January 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1193845] MozillaFirefox: update to 91.4.1esr and 95.0.1
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1193845 https://bugzilla.suse.com/show_bug.cgi?id=1193845#c8 --- Comment #8 from Martin Sirringhaus <martin.sirringhaus(a)suse.com> --- (In reply to Martin Sirringhaus from comment #7) > - Mozilla Thunderbird 91.4.1 > MFSA 2021-55 > * CVE-2021-4126 (bmo#1732310) > OpenPGP signature status doesn't consider additional message > content > * CVE-2021-44538 (bmo#1744056) > Matrix chat library libolm bundled with Thunderbird > vulnerable to a buffer overflow Scratch that. It just got its own Bug: https://bugzilla.suse.com/show_bug.cgi?id=1194215 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193562] VUL-0: CVE-2021-4048: lapack: Out-of-bounds read in *larrv
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1193562 https://bugzilla.suse.com/show_bug.cgi?id=1193562#c3 Richard Biener <rguenther(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |IN_PROGRESS --- Comment #3 from Richard Biener <rguenther(a)suse.com> --- Btw, the functions are inherently unsafe since the dimensions of the arrays are being passed as function arguments. If function arguments cannot be trusted then we're hosed. What the "fix" does is validate argument constraints (M >= 0) together with early out (M == 0). But if the attacker crafts M == 12375462 (large dimension) it will still crash. It's like complaining that strncpy with attacker controlled 'n' is "broken". The fix has to be on the caller side, just checking that 'n' is not < 0 is - err, short-sighted. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194165] VUL-1: CVE-2021-4186: wireshark: Gryphon dissector crash (wnpa-sec-2021-16)
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1194165 https://bugzilla.suse.com/show_bug.cgi?id=1194165#c1 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Robert Frohl <rfrohl(a)suse.com> --- submitted to factory, need to think about how to solve this in SLE -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194166] VUL-1: CVE-2021-4185: wireshark: RTMPT dissector infinite loop (wnpa-sec-2021-17)
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1194166 https://bugzilla.suse.com/show_bug.cgi?id=1194166#c1 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Robert Frohl <rfrohl(a)suse.com> --- submitted to factory, need to think about how to solve this in SLE -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194167] VUL-1: CVE-2021-4184: wireshark: BitTorrent DHT dissector infinite loop (wnpa-sec-2021-18)
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1194167 https://bugzilla.suse.com/show_bug.cgi?id=1194167#c1 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Robert Frohl <rfrohl(a)suse.com> --- submitted to factory, need to think about how to solve this in SLE -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194168] VUL-1: CVE-2021-4183: wireshark: pcapng file parser crash (wnpa-sec-2021-19)
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1194168 https://bugzilla.suse.com/show_bug.cgi?id=1194168#c1 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Robert Frohl <rfrohl(a)suse.com> --- submitted to factory, need to think about how to solve this in SLE -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194169] VUL-1: CVE-2021-4182: wireshark: RFC 7468 file parser infinite loop (wnpa-sec-2021-20)
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1194169 https://bugzilla.suse.com/show_bug.cgi?id=1194169#c1 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Robert Frohl <rfrohl(a)suse.com> --- submitted to factory, need to think about how to solve this in SLE -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194170] VUL-1: CVE-2021-4181 wireshark: Sysdig Event dissector crash (wnpa-sec-2021-21)
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1194170 https://bugzilla.suse.com/show_bug.cgi?id=1194170#c1 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Robert Frohl <rfrohl(a)suse.com> --- submitted to factory, need to think about how to solve this in SLE -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1194171] VUL-1: CVE-2021-4190: wireshark: Kafka dissector infinite loop (wnpa-sec-2021-22)
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1194171 https://bugzilla.suse.com/show_bug.cgi?id=1194171#c1 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #1 from Robert Frohl <rfrohl(a)suse.com> --- submitted to factory, need to think about how to solve this in SLE -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193845] MozillaFirefox: update to 91.4.1esr and 95.0.1
by bugzilla_noreply＠suse.com 03 Jan '22

03 Jan '22

https://bugzilla.suse.com/show_bug.cgi?id=1193845 https://bugzilla.suse.com/show_bug.cgi?id=1193845#c7 --- Comment #7 from Martin Sirringhaus <martin.sirringhaus(a)suse.com> --- - Mozilla Thunderbird 91.4.1 MFSA 2021-55 * CVE-2021-4126 (bmo#1732310) OpenPGP signature status doesn't consider additional message content * CVE-2021-44538 (bmo#1744056) Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow -- You are receiving this mail because: You are on the CC list for the bug.

1 0