November 2020 - openSUSE Bugs - openSUSE Mailing Lists

[opensuse-bugs] [Bug 1178744] VUL-0: CVE-2020-25074: :moinmoin-wiki: remote code execution via cache action
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178744 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178712] chromium: Received signal 4 ILL_ILLOPN (again)
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1178712 http://bugzilla.opensuse.org/show_bug.cgi?id=1178712#c1 --- Comment #1 from Callum Farmer <callumjfarmer13(a)gmail.com> --- Can you please run the vainfo command from the libva-utils package -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178745] New: VUL-0: CVE-2020-15275: moinmoin-wiki: malicious SVG attachment causing stored XSS vulnerability
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1178745 Bug ID: 1178745 Summary: VUL-0: CVE-2020-15275: moinmoin-wiki: malicious SVG attachment causing stored XSS vulnerability Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/271233/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: sbahling(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: wolfgang.engel(a)suse.com Found By: Security Response Team Blocker: --- rh#1897189 MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes. Reference: https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43 Upstream patch: https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4… References: https://bugzilla.redhat.com/show_bug.cgi?id=1897189 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15275 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-15275.html http://www.debian.org/security/-1/dsa-4787 https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4… https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11 https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15275 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178744] New: VUL-0: CVE-2020-25074: :moinmoin-wiki: remote code execution via cache action
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

http://bugzilla.opensuse.org/show_bug.cgi?id=1178744 Bug ID: 1178744 Summary: VUL-0: CVE-2020-25074: :moinmoin-wiki: remote code execution via cache action Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/271234/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: sbahling(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: wolfgang.engel(a)suse.com Found By: Security Response Team Blocker: --- rh#1897192 The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution. Reference: https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq References: https://bugzilla.redhat.com/show_bug.cgi?id=1897192 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25074 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-25074.html https://www.debian.org/security/2020/dsa-4787 http://www.debian.org/security/-1/dsa-4787 https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25074 http://moinmo.in/SecurityFixes -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1177419] [Build 20201003] udisks2ctl randomly fails to set up loop device for /root/udisk_test.iso: GDBus.Error:org.freedesktop.UDisks2.Error.Failed: Error waiting for loop object after creating '/dev/loop0': Timed out waiting for object
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1177419 https://bugzilla.suse.com/show_bug.cgi?id=1177419#c11 --- Comment #11 from Thomas Blume <thomas.blume(a)suse.com> --- Status update, there is a new upstream bug now and it seems they are working on that: https://github.com/storaged-project/udisks/issues/817 I've put my findings there. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1173279] perl-GD,mistake in spec file
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1173279 Pedro Monreal Gonzalez <pmonrealgonzalez(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178643] Can't login to openSUSE Forums anymore
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178643 https://bugzilla.suse.com/show_bug.cgi?id=1178643#c3 Malcolm Lewis <malcolmlewis(a)cableone.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #3 from Malcolm Lewis <malcolmlewis(a)cableone.net> --- All fixed, user confirmed can now log into Forum. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 936888] After updating to openssl-1.0.1k-11.72.1 mySQL SSL connections fail
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=936888 https://bugzilla.suse.com/show_bug.cgi?id=936888#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:1901-1: An update that solves 7 vulnerabilities and has 44 fixes is now available. Category: security (important) Bug References: 1055014,1058115,1061843,1065600,1065729,1066382,1077428,1112178,1131277,1134760,1163592,1167030,1170415,1171558,1173432,1174748,1176354,1176485,1176560,1176713,1176723,1176907,1177086,1177101,1177271,1177281,1177410,1177411,1177470,1177687,1177719,1177740,1177749,1177750,1177753,1177754,1177755,1177766,1177855,1177856,1177861,1178027,1178123,1178166,1178185,1178187,1178188,1178202,1178234,1178330,936888 CVE References: CVE-2020-0430,CVE-2020-14351,CVE-2020-16120,CVE-2020-25285,CVE-2020-25656,CVE-2020-25668,CVE-2020-8694 JIRA References: Sources used: openSUSE Leap 15.1 (src): kernel-debug-4.12.14-lp151.28.79.1, kernel-default-4.12.14-lp151.28.79.1, kernel-docs-4.12.14-lp151.28.79.2, kernel-kvmsmall-4.12.14-lp151.28.79.1, kernel-obs-build-4.12.14-lp151.28.79.1, kernel-obs-qa-4.12.14-lp151.28.79.1, kernel-source-4.12.14-lp151.28.79.1, kernel-syms-4.12.14-lp151.28.79.1, kernel-vanilla-4.12.14-lp151.28.79.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1178330] Customer kernel module build leaves null.000i.ipa-clones after "make clean"
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1178330 https://bugzilla.suse.com/show_bug.cgi?id=1178330#c24 --- Comment #24 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:1901-1: An update that solves 7 vulnerabilities and has 44 fixes is now available. Category: security (important) Bug References: 1055014,1058115,1061843,1065600,1065729,1066382,1077428,1112178,1131277,1134760,1163592,1167030,1170415,1171558,1173432,1174748,1176354,1176485,1176560,1176713,1176723,1176907,1177086,1177101,1177271,1177281,1177410,1177411,1177470,1177687,1177719,1177740,1177749,1177750,1177753,1177754,1177755,1177766,1177855,1177856,1177861,1178027,1178123,1178166,1178185,1178187,1178188,1178202,1178234,1178330,936888 CVE References: CVE-2020-0430,CVE-2020-14351,CVE-2020-16120,CVE-2020-25285,CVE-2020-25656,CVE-2020-25668,CVE-2020-8694 JIRA References: Sources used: openSUSE Leap 15.1 (src): kernel-debug-4.12.14-lp151.28.79.1, kernel-default-4.12.14-lp151.28.79.1, kernel-docs-4.12.14-lp151.28.79.2, kernel-kvmsmall-4.12.14-lp151.28.79.1, kernel-obs-build-4.12.14-lp151.28.79.1, kernel-obs-qa-4.12.14-lp151.28.79.1, kernel-source-4.12.14-lp151.28.79.1, kernel-syms-4.12.14-lp151.28.79.1, kernel-vanilla-4.12.14-lp151.28.79.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1163592] kernel packaging problem: RPM group = %group
by bugzilla_noreply＠suse.com 12 Nov '20

12 Nov '20

https://bugzilla.suse.com/show_bug.cgi?id=1163592 https://bugzilla.suse.com/show_bug.cgi?id=1163592#c31 --- Comment #31 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2020:1901-1: An update that solves 7 vulnerabilities and has 44 fixes is now available. Category: security (important) Bug References: 1055014,1058115,1061843,1065600,1065729,1066382,1077428,1112178,1131277,1134760,1163592,1167030,1170415,1171558,1173432,1174748,1176354,1176485,1176560,1176713,1176723,1176907,1177086,1177101,1177271,1177281,1177410,1177411,1177470,1177687,1177719,1177740,1177749,1177750,1177753,1177754,1177755,1177766,1177855,1177856,1177861,1178027,1178123,1178166,1178185,1178187,1178188,1178202,1178234,1178330,936888 CVE References: CVE-2020-0430,CVE-2020-14351,CVE-2020-16120,CVE-2020-25285,CVE-2020-25656,CVE-2020-25668,CVE-2020-8694 JIRA References: Sources used: openSUSE Leap 15.1 (src): kernel-debug-4.12.14-lp151.28.79.1, kernel-default-4.12.14-lp151.28.79.1, kernel-docs-4.12.14-lp151.28.79.2, kernel-kvmsmall-4.12.14-lp151.28.79.1, kernel-obs-build-4.12.14-lp151.28.79.1, kernel-obs-qa-4.12.14-lp151.28.79.1, kernel-source-4.12.14-lp151.28.79.1, kernel-syms-4.12.14-lp151.28.79.1, kernel-vanilla-4.12.14-lp151.28.79.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0