September 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1189899] AUDIT-0: low-memory-monitor: Package installs new dbus service file
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1189899 https://bugzilla.suse.com/show_bug.cgi?id=1189899#c4 --- Comment #4 from Johannes Segitz <jsegitz(a)suse.com> --- The whitelist is now added to rpmlint. As Matthias already explained we currently have some major changes there in progress and because of this I won't submit this right away, we need to sort out some issues first. But it will be in the next submission as it's already on github now -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190689] New: update plasma kwin_x11 is not able to run /usrlib64/libexec/drkonqui
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190689 Bug ID: 1190689 Summary: update plasma kwin_x11 is not able to run /usrlib64/libexec/drkonqui Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: x86-64 OS: openSUSE Leap 15.3 Status: NEW Severity: Critical Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: ivo.grimaldi(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Leap 15.3 + 4 repos plasma newest ============== how i installed newest kde plasma========= zypper ar -p 75 https://download.opensuse.org/repositories/KDE:/Qt5/openSUSE_Leap_15.3 KDE-Qt5 zypper ar -p 75 https://download.opensuse.org/repositories/KDE:/Frameworks5/openSUSE_Leap_1… KDE-Frameworks zypper ar -p 75 https://download.opensuse.org/repositories/KDE:/Applications/KDE_Frameworks… KDE-Applications zypper ar -p 75 https://download.opensuse.org/repositories/KDE:/Extra/KDE_Applications_open… KDE-Extra sudo zypper -v dup --force-resolution --allow-vendor-change --from KDE-Frameworks && sudo zypper -v dup --force-resolution --allow-vendor-change --from KDE-Applications && sudo zypper -v dup --force-resolution --allow-vendor-change --from KDE-Qt5 && sudo zypper -v dup --force-resolution --allow-vendor-change --from KDE-Extra ========================= yesterday, at 10 pm UTC, plasma widget suggest me to update a lot of kde plasma files, ok should be a new plasma release. Download and install, all ok. After 1st reboot, a lot of problem. 1. I'm able to use gui to login, 2. after login i see the opensuse animation in loop (or freeze) 3. i cannot see the desktop 4. I try to open terminal (ctrl+alt+t) ok 5. try to reopen plasmashell, kill plasmashell and reload: wow i can see my desktop 6. without window buttons and is impossibile to work and close windows 7. inside terminal i try to kill kwin_x11 and restart, I see a message: /usrlib64/libexec/drkonqui core dump may be kwin_x11 call drkonqui and crash? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190688] New: VUL-1: CVE-2021-39530: libredwg: heap-based buffer overflow in function bit_wcs2nlen()
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190688 Bug ID: 1190688 Summary: VUL-1: CVE-2021-39530: libredwg: heap-based buffer overflow in function bit_wcs2nlen() Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/310512/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-39530 An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2nlen() in bits.c has a heap-based buffer overflow. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39530 https://github.com/LibreDWG/libredwg/issues/258 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39530 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190687] New: VUL-1: CVE-2021-39528: libredwg: double free in function dwg_free_MATERIAL_private()
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190687 Bug ID: 1190687 Summary: VUL-1: CVE-2021-39528: libredwg: double free in function dwg_free_MATERIAL_private() Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/310513/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-39528 An issue was discovered in libredwg through v0.10.1.3751. dwg_free_MATERIAL_private() in dwg.spec has a double free. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39528 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39528 https://github.com/LibreDWG/libredwg/issues/256 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190686] New: VUL-1: CVE-2021-39527: libredwg: heap-based buffer overflow in function appinfo_private()
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190686 Bug ID: 1190686 Summary: VUL-1: CVE-2021-39527: libredwg: heap-based buffer overflow in function appinfo_private() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/310514/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-39527 An issue was discovered in libredwg through v0.10.1.3751. appinfo_private() in decode.c has a heap-based buffer overflow. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39527 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39527 https://github.com/LibreDWG/libredwg/issues/252 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190685] New: VUL-1: CVE-2021-39525: libredwg: heap-based buffer overflow in function bit_read_fixed()
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190685 Bug ID: 1190685 Summary: VUL-1: CVE-2021-39525: libredwg: heap-based buffer overflow in function bit_read_fixed() Classification: openSUSE Product: openSUSE Distribution Version: Leap 42.3 Hardware: Other URL: https://smash.suse.de/issue/310515/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-39525 An issue was discovered in libredwg through v0.10.1.3751. bit_read_fixed() in bits.c has a heap-based buffer overflow. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39525 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39525 https://github.com/LibreDWG/libredwg/issues/261 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190684] New: VUL-1: CVE-2021-39523: libredwg: NULL pointer dereference in function check_POLYLINE_handles()
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190684 Bug ID: 1190684 Summary: VUL-1: CVE-2021-39523: libredwg: NULL pointer dereference in function check_POLYLINE_handles() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/310516/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-39523 An issue was discovered in libredwg through v0.10.1.3751. A NULL pointer dereference exists in the function check_POLYLINE_handles() located in decode.c. It allows an attacker to cause Denial of Service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39523 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39523 https://github.com/LibreDWG/libredwg/issues/251 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190683] New: VUL-1: CVE-2021-39522: libredwg: heap-based buffer overflow in function bit_wcs2len()
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190683 Bug ID: 1190683 Summary: VUL-1: CVE-2021-39522: libredwg: heap-based buffer overflow in function bit_wcs2len() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/310517/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-39522 An issue was discovered in libredwg through v0.10.1.3751. bit_wcs2len() in bits.c has a heap-based buffer overflow. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39522 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39522 https://github.com/LibreDWG/libredwg/issues/255 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190682] New: VUL-1: CVE-2021-39521: libredwg: NULL pointer dereference in function bit_read_BB()
by bugzilla_noreply＠suse.com 21 Sep '21

21 Sep '21

http://bugzilla.opensuse.org/show_bug.cgi?id=1190682 Bug ID: 1190682 Summary: VUL-1: CVE-2021-39521: libredwg: NULL pointer dereference in function bit_read_BB() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/310518/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-39521 An issue was discovered in libredwg through v0.10.1.3751. A NULL pointer dereference exists in the function bit_read_BB() located in bits.c. It allows an attacker to cause Denial of Service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39521 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39521 https://github.com/LibreDWG/libredwg/issues/262 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1184100] Flatpak test fails on aarch64 with /usr/lib/aarch64-linux-gnu/libgomp.so.1: cannot allocate memory in static TLS block
by bugzilla_noreply＠suse.com 20 Sep '21

20 Sep '21

https://bugzilla.suse.com/show_bug.cgi?id=1184100 https://bugzilla.suse.com/show_bug.cgi?id=1184100#c2 --- Comment #2 from openQA Review <openqa-review(a)suse.de> --- This is an autogenerated message for openQA integration by the openqa_review script: This bug is still referenced in a failing openQA test: desktopapps-other-wayland https://openqa.opensuse.org/tests/1923964 To prevent further reminder comments one of the following options should be followed: 1. The test scenario is fixed by applying the bug fix to the tested product or the test is adjusted 2. The openQA job group is moved to "Released" or "EOL" (End-of-Life) 3. The bugref in the openQA scenario is removed or replaced, e.g. `label:wontfix:boo1234` -- You are receiving this mail because: You are on the CC list for the bug.

1 0