June 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1200125] New: VUL-1: CVE-2022-1942: vim: out of bounds write in vim_regsub_both()
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1200125 Bug ID: 1200125 Summary: VUL-1: CVE-2022-1942: vim: out of bounds write in vim_regsub_both() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/333259/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: mimi.vx(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2022-1942 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1942 https://github.com/vim/vim/commit/71223e2db87c2bf3b09aecb46266b56cda26191d http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1942 http://www.cvedetails.com/cve/CVE-2022-1942/ https://huntr.dev/bounties/67ca4d3b-9175-43c1-925c-72a7091bc071 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1199893] VUL-0: chromium: multiple security issues fixed in 102.0.5005.61
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1199893 http://bugzilla.opensuse.org/show_bug.cgi?id=1199893#c3 --- Comment #3 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1199893) was mentioned in https://build.opensuse.org/request/show/980326 Backports:SLE-15-SP3 / chromium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1190024] haveged service has become obsolete with recent kernels (>= 5.6)
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1190024 http://bugzilla.opensuse.org/show_bug.cgi?id=1190024#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1190024) was mentioned in https://build.opensuse.org/request/show/980343 Factory / patterns-base -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1199925] [Build 20220524] LTP: preadv2 fails
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

https://bugzilla.suse.com/show_bug.cgi?id=1199925 https://bugzilla.suse.com/show_bug.cgi?id=1199925#c6 --- Comment #6 from Petr Vorel <petr.vorel(a)suse.com> --- Martin prepared patch based on Fabian's suggestion: https://lore.kernel.org/ltp/20220601141634.1795-1-mdoucha@suse.cz/ https://patchwork.ozlabs.org/project/ltp/patch/20220601141634.1795-1-mdouch… Thanks Fabian. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200118] VUL-0: CVE-2022-31003: sofia-sip: out of bounds write via malformed sdp message
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

https://bugzilla.suse.com/show_bug.cgi?id=1200118 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200117] VUL-0: CVE-2022-31002: sofia-sip: out of bounds read via malformed URL
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

https://bugzilla.suse.com/show_bug.cgi?id=1200117 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200116] VUL-0: CVE-2022-31001: sofia-sip: out of bounds read can lead to remote DoS
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

https://bugzilla.suse.com/show_bug.cgi?id=1200116 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200091] [package updater] Allow un-/select entire groups of packages
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

https://bugzilla.suse.com/show_bug.cgi?id=1200091 https://bugzilla.suse.com/show_bug.cgi?id=1200091#c5 --- Comment #5 from macias - <bluedzins(a)wp.pl> --- Stefan thank you for pointing out Yast2 features (will use it next time), but this report is about Package Updater. I didn't use computer for a while, and yesterday I saw the summary of the updates -- 572 packages, straight list of checkboxes. I understand the notion of simple program, but not crippled one, thus this report. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200118] New: VUL-0: CVE-2022-31003: sofia-sip: out of bounds write via malformed sdp message
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1200118 Bug ID: 1200118 Summary: VUL-0: CVE-2022-31003: sofia-sip: out of bounds write via malformed sdp message Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/333270/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: os.gnome.maintainers(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2022-31003 Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31003 https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8w5j-6g2j-… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31003 https://github.com/freeswitch/sofia-sip/commit/907f2ac0ee504c93ebfefd676b46… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1200117] New: VUL-0: CVE-2022-31002: out of bounds read via malformed URL
by bugzilla_noreply＠suse.com 01 Jun '22

01 Jun '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1200117 Bug ID: 1200117 Summary: VUL-0: CVE-2022-31002: out of bounds read via malformed URL Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/333252/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: os.gnome.maintainers(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2022-31002 Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-31002 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31002 https://github.com/freeswitch/sofia-sip/commit/51841eb53679434a386fb2dcbca9… https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-g3x6-p824-… -- You are receiving this mail because: You are on the CC list for the bug.

1 2