October 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1175475] New: VUL-0: CVE-2020-14352: librepo: missing path validation in repomd.xml may lead to directory traversal
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1175475 Bug ID: 1175475 Summary: VUL-0: CVE-2020-14352: librepo: missing path validation in repomd.xml may lead to directory traversal Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other URL: https://smash.suse.de/issue/265258/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: christian.voegl(a)suse.com Reporter: rfrohl(a)suse.com QA Contact: security-team(a)suse.de CC: pth(a)suse.com Found By: Security Response Team Blocker: --- rh#1866498 Librepo fails to sanitize paths in the 'repomd.xml' configuration file. Malformed or malicious repository metadata could allow a remote attacker to copy files outside of the destination directory via path traversal. Considering that DNF runs as root, this flaw could potentially result in system compromise via arbitrary file overwriting of critical system files. References: https://bugzilla.redhat.com/show_bug.cgi?id=1866498 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14352 https://access.redhat.com/security/cve/CVE-2020-14352 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1195496] TW/Nvidia hangs at boot with Optimus graphic and 510.47.03 (G06) driver - but still works with G05 drivers
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1195496 https://bugzilla.suse.com/show_bug.cgi?id=1195496#c22 --- Comment #22 from Stefan Dirsch <sndirsch(a)suse.com> --- Ok. Thanks for confirmation! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203748] Laptop very slow in battery mode (Lenovo Thinkpad T470)
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203748 http://bugzilla.opensuse.org/show_bug.cgi?id=1203748#c13 --- Comment #13 from Takashi Iwai <tiwai(a)suse.com> --- (In reply to Stefan Dirsch from comment #12) > BTW I opened the bug for the wrong > Leap version. It's 15.3, not 15.4. Sorry for that! Could you try to boot with Leap 15.4 kernel on top of the same system? That'll be interesting. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203442] Missing Dependencies for dnf and dnf-utils
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203442 http://bugzilla.opensuse.org/show_bug.cgi?id=1203442#c6 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS Assignee|packagehub-bugs(a)suse.com |Andreas.Stieger(a)gmx.de --- Comment #6 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- libdnf2-0.65.0-bp154.2.1.x86_64.rpm libdnf-repo-config-zypp-0.65.0-bp154.2.1.x86_64.rpm python3-libdnf-0.65.0-bp154.2.1.x86_64.rpm python3-hawkey-0.65.0-bp154.2.1.x86_64.rpm -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202571] kernel 5.19.1 shuts down after waking from suspend
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1202571 https://bugzilla.suse.com/show_bug.cgi?id=1202571#c4 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tiwai(a)suse.com --- Comment #4 from Takashi Iwai <tiwai(a)suse.com> --- TW is already moving to 6.0, and the fix for 5.19 won't be handled any longer. Could try 6.0 and verify whether the issue persists or not? If yes, we need to report it to the upstream somehow. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202581] kernel 5.14.21-150400.24.18-default emits "soft lockup" errors; sometimes won't even boot
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

https://bugzilla.suse.com/show_bug.cgi?id=1202581 https://bugzilla.suse.com/show_bug.cgi?id=1202581#c14 --- Comment #14 from Takashi Iwai <tiwai(a)suse.com> --- OK, it sounds like a good start. I asked for retesting because the latest SLE15-SP4 update kernel is known to have a few regressions. Those have been addressed in SLE15-SP4 git branch, and will be fixed in the next update in October. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203442] Missing Dependencies for dnf and dnf-utils
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203442 http://bugzilla.opensuse.org/show_bug.cgi?id=1203442#c5 --- Comment #5 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Still building please check back in a short while -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203442] Missing Dependencies for dnf and dnf-utils
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203442 http://bugzilla.opensuse.org/show_bug.cgi?id=1203442#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(stephan.kreuz@bwi | |.de) --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Well that's all fine and good, but the branching of the package into SUSE:SLE-15-SP4:GA/libdnf caused it to be dropped from PackageHub in the first place. And nobody of the SUSE engineers setting up PackageHub for SLE 15 SP4 noticed because it is a run-time dependency only, not a build time dependency. Reporter, please confirm functionality with this package (~30mins): http://download.opensuse.org/repositories/home:/AndreasStieger:/branches:/O… Submitted as update: https://build.opensuse.org/request/show/1008091 Christian, Daniel, please accept review on the maintenance submission once the bot adds it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1198253] Converting in Calibre doesn't work
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1198253 http://bugzilla.opensuse.org/show_bug.cgi?id=1198253#c3 Eric Schirra <ecsos(a)schirra.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WORKSFORME --- Comment #3 from Eric Schirra <ecsos(a)schirra.net> --- I think the bug is or was never relevant or existent. Because under Leap in version 4.23 as well as under Tumbleweed with version 6.5 no error occurs during the conversion. The conversion works smoothly. I could not test 6.6.1 because of the error in the necessary python package. But I assume that it works there too. I will close it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1203722] New: bluetooth, no more A2DP, only HSP,
by bugzilla_noreply＠suse.com 05 Oct '22

05 Oct '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1203722 Bug ID: 1203722 Summary: bluetooth, no more A2DP, only HSP, Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: epistemepromeneur(a)free.fr QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- bluetooth 5.2 pci card EDUP LOVE ep-9651GS (chipset Intel AX210) Samsung S7, bluetooth 4.0 -- You are receiving this mail because: You are on the CC list for the bug.

1 20