[Bug 1199972] New: perl-Gtk3-0.019-1.fc23 FBTFS:
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1199972
Bug ID: 1199972
Summary: perl-Gtk3-0.019-1.fc23 FBTFS:
Product: Fedora
Version: rawhide
Component: perl-Gtk3
Assignee: berrange(a)redhat.com
Reporter: ppisar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: berrange(a)redhat.com,
perl-devel(a)lists.fedoraproject.org
perl-Gtk3-0.019-1.fc23 fails to build in F23 because a test fails:
t/floating-refs.t .............. ok
Gtk-Message: GtkDialog mapped without a transient parent. This is discouraged.
GLib-GObject-WARNING **: The property GtkColorButton:color is deprecated and
shouldn't be used anymore. It will be removed in a future version. at
/usr/lib64/perl5/vendor_perl/Glib/Object/Introspection.pm line 58.
GLib-GIO-Message: Using the 'memory' GSettings backend. Your settings will not
be saved or shared with other applications.
GLib-GObject-WARNING **: The property GtkButton:use-stock is deprecated and
shouldn't be used anymore. It will be removed in a future version. at
/builddir/build/BUILD/Gtk3-0.019/blib/lib/Gtk3.pm line 702.
GLib-GObject-WARNING **: The property GtkSettings:gtk-button-images is
deprecated and shouldn't be used anymore. It will be removed in a future
version. at /builddir/build/BUILD/Gtk3-0.019/blib/lib/Gtk3.pm line 702.
*** menu position callback ignoring error: Can't use string ("320") as an ARRAY
ref while "strict refs" in use at t/overrides.t line 235.
*** menu position callback must return two integers (x, y) or two integers and
a boolean (x, y, push_in) at /builddir/build/BUILD/Gtk3-0.019/blib/lib/Gtk3.pm
line 937.
*** menu position callback ignoring error: Can't use string ("320") as an ARRAY
ref while "strict refs" in use at t/overrides.t line 235.
*** menu position callback must return two integers (x, y) or two integers and
a boolean (x, y, push_in) at /builddir/build/BUILD/Gtk3-0.019/blib/lib/Gtk3.pm
line 937.
Can't find information for method Pixbuf::save at t/overrides.t line 639.
# Looks like you planned 164 tests but ran 144.
# Looks like your test exited with 1 just after 144.
t/overrides.t ..................
Dubious, test returned 1 (wstat 256, 0x100)
Failed 20/164 subtests
(less 55 skipped subtests: 89 okay)
This happens since upgrading gdk-pixbuf2 from 2.31.2-2.fc23 to 2.31.3-1.fc23.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=FsHu8z1Mep&a=cc_unsubscribe
8 years, 8 months
[Bug 750805] New: Fails to build on ARM, needs to use default setjmp not ucontext
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: Fails to build on ARM, needs to use default setjmp not ucontext
https://bugzilla.redhat.com/show_bug.cgi?id=750805
Summary: Fails to build on ARM, needs to use default setjmp not
ucontext
Product: Fedora
Version: 15
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: unspecified
Priority: unspecified
Component: perl-Coro
AssignedTo: ppisar(a)redhat.com
ReportedBy: henrik(a)henriknordstrom.net
QAContact: extras-qa(a)fedoraproject.org
CC: fedora-perl-devel-list(a)redhat.com,
mmaslano(a)redhat.com, kwizart(a)gmail.com,
bochecha(a)fedoraproject.org, ppisar(a)redhat.com
Classification: Fedora
Story Points: ---
Type: ---
Description of problem:
ARM do not implement the needed ucontext functions, and need to use the default
setjmp method. This is normally the default, except that fedora patches it to
hardwire ucontext as default method..
Version-Release number of selected component (if applicable):
perl-Coro-5.372-3.fc15
How reproducible:
always
Steps to Reproduce:
1. Try to rebuild perl-Coro on arm
2.
3.
Actual results:
failed build, crashing in testsuite
Expected results:
successful build
Additional info:
Trivial spec file patch attached.
Please apply patch and sumbit a F15 koji build from which arm can pull the
srpm. update request is not stricty needed if the only change relative to
current F15 build is this patch.
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
8 years, 8 months
[Bug 1068706] New: Password prompt matching requires colon, which may be missing
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1068706
Bug ID: 1068706
Summary: Password prompt matching requires colon, which may be
missing
Product: Fedora
Version: 20
Component: perl-Net-SFTP-Foreign
Severity: low
Assignee: fedorapkg(a)rule.lv
Reporter: ejtr(a)layer3.co.uk
QA Contact: extras-qa(a)fedoraproject.org
CC: fedorapkg(a)rule.lv, perl-devel(a)lists.fedoraproject.org
Description of problem:
Net::SFTP::Foreign's password prompt matching code goes into a permanent loop
when the remote server supplies a prompt without a trailing colon.
Version-Release number of selected component (if applicable):
perl-Net-SFTP-Foreign-1.75-3.fc20.noarch.rpm
How reproducible:
When testing Net::SFTP::Foreign against an "unusual" host which supported
keyboard-interactive authentication, and thus generated a server-supplied
password prompt, it was found that the host in question had a prompt of the
form "username's password", rather than the more usual "username@host's
password: " as seen from OpenSSH client code supporting the password
authentication mode.
As a consequence, the Net::SFTP::Foreign module simply sulked waiting for a
colon.
Looking at the relevant
/usr/share/perl5/vendor_perl/Net/SFTP/Foreign/Backend/Unix.pm code file, we
find the following code fragment:
.....
debug and $debug & 65536 and _debug "looking for user/password prompt";
my $re = ( defined $password_prompt
? $password_prompt
: qr/(user|name|login)?[:?]\s*$/i );
$debug and $debug & 65536 and _debug "matching against $re";
if (substr($buffer, $at) =~ $re) {
if ($ask_for_username_at_login and
($ask_for_username_at_login ne 'auto' or defined $1)) {
$debug and $debug & 65536 and _debug "sending username";
print $pty "$user\n";
undef $ask_for_username_at_login;
}
else {
$debug and $debug & 65536 and _debug "sending password";
print $pty "$pass\n";
$password_sent = 1;
}
$at = length $buffer;
}
.....
In the absence of the $password_prompt setting, $re only matches a password
prompt containing the string "password" if it contains a colon or question-mark
after the word "password".
The code is also questionable in being capable of sending a password in
response to a prompt which contains only a colon followed by whitespace; I feel
it ought to at least see the word "password" or "passphrase".
The code also uses the $password_prompt variable to match against a potential
username prompt, which is questionable.
I believe it would be better to more completely separate the user and password
prompt matching with different Regex's, and avoid being able to match against
the short ":" string alone, and cope with the unusual condition of a missing
colon.
This recoding of the relevant block is a potential solution:
.....
$debug and $debug & 65536 and _debug "looking for user/password prompt";
my $reuser = qr/(user|name|login)([:?])?\s*$/i;
my $repass = ( defined $password_prompt ?
$password_prompt : qr/(password|passphrase)([:?])?\s*$/i );
if (substr($buffer, $at) =~ $reuser) {
$debug and $debug & 65536 and _debug "matched against $reuser";
if ($ask_for_username_at_login and
($ask_for_username_at_login ne 'auto' or defined $1)) {
$debug and $debug & 65536 and _debug "sending username";
print $pty "$user\n";
undef $ask_for_username_at_login;
}
$at = length $buffer;
} elsif (substr($buffer, $at) =~ $repass) {
$debug and $debug & 65536 and _debug "matched against $repass";
$debug and $debug & 65536 and _debug "sending password";
print $pty "$pass\n";
$password_sent = 1;
$at = length $buffer;
}
....
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=SXtN9EENTL&a=cc_unsubscribe
8 years, 9 months
[Bug 1135624] New: perl-Clipboard: insecure temporary file usage
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1135624
Bug ID: 1135624
Summary: perl-Clipboard: insecure temporary file usage
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: vdanen(a)redhat.com
CC: iarnell(a)gmail.com, mkreder(a)gmail.com,
perl-devel(a)lists.fedoraproject.org
It was reported [1],[2] that the clipedit program as shipped with
perl-Clipboard uses temporary files insecurely (based on the PID of the running
program). Using symlink attacks, an attacker could cause the deletion of
arbitrary files that the user running clipedit has write access to.
[...]
7 my $tmpfilename = "/tmp/clipedit$$";
8 open my $tmpfile, ">$tmpfilename" or die "Failure to open $tmpfilename:
$!";
9 print $tmpfile $orig;
10 close $tmpfile;
[...]
13 system($ed, $tmpfilename);
14
15 open $tmpfile, $tmpfilename or die "Failure to open $tmpfilename: $!";
16 my $edited = join '', <$tmpfile>;
[...]
49 unlink($tmpfilename) or die "Couldn't remove $tmpfilename: $!";
[1] http://seclists.org/oss-sec/2014/q3/467
[2] https://rt.cpan.org/Public/Bug/Display.html?id=98435
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=71pk61Zg6T&a=cc_unsubscribe
8 years, 9 months
[Bug 1135625] New: perl-Clipboard: insecure temporary file usage [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1135625
Bug ID: 1135625
Summary: perl-Clipboard: insecure temporary file usage
[fedora-all]
Product: Fedora
Version: 20
Component: perl-Clipboard
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: iarnell(a)gmail.com
Reporter: vdanen(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: iarnell(a)gmail.com, mkreder(a)gmail.com,
perl-devel(a)lists.fedoraproject.org
Blocks: 1135624
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1135624
[Bug 1135624] perl-Clipboard: insecure temporary file usage
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=c5n8dVtB1G&a=cc_unsubscribe
8 years, 9 months