[Bug 1737785] New: CVE-2019-1010238 pango: heap based buffer overflow can be used to get code execution
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1737785
Bug ID: 1737785
Summary: CVE-2019-1010238 pango: heap based buffer overflow can
be used to get code execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: mrehak(a)redhat.com
CC: caillon+fedoraproject(a)gmail.com,
eng-i18n-bugs(a)redhat.com,
fonts-bugs(a)lists.fedoraproject.org,
gnome-sig(a)lists.fedoraproject.org,
i18n-bugs(a)lists.fedoraproject.org,
john.j5live(a)gmail.com, mclasen(a)redhat.com,
pwu(a)redhat.com, rhughes(a)redhat.com,
rstrode(a)redhat.com, sandmann(a)redhat.com,
tagoh(a)redhat.com
Target Milestone: ---
Classification: Other
Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The
heap based buffer overflow can be used to get code execution. The component is:
function name: pango_log2vis_get_embedding_levels, assignment of nchars and the
loop condition. The attack vector is: Bug can be used when application pass
invalid utf-8 strings to functions like pango_itemize.
External References:
https://packetstormsecurity.com/files/153838/USN-4081-1.txt
--
You are receiving this mail because:
You are on the CC list for the bug.
4 weeks
[Bug 1750891] New: font cache not getting update on Silverblue 31?
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1750891
Bug ID: 1750891
Summary: font cache not getting update on Silverblue 31?
Product: Fedora
Version: 31
Status: NEW
Component: fontconfig
Assignee: tagoh(a)redhat.com
Reporter: pnemade(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ajax(a)redhat.com, caillon+fedoraproject(a)gmail.com,
fonts-bugs(a)lists.fedoraproject.org,
gnome-sig(a)lists.fedoraproject.org,
i18n-bugs(a)lists.fedoraproject.org,
john.j5live(a)gmail.com, mclasen(a)redhat.com,
pnemade(a)redhat.com, rhughes(a)redhat.com,
rstrode(a)redhat.com, sandmann(a)redhat.com,
tagoh(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
I have this system state
[parag@localhost ~]$ rpm-ostree status
State: idle
AutomaticUpdates: disabled
Deployments:
● ostree://fedora:fedora/31/x86_64/silverblue
Version: 31.20190909.n.0 (2019-09-09T08:24:14Z)
BaseCommit:
093a07e18c0514e47e978c9c33ef73a2615117db343e0eef7218c298b1e3502c
GPGSignature: Valid signature by
7D22D5867F2A4236474BF7B850CB390B3C3359C4
LayeredPackages: gedit gnome-tweaks hunspell-hi langpacks-hi
libreoffice-core
ostree://fedora:fedora/31/x86_64/silverblue
Version: 31.20190909.n.0 (2019-09-09T08:24:14Z)
BaseCommit:
093a07e18c0514e47e978c9c33ef73a2615117db343e0eef7218c298b1e3502c
GPGSignature: Valid signature by
7D22D5867F2A4236474BF7B850CB390B3C3359C4
LayeredPackages: gedit gnome-tweaks hunspell-hi libreoffice-core
[parag@localhost ~]$ rpm-ostree db diff
ostree diff commit from: rollback deployment
(0ad271d38c5aa4e1ce194ea625f83862d2c317774d96ba9b94d53c5324133265)
ostree diff commit to: booted deployment
(61f7aea98b458e53e42e85131e62ad7c84f80592676f28949cc5aa411e34ff55)
Added:
glibc-langpack-hi-2.30-1.fc31.x86_64
google-noto-sans-devanagari-ui-vf-fonts-20181223-6.fc31.noarch
google-noto-sans-devanagari-vf-fonts-20181223-6.fc31.noarch
hyphen-hi-1:0.7.0-14.fc31.noarch
langpacks-core-hi-2.0-6.fc31.noarch
langpacks-hi-2.0-6.fc31.noarch
libreoffice-help-hi-1:6.3.1.2-1.fc31.x86_64
libreoffice-langpack-hi-1:6.3.1.2-1.fc31.x86_64
samyak-devanagari-fonts-1.2.2-22.fc31.noarch
samyak-fonts-common-1.2.2-22.fc31.noarch
[parag@localhost ~]$ fc-list :lang=hi
/usr/share/fonts/lohit-devanagari/Lohit-Devanagari.ttf: Lohit
Devanagari:style=Regular
/usr/share/fonts/google-droid/DroidSansDevanagari-Regular.ttf: Droid
Sans:style=Regular
[parag@localhost ~]$
Version-Release number of selected component (if applicable):
fontconfig-2.13.92-2.fc31.x86_64
How reproducible:
always
Steps to Reproduce:
1. on F31, install any langpacks which will install additional fonts packages
like langpacks-hi
2. execute fc-list :lang=hi
3.
Actual results:
"fc-list :lang=hi" output remained same
Expected results:
"fc-list :lang=hi" should included rencently installed font packages as well
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month
[Bug 1753295] New: Pango no longer supports bitmap fonts
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1753295
Bug ID: 1753295
Summary: Pango no longer supports bitmap fonts
Product: Fedora
Version: 31
Status: NEW
Component: pango
Assignee: tagoh(a)redhat.com
Reporter: jsbillin(a)umich.edu
QA Contact: extras-qa(a)fedoraproject.org
CC: caillon+fedoraproject(a)gmail.com,
fonts-bugs(a)lists.fedoraproject.org,
gnome-sig(a)lists.fedoraproject.org,
i18n-bugs(a)lists.fedoraproject.org,
john.j5live(a)gmail.com, mclasen(a)redhat.com,
pwu(a)redhat.com, rhughes(a)redhat.com,
rstrode(a)redhat.com, sandmann(a)redhat.com,
tagoh(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
In pango 1.44, pango dropped support for bitmap fonts, so font packages like
terminus-fonts and ucs-miscfixed-fonts no longer appear in GNOME applications
that use pango, such as Terminal. If you did a dnf system-upgrade from Fedora
30 and were using a bitmap font like Terminus, all your terminals will show the
rectangular placeholders the first time you start a terminal.
Bitmap fonts like terminus and ucs-miscfixed are much easier to read in a
terminal since they are pixel perfect. If Fedora 31 is going to disable
support for bitmap fonts, it needs to be announced and the package maintainers
of those bitmap font packages are going to need to find a way to convert their
fonts.
Version-Release number of selected component (if applicable):
pango-1.44.6-1.fc31.x86_64
How reproducible:
always
Steps to Reproduce:
1. install 'terminus-fonts'
2. Start GNOME terminal
3. Open Terminal Preferences
4. Attempt to change the font to Terminus font
Actual results:
If you upgraded from Fedora 30 and had Terminus fonts as the default font, the
first time you launch Terminal, all the text will be the rectangular
placeholders. If you search for the Terminus font in the preferences, you
won't be able to find it.
Expected results:
Use the Terminus font as usual
Additional info:
It appears that pango switched from using FreeType to HarfBuzz, which only
supports truetype. I rebuilt the Fedora 30 pango package (1.43) for Fedora 31,
downgraded it, and now my terminals are fine showing my bitmap fonts.
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month
[Bug 1733869] New: gettext: Getting errors in double free with msgfmt command.
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1733869
Bug ID: 1733869
Summary: gettext: Getting errors in double free with msgfmt
command.
Product: Fedora
Version: 30
Status: NEW
Component: gettext
Assignee: panovotn(a)redhat.com
Reporter: poyadav(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dueno(a)redhat.com, i18n-bugs(a)lists.fedoraproject.org,
jjanco(a)redhat.com, nphilipp(a)redhat.com,
panovotn(a)redhat.com, petersen(a)redhat.com,
praiskup(a)redhat.com, suanand(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem: Error in poc, please refer the result section for
details.
Version-Release number of selected component (if applicable):
gettext-0.19.8.1-18.fc30.x86_64
How reproducible:
Always
Steps to Reproduce:
1. Clone https://github.com/CCCCCrash/POCs.git.
2. Run valgrind msgfmt poc command.
3. Observe the output.
Actual results:
[poyadav@localhost doublefree]$ valgrind msgfmt poc
==8072== Memcheck, a memory error detector
==8072== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==8072== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==8072== Command: msgfmt poc
==8072==
==8072== Conditional jump or move depends on uninitialised value(s)
==8072== at 0x48D9940: freea (in /usr/lib64/libgettextlib-0.19.8.1.so)
==8072== by 0x487E8EA: po_lex_charset_set (in
/usr/lib64/libgettextsrc-0.19.8.1.so)
==8072== by 0x487E098: po_gram_parse (in
/usr/lib64/libgettextsrc-0.19.8.1.so)
==8072== by 0x487EB9A: ??? (in /usr/lib64/libgettextsrc-0.19.8.1.so)
==8072== by 0x487A773: catalog_reader_parse (in
/usr/lib64/libgettextsrc-0.19.8.1.so)
==8072== by 0x10E7C7: ??? (in /usr/bin/msgfmt)
==8072== by 0x10D8EB: ??? (in /usr/bin/msgfmt)
==8072== by 0x4AABF32: (below main) (in /usr/lib64/libc-2.29.so)
==8072==
poc:17: duplicate message definition...
poc:16: ...this is the location of the first definition
poc:18:3: syntax error
poc:18: keyword "n" unknown
poc:19: end-of-line within string
poc:28: duplicate message definition...
poc:24: ...this is the location of the first definition
poc:35: keyword "msgud_plural" unknown
poc:34: missing 'msgstr' section
poc:35:13: syntax error
poc:40: end-of-line within string
poc:46: end-of-line within string
poc: warning: Charset missing in header.
Message conversion to user's charset will not work.
poc:42: duplicate message definition...
poc:6: ...this is the location of the first definition
poc:46:2: syntax error
poc:46: keyword "Ep" unknown
poc:47: keyword "C" unknown
poc:48: keyword "s" unknown
poc:49: keyword "bo" unknown
poc:50: keyword "S" unknown
poc:50:236: invalid control sequence
poc:50:397: invalid control sequence
poc:51: end-of-line within string
msgfmt: too many errors, aborting
==8072==
==8072== HEAP SUMMARY:
==8072== in use at exit: 59,783 bytes in 123 blocks
==8072== total heap usage: 547 allocs, 424 frees, 99,479 bytes allocated
==8072==
==8072== LEAK SUMMARY:
==8072== definitely lost: 650 bytes in 82 blocks
==8072== indirectly lost: 0 bytes in 0 blocks
==8072== possibly lost: 0 bytes in 0 blocks
==8072== still reachable: 59,133 bytes in 41 blocks
==8072== suppressed: 0 bytes in 0 blocks
==8072== Rerun with --leak-check=full to see details of leaked memory
==8072==
==8072== Use --track-origins=yes to see where uninitialised values come from
==8072== For lists of detected and suppressed errors, rerun with: -s
==8072== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Expected results:
No errors.
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month, 2 weeks
[Bug 1739051] New: tomoe-gtk depends on Python 2
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1739051
Bug ID: 1739051
Summary: tomoe-gtk depends on Python 2
Product: Fedora
Version: rawhide
Status: NEW
Component: tomoe-gtk
Assignee: extras-orphan(a)fedoraproject.org
Reporter: lbalhar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com, extras-orphan(a)fedoraproject.org,
i18n-bugs(a)lists.fedoraproject.org, tfujiwar(a)redhat.com
Blocks: 1698500 (F31_PY2REMOVAL)
Target Milestone: ---
Classification: Fedora
Python 2.7 will reach end-of-life in January 2020, over 9 years after it was
released. This falls within the Fedora 31 lifetime.
Packages that depend on Python 2 are being switched to Python 3 or removed from
Fedora:
https://fedoraproject.org/wiki/Changes/F31_Mass_Python_2_Package_Removal#...
Python 2 will be retired in Fedora 32:
https://fedoraproject.org/wiki/Changes/RetirePython2
To help planning, we'd like to know the plans for tomoe-gtk's future.
Specifically:
- What is the reason for the Python2 dependency? (Is it software written in
Python, or does it just provide Python bindings, or use Python in the build
system or test runner?)
- What are the upstream/community plans/timelines regarding Python 3?
- What is the guidance for porting to Python 3? (Assuming that there is someone
who generally knows how to port to Python 3, but doesn't know anything about
the particular package, what are the next steps to take?)
This bug is filed semi-automatically, and might not have all the context
specific to tomoe-gtk.
If you need anything from us, or something is unclear, please mention it here.
Thank you.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1698500
[Bug 1698500] F31 Mass Python 2 Package Removal
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month, 2 weeks
[Bug 1689745] New: [abrt] ibus-libpinyin: pinyin_save(): ibus-engine-libpinyin killed by SIGSEGV
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1689745
Bug ID: 1689745
Summary: [abrt] ibus-libpinyin: pinyin_save():
ibus-engine-libpinyin killed by SIGSEGV
Product: Fedora
Version: 30
Hardware: x86_64
Status: NEW
Whiteboard: abrt_hash:cb822be7ac46c50ce113ca1671deec6e2f6c4599;
Component: ibus-libpinyin
Assignee: pwu(a)redhat.com
Reporter: robinlee.sysu(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: i18n-bugs(a)lists.fedoraproject.org,
petersen(a)redhat.com, pwu(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
Crash when updating system
Version-Release number of selected component:
ibus-libpinyin-1.11.0-2.fc30
Additional info:
reporter: libreport-2.10.0
backtrace_rating: 4
cmdline: /usr/libexec/ibus-engine-libpinyin --ibus
crash_function: pinyin_save
executable: /usr/libexec/ibus-engine-libpinyin
journald_cursor:
s=cc3b4d7aa103497a99d675649b9ae013;i=94c7;b=13573ad620e541ff8cacc1ad1ceca0c3;m=eea6a32;t=584549ca4b236;x=245f7212fc098115
kernel: 5.0.0-300.fc30.x86_64
rootdir: /
runlevel: N 5
type: CCpp
uid: 1000
Truncated backtrace:
Thread no. 1 (10 frames)
#0 pinyin_save at pinyin.cpp:736
#1 PY::LibPinyinBackEnd::clearPinyinUserData at PYLibPinyin.cc:307
#2 PY::PinyinConfig::valueChanged at
/usr/include/c++/9/bits/basic_string.h:2297
#3 PY::LibPinyinConfig::valueChangedCallback at
/usr/include/c++/9/bits/char_traits.h:300
#8 g_settings_real_change_event at ../gio/gsettings.c:391
#9 ffi_call_unix64 at ../src/x86/unix64.S:76
#10 ffi_call at ../src/x86/ffi64.c:525
#11 g_cclosure_marshal_generic_va at ../gobject/gclosure.c:1614
#12 _g_closure_invoke_va at ../gobject/gclosure.c:873
#15 settings_backend_path_changed at ../gio/gsettings.c:466
Potential duplicate: bug 1649100
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month, 2 weeks
[Bug 1711631] New: [abrt] ibus-libpinyin: pinyin_save(pinyin_context_t*)(): ibus-engine-libpinyin killed by SIGSEGV
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1711631
Bug ID: 1711631
Summary: [abrt] ibus-libpinyin:
pinyin_save(pinyin_context_t*)():
ibus-engine-libpinyin killed by SIGSEGV
Product: Fedora
Version: 30
Hardware: x86_64
Status: NEW
Whiteboard: abrt_hash:2907b6d4b730ec4a10a6bea50fea98c87d3a4241;VAR
IANT_ID=workstation;
Component: ibus-libpinyin
Assignee: pwu(a)redhat.com
Reporter: leftmostcat(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: i18n-bugs(a)lists.fedoraproject.org,
petersen(a)redhat.com, pwu(a)redhat.com
Target Milestone: ---
Classification: Fedora
Version-Release number of selected component:
ibus-libpinyin-1.11.0-2.fc30
Additional info:
reporter: libreport-2.10.0
backtrace_rating: 4
cmdline: /usr/libexec/ibus-engine-libpinyin --ibus
crash_function: pinyin_save(pinyin_context_t*)
executable: /usr/libexec/ibus-engine-libpinyin
journald_cursor:
s=f9047c3871b9426fb1457b843e4962ba;i=2be43;b=a2c85faaa45f4919a598643806057a19;m=10704f78ad;t=58937579e8528;x=34c91ce58520a188
kernel: 5.0.16-300.fc30.x86_64
rootdir: /
runlevel: N 5
type: CCpp
uid: 1000
Truncated backtrace:
Thread no. 1 (4 frames)
#0 pinyin_save(pinyin_context_t*) at pinyin.cpp:736
#1 PY::LibPinyinBackEnd::clearPinyinUserData(char const*) at
PYLibPinyin.cc:307
#2 PY::PinyinConfig::valueChanged(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&,
std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >
const&, _GVariant*) at /usr/include/c++/9/bits/basic_string.h:2297
#3 PY::LibPinyinConfig::valueChangedCallback(_GSettings*, char const*,
PY::LibPinyinConfig*) at /usr/include/c++/9/bits/char_traits.h:300
Potential duplicate: bug 1579078
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month, 2 weeks
[Bug 1748187] New: cannot install the best update candidate for package liberation-fonts-1:2.00.5-3.fc30.noarch
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1748187
Bug ID: 1748187
Summary: cannot install the best update candidate for package
liberation-fonts-1:2.00.5-3.fc30.noarch
Product: Fedora
Version: 30
Hardware: x86_64
OS: Linux
Status: NEW
Component: liberation-narrow-fonts
Severity: high
Assignee: vishalvijayraghavan(a)gmail.com
Reporter: sascha(a)peilicke.de
QA Contact: extras-qa(a)fedoraproject.org
CC: i18n-bugs(a)lists.fedoraproject.org,
psatpute(a)redhat.com, vishalvijayraghavan(a)gmail.com
Target Milestone: ---
Classification: Fedora
Description of problem:
$ sudo dnf upgrade --best --allowerasing --skip-broken
Last metadata expiration check: 0:01:01 ago on Di 03 Sep 2019 08:17:06 CEST.
Error:
Problem: cannot install the best update candidate for package
liberation-fonts-1:2.00.5-3.fc30.noarch
- cannot install both liberation-fonts-1:2.00.5-1.fc30.noarch and
liberation-fonts-1:2.00.5-3.fc30.noarch
- problem with installed package liberation-narrow-fonts-1.07.6-1.fc30.noarch
- cannot install the best update candidate for package
liberation-narrow-fonts-1.07.6-1.fc30.noarch
$ dnf list installed | grep liberation
liberation-fonts.noarch 1:2.00.5-3.fc30 @updates
liberation-fonts-common.noarch 1:2.00.5-3.fc30 @updates
liberation-mono-fonts.noarch 1:2.00.5-3.fc30 @updates
liberation-narrow-fonts.noarch 1.07.6-1.fc30 @fedora
liberation-sans-fonts.noarch 1:2.00.5-3.fc30 @updates
liberation-serif-fonts.noarch 1:2.00.5-3.fc30 @updates
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month, 3 weeks
[Bug 1707001] New: Ibus-pinyin ERROR
by bugzilla＠redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1707001
Bug ID: 1707001
Summary: Ibus-pinyin ERROR
Product: Fedora
Version: 30
Hardware: All
OS: Linux
Status: NEW
Component: ibus-pinyin
Severity: urgent
Assignee: pwu(a)redhat.com
Reporter: 1990konger(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: i18n-bugs(a)lists.fedoraproject.org, pwu(a)redhat.com,
shawn.p.huang(a)gmail.com, tfujiwar(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
The input method is incorrect and cannot be recognized correctly. The text to
be entered is required.
For example, 'nihao' should be right, '你好'.
Now enter 'nihao' to show 'niha o'.Unrecognized what you need
'ni' is a word.
'hao' is a word.
'ha' is a word but the display is wrong at this time and cannot be selected.
Unable to recognize 'hao'. Affect all input suggestions to withdraw to the old
version
Version-Release number of selected component (if applicable):
Name : ibus-pinyin
Version : 1.5.0
Release : 16.fc30
How reproducible:
'nihao' is meaning is 'Hello'
'niha o', it is an error
Steps to Reproduce:
1.All Chinese input is wrong
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
1 month, 3 weeks