecommended
texlive-collection-fontutils texlive-collection-langczechslovak
  texlive-collection-langeuropean texlive-collection-langfrench
texlive-collection-langgerman texlive-collection-langpolish
texlive-collection-langportuguese texlive-collection-langspanish
  texlive-collection-latex texlive-collection-latexrecommended
texlive-collection-luatex texlive-collection-metapost
texlive-collection-plaingeneric texlive-collection-xetex texlive-context
  texlive-context-account texlive-context-algorithmic texlive-context-animation
texlive-context-annotation texlive-context-bnf texlive-context-cmscbf
texlive-context-cmttbf
  texlive-context-construction-plan texlive-context-cyrillicnumbers
texlive-context-degrade texlive-context-fancybreak texlive-context-filter
texlive-context-french texlive-context-fullpage
  texlive-context-gantt texlive-context-gnuplot texlive-context-handlecsv
texlive-context-chromato texlive-context-inifile texlive-context-layout
texlive-context-letter texlive-context-lettrine
  texlive-context-mathsets texlive-context-notes-zh-cn texlive-context-rst
texlive-context-ruby texlive-context-simplefonts texlive-context-simpleslides
texlive-context-title
  texlive-context-transliterator texlive-context-typearea
texlive-context-typescripts texlive-context-vim texlive-context-visualcounter
texlive-cslatex texlive-ctex texlive-latex-bin texlive-luahbtex
  texlive-luajittex texlive-luatex-doc texlive-platex texlive-platex-tools
texlive-uplatex texlive-xecjk texlive-xelatex-dev texlive-xetex texlive-xpinyin

66 packages to remove.
After the operation, 71,0 MiB will be freed.

# zypper rm texlive-pdftex-doc-2021.186.svn57973-44.4.noarch
Reading installed packages...
Resolving package dependencies...

The following 52 packages are going to be REMOVED:
  texlive-collection-context texlive-collection-langczechslovak
texlive-collection-langpolish texlive-collection-latex
texlive-collection-latexrecommended texlive-collection-xetex texlive-context
  texlive-context-account texlive-context-algorithmic texlive-context-animation
texlive-context-annotation texlive-context-bnf texlive-context-cmscbf
texlive-context-cmttbf
  texlive-context-construction-plan texlive-context-cyrillicnumbers
texlive-context-degrade texlive-context-fancybreak texlive-context-filter
texlive-context-french texlive-context-fullpage
  texlive-context-gantt texlive-context-gnuplot texlive-context-handlecsv
texlive-context-chromato texlive-context-inifile texlive-context-layout
texlive-context-letter texlive-context-lettrine
  texlive-context-mathsets texlive-context-notes-zh-cn texlive-context-rst
texlive-context-ruby texlive-context-simplefonts texlive-context-simpleslides
texlive-context-title
  texlive-context-transliterator texlive-context-typearea
texlive-context-typescripts texlive-context-vim texlive-context-visualcounter
texlive-cslatex texlive-ctex texlive-latex-bin texlive-pdftex-doc
  texlive-platex texlive-platex-tools texlive-uplatex texlive-xecjk
texlive-xelatex-dev texlive-xetex texlive-xpinyin

52 packages to remove.
After the operation, 71,2 MiB will be freed.

# zypper rm texlive-texlive.infra-doc-2021.188.svn58646-47.3.noarch
Reading installed packages...
Resolving package dependencies...

The following 1419 packages are going to be REMOVED:
  dblatex emacs-auctex gtk-doc-mkpdf texlive texlive-abbr texlive-abstyles
texlive-accents texlive-accfonts texlive-accsupp texlive-acro texlive-addliga
texlive-adhocfilelist texlive-adjustbox
  texlive-adobemapping texlive-advdate texlive-ae texlive-aeguill
texlive-afm2pl texlive-albatross texlive-alg texlive-algobox
texlive-algorithmicx texlive-algorithms texlive-algorithm2e
  texlive-algxpar texlive-aligned-overset texlive-alphalph
texlive-amiweb2c-guide texlive-amscdx texlive-amscls texlive-amsfonts
texlive-amslatex-primer texlive-amsmath texlive-amsmath-it
  texlive-amstex texlive-amsthdoc-it texlive-annee-scolaire texlive-answers
texlive-antanilipsum texlive-anysize texlive-apalike-german texlive-apnum
texlive-appendix
  texlive-apprendre-a-programmer-en-tex texlive-apprends-latex texlive-apxproof
texlive-arabxetex texlive-arara texlive-armtex texlive-around-the-bend
texlive-arphic texlive-arrayjobx texlive-arydshln
  texlive-ascii-chart texlive-ascmac texlive-asymptote texlive-atbegshi
texlive-atenddvi texlive-attachfile2 texlive-atveryend texlive-autoaligne
texlive-autobreak texlive-automata texlive-auto-pst-pdf
  texlive-auto-pst-pdf-lua texlive-auxhook texlive-avantgar texlive-awesomebox
texlive-axodraw2 texlive-a0poster texlive-a2ping texlive-a4wide texlive-babel
texlive-babel-albanian texlive-babel-basque
  texlive-babelbib texlive-babel-bosnian texlive-babel-breton
texlive-babel-catalan texlive-babel-croatian texlive-babel-czech
texlive-babel-danish texlive-babel-dutch texlive-babel-english
  texlive-babel-estonian texlive-babel-finnish texlive-babel-french
texlive-babel-friulan texlive-babel-galician texlive-babel-german
texlive-babel-hebrew texlive-babel-hungarian
  texlive-babel-icelandic texlive-babel-irish texlive-babel-italian
texlive-babel-kurmanji texlive-babel-latin texlive-babel-latvian
texlive-babel-macedonian texlive-babel-norsk texlive-babel-occitan
  texlive-babel-piedmontese texlive-babel-polish texlive-babel-portuges
texlive-babel-romanian texlive-babel-romansh texlive-babel-samin
texlive-babel-scottish texlive-babel-slovak
  texlive-babel-slovenian texlive-babel-spanish texlive-babel-swedish
texlive-babel-turkish texlive-babel-welsh texlive-background texlive-backnaur
texlive-barr texlive-barracuda texlive-basque-book
  texlive-basque-date texlive-bbcard texlive-bbding texlive-bclogo
texlive-beamer texlive-beamer-tut-pt texlive-begriff texlive-bera texlive-beton
texlive-bezierplot texlive-bguq texlive-biber
  texlive-bib-fr texlive-biblatex texlive-biblatex-cheatsheet texlive-bibleref
texlive-bibleref-french texlive-bibleref-german texlive-bibtex texlive-bibtexu
texlive-bibtex8 texlive-bibunits
  texlive-bidi texlive-bidi-atbegshi texlive-bidicontour texlive-bidipagegrid
texlive-bidipresentation texlive-bidishadowtext texlive-bigfoot
texlive-bigintcalc texlive-binomexp texlive-biocon
  texlive-bitelist texlive-bitpattern texlive-bitset texlive-blockdraw_mp
texlive-bohr texlive-boldtensors texlive-bookman texlive-bookmark
texlive-booktabs texlive-booktabs-de texlive-booktabs-fr
  texlive-borceux texlive-bosisio texlive-boxedminipage texlive-bpchem
texlive-bpolynomial texlive-braket texlive-breakcites texlive-breakurl
texlive-bredzenie texlive-breqn texlive-bropd
  texlive-bundledoc texlive-businesscard-qrcode texlive-bussproofs
texlive-bussproofs-extra texlive-bytefield texlive-calculation texlive-cancel
texlive-caption texlive-capt-of texlive-carlisle
  texlive-cascade texlive-catcodes texlive-catchfile texlive-causets
texlive-ccaption texlive-ccfonts texlive-ccool texlive-cc-pl texlive-cite
texlive-citeref texlive-cjk texlive-cjk-ko
  texlive-cjkpunct texlive-cleveref texlive-clojure-pamphlet texlive-cloze
texlive-clrscode texlive-clrscode3e texlive-cluttex texlive-cm texlive-cmap
texlive-cmarrows texlive-cmbright texlive-cmexb
  texlive-cmextra texlive-cm-super texlive-cnbwp texlive-cnltx texlive-cns
texlive-codeanatomy texlive-codicefiscaleitaliano texlive-collcell
texlive-collectbox texlive-collection-basic
  texlive-collection-binextra texlive-collection-context
texlive-collection-fontsrecommended texlive-collection-fontutils
texlive-collection-langczechslovak texlive-collection-langeuropean
  texlive-collection-langfrench texlive-collection-langpolish
texlive-collection-langportuguese texlive-collection-langspanish
texlive-collection-latex texlive-collection-latexrecommended
  texlive-collection-metapost texlive-collection-plaingeneric
texlive-collection-xetex texlive-colorprofiles texlive-colorsep
texlive-colortbl texlive-combofont texlive-commath texlive-comment
  texlive-commutative-diagrams texlive-compare texlive-complexity
texlive-components-of-TeX texlive-comprehensive
texlive-computational-complexity texlive-concmath texlive-concrete
texlive-conteq
  texlive-context texlive-context-account texlive-context-algorithmic
texlive-context-animation texlive-context-annotation texlive-context-bnf
texlive-context-cmscbf texlive-context-cmttbf
  texlive-context-construction-plan texlive-context-cyrillicnumbers
texlive-context-degrade texlive-context-fancybreak texlive-context-filter
texlive-context-french texlive-context-fullpage
  texlive-context-gantt texlive-context-gnuplot texlive-context-handlecsv
texlive-context-chromato texlive-context-inifile texlive-context-layout
texlive-context-letter texlive-context-lettrine
  texlive-context-mathsets texlive-context-notes-zh-cn texlive-context-rst
texlive-context-ruby texlive-context-simplefonts texlive-context-simpleslides
texlive-context-title
  texlive-context-transliterator texlive-context-typearea
texlive-context-typescripts texlive-context-vim texlive-context-visualcounter
texlive-contour texlive-coollist texlive-coolstr
  texlive-correctmathalign texlive-courier texlive-courier-scaled
texlive-c-pascal texlive-cqubeamer texlive-crop texlive-cryptocode texlive-cs
texlive-csbulletin texlive-cslatex texlive-csplain
  texlive-csquotes texlive-csquotes-de texlive-cstex texlive-cstypo
texlive-ctable texlive-ctablestack texlive-ctanbib texlive-ctan_chk
texlive-ctanify texlive-ctan-o-mat texlive-ctanupload
  texlive-ctex texlive-ctie texlive-currfile texlive-cursolatex texlive-curves
texlive-curve2e texlive-cweb texlive-cweb-old texlive-cyrillic
texlive-cyrillic-bin texlive-datatool texlive-datetime2
  texlive-decision-table texlive-dehyph texlive-dehyph-exptl texlive-dejavu
texlive-delim texlive-delimseasy texlive-delimset texlive-de-macro
texlive-derivative texlive-detex texlive-dhua
  texlive-dickimaw texlive-diffcoeff texlive-digiconfigs texlive-dijkstra
texlive-dinat texlive-dingbat texlive-dirtree texlive-docbytex
texlive-docsurvey texlive-dosepsbin texlive-dot2texi
  texlive-dowith texlive-draftcopy texlive-drawmatrix texlive-drawstack
texlive-droit-fr texlive-drv texlive-dtk-bibliography texlive-dtl
texlive-dtxgen texlive-dtxtut texlive-dviasm texlive-dvicopy
  texlive-dvidvi texlive-dviincl texlive-dviinfox texlive-dviljk
texlive-dviout-util texlive-dvipdfmx texlive-dvipdfmx-bin texlive-dvipng
texlive-dvipos texlive-dvips texlive-dvipsconfig
  texlive-dvisvgm texlive-dynkin-diagrams texlive-dyntree texlive-ebproof
texlive-ec texlive-econometrics texlive-eepic texlive-e-french texlive-eijkhout
texlive-ekdosis texlive-elements
  texlive-ellipsis texlive-elocalloc texlive-eltex texlive-embedfile
texlive-embrac texlive-emf texlive-emoji texlive-emojicite texlive-emp
texlive-enctex texlive-encxvlna texlive-endfloat
  texlive-endiagram texlive-engrec texlive-engtlc texlive-enigma
texlive-enumitem texlive-environ texlive-epigram texlive-epsf
texlive-epsf-dvipdfmx texlive-epsincl texlive-epslatex-fr texlive-epstopdf
  texlive-epstopdf-pkg texlive-eqexpl texlive-eqnarray texlive-eqnnumwarn
texlive-erewhon texlive-erw-l3 texlive-eso-pic texlive-es-tex-faq
texlive-esvect texlive-etdipa texlive-etex texlive-etexcmds
  texlive-etex-pkg texlive-etextools texlive-etoc texlive-etoolbox
texlive-etoolbox-de texlive-euclideangeometry texlive-euenc texlive-euler
texlive-euro texlive-euro-ce texlive-eurosym
  texlive-everyhook texlive-everypage texlive-everysel texlive-everyshi
texlive-expkv texlive-expkv-cs texlive-expkv-def texlive-expkv-opt
texlive-expose-expl3-dunkerque-2019 texlive-expressg
  texlive-extarrows texlive-exteps texlive-extpfeil texlive-extratools
texlive-extsizes texlive-facture texlive-faktor texlive-fancybox
texlive-fancyhdr texlive-fancyhdr-it texlive-fancylabel
  texlive-fancyref texlive-fancyvrb texlive-fandol texlive-fascicules
texlive-featpost texlive-fenixpar texlive-feupphdteses texlive-feynmf
texlive-feynmp-auto texlive-fifinddo-info texlive-fifo-stack
  texlive-figflow texlive-filecontents texlive-filehook texlive-filesystem
texlive-finbib texlive-findhyph texlive-finstrut texlive-firstaid
texlive-fixlatvian texlive-fixltxhyph texlive-fixpdfmag
  texlive-fix2col texlive-fiziko texlive-float texlive-floatrow
texlive-fltpoint texlive-fmtcount texlive-fnpara texlive-fnpct texlive-fnspe
texlive-fntproof texlive-fontawesome texlive-fontawesome5
  texlive-fontaxes texlive-fontbook texlive-fontch texlive-font-change
texlive-font-change-xetex texlive-fontinst texlive-fontname texlive-fontools
texlive-fontspec texlive-fonts-tlwg texlive-fontware
  texlive-fontwrap texlive-footmisc texlive-footnotehyper texlive-forarray
texlive-forest texlive-forest-quickstart texlive-forloop
texlive-formation-latex-ul texlive-fouridx texlive-fp texlive-fpl
  texlive-fragmaster texlive-framed texlive-frenchmath texlive-frletter
texlive-frontespizio texlive-frpseudocode texlive-functan texlive-fvextra
texlive-galois texlive-garrigues texlive-garuda-c90
  texlive-gastex texlive-gates texlive-gene-logic texlive-gentle
texlive-geometry texlive-german texlive-germbib texlive-germkorr
texlive-getoptk texlive-gettitlestring texlive-gfnotation
  texlive-ghsystem texlive-git-latexdiff texlive-glosmathtools
texlive-glossaries texlive-gloss-occitan texlive-glyphlist texlive-gmp
texlive-gobble texlive-gotoh texlive-graphbox texlive-graphics
  texlive-graphics-cfg texlive-graphics-def texlive-graphics-pln
texlive-greek-fontenc texlive-grfext texlive-grffile texlive-grundgesetze
texlive-gsftopk texlive-gtl texlive-gu texlive-guide-to-latex
  texlive-gustlib texlive-gustprog texlive-happy4th texlive-hardwrap
texlive-hatching texlive-hausarbeit-jura texlive-helmholtz-ellis-ji-notation
texlive-helvetic texlive-hep texlive-hepnames
  texlive-hepparticles texlive-hepthesis texlive-hepunits texlive-hlist
texlive-hologo texlive-hook-pre-commit-pkg texlive-hopatch texlive-hrlatex
texlive-hulipsum texlive-hycolor texlive-hyperref
  texlive-hyphen-ancientgreek texlive-hyphenat texlive-hyphen-base
texlive-hyphen-basque texlive-hyphen-catalan texlive-hyphen-croatian
texlive-hyphen-czech texlive-hyphen-danish texlive-hyphen-dutch
  texlive-hyphen-english texlive-hyphen-estonian texlive-hyphenex
texlive-hyphen-finnish texlive-hyphen-french texlive-hyphen-friulan
texlive-hyphen-galician texlive-hyphen-german texlive-hyphen-greek
  texlive-hyphen-hungarian texlive-hyphen-churchslavonic
texlive-hyphen-icelandic texlive-hyphen-irish texlive-hyphen-italian
texlive-hyphen-kurmanji texlive-hyphen-latin texlive-hyphen-latvian
  texlive-hyphen-lithuanian texlive-hyphen-macedonian texlive-hyphen-norwegian
texlive-hyphen-occitan texlive-hyphen-piedmontese texlive-hyphen-polish
texlive-hyphen-portuguese texlive-hyphen-romanian
  texlive-hyphen-romansh texlive-hyphen-slovak texlive-hyphen-slovenian
texlive-hyphen-spanish texlive-hyphen-swedish texlive-hyphen-turkish
texlive-hyphen-uppersorbian texlive-hyphen-welsh
  texlive-hyph-utf8 texlive-hyplain texlive-changebar texlive-changepage
texlive-charter texlive-checkcites texlive-checklistings texlive-chemarrow
texlive-chemcompounds texlive-chemcono
  texlive-chemexec texlive-chemfig texlive-chemformula texlive-chemgreek
texlive-chemmacros texlive-chemnum texlive-chemplants texlive-chemsec
texlive-chemschemex texlive-chemstyle texlive-chicago
  texlive-chickenize texlive-chinese-jfm texlive-chklref texlive-chktex
texlive-chngcntr texlive-chronosys texlive-idxcmds texlive-ifmtarg
texlive-ifoddpage texlive-ifplatform texlive-ifptex
  texlive-ifsym texlive-iftex texlive-imakeidx texlive-impatient
texlive-impatient-fr texlive-impnattypo texlive-includernw texlive-index
texlive-infwarerr texlive-inlinedef texlive-innerscript
  texlive-insbox texlive-intcalc texlive-interchar texlive-interpreter
texlive-interval texlive-intro-scientific texlive-ionumbers texlive-isodate
texlive-isomath texlive-itnumpar texlive-jadetex
  texlive-jkmath texlive-jknapltx texlive-jmn texlive-jsclasses texlive-js-misc
texlive-jupynotex texlive-jurabib texlive-juramisc texlive-kanaparser
texlive-kantlipsum texlive-karnaugh
  texlive-karnaugh-map texlive-karnaughmap texlive-kastrup texlive-ketcindy
texlive-keyfloat texlive-knuth-errata texlive-knuth-lib texlive-knuth-local
texlive-knuth-pdf texlive-koma-script
  texlive-koma-script-examples texlive-kotex-utf texlive-kpathsea
texlive-kpathsea-bin texlive-kpfonts texlive-kpfonts-otf texlive-kvdefinekeys
texlive-kvmap texlive-kvoptions texlive-kvsetkeys
  texlive-lacheck texlive-lambda-lists texlive-langcode texlive-latex
texlive-latex-base-dev texlive-latex-bin texlive-latex-brochure
texlive-latexbug texlive-latexconfig texlive-latex-course
  texlive-latexcourse-rug texlive-latexdiff texlive-latexfileinfo-pkgs
texlive-latexfileversion texlive-latex-fonts texlive-latex-git-log
texlive-latex-graphics-companion texlive-latex-graphics-dev
  texlive-latexcheat texlive-latexcheat-de texlive-latexcheat-esmx
texlive-latexcheat-ptbr texlive-latexindent texlive-latexmk texlive-latexmp
texlive-latexpand texlive-latex-papersize
  texlive-latex-refsheet texlive-latex-tools-dev texlive-latex-veryshortguide
texlive-latex-via-exemplos texlive-latex-web-companion
texlive-latex2e-help-texinfo texlive-latex2e-help-texinfo-fr
  texlive-latex2e-help-texinfo-spanish texlive-latex2man texlive-latex2nemeth
texlive-latex4wp texlive-latex4wp-it texlive-layaureo texlive-lcdftypetools
texlive-lecturer texlive-letltxmacro
  texlive-letterspacing texlive-letterswitharrows texlive-lettrine
texlive-libertine texlive-libertinus-otf texlive-librarian texlive-lie-hasse
texlive-light-latex-make texlive-linegoal texlive-lineno
  texlive-lipsum texlive-listings texlive-listings-ext texlive-listofitems
texlive-lithuanian texlive-lm texlive-lm-math texlive-localloc
texlive-logicproof texlive-logreq texlive-longdivision
  texlive-lpform texlive-lplfitch texlive-lshort-czech texlive-lshort-dutch
texlive-lshort-english texlive-lshort-estonian texlive-lshort-finnish
texlive-lshort-french texlive-lshort-german
  texlive-lshort-italian texlive-lshort-polish texlive-lshort-portuguese
texlive-lshort-slovak texlive-lshort-slovenian texlive-lshort-spanish
texlive-lshort-turkish texlive-lstbayes texlive-ltablex
  texlive-ltabptch texlive-ltxcmds texlive-ltxfileinfo texlive-ltximg
texlive-ltxmisc texlive-lua-alt-getopt texlive-luabidi texlive-luacode
texlive-luacolor texlive-luahbtex texlive-luahyphenrules
  texlive-luaimageembed texlive-luaindex texlive-luainputenc texlive-luaintro
texlive-luajittex texlive-luakeys texlive-lualatex-math
texlive-lualatex-truncate texlive-lualibs texlive-luamplib
  texlive-luaotfload texlive-luapackageloader texlive-luaprogtable
texlive-luarandom texlive-luatex texlive-luatexbase texlive-luatexja
texlive-luatexko texlive-luatextra texlive-luatex85
  texlive-lua-typo texlive-lua-uca texlive-lua-ul texlive-lua-uni-algos
texlive-lua-visual-debug texlive-luavlna texlive-luaxml texlive-lwarp
texlive-l2picfaq texlive-l2tabu texlive-l2tabu-english
  texlive-l2tabu-french texlive-l2tabu-italian texlive-l2tabu-spanish
texlive-l3backend texlive-l3experimental texlive-l3kernel texlive-l3packages
texlive-macros2e texlive-mafr texlive-makecell
  texlive-makecmds texlive-makeindex texlive-makerobust texlive-make4ht
texlive-manfnt texlive-manfnt-font texlive-marginnote texlive-marvosym
texlive-matapli texlive-mathcommand texlive-mathcomp
  texlive-mathdots texlive-mathfixs texlive-math-into-latex-4 texlive-mathlig
texlive-mathpartir texlive-mathpazo texlive-mathpunctspace texlive-mathspec
texlive-maths-symbols texlive-mathtools
  texlive-match_parens texlive-matlab-prettifier texlive-matrix-skeleton
texlive-mattens texlive-mcf2graph texlive-mdframed texlive-mdwtools
texlive-media9 texlive-membranecomputing texlive-memdesign
  texlive-memoir texlive-MemoirChapStyles texlive-memorygraphs texlive-metafont
texlive-metafont-beginners texlive-metago texlive-metalogo texlive-metaobj
texlive-metaplot texlive-metapost
  texlive-metapost-colorbrewer texlive-metapost-examples texlive-metatex
texlive-metatype1 texlive-metauml texlive-mex texlive-mfirstuc texlive-mflogo
texlive-mflogo-font texlive-mflua texlive-mfnfss
  texlive-mfpic texlive-mfpic4ode texlive-mfware texlive-mf2pt1 texlive-mgltex
texlive-mhequ texlive-mhchem texlive-microtype texlive-microtype-de
texlive-midnight texlive-miller texlive-milog
  texlive-minifp texlive-minitoc texlive-minted texlive-mismath
texlive-mkjobtexmf texlive-mkpattern texlive-mnsymbol texlive-modes
texlive-modulus texlive-morefloats texlive-moreverb texlive-movie15
  texlive-mparhack texlive-mparrows texlive-mpattern texlive-mpcolornames
texlive-mpgraphics texlive-mptopdf texlive-mptrees texlive-mp3d texlive-ms
texlive-msg texlive-multido texlive-multiobjective
  texlive-multirow texlive-musicography texlive-mwcls texlive-mweights
texlive-nag texlive-namedef texlive-na-position texlive-natbib texlive-natded
texlive-nath texlive-navigator texlive-ncctools
  texlive-ncntrsbk texlive-needspace texlive-nevelok texlive-newfloat
texlive-newpax texlive-newsletr texlive-newtx texlive-newunicodechar
texlive-nicematrix texlive-nodetree texlive-norasi-c90
  texlive-notoccite texlive-npp-for-context texlive-ntgclass texlive-nth
texlive-ntheorem texlive-nuc texlive-nucleardata texlive-numberpt
texlive-numerica texlive-numprint texlive-oberdiek
  texlive-objectz texlive-ocg-p texlive-ocgx texlive-ocgx2 texlive-odsfile
texlive-ofs texlive-olsak-misc texlive-oplotsymbl texlive-optex
texlive-optional texlive-ordinalpt texlive-ot-tableau
  texlive-oubraces texlive-outerhbox texlive-overpic texlive-padcount
texlive-pagesel texlive-palatino texlive-paracol texlive-paralist
texlive-parallel texlive-parnotes texlive-parskip
  texlive-passivetex texlive-patgen texlive-patgen2-tutorial texlive-path
texlive-pbox texlive-pdfarticle texlive-pdfbook2 texlive-pdfcolmk
texlive-pdfcomment texlive-pdfcrop texlive-pdfescape
  texlive-pdfjam texlive-pdflatexpicscale texlive-pdflscape
texlive-pdfmanagement-testphase texlive-pdfpages texlive-pdftex
texlive-pdftexcmds texlive-pdftex-quiet texlive-pdftosrc texlive-pdf-trans
  texlive-pdfxup texlive-pdf14 texlive-perfectcut texlive-perltex
texlive-pfarrei texlive-pgf texlive-pgfgantt texlive-pgfopts texlive-pgfplots
texlive-philokalia texlive-physconst texlive-physics
  texlive-physunits texlive-pictexsum texlive-picture texlive-pict2e
texlive-piechartmp texlive-pinoutikz texlive-pitex texlive-pkfix
texlive-pkfix-helper texlive-pl texlive-placeat texlive-placeins
  texlive-placeins-plain texlive-plain texlive-plainpkg texlive-plantuml
texlive-platex texlive-platex-tools texlive-plipsum texlive-plnfss
texlive-plstmary texlive-pm-isomath texlive-polexpr
  texlive-polski texlive-polyglossia texlive-poormanlog texlive-prelim2e
texlive-present texlive-preview texlive-prftree texlive-principia
texlive-printlen texlive-proba texlive-profcollege
  texlive-proof-at-the-end texlive-prooftrees texlive-przechlewski-book
texlive-pseudo texlive-pseudocode texlive-psfrag texlive-psfrag-italian
texlive-pslatex texlive-psnfss texlive-pspicture
  texlive-pst-blur texlive-pst-calculate texlive-pst-coil texlive-pst-eps
texlive-pst-fill texlive-pst-grad texlive-pst-math texlive-pst-node
texlive-pst-ovl texlive-pst-pdf texlive-pst-plot
  texlive-pstricks texlive-pstricks-add texlive-pst-text texlive-pst-tree
texlive-pst-3d texlive-ps2eps texlive-ps2pk texlive-ptex texlive-ptex-base
texlive-ptex-fonts texlive-ptext texlive-purifyeps
  texlive-pwebmac texlive-pxfonts texlive-pythonhighlight texlive-pythontex
texlive-qpxqtx texlive-qrcode texlive-qsharp texlive-quran texlive-quran-de
texlive-ragged2e texlive-random
  texlive-randomlist texlive-rank-2-roots texlive-rcs texlive-realscripts
texlive-rec-thy texlive-refcount texlive-regexpatch texlive-relsize
texlive-repere texlive-rerunfilecheck texlive-rest-api
  texlive-resumemac texlive-revquantum texlive-ribbonproofs texlive-rmathbr
texlive-roex texlive-rojud texlive-roundrect texlive-rsfs texlive-ruhyphen
texlive-ruler texlive-r_und_s texlive-sankey
  texlive-sansmath texlive-sansmathaccent texlive-sasnrdisplay texlive-sauerj
texlive-scalerel texlive-sciposter texlive-sclang-prettifier texlive-scratchx
texlive-scripts texlive-scripts-extra
  texlive-section texlive-sectsty texlive-seetexk texlive-selinput
texlive-selnolig texlive-seminar texlive-sepnum texlive-sesamanuel
texlive-setspace texlive-sfg texlive-shade texlive-shadethm
  texlive-shadow texlive-shadowtext texlive-shapes texlive-short-math-guide
texlive-showexpl texlive-shuffle texlive-schemata texlive-schulmathematik
texlive-sidecap texlive-simplebnf texlive-simplekv
  texlive-simple-resume-cv texlive-simpler-wick
texlive-simple-thesis-dissertation texlive-simplewick texlive-simplified-latex
texlive-SIstyle texlive-SIunits texlive-siunitx texlive-skmath
  texlive-slideshow texlive-soul texlive-soulpos texlive-soulutf8
texlive-sourcecodepro texlive-spalign texlive-spelling texlive-spix
texlive-splines texlive-srcredact texlive-stackengine
  texlive-stanli texlive-startlatex2e texlive-statex texlive-statex2
texlive-statistics texlive-statistik texlive-statmath texlive-steinmetz
texlive-stmaryrd texlive-stricttex texlive-stringenc
  texlive-structmech texlive-struktex texlive-sttools texlive-sty2dtx
texlive-suanpan texlive-subdepth texlive-subfig texlive-subfigure
texlive-substances texlive-substr texlive-subsupscripts
  texlive-subtext texlive-supertabular texlive-susy texlive-svg-inkscape
texlive-svn-prov texlive-swebib texlive-swrule texlive-syllogism texlive-symbol
texlive-synctex texlive-synproof texlive-systeme
  texlive-tablor texlive-tabto-generic texlive-tabto-ltx texlive-tabu
texlive-tabulary texlive-tabvar texlive-tagging texlive-tagpdf
texlive-tamethebeast texlive-t-angles texlive-tap texlive-tasks
  texlive-tcolorbox texlive-tds texlive-tdsfrmath texlive-templates-fenn
texlive-templates-sommer texlive-tensind texlive-tensor texlive-termcal
texlive-termcal-de texlive-termmenu texlive-tetragonos
  texlive-tex texlive-texapi texlive-texbytopic texlive-texcount
texlive-texdate texlive-texdef texlive-texdiff texlive-texdirflatten
texlive-texdoc texlive-texdoctk texlive-tex-ewd
  texlive-tex-font-errors-cheatsheet texlive-texfot texlive-tex-gyre
texlive-tex-gyre-math texlive-texinfo texlive-tex-ini-files
texlive-texlive-common texlive-texlive-cz texlive-texlive-de
  texlive-texlive-en texlive-texlive-es texlive-texlive-fr
texlive-texlive.infra texlive-texlive.infra-doc texlive-texlive-it
texlive-texliveonfly texlive-texlive-pl texlive-texloganalyser
  texlive-tex-nutshell texlive-texonly texlive-texosquery texlive-tex-overview
texlive-texplate texlive-tex-ps texlive-tex-refs texlive-texshade
texlive-textcase texlive-textgreek texlive-textopo
  texlive-textpath texlive-textpos texlive-tex-virtual-academy-pl
texlive-texware texlive-tex4ebook texlive-tex4ht texlive-thmbox
texlive-thmtools texlive-threeddice texlive-threeparttable
  texlive-thumbpdf texlive-tie texlive-tikz-cd texlive-times texlive-timetable
texlive-tipa texlive-tipa-de texlive-titlepages texlive-titlesec
texlive-titling texlive-tkz-tab texlive-tlc2
  texlive-tlmgrbasics texlive-tocbibind texlive-tools texlive-tpic2pdftex
texlive-tracklang texlive-translation-array-fr
texlive-translation-arsclassica-de texlive-translation-biblatex-de
  texlive-translation-dcolumn-fr texlive-translation-ecv-de
texlive-translation-enumitem-de texlive-translation-europecv-de
texlive-translation-filecontents-de texlive-translation-chemsym-de
  texlive-translation-moreverb-de texlive-translation-natbib-fr
texlive-translations texlive-translation-tabbing-fr texlive-translator
texlive-transparent texlive-treetex texlive-trigonometry
  texlive-trimspaces texlive-truncate texlive-ttfutils texlive-tufte-latex
texlive-turkmen texlive-turnstile texlive-txfonts texlive-typehtml
texlive-typeoutfileinfo texlive-typewriter texlive-type1cm
  texlive-Type1fonts texlive-t2 texlive-ucs texlive-udesoftec texlive-uhc
texlive-uhrzeit texlive-ucharcat texlive-ucharclasses texlive-ukrhyph
texlive-ulem texlive-ulqda texlive-umlaute
  texlive-undergradmath texlive-underscore texlive-unicode-bidi
texlive-unicode-data texlive-unicode-math texlive-uninormalize
texlive-uniquecounter texlive-unisugar texlive-units texlive-unitsdef
  texlive-upca texlive-updmap-map texlive-uplatex texlive-upquote texlive-uptex
texlive-uptex-base texlive-uptex-fonts texlive-uri texlive-url texlive-utf8mex
texlive-utopia texlive-variations
  texlive-varisize texlive-varwidth texlive-venn texlive-verifica texlive-verse
texlive-visualfaq texlive-visualtikz texlive-vlna texlive-voss-mathcol
texlive-wadalab texlive-wallpaper texlive-was
  texlive-wasy texlive-wasysym texlive-wasy-type1 texlive-web texlive-webguide
texlive-witharrows texlive-wrapfig texlive-xargs texlive-xcjk2uni
texlive-xcolor texlive-xcomment texlive-xdvi
  texlive-xebaposter texlive-xecjk texlive-xecolor texlive-xecyr
texlive-xechangebar texlive-xeindex texlive-xelatex-dev texlive-xesearch
texlive-xespotcolor texlive-xetex texlive-xetexconfig
  texlive-xetexfontinfo texlive-xetex-itrans texlive-xetexko
texlive-xetex-pstricks texlive-xetexref texlive-xetex-tibetan texlive-xevlna
texlive-xfor texlive-xifthen texlive-xii texlive-xii-lat
  texlive-xindex texlive-xint texlive-xkeyval texlive-xlop texlive-xltxtra
texlive-xmltex texlive-xmltexconfig texlive-xpatch texlive-xpdfopen
texlive-xpinyin texlive-xsim texlive-xstring
  texlive-xunicode texlive-xymtex texlive-xypic-tut-pt texlive-yax
texlive-yhmath texlive-youngtab texlive-yquant texlive-ytableau
texlive-zapfding texlive-zapfchan texlive-zbmath-review-template
  texlive-zhmetrics texlive-zhmetrics-uptex texlive-zhnumber texlive-zref
texlive-zwpagelayout texlive-zztex texlive-12many

1419 packages to remove.
After the operation, 803,2 MiB will be freed.

pkgs: texlive-specs-g texlive-specs-o


--1648103876.facfA1.9009
Date: Thu, 24 Mar 2022 06:37:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197453

            Bug ID: 1197453
           Summary: VUL-1: CVE-2021-28275: A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
               URL: https://smash.suse.de/issue/327049/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-28275

A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild
address read in the Get16u function in exif.c in will cause segmentation fault
via a crafted_file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28275
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28275
https://github.com/Matthias-Wandel/jhead/issues/17


--1648103879.4CBAB871.10418
Date: Thu, 24 Mar 2022 06:37:59 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197454

            Bug ID: 1197454
           Summary: VUL-1: CVE-2021-28276: A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMakerNoteDir function in makernote.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
               URL: https://smash.suse.de/issue/327048/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-28276

A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild
address read in the ProcessCanonMakerNoteDir function in makernote.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28276
https://github.com/Matthias-Wandel/jhead/issues/1


--1648103882.edE611.10211
Date: Thu, 24 Mar 2022 06:38:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197455

            Bug ID: 1197455
           Summary: VUL-1: CVE-2021-28277: A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
               URL: https://smash.suse.de/issue/327047/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-28277

A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is
affected by: Buffer Overflow via the RemoveUnknownSections function in
jpgfile.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28277
https://github.com/Matthias-Wandel/jhead/issues/16


--1648103886.D6718eE1.9991
Date: Thu, 24 Mar 2022 06:38:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197456

            Bug ID: 1197456
           Summary: VUL-1: CVE-2021-28278: A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
               URL: https://smash.suse.de/issue/327046/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: sbrabec-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2021-28278

A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via
the
RemoveSectionType function in jpgfile.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28278
https://github.com/Matthias-Wandel/jhead/issues/15


--1648192642.2E0F4.11700
Date: Fri, 25 Mar 2022 07:17:22 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197506

            Bug ID: 1197506
           Summary: gnome-pomodoro broken by new gnome-shell
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: felix.niederwanger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When updating from 20220322 to 20220323, gnome-pomodoro complains about a too
high version of gnome-shell:

> Problem: the installed gnome-pomodoro-0.20.0-2.4.x86_64 requires 'gnome-shell < 42', but this requirement cannot be provided
>   deleted providers: gnome-shell-41.4-2.1.x86_64
>  Solution 1: Following actions will be done:
>   keep obsolete gnome-shell-41.4-2.1.x86_64
>   keep obsolete mutter-41.4-1.1.x86_64
>  Solution 2: deinstallation of gnome-pomodoro-0.20.0-2.4.x86_64
>  Solution 3: break gnome-pomodoro-0.20.0-2.4.x86_64 by ignoring some of its dependencies


--1648306618.ed188D1.28771
Date: Sat, 26 Mar 2022 14:56:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197552

            Bug ID: 1197552
           Summary: VUL-0: CVE-2022-1096: chromium: Type Confusion in V8
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: gmbr3-at-opensuse.org
          Found By: Security Response Team
           Blocker: ---

Fixed in Chromium 99.0.4844.84:
CVE-2022-1096: Type Confusion in V8
Public exploit exists

References:
https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html
https://crbug.com/1309225


body:
--1648374880.4cbA0.4169
Date: Sun, 27 Mar 2022 09:54:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197561

            Bug ID: 1197561
           Summary: RSS Guard misses Node.js
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: suse@gerrit-heim.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Since the last update RSS Guard reports the absence of Node.js. See settings ->
Node.js In the Spec-File i see no Node.js-Dependency. Should be added.

summary: RSS Guard misses Node.js


--1648561115.Ae452d1a0.18914
Date: Tue, 29 Mar 2022 13:38:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197651

            Bug ID: 1197651
           Summary: Lazarus startup error: Fppkg reports that the RTL is not installed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: voorburg-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 857475
  --> http://bugzilla.opensuse.org/attachment.cgi?id=857475&action=edit
Welcome to Lazarus screen, showing the Fppkg error

The update to Lazarus IDE 2.2.0 introduced a few problems to the point that you
can no longer do actual development work with it.

Upon startup, you now always get the "Welcome to Lazarus" screen, which reports
an error for Fppkg (see screenshot):

"Error: there is a problem with the Fppkg configuration. (Fppkg reports that
the RTL is not installed.)"

If you ignore it, Lazarus does start, but you cannot do much with it. If you
create an empty application and add something basic as just a TMemo or TTimer
on it, you get an error when trying to run it:

"Project project1 raised exception class 'EClassNotFound' with message: class
TMemo not found".

I installed Lazarus using:

sudo zypper install make gdb fpc fpc-src lazarus libQt5Pas-devel
libqt5-qtbase-devel

As a workaround, I installed Lazarus 2.2.0 and FPC 3.2.2 using the RPMs from
the Lazarus SourceForge page. In this case everything works fine. So it must
have something to do with how Lazarus and/or FPC are packages for openSUSE.


body:
--1648585261.2dEb0.28526
Date: Tue, 29 Mar 2022 20:21:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197664

            Bug ID: 1197664
           Summary: librecad mimetype error
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: opensuse@1.opensuse.bgcomp.co.uk
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

A tiny issue...

kf.service.services: The desktop entry file
"/usr/share/applications/librecad.desktop" has an empty MimeType!

And when you look at it, it has a line with 2 ';':
MimeType=image/vnd.dxf;;

summary: librecad mimetype error


body:
--1648608238.c530b0.18255
Date: Wed, 30 Mar 2022 02:43:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197672

            Bug ID: 1197672
           Summary: Podman is broken in 20220328
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: adathor-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,

After updating Tumbleweed today I can't launch any containers with podman,
getting the following error: https://paste.opensuse.org/15394995.
Suspecting conmon, but there has been no changes applied since end of Feb and
can't really see anything suspicious in zypper history either.

Gets more interesting. When ssh in to my workstation everything works fine.
Logs are here: https://paste.opensuse.org/42152257
This issue exists on MicroOS as well as one would expect.

summary: Podman is broken in 20220328


--1648625799.66Be01.3363
Date: Wed, 30 Mar 2022 07:36:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197680

            Bug ID: 1197680
           Summary: VUL-0: chromium: multiple security issues fixed in 100.0.4896.60
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: security-team-at-suse.de
          Found By: ---
           Blocker: ---

This update includes 28 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

[$7000][1292261] High CVE-2022-1125: Use after free in Portals. Reported by
Khalil Zhani on 2022-01-29

[$5000][1291891] High CVE-2022-1127: Use after free in QR Code Generator.
Reported by anonymous on 2022-01-28

[$5000][1301920] High CVE-2022-1128: Inappropriate implementation in Web Share
API. Reported by Abdel Adim (@smaury92) Oisfi of Shielder on 2022-03-01

[$3000][1300253] High CVE-2022-1129: Inappropriate implementation in Full
Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2022-02-24

[$1000][1142269] High CVE-2022-1130: Insufficient validation of untrusted input
in WebOTP. Reported by Sergey Toshin of Oversecurity Inc. on 2020-10-25

[$NA][1297404] High CVE-2022-1131: Use after free in Cast UI. Reported by
Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2022-02-15

[$TBD][1303410] High CVE-2022-1132: Inappropriate implementation in Virtual
Keyboard. Reported by Andr.Ess on 2022-03-07

[$TBD][1305776] High CVE-2022-1133: Use after free in WebRTC. Reported by
Anonymous on 2022-03-13

[$TBD][1308360] High CVE-2022-1134: Type Confusion in V8. Reported by Man Yue
Mo of GitHub Security Lab on 2022-03-21

[$16000][1285601] Medium CVE-2022-1135: Use after free in Shopping Cart.
Reported by Wei Yuan of MoyunSec VLab on 2022-01-09

[$7000][1280205] Medium CVE-2022-1136: Use after free in Tab Strip . Reported
by Krace on 2021-12-15

[$5000][1289846] Medium CVE-2022-1137: Inappropriate implementation in
Extensions. Reported by Thomas Orlita on 2022-01-22

[$2000][1246188] Medium CVE-2022-1138: Inappropriate implementation in Web
Cursor. Reported by Alesandro Ortiz on 2021-09-03

[$TBD][1268541] Medium CVE-2022-1139: Inappropriate implementation in
Background Fetch API. Reported by Maurice Dauer on 2021-11-10

[$TBD][1303253] Medium CVE-2022-1141: Use after free in File Manager. Reported
by raven at KunLun lab on 2022-03-05

[$TBD][1303613] Medium CVE-2022-1142: Heap buffer overflow in WebUI. Reported
by Leecraso and Guang Gong of 360 Alpha Lab on 2022-03-07

[$TBD][1303615] Medium CVE-2022-1143: Heap buffer overflow in WebUI. Reported
by Leecraso and Guang Gong of 360 Alpha Lab on 2022-03-07

[$TBD][1304145] Medium CVE-2022-1144: Use after free in WebUI. Reported by
Leecraso and Guang Gong of 360 Alpha Lab on 2022-03-08

[$TBD][1304545] Medium CVE-2022-1145: Use after free in Extensions. Reported by
Yakun Zhang of Baidu Security on 2022-03-09

[$TBD][1290150] Low CVE-2022-1146: Inappropriate implementation in Resource
Timing. Reported by Sohom Datta on 2022-01-23

We would also like to thank all security researchers that worked with us during
the development cycle to prevent security bugs from ever reaching the stable
channel.As usual, our ongoing internal security work was responsible for a wide
range of fixes:

[1311327] Various fixes from internal audits, fuzzing and other initiatives


--1648800859.1F7E0B5.20279
Date: Fri, 1 Apr 2022 08:14:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197907

            Bug ID: 1197907
           Summary: SLE-Classic not compatible with the new stylesheet  of GNOME 42
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: qkzhu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: dimstar-at-opensuse.org, fcrozat-at-suse.com,
                    gnome-bugs-at-suse.de, grace.wang-at-suse.com,
                    gyribeiro-at-suse.com, mawerner-at-suse.com,
                    sweiberg-at-suse.com, yfjiang-at-suse.com, zcjia-at-suse.com
        Depends on: 1197175
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1197175 +++

Steps:
1. Login with SLE-Classic session selected.
2. Press the "Windows" button and try to search the Cheese application by
inputting "Chess"
3. Observe the search result window

Actual Result:
Most of the characters can't be seen due to the color of the theme.
Please find the attachment for more details.


--1648914006.cBfA0.12741
Date: Sat, 2 Apr 2022 15:40:06 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197968

            Bug ID: 1197968
           Summary: systemd 250 seems to change handling of unreadable networkd
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The trigger of the bug is https://bugzilla.opensuse.org/show_bug.cgi?id=1197967

But systemd 250 changed the behavior of networkd.

Up to systemd 249 it just ignored unreadable files. so even if those vpn files
had root:root u=rw,g=r,o= it worked just fine as the normal network files were
worldreable. this is no longer the case and now it seems any unreadable file
breaks the network startup in the initrd. once we are in the full system, the
files on disk have the proper group again and loading of those vpn unit files
works.

Is this behavior change really intended?


--1648917561.FfDA510.15956
Date: Sat, 2 Apr 2022 16:39:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1197969

            Bug ID: 1197969
           Summary: No repository is present on the system after installing the Default .tax.xz image
    Classification: openSUSE
           Product: openSUSE Leap Micro
           Version: 5.3
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Base
          Assignee: lubos.kocman-at-suse.com
          Reporter: lubos.kocman-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Seems like there is no repository available on the preconfigured image (I did
download openSUSE-Leap-Micro.aarch64-Default.raw.xz

We need to ensure that this is set, as PM said this should be preferred way of
installing the image.


--1649062846.6Ac40.31355
Date: Mon, 4 Apr 2022 09:00:46 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1197994

            Bug ID: 1197994
           Summary: Tracker bug for -z now global enablement in factory for Full RELRO
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: meissner-at-suse.com
          Reporter: meissner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

We  started a project to globally enable -z now in Factory.

The default ELF linking option is -z lazy , but we want to mark elf binaries
relocation as "readonly" aka "Full RelRO" for security hardening purposes which
needs also this -z now immediate binding option.

This can expose problems with dynamically loaded modules and implicit function
imports, which needs to be handled specially. (it also might not be possible).

Also C++ with dynamic_cast / RTTI across modules will not work with this out of
the box.

Implementation approach:

Current approach we are taking is similar to the --as-needed global enablement:

- binutils can detected the "SUSE_ZNOW" variable.

  If it is set, and NOT 0, it will switch on -z now linking by default.

- post-build-checks does export SUSE_ZNOW=1 in
/etc/profile.d/suse-buildsystem.sh
  so it will be picked up by all packages.

The feature is currently staged in openSUSE:Factory:Staging:B only, and not in
Factory yet and I am working through failures.


--1649067174.1BaB6E0.15016
Date: Mon, 4 Apr 2022 10:12:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198000

            Bug ID: 1198000
           Summary: TW 20220402: powertop crashes after start
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: develop7@develop7.info
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Repro: run `sudo powertop --debug --html=report.html`

Expected: a report is generated

What happens instead: program crashes citing following output

$ sudo powertop --debug --html=report.html
[sudo] password for root:
modprobe cpufreq_stats failedLoaded 11 prior measurements
RAPL device for cpu 0
RAPL Using PowerCap Sysfs : Domain Mask 5
RAPL device for cpu 0
RAPL Using PowerCap Sysfs : Domain Mask 5
Devfreq not enabled
glob returned GLOB_ABORTED
Preparing to take measurements
Killed


--1649108692.eCd7a0.1261
Date: Mon, 4 Apr 2022 21:44:52 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198053

            Bug ID: 1198053
           Summary: VUL-0: CVE-2022-1232: chromium: Type Confusion in V8
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

CVE-2022-1232: Type Confusion in V8

fixed in 100.0.4896.75

References:
https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html

https://crbug.com/1311641


--1649159220.61eB2.3164
Date: Tue, 5 Apr 2022 11:47:00 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198089

            Bug ID: 1198089
           Summary: VUL-1: CVE-2022-1212: mruby: Use-After-Free in str_escape in mruby prior to 3.2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.4
          Hardware: Other
               URL: https://smash.suse.de/issue/328103/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Ruby
          Assignee: rpm-at-fthiessen.de
          Reporter: cathy.hu-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2022-1212

Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby
prior to 3.2. Possible arbitrary code execution if being exploited.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1212
https://github.com/mruby/mruby/commit/3cf291f72224715942beaf8553e42ba8891ab3c6
https://huntr.dev/bounties/9fcc06d0-08e4-49c8-afda-2cae40946abe


--1649170651.1fec8b3.29745
Date: Tue, 5 Apr 2022 14:57:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198106

            Bug ID: 1198106
           Summary: quilt push fails to parse filenames of modified files from patch
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: patrik.jakobsson-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 857842
  --> http://bugzilla.opensuse.org/attachment.cgi?id=857842&action=edit
Patch that is not parsed correctly

Here's an interesting one...

I ran into this issue when trying to backport a patch to the SLE15-SP4 kernel.
The patch fails to apply, so I do "quilt push -f" to apply the patch. If I then
run "quilt files" it only shows one of the two files modified by the patch.

Doing "quilt push -f --merge" instead results in the correct behaviour. Both
files are listed by "quilt files".

Interestingly enough the problem only occurs on ext4 filesystems. tmpfs and
btrfs seems to work fine. Others have confirmed this as well.

When removing --git from the "diff --git a/... b/..." lines in the patch it
also works.

This makes us believe that the problem is in the git specific parts of the
patch tool.

I'm attaching the offending patch and there is also an internal branch at
users/pjakobsson/SLE15-SP4/quilt-is-broken for those who have access.


--1649190271.Ed60A8aD0.5569
Date: Tue, 5 Apr 2022 20:24:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198118

            Bug ID: 1198118
           Summary: Steam requires 'tar' package from download.opensuse.org-non-oss does not install 'tar' if it is absent from the system.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: alejandro_moraleslepe-at-posteo.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When installing Steam with GNOME Software on a system that does not have 'tar'
installed, GNOME Software does not pull 'tar' which is required for the
application to be executed. Steam appears to be installed, but the first run,
which requires decompression in order to setup itself will fail, without any
output on the GUI, the only clue of what is going on, being when Steam is ran
from CLI. This will be confusing for new or non-technically oriented users.


--1649198090.B43c50.16531
Date: Tue, 5 Apr 2022 22:34:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198124

            Bug ID: 1198124
           Summary: chromium: Opening and closing media controls triggers segmentation fault
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: victhor.foster-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 857852
  --> http://bugzilla.opensuse.org/attachment.cgi?id=857852&action=edit
gdb backtrace

Chromium 100.0.4896.60-1.1 suffers from a bug that causes the entire browser to
crash with either a segfault or a general protection fault, triggered by
opening then closing the media controls.

Steps to reproduce:
1. Open any site that plays back media (youtube, spotify, etc)
2. Click on the media control button on the toolbar
3. Click on the button again, to close the dialog

Actual result:
Chromium crashes with a segfault or a general protection fault.

Expected result:
Media control dialog closes.

Build:
Tumbleweed 20220403 x86_64
CPU: Intel Core i7-7200U
GPU: Intel HD Graphics 620
No command line options or flags were used, other than any set by the
distribution's /usr/bin/chromium script.


body:
--1649215543.1250d204.9737
Date: Wed, 6 Apr 2022 03:25:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198128

            Bug ID: 1198128
           Summary: Optimize NetworkManager subpackages.
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: yfjiang-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Currently NetworkManager is nearly "monotholically packaged", which appears
nearly everything is packed in a single package networkManager (except for
libnm, adsl&pppoe were splitted into sub packages). With the NetworkManager's
role played in areas like cloud instances and storage-sensitive devices, it is
more important to split the package into more fine-grain items so that people
could select what to install to precisely fit the requirement. For example,
Fedora had a practical package splitting to get the major feautures divided:

https://src.fedoraproject.org/rpms/NetworkManager/raw/f36/f/NetworkManager.spec

where I think it makes sense to look into those packages:

%package bluetooth ...
%package team ...
%package wifi ...
%package wwan ...
%package ovs ...
%package ppp ...
%package config-server ...
%package tui ...
%package cloud-setup ...

Probably we could do things similar.

summary: Optimize NetworkManager subpackages.


--1649223613.Fb7aAE0.12277
Date: Wed, 6 Apr 2022 05:40:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198130

            Bug ID: 1198130
           Summary: security/parsec-tool: Bug rust-packaging will be removed. Please update to cargo-packaging
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: meissner-at-suse.com
          Reporter: william.brown-at-suse.com
        QA Contact: screening-team-bugs-at-suse.de
          Found By: ---
           Blocker: ---

We plan to remove the unmaintained rust-packaging package. Please update to use
cargo-packaging instead.


--1649223616.777dF60.16906
Date: Wed, 6 Apr 2022 05:40:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198131

            Bug ID: 1198131
           Summary: security/parsec: Bug rust-packaging will be removed. Please update to cargo-packaging
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: meissner-at-suse.com
          Reporter: william.brown-at-suse.com
        QA Contact: screening-team-bugs-at-suse.de
          Found By: ---
           Blocker: ---

We plan to remove the unmaintained rust-packaging package. Please update to use
cargo-packaging instead.


--1649262211.Adad0.31837
Date: Wed, 6 Apr 2022 16:23:31 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1198166

            Bug ID: 1198166
           Summary: PostgreSQL 11-14 don't build with LLVM 14
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: aaronpuchert@alice-dsl.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

There are some missing headers that were probably transitively included before:

llvmjit_error.cpp:28:13: error: 'new_handler' in namespace 'std' does not name
a type
   28 | static std::new_handler old_new_handler = NULL;
      |             ^~~~~~~~~~~
llvmjit_error.cpp:32:64: error: 'string' in namespace 'std' does not name a
type
   32 | static void fatal_llvm_new_handler(void *user_data, const std::string&
reason, bool gen_crash_diag);
      |                                                                ^~~~~~
llvmjit_error.cpp:25:1: note: 'std::string' is defined in header '<string>';
did you forget to '#include <string>'?
   24 | #include "jit/llvmjit.h"
  +++ |+#include <string>
   25 |

Then later a removed function:

llvmjit_inline.cpp: In function 'bool function_inlinable(llvm::Function&, int,
FunctionInlineStates&, InlineWorkList&, InlineSearchPath&,
llvm::SmallPtrSet<const llvm::Function*, 8>&, int&, llvm::StringSet<>&)':
llvmjit_inline.cpp:597:31: error: 'class llvm::AttributeList' has no member
named 'hasFnAttribute'; did you mean 'addFnAttribute'?
  597 |         if
(F.getAttributes().hasFnAttribute(llvm::Attribute::NoInline))
      |                               ^~~~~~~~~~~~~~
      |                               addFnAttribute
llvmjit_inline.cpp: In function 'llvm::Function*
create_redirection_function(std::unique_ptr<llvm::Module>&, llvm::Function*,
llvm::StringRef)':
llvmjit_inline.cpp:885:18: error: 'class llvm::CallInst' has no member named
'addAttribute'; did you mean 'getAttributes'?
  885 |         fwdcall->addAttribute(~0U, inlineAttribute);
      |                  ^~~~~~~~~~~~
      |                  getAttributes

Then the build aborts. I see two solutions:

1) Pin to llvm13 for now.
2) Fix the build errors. Likely there are already changes upstream that can be
ported back, none of the build errors seem related to patches we have in
openSUSE.

This is currently in Staging:F, change that causes it is
https://build.opensuse.org/request/show/967027.


body:
--1649318915.D2CAf0.31283
Date: Thu, 7 Apr 2022 08:08:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

https://bugzilla.suse.com/show_bug.cgi?id=1198182

            Bug ID: 1198182
           Summary: replace SDL1 by sdl12-compat
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: jengelh-at-inai.de
          Reporter: meissner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: mgorse-at-suse.com
          Found By: ---
           Blocker: ---

bug 1198001 sugested replacing SDL 1.2 by sdl12-compat

 Michael Gorse 2022-04-05 18:55:00 UTC

For TW, I think we should replace the old SDL package with sdl12-compat, since
SDL 1.2 is no longer maintained. Red Hat has done this. But that should be a
separate bug. I've submitted a backport of the CVE fix for now.

Is this something you could take?

summary: replace SDL1 by sdl12-compat