openSUSE Bugs July 2022

bugs@lists.opensuse.org

1 participants
2560 discussions

[Bug 1201181] VUL-0: CVE-2021-41690: dcmtk: malloced memory for storing all file information are recorded in a global variable LST and are not freed properly
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1201181 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201179] VUL-0: CVE-2021-41688: dcmtk: object in the program is free but its address is still used in other locations
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1201179 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201180] VUL-0: CVE-2021-41689: dcmtk: sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1201180 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201178] VUL-0: CVE-2021-41687: dcmtk: the program malloc a heap memory for parsing data, but does not free it when error in parsing
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1201178 Maintenance Robot <maint-coord+maintenance_robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1183669] AUDIT-TRACKER: CVE-2021-31153,CVE-2021-31154,CVE-2021-31155: please: security audit for permissions-file-setuid-bit
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1183669 https://bugzilla.suse.com/show_bug.cgi?id=1183669#c24 --- Comment #24 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to Andreas Stieger from comment #23) > Reporter sais this was not actually applied to the distros? > security:idm/pleaser/15.3/x86_64 > security:idm/pleaser/15.4/x86_64 No it wasn't. The whitelisting was only requested for Factory up to now. Please open a separate bug prefixed with "AUDIT-WHITELIST:" to request backports of whitelistings into individual products. Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200965] Intel Skylake: iris driver mistakenly been used (Dell Latitude 7480)
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1200965 https://bugzilla.suse.com/show_bug.cgi?id=1200965#c7 --- Comment #7 from Stefan Dirsch <sndirsch(a)suse.com> --- But this changed already with Mesa 20.x on Leap 15.3/SLE15-SP3. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200965] Intel Skylake: iris driver mistakenly been used (Dell Latitude 7480)
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1200965 https://bugzilla.suse.com/show_bug.cgi?id=1200965#c6 --- Comment #6 from Stefan Dirsch <sndirsch(a)suse.com> --- Ok. Finally found the commit, which changed this. https://gitlab.freedesktop.org/mesa/mesa/-/commit/adaa3583f507f822533162279… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201118] polkit.log method is useless after switching to duktape
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1201118 https://bugzilla.suse.com/show_bug.cgi?id=1201118#c1 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |UPSTREAM --- Comment #1 from Fabian Vogt <fvogt(a)suse.com> --- I reported this upstream as https://gitlab.freedesktop.org/polkit/polkit/-/issues/176 with some ideas. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201181] New: VUL-0: CVE-2021-41690: dcmtk: malloced memory for storing all file information are recorded in a global variable LST and are not freed properly
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201181 Bug ID: 1201181 Summary: VUL-0: CVE-2021-41690: dcmtk: malloced memory for storing all file information are recorded in a global variable LST and are not freed properly Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/335773/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41690 DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41690 https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec8… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41690 https://github.com/DCMTK/dcmtk -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201180] New: VUL-0: CVE-2021-41689: dcmtk: sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201180 Bug ID: 1201180 Summary: VUL-0: CVE-2021-41689: dcmtk: sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/335774/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41689 DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41689 https://github.com/DCMTK/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b15809… https://github.com/DCMTK/dcmtk -- You are receiving this mail because: You are on the CC list for the bug.

1 0

Jump to page:

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openSUSE Bugs July 2022