August 2019 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1143838] New: VUL-1: CVE-2019-14295: upx: integer overflow in getElfSections function in p_vmlinx.cpp
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1143838 Bug ID: 1143838 Summary: VUL-1: CVE-2019-14295: upx: integer overflow in getElfSections function in p_vmlinx.cpp Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/238126/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: crrodriguez(a)opensuse.org Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- rh#1735667 An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory. Reference: https://github.com/upx/upx/issues/286 References: https://bugzilla.redhat.com/show_bug.cgi?id=1735667 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14295 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-14295.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14295 http://www.cvedetails.com/cve/CVE-2019-14295/ https://github.com/upx/upx/issues/286 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1141597] [Build 20190713] systemd networkd_dhcp fails to bring up the network
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1141597 http://bugzilla.suse.com/show_bug.cgi?id=1141597#c27 --- Comment #27 from Dominik Heidler <dheidler(a)suse.com> --- Fix that will stop firewalld: https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/8094 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1141597] [Build 20190713] systemd networkd_dhcp fails to bring up the network
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1141597 http://bugzilla.suse.com/show_bug.cgi?id=1141597#c26 --- Comment #26 from Thomas Blume <thomas.blume(a)suse.com> --- (In reply to Franck Bui from comment #25) > So I'm not sure what should be done next as this seems an issue with the way > the firewall is configured in the test. > > I'm assigning this to Dominik so the test is modified to ensure that the > firewall is setup to let the communication work between the 2 containers. At least the official openQA tests still fail, even with the latest Tumbleweed build, see: https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor… So, I'd bet the firewall is active there. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1141597] [Build 20190713] systemd networkd_dhcp fails to bring up the network
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1141597 http://bugzilla.suse.com/show_bug.cgi?id=1141597#c25 Franck Bui <fbui(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|systemd-maintainers(a)suse.de |dheidler(a)suse.com --- Comment #25 from Franck Bui <fbui(a)suse.com> --- So I'm not sure what should be done next as this seems an issue with the way the firewall is configured in the test. I'm assigning this to Dominik so the test is modified to ensure that the firewall is setup to let the communication work between the 2 containers. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1141597] [Build 20190713] systemd networkd_dhcp fails to bring up the network
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1141597 http://bugzilla.suse.com/show_bug.cgi?id=1141597#c24 --- Comment #24 from Franck Bui <fbui(a)suse.com> --- (In reply to Dominik Heidler from comment #22) > yes - maybe that kernel/systemd fix resolved it. No since running the latest version of systemd didn't help. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1140730] dracut: module not installed, because '/usr/lib/udev/collect' could not be found
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1140730 http://bugzilla.suse.com/show_bug.cgi?id=1140730#c3 --- Comment #3 from Daniel Molkentin <daniel.molkentin(a)suse.com> --- Some more details: Statement in systemd's NEWS file: * The "collect" udev component has been removed without replacement, as it is neither used nor maintained. The patch removes collect is already from 2018: https://github.com/systemd/systemd/commit/a168792c2d95695fd30c0371d4b3890a9… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1140730] dracut: module not installed, because '/usr/lib/udev/collect' could not be found
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1140730 http://bugzilla.suse.com/show_bug.cgi?id=1140730#c2 --- Comment #2 from Thomas Blume <thomas.blume(a)suse.com> --- systemd upstream has removed the collect helper. Obviously they don't have s390 machines in their test setups. I've involved Hannes Reinecke who wrote the patch initially. According to him, collect has to be reintroduced. Maybe this could be escalated via IBM to upstream. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1143556] New: VUL-1: CVE-2019-14441: libav: access violation allows remote attackers to cause a denial of service
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1143556 Bug ID: 1143556 Summary: VUL-1: CVE-2019-14441: libav: access violation allows remote attackers to cause a denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/238326/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alarrosa(a)suse.com Reporter: atoptsoglou(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-14441 An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv. This is related to ff_mpa_synth_filter_float in avcodec/mpegaudiodsp_template.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14441 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14441 https://bugzilla.libav.org/show_bug.cgi?id=1161#c0 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1143243] New: VUL-0: CVE-2019-14372: In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.opensuse.org/show_bug.cgi?id=1143243 Bug ID: 1143243 Summary: VUL-0: CVE-2019-14372: In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other URL: https://smash.suse.de/issue/238156/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: alarrosa(a)suse.com Reporter: wolfgang.frisch(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2019-14372 In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-14372 http://www.cvedetails.com/cve/CVE-2019-14372/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14372 https://bugzilla.libav.org/show_bug.cgi?id=1165 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1140730] dracut: module not installed, because '/usr/lib/udev/collect' could not be found
by bugzilla_noreply＠novell.com 01 Aug '19

01 Aug '19

http://bugzilla.suse.com/show_bug.cgi?id=1140730 Thomas Blume <thomas.blume(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |hare(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0