July 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1200965] Intel Skylake: iris driver mistakenly been used (Dell Latitude 7480)
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1200965 https://bugzilla.suse.com/show_bug.cgi?id=1200965#c7 --- Comment #7 from Stefan Dirsch <sndirsch(a)suse.com> --- But this changed already with Mesa 20.x on Leap 15.3/SLE15-SP3. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1200965] Intel Skylake: iris driver mistakenly been used (Dell Latitude 7480)
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1200965 https://bugzilla.suse.com/show_bug.cgi?id=1200965#c6 --- Comment #6 from Stefan Dirsch <sndirsch(a)suse.com> --- Ok. Finally found the commit, which changed this. https://gitlab.freedesktop.org/mesa/mesa/-/commit/adaa3583f507f822533162279… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201118] polkit.log method is useless after switching to duktape
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1201118 https://bugzilla.suse.com/show_bug.cgi?id=1201118#c1 Fabian Vogt <fvogt(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |UPSTREAM --- Comment #1 from Fabian Vogt <fvogt(a)suse.com> --- I reported this upstream as https://gitlab.freedesktop.org/polkit/polkit/-/issues/176 with some ideas. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201181] New: VUL-0: CVE-2021-41690: dcmtk: malloced memory for storing all file information are recorded in a global variable LST and are not freed properly
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201181 Bug ID: 1201181 Summary: VUL-0: CVE-2021-41690: dcmtk: malloced memory for storing all file information are recorded in a global variable LST and are not freed properly Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/335773/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41690 DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41690 https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec8… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41690 https://github.com/DCMTK/dcmtk -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201180] New: VUL-0: CVE-2021-41689: dcmtk: sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201180 Bug ID: 1201180 Summary: VUL-0: CVE-2021-41689: dcmtk: sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/335774/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41689 DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41689 https://github.com/DCMTK/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b15809… https://github.com/DCMTK/dcmtk -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201179] New: VUL-0: CVE-2021-41688: dcmtk: object in the program is free but its address is still used in other locations
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201179 Bug ID: 1201179 Summary: VUL-0: CVE-2021-41688: dcmtk: object in the program is free but its address is still used in other locations Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/335775/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41688 DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41688 https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec8… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41688 https://github.com/DCMTK/dcmtk -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201178] New: VUL-0: CVE-2021-41687: dcmtk: the program malloc a heap memory for parsing data, but does not free it when error in parsing
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201178 Bug ID: 1201178 Summary: VUL-0: CVE-2021-41687: dcmtk: the program malloc a heap memory for parsing data, but does not free it when error in parsing Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/335776/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-41687 DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41687 https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec8… https://github.com/DCMTK/dcmtk http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41687 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201146] VUL-0: CVE-2022-33099: lua54,lua53,lua51,lua: heap buffer overflow due to uncontrolled recursion in error handling
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1201146 http://bugzilla.opensuse.org/show_bug.cgi?id=1201146#c6 --- Comment #6 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1201146) was mentioned in https://build.opensuse.org/request/show/986624 Factory / lua54 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1199909] NXP i.MX8MQ-EVK not able to recognize eMMC
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1199909 https://bugzilla.suse.com/show_bug.cgi?id=1199909#c21 --- Comment #21 from Peng Fan <peng.fan(a)nxp.com> --- Just give a try with Leap 15.4, sadly this config still not enabled. ttymxc0:install:/ # cp /proc/config.gz . ttymxc0:install:/ # gunzip config.gz ttymxc0:install:/ # cat config | grep PFUZE # CONFIG_REGULATOR_PFUZE100 is not set ttymxc0:install:/ # uname -a Linux install 5.14.21-150400.22-default #1 SMP PREEMPT_DYNAMIC Wed May 11 06:57:18 UTC 2022 (49db222) aarch64 aarch64 aarch64 GNU/Linux -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1201146] VUL-0: CVE-2022-33099: lua54,lua53,lua51,lua: heap buffer overflow due to uncontrolled recursion in error handling
by bugzilla_noreply＠suse.com 04 Jul '22

04 Jul '22

https://bugzilla.suse.com/show_bug.cgi?id=1201146 https://bugzilla.suse.com/show_bug.cgi?id=1201146#c5 Callum Farmer <gmbr3(a)opensuse.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|gmbr3(a)opensuse.org |security-team(a)suse.de --- Comment #5 from Callum Farmer <gmbr3(a)opensuse.org> --- in Factory -- You are receiving this mail because: You are on the CC list for the bug.

1 0