July 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1187325] VUL-0: CVE-2021-34550: tor: out-of-bounds memory access in v3 onion service descriptor parsing
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187325 https://bugzilla.suse.com/show_bug.cgi?id=1187325#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0989-1: An update that solves three vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1179331,1181244,1187322,1187323,1187324,1187325 CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): tor-0.4.5.9-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187324] VUL-0: CVE-2021-34549: tor: hashtable-based CPU denial-of-service attack against relays
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187324 https://bugzilla.suse.com/show_bug.cgi?id=1187324#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0989-1: An update that solves three vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1179331,1181244,1187322,1187323,1187324,1187325 CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): tor-0.4.5.9-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187323] VUL-1: tor: errors from RNG not detected
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187323 https://bugzilla.suse.com/show_bug.cgi?id=1187323#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0989-1: An update that solves three vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1179331,1181244,1187322,1187323,1187324,1187325 CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): tor-0.4.5.9-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1187322] VUL-0: CVE-2021-34548: tor: RELAY_END or RELAY_RESOLVED spoofing
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187322 https://bugzilla.suse.com/show_bug.cgi?id=1187322#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0989-1: An update that solves three vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1179331,1181244,1187322,1187323,1187324,1187325 CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): tor-0.4.5.9-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1181244] Duplicate journal timestamp prefix for tor
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1181244 https://bugzilla.suse.com/show_bug.cgi?id=1181244#c9 --- Comment #9 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0989-1: An update that solves three vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 1179331,1181244,1187322,1187323,1187324,1187325 CVE References: CVE-2021-34548,CVE-2021-34549,CVE-2021-34550 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): tor-0.4.5.9-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[opensuse-bugs] [Bug 1179331] New: [warn] Tor was compiled with zstd 1.4.4, but is running with zstd 1.4.5 (Factory i586 tests issue)
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1179331 Bug ID: 1179331 Summary: [warn] Tor was compiled with zstd 1.4.4, but is running with zstd 1.4.5 (Factory i586 tests issue) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Network Assignee: bwiedemann(a)suse.com Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: Andreas.Stieger(a)gmx.de, bwiedemann(a)suse.com, suseino(a)riseup.net Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1158700 +++ tor FTBFS - tests issue on Factory i586, causing it to appear outdated on Tumbleweed. [ 157.292749] tor[1745]: Nov 25 11:35:49.909 [warn] Tor was compiled with zstd 1.4.4, but is running with zstd 1.4.5. For safety, we'll avoid using advanced zstd functionality. From https://build.opensuse.org/build/openSUSE:Factory/standard/i586/tor/_log [ 653s] prob_distr/log_logistic: [forking] fail log logistic cdf/sf [ 653s] [ 653s] FAIL src/test/test_prob_distr.c:576: assert(ok) [ 653s] [log_logistic FAILED] [...] [ 654s] FAIL src/test/unittest_part6.sh (exit status: 1) [ 654s] [ 654s] + exit 42 [ 654s] error: Bad exit status from /var/tmp/rpm-tmp.JpQp8f (%check) -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1187177] New: Guake follows mouse to new monitor when clicking and covers up window
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1187177 Bug ID: 1187177 Summary: Guake follows mouse to new monitor when clicking and covers up window Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: logan.caldwell(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This has been reported several times, and the resolution is quite easy. See the issue here: https://github.com/Guake/guake/issues/1761 This is the section of code: def set_window_state(self, window_state): self.window_state = window_state setattr(self.window, self.FULLSCREEN_ATTR, bool(window_state & Gdk.WindowState.FULLSCREEN)) if not window_state & Gdk.WindowState.WITHDRAWN: if self.is_fullscreen(): self.fullscreen() # modify the codes here: else: The else in line 171 needs to be changed to elif window_state & Gdk.WindowState.FOCUSED and self.guake.hidden: self.unfullscreen() This resolves the issue. Currently this fix has been merged into master but no new official release has been made in 16 months. Are we able to resolve this ourselves? -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1186619] VUL-0: CVE-2021-32635: singularity: Action commands against library URIs ignore configured remote endpoint
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1186619 https://bugzilla.suse.com/show_bug.cgi?id=1186619#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0987-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1186619 CVE References: CVE-2021-29136,CVE-2021-32635 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): singularity-3.7.4-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1186929] ckb-next incorrect dependency on //bin/bash
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1186929 https://bugzilla.suse.com/show_bug.cgi?id=1186929#c3 --- Comment #3 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-RU-2021:1000-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1186929 CVE References: JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): ckb-next-0.4.4-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1186027] VUL-1: CVE-2021-32917,CVE-2021-32918,CVE-2021-32919,CVE-2021-32920,CVE-2021-32921: Prosody XMPP server advisory 2021-05-12 (multiple vulnerabilities)
by bugzilla_noreply＠suse.com 08 Jul '21

08 Jul '21

https://bugzilla.suse.com/show_bug.cgi?id=1186027 https://bugzilla.suse.com/show_bug.cgi?id=1186027#c7 --- Comment #7 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2021:0991-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1186027 CVE References: CVE-2021-32917,CVE-2021-32918,CVE-2021-32919,CVE-2021-32920 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): prosody-0.11.9-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0