November 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1195124] VUL-0: CVE-2022-0367: libmodbus: Heap-based Buffer Overflow in modbus_reply
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1195124 https://bugzilla.suse.com/show_bug.cgi?id=1195124#c3 Jason Sikes <jsikes(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|jsikes(a)suse.com |security-team(a)suse.de --- Comment #3 from Jason Sikes <jsikes(a)suse.com> --- This was fixed in Factory by the update to 3.1.7, even though the changelog doesn't mention it. created request id 1034645 for openSUSE:Backports:SLE-15-SP4:Update. Handing over to Security Team. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204928] New: AUDIT-0: openSUSE Leap Micro 5.3 RC/GM security audit
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1204928 Bug ID: 1204928 Summary: AUDIT-0: openSUSE Leap Micro 5.3 RC/GM security audit Classification: openSUSE Product: openSUSE Leap Micro Version: 5.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Base Assignee: screening-team-bugs(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hello team, this is more a no-op heads up than an actual request for the audit. We plan to release Leap Micro 5.3 within next 14 days (suggested GA on 15th November). It's in fact just re-shipping of existing SLE Micro 5.3 artifacts + openSUSE Branding. https://download.opensuse.org/distribution/leap-micro/5.3/product/ https://build.opensuse.org/project/show/openSUSE:Leap:Micro:5.3 I think SLE Micro 5.3 security audit can be fully aplicable here. Feel free to simply resolve issue if you also see no action needed from your side. Thank you -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1203934] New: cannot install cockpit-machines
by bugzilla_noreply＠suse.com 09 Nov '22

09 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1203934 Bug ID: 1203934 Summary: cannot install cockpit-machines Classification: openSUSE Product: openSUSE Leap Micro Version: 5.3 Hardware: Other URL: https://openqa.opensuse.org/tests/2753195 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Patterns Assignee: lubos.kocman(a)suse.com Reporter: mloviska(a)suse.com QA Contact: qa-bugs(a)suse.de CC: jalausuch(a)suse.com Depends on: 1202569 Found By: openQA Blocker: --- Issue should have already been solved by SR#998260 [1] and looks like the requirements of daemon-driver-qemu are set correctly. [2] ``` 2022-09-29 18:20:05 Options: callext 2 zypper -R {} install cockpit cockpit-wicked cockpit-machines cockpit-tukit 2022-09-29 18:20:05 Executing `zypper -R /.snapshots/2/snapshot install cockpit cockpit-wicked cockpit-machines cockpit-tukit`: Loading repository data... Reading installed packages... Package 'cockpit-wicked' not found. Resolving package dependencies... Problem: the to be installed cockpit-machines-249.1-150400.2.1.noarch requires 'libvirt-daemon-qemu', but this requirement cannot be provided not installable providers: libvirt-daemon-qemu-8.0.0-150400.5.8.x86_64[repo-main] Solution 1: deinstallation of busybox-gzip-1.34.1-150400.2.23.noarch Solution 2: do not install cockpit-machines-249.1-150400.2.1.noarch Solution 3: break cockpit-machines-249.1-150400.2.1.noarch by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/3/c/d/?] (c): ``` The test has detected usage of wicked instead of NetworkManager which diverges with SLEM 5.3. Therefore tries to pull *cockpit-wicked* ``` Package 'cockpit-wicked' not found. ``` [1] https://build.opensuse.org/request/show/998260 [2] https://build.opensuse.org/package/view_file/openSUSE/libvirt/libvirt.spec?… -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1204427] VUL-0: CVE-2022-3559: exim: use after free in processing of the component Regex Handler
by bugzilla_noreply＠suse.com 08 Nov '22

08 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1204427 https://bugzilla.suse.com/show_bug.cgi?id=1204427#c6 --- Comment #6 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:10191-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1204427 CVE References: CVE-2022-3559 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): exim-4.94.2-bp153.5.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1195124] VUL-0: CVE-2022-0367: libmodbus: Heap-based Buffer Overflow in modbus_reply
by bugzilla_noreply＠suse.com 08 Nov '22

08 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1195124 https://bugzilla.suse.com/show_bug.cgi?id=1195124#c2 --- Comment #2 from Jason Sikes <jsikes(a)suse.com> --- Patch is in https://github.com/stephane/libmodbus/commit/b4ef4c17d618eba0adccc4c7d9e9a1… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1205172] [Staging] mdadm 4.2 fails installation on RAID1 with YaST
by bugzilla_noreply＠suse.com 08 Nov '22

08 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1205172 Neil Brown <nfbrown(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |colyli(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1205206] New: KDE panel applet Software Updates pesters incessantly
by bugzilla_noreply＠suse.com 08 Nov '22

08 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1205206 Bug ID: 1205206 Summary: KDE panel applet Software Updates pesters incessantly Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: openSUSE Leap 15.4 Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: bugz57(a)top.geek.nz QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The KDE panel applet "Software Updater" is forever popping up with things that don't need installing or where that is questionable. There were a lot of "optional" updates, and as they were optional and didn't actually do anything for my system I didn't install them. Ever since the applet is always active. The applet also always warns about updates in repos that are additionally configured (security, editors, ...), but yast online update doesn't show them, and can't even give a complete list of them. Both those mean the applet has become as useful as the oil-warning on the dash that's always on - you just cut the wire. Having to install packages just to shut up an applet looks rather stupid. This applet is a critical component of keeping systems updated, which itself is a critical activity. It is essentially unusable. This bug may be related to bug 1205203. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201994] Xen DomU unable to emulate audio device
by bugzilla_noreply＠suse.com 08 Nov '22

08 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1201994 https://bugzilla.suse.com/show_bug.cgi?id=1201994#c34 Erwin Pacua <erwin.pacua(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- --- Comment #34 from Erwin Pacua <erwin.pacua(a)gmail.com> --- Not sure why it is marked as resolved, I think it is still not. [root@pc1:/etc/xen/vm]# zypper se -istpackage /^xen/ Loading repository data... Reading installed packages... S | Name | Type | Version | Arch | Repository ---+-----------+---------+-------------------------+--------+------------------------------------------------------------- i+ | xen | package | 4.16.2_06-150400.4.11.1 | x86_64 | Update repository with updates from SUSE Linux Enterprise 15 i+ | xen-libs | package | 4.16.2_06-150400.4.11.1 | x86_64 | Update repository with updates from SUSE Linux Enterprise 15 i+ | xen-tools | package | 4.16.2_06-150400.4.11.1 | x86_64 | Update repository with updates from SUSE Linux Enterprise 15 The issue still remains - xl unable to emulate audio device while libvirt can. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1205203] New: zypper up differs from yast online update
by bugzilla_noreply＠suse.com 08 Nov '22

08 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1205203 Bug ID: 1205203 Summary: zypper up differs from yast online update Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: x86-64 OS: openSUSE Leap 15.4 Status: NEW Severity: Normal Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: bugz57(a)top.geek.nz QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- Running yast online update lists nothing to install. Running zypper up gives The following 290 package updates will NOT be installed: ... 37 packages to upgrade, 4 new, 2 to remove. This is confusing and means one can't easily install security patches via console. (yast-console isn't so user-friendly.) On a system that has essentially only repos and packages added that behaviour is unexpected. My expected behaviour is that patches offered for installation are identical regardless whether I use GUI or zypper. The 290 packages seem to be the "optional" patches list. The 37 packages seem to come mostly (all?) from additional repos like graphics, publishing, or toolchain-avr. Why are those additional repos treated differently? I don't see how changes to zypp.conf with these variables could cause this: commit.downloadMode download.media_preference download.min_download_speed download.use_deltarpm multiversion.kernels repo.refresh.delay solver.upgradeTestcasesToKeep That's all about how packages are downloaded, not which are installed. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1205201] Documentation for xl.cfg is no longer accurate
by bugzilla_noreply＠suse.com 08 Nov '22

08 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1205201 http://bugzilla.opensuse.org/show_bug.cgi?id=1205201#c1 --- Comment #1 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- *** Bug 1205202 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are on the CC list for the bug.

1 0