July 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1194331] New: VUL-0: chromium: multiple security issues fixed in 97.0.4692.71
by bugzilla_noreply＠suse.com 03 Jan '23

03 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1194331 Bug ID: 1194331 Summary: VUL-0: chromium: multiple security issues fixed in 97.0.4692.71 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: gianluca.gabrielli(a)suse.com QA Contact: security-team(a)suse.de Found By: --- Blocker: --- The Chrome team is delighted to announce the promotion of Chrome 97 to the stable channel for Windows, Mac and Linux.This will roll out over the coming days/weeks. Chrome 97.0.4692.71 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 97. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven��t yet fixed. This update includes 37 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. [$TBD][1275020] Critical CVE-2022-0096: Use after free in Storage. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-11-30 [$10000][1117173] High CVE-2022-0097: Inappropriate implementation in DevTools. Reported by David Erceg on 2020-08-17 [$10000][1273609] High CVE-2022-0098: Use after free in Screen Capture. Reported by @ginggilBesel on 2021-11-24 [$5000][1245629] High CVE-2022-0099: Use after free in Sign-in. Reported by Rox on 2021-09-01 [$TBD][1238209] High CVE-2022-0100: Heap buffer overflow in Media streams API. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-08-10 [$TBD][1249426] High CVE-2022-0101: Heap buffer overflow in Bookmarks. Reported by raven (@raid_akame) on 2021-09-14 [$TBD][1260129] High CVE-2022-0102: Type Confusion in V8 . Reported by Brendon Tiszka on 2021-10-14 [$TBD][1272266] High CVE-2022-0103: Use after free in SwiftShader. Reported by Abraruddin Khan and Omair on 2021-11-21 [$TBD][1273661] High CVE-2022-0104: Heap buffer overflow in ANGLE. Reported by Abraruddin Khan and Omair on 2021-11-25 [$TBD][1274376] High CVE-2022-0105: Use after free in PDF. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-11-28 [$TBD][1278960] High CVE-2022-0106: Use after free in Autofill. Reported by Khalil Zhani on 2021-12-10 [$10000][1248438] Medium CVE-2022-0107: Use after free in File Manager API. Reported by raven (@raid_akame) on 2021-09-10 [$5000][1248444] Medium CVE-2022-0108: Inappropriate implementation in Navigation. Reported by Luan Herrera (@lbherrera_) on 2021-09-10 [$4000][1261689] Medium CVE-2022-0109: Inappropriate implementation in Autofill. Reported by Young Min Kim (@ylemkimon), CompSec Lab at Seoul National University on 2021-10-20 [$3000][1237310] Medium CVE-2022-0110: Incorrect security UI in Autofill. Reported by Alesandro Ortiz on 2021-08-06 [$3000][1241188] Medium CVE-2022-0111: Inappropriate implementation in Navigation. Reported by garygreen on 2021-08-18 [$3000][1255713] Medium CVE-2022-0112: Incorrect security UI in Browser UI. Reported by Thomas Orlita on 2021-10-04 [$1000][1039885] Medium CVE-2022-0113: Inappropriate implementation in Blink. Reported by Luan Herrera (@lbherrera_) on 2020-01-07 [$TBD][1267627] Medium CVE-2022-0114: Out of bounds memory access in Web Serial. Reported by Looben Yang on 2021-11-06 [$NA][1268903] Medium CVE-2022-0115: Uninitialized Use in File API. Reported by Mark Brand of Google Project Zero on 2021-11-10 [$TBD][1272250] Medium CVE-2022-0116: Inappropriate implementation in Compositing. Reported by Irvan Kurniawan (sourc7) on 2021-11-20 [$TBD][1115847] Low CVE-2022-0117: Policy bypass in Service Workers. Reported by Dongsung Kim (@kid1ng) on 2020-08-13 [$TBD][1238631] Low CVE-2022-0118: Inappropriate implementation in WebShare. Reported by Alesandro Ortiz on 2021-08-11 [$TBD][1262953] Low CVE-2022-0120: Inappropriate implementation in Passwords. Reported by CHAKRAVARTHI (Ruler96) on 2021-10-25 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.As usual, our ongoing internal security work was responsible for a wide range of fixes: [1284397] Various fixes from internal audits, fuzzing and other initiatives Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1195420] New: VUL-0: chromium: multiple security issues fixed in 98.0.4758.80
by bugzilla_noreply＠suse.com 03 Jan '23

03 Jan '23

https://bugzilla.suse.com/show_bug.cgi?id=1195420 Bug ID: 1195420 Summary: VUL-0: chromium: multiple security issues fixed in 98.0.4758.80 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: gmbr3(a)opensuse.org Reporter: gianluca.gabrielli(a)suse.com QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: --- Blocker: --- [$20000][1284584] High CVE-2022-0452: Use after free in Safe Browsing. Reported by avaue at S.S.L. on 2022-01-05 [$20000][1284916] High CVE-2022-0453: Use after free in Reader Mode. Reported by Rong Jian of VRI on 2022-01-06 [$12000][1287962] High CVE-2022-0454: Heap buffer overflow in ANGLE. Reported by Seong-Hwan Park (SeHwa) of SecunologyLab on 2022-01-17 [$7500][1270593] High CVE-2022-0455: Inappropriate implementation in Full Screen Mode. Reported by Irvan Kurniawan (sourc7) on 2021-11-16 [$7000][1289523] High CVE-2022-0456: Use after free in Web Search. Reported by Zhihua Yao of KunLun Lab on 2022-01-21 [$5000][1274445] High CVE-2022-0457: Type Confusion in V8. Reported by rax of the Group0x58 on 2021-11-29 [$1000][1267060] High CVE-2022-0458: Use after free in Thumbnail Tab Strip. Reported by Anonymous on 2021-11-05 [$TBD][1244205] High CVE-2022-0459: Use after free in Screen Capture. Reported by raven (@raid_akame) on 2021-08-28 [$7500][1250227] Medium CVE-2022-0460: Use after free in Window Dialog. Reported by 0x74960 on 2021-09-16 [$3000][1256823] Medium CVE-2022-0461: Policy bypass in COOP. Reported by NDevTK on 2021-10-05 [$2000][1270470] Medium CVE-2022-0462: Inappropriate implementation in Scroll. Reported by Youssef Sammouda on 2021-11-16 [$1000][1268240] Medium CVE-2022-0463: Use after free in Accessibility. Reported by Zhihua Yao of KunLun Lab on 2021-11-09 [$1000][1270095] Medium CVE-2022-0464: Use after free in Accessibility. Reported by Zhihua Yao of KunLun Lab on 2021-11-14 [$1000][1281941] Medium CVE-2022-0465: Use after free in Extensions. Reported by Samet Bekmezci @sametbekmezci on 2021-12-22 [$TBD][1115460] Medium CVE-2022-0466: Inappropriate implementation in Extensions Platform. Reported by David Erceg on 2020-08-12 [$TBD][1239496] Medium CVE-2022-0467: Inappropriate implementation in Pointer Lock. Reported by Alesandro Ortiz on 2021-08-13 [$TBD][1252716] Medium CVE-2022-0468: Use after free in Payments. Reported by Krace on 2021-09-24 [$TBD][1279531] Medium CVE-2022-0469: Use after free in Cast. Reported by Thomas Orlita on 2021-12-14 [$TBD][1269225] Low CVE-2022-0470: Out of bounds memory access in V8. Reported by Looben Yang on 2021-11-11 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.As usual, our ongoing internal security work was responsible for a wide range of fixes: [1293087] Various fixes from internal audits, fuzzing and other initiatives -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1201627] New: openssl-1_0_0 FTBFS 2023-05-26
by bugzilla_noreply＠suse.com 02 Jan '23

02 Jan '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1201627 Bug ID: 1201627 Summary: openssl-1_0_0 FTBFS 2023-05-26 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: jsikes(a)suse.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: pmonrealgonzalez(a)suse.com Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our openssl-1_0_0 package fails build after 2023-05-26 To Reproduce: osc co openSUSE:Factory/openssl-1_0_0 && cd $_ osc build --vm-type=kvm --noservice --clean \ --build-opt=--vm-custom-opt="-rtc base=2023-05-26T18:00:00" standard It is probably possible to re-use the solution from bug 1185637 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1191331] New: VUL-0: CVE-2021-32765: hiredis: integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data
by bugzilla_noreply＠suse.com 02 Jan '23

02 Jan '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1191331 Bug ID: 1191331 Summary: VUL-0: CVE-2021-32765: hiredis: integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/311708/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: abergmann(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-32765 Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32765 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32765 https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2 https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec… https://wiki.sei.cmu.edu/confluence/display/c/MEM07-C.+Ensure+that+the+argu… -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1200974] New: [trackerbug] lxd 5.3 update
by bugzilla_noreply＠suse.com 31 Dec '22

31 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1200974 Bug ID: 1200974 Summary: [trackerbug] lxd 5.3 update Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: asarai(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- - Update to LXD 5.3. The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-5-3-has-been-released/14439 + Extended raw.qemu support + fscache support for cephfs storage pools -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1200002] New: [trackerbug] lxd 5.2 update
by bugzilla_noreply＠suse.com 31 Dec '22

31 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1200002 Bug ID: 1200002 Summary: [trackerbug] lxd 5.2 update Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: asarai(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- - Update to LXD 5.2. The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-5-2-has-been-released/14200 + VPD information in resources API * Cross-project profile copy * HTTP streaming support in /dev/lxd API * Use of server-side filtering in CLI * Ceph librbd for virtual machines -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1174075] New: Changing %{_libexecdir} breaks some packages which are misusing the macro
by bugzilla_noreply＠suse.com 28 Dec '22

28 Dec '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1174075 Bug ID: 1174075 Summary: Changing %{_libexecdir} breaks some packages which are misusing the macro Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Basesystem Assignee: callumjfarmer13(a)gmail.com Reporter: callumjfarmer13(a)gmail.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is a bug to log changes regarding the current major change to the rpm macro %{_libexecdir} which has resulted in many packages breaking where they explicitly call /usr/lib , in these cases the packages are being changed to use %{_prefix}/lib. Most changes to individual packages are being completed by myself. -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 1174609] New: Ctrl+Alt+Shift+Del - Keyboard shortcut - logout without confirmation cause crash KDE interface
by bugzilla_noreply＠suse.com 27 Dec '22

27 Dec '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1174609 Bug ID: 1174609 Summary: Ctrl+Alt+Shift+Del - Keyboard shortcut - logout without confirmation cause crash KDE interface Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Critical Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: ionut_n2001(a)yahoo.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Ctrl+Alt+Shift+Del - Keyboard shortcut - logout without confirmation cause crash KDE interface Hi OpenSUSE Team, I noticed this bug, which is very annoying. With this KBShortcut, system is unstable. With resume, graphic windows no longer appear. With full restart OS, working correctly KDE. Application: plasmashell (5.19.3) Qt Version: 5.15.0 Frameworks Version: 5.72.0 Operating System: Linux 5.7.9-1-default x86_64 Windowing system: X11 Distribution: "openSUSE Tumbleweed" cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20200726" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20200726" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:tumbleweed:20200726" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" LOGO="distributor-logo" -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1185077] New: Screen locker is broken and unlocking is not possible anymore
by bugzilla_noreply＠suse.com 27 Dec '22

27 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1185077 Bug ID: 1185077 Summary: Screen locker is broken and unlocking is not possible anymore Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Critical Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: ionut_n2001(a)yahoo.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- The screen locker is broken and unlocking is not possible anymore. in order to unlock switch to a virtual terminal (e.g. Ctrl+Alt+F2), log in and execute the command: loginctl unlock-session 2 Afterwards switch back to the running session (Ctrl+Alt+F2) cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20210418" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20210418" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" CPE_NAME="cpe:/o:opensuse:tumbleweed:20210418" BUG_REPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org/" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo" uname -a Linux my-opensuse 5.11.15-1-default #1 SMP Fri Apr 16 16:47:34 UTC 2021 (64fb5bf) x86_64 x86_64 x86_64 GNU/Linux rpm -qa | grep ksc kscreen5-5.21.4-1.1.x86_64 kscreen5-lang-5.21.4-1.1.noarch libkscreen2-plugin-5.21.4-1.1.x86_64 kscreenlocker-lang-5.21.4-1.2.noarch kscreenlocker-5.21.4-1.2.x86_64 kscreen5-plasmoid-5.21.4-1.1.x86_64 kdeinit5 --version Qt: 5.15.2 KDE: 5.81.0 lscpu | grep Model Model: 142 Model name: Intel(R) Core(TM) i5-7260U CPU @ 2.20GHz lspci | grep VGA 00:02.0 VGA compatible controller: Intel Corporation Iris Plus Graphics 640 (rev 06) -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[opensuse-bugs] [Bug 1178989] New: Multiboot and multiboot2 is supported with Grub2?
by bugzilla_noreply＠suse.com 27 Dec '22

27 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1178989 Bug ID: 1178989 Summary: Multiboot and multiboot2 is supported with Grub2? Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: ionut_n2001(a)yahoo.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Hi OpenSUSE team, One question: Multiboot and multiboot2 is supported with Grub2? Example: menuentry 'Boot OS from multiboot2' { insmod part_gpt insmod ext2 echo 'Loading OS ...' multiboot2 /boot/os.bin module2 /boot/kernel4os-part1 xxxxxx $(os1 bootargs) module2 /boot/kernel4os-part2 yyyyyy $(os2 bootargs) } Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 4