September 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1215651] New: VPN helper does not add a VPN
by bugzilla_noreply＠suse.com 07 Oct '23

07 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1215651 Bug ID: 1215651 Summary: VPN helper does not add a VPN Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: illigarium(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 869716 --> https://bugzilla.suse.com/attachment.cgi?id=869716&action=edit Screen Record VPN helper does not add a VPN. It just doesn't appear. GNOME Settings version `gnome-control-center 45.0` There is nothing in stdout/stderr Steps to reproduce: 1. Open GNOME Settings; 2. Try to add any VPN by any means; 3. It does not appear. Also filed a bug here: https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/2668 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1214853] New: Add Mageia 9 distribution repository to OBS
by bugzilla_noreply＠suse.com 07 Oct '23

07 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1214853 Bug ID: 1214853 Summary: Add Mageia 9 distribution repository to OBS Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: BuildService Assignee: screening-team-bugs(a)suse.de Reporter: ugal12v(a)gmail.com QA Contact: adrian.schroeter(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Mageia 9 distribution has been released. https://www.mageia.org/en/9/ Could you please add the distribution repository to OBS. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1215523] New: kernel 5.14.21.150400.24.84.1 amdgpu critical error
by bugzilla_noreply＠suse.com 06 Oct '23

06 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1215523 Bug ID: 1215523 Summary: kernel 5.14.21.150400.24.84.1 amdgpu critical error Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: x86-64 OS: openSUSE Leap 15.4 Status: NEW Severity: Critical Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: bugs(a)clearingstelle-eeg-kwkg.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After the kernel update today to 5.14.21.150400.24.84.1 the system boots, but due to constantly repeated amdgpu error the files /var/log/messages and /var/log/warn grows up to gigabytes in a few minutes and the root file system gets exhausted and no space is left on the device. switching back to the previous kernel 5.14.21.150400.24.81.1 "solves" the issue. GIT Branch: SLE15-SP4_EMBARGO Distribution: SUSE Linux Enterprise 15 Name : kernel-default Version : 5.14.21 Release : 150400.24.84.1 Architecture: x86_64 /var/log/messages is full of errors like this ------------[ cut here ]------------ WARNING: CPU: 10 PID: 8062 at ../include/linux/dma-fence.h:478 amdgpu_sync_keep_later+0xab/0xc0 [amdgpu] 2023-09-20T15:06:06.968445+02:00 fermium kernel: [ 219.037070][ T8062] Modules linked in: rfcomm nf_nat_sip nft_objref nf_conntrack_sip nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib af_packet nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject cmac algif_hash alg if_skcipher af_alg nft_ct bnep nft_chain_nat nf_tables btusb btrtl btbcm btintel ebtable_nat ebtable_broute bluetooth ip6table_nat uvcvideo snd_usb_audio videobuf2_vmalloc ip6table_mangle videobuf2_memops videobuf2_v4l2 ip6table_raw videobuf2_common ip6table_security sn d_usbmidi_lib videodev snd_rawmidi ecdh_generic snd_seq_device mc iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_mangle iptable_raw iptable_security ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter bpfil ter vboxnetadp(OEN) vboxnetflt(OEN) vboxdrv(OEN) dmi_sysfs iwlmvm joydev sunrpc mac80211 libarc4 snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi intel_rapl_msr intel_rapl_common edac_mce_amd snd_hda_intel 2023-09-20T15:06:06.968538+02:00 fermium kernel: [ 219.037204][ T8062] snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec kvm_amd nls_iso8859_1 snd_hda_core iwlwifi hid_multitouch nls_cp437 snd_hwdep vfat kvm snd_pcm r8169 fat snd_timer cfg80211 acer_wmi irqbypass real tek sparse_keymap snd mdio_devres rfkill pcspkr ucsi_acpi snd_pci_acp5x wmi_bmof efi_pstore(N) i2c_piix4 libphy snd_rn_pci_acp3x typec_ucsi soundcore k10temp snd_pci_acp3x thermal typec roles acer_wireless(N) button acpi_cpufreq i2c_designware_platform i2c_designware_co re amd_pmc ac fuse configfs ip_tables x_tables ext4 crc16 mbcache jbd2 dm_crypt essiv authenc hid_generic usbhid amdgpu crc32_pclmul crc32c_intel ghash_clmulni_intel drm_ttm_helper ttm iommu_v2 gpu_sched i2c_algo_bit rtsx_pci_sdmmc drm_kms_helper mmc_core syscopyarea sy sfillrect sysimgblt fb_sys_fops aesni_intel cec rc_core xhci_pci crypto_simd xhci_pci_renesas xhci_hcd drm cryptd nvme usbcore serio_raw nvme_core ccp rtsx_pci sp5100_tco(N) nvme_common t10_pi mfd_core battery video wmi i2c_hid_acpi 2023-09-20T15:06:06.968543+02:00 fermium kernel: [ 219.037378][ T8062] i2c_hid dm_mirror dm_region_hash dm_log sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod msr efivarfs 2023-09-20T15:06:06.968547+02:00 fermium kernel: [ 219.037403][ T8062] Supported: No, Unsupported modules are loaded 2023-09-20T15:06:06.968551+02:00 fermium kernel: [ 219.037406][ T8062] CPU: 10 PID: 8062 Comm: kwin_x11:cs0 Tainted: G W OE N 5.14.21-150400.24.84-default #1 SLE15-SP4 2d2aae51046e63e9f8c5f181ee9c884ea3512c4e 2023-09-20T15:06:06.968554+02:00 fermium kernel: [ 219.037414][ T8062] Hardware name: Acer TravelMate P215-41/Bassdrum_RC, BIOS V1.02 02/18/2021 2023-09-20T15:06:06.968557+02:00 fermium kernel: [ 219.037417][ T8062] RIP: 0010:amdgpu_sync_keep_later+0xab/0xc0 [amdgpu] 2023-09-20T15:06:06.968561+02:00 fermium kernel: [ 219.037602][ T8062] Code: d1 0f 92 c2 eb b4 e8 04 ae bb ed 48 85 db 75 ca eb e1 be 01 00 00 00 e8 83 3a 97 ed eb d5 be 03 00 00 00 e8 77 3a 97 ed eb ab <0f> 0b eb 90 be 02 00 00 00 e8 67 3a 97 ed eb b9 0f 1f 44 00 00 0 f 2023-09-20T15:06:06.968564+02:00 fermium kernel: [ 219.037607][ T8062] RSP: 0018:ffffa76502227ac8 EFLAGS: 00010206 2023-09-20T15:06:06.968567+02:00 fermium kernel: [ 219.037612][ T8062] RAX: ffffffffb0afffc0 RBX: ffff9c1263211940 RCX: 0000000000000000 2023-09-20T15:06:06.968570+02:00 fermium kernel: [ 219.037616][ T8062] RDX: ffff9c1244b00e18 RSI: ffff9c1263211940 RDI: ffff9c1327f51cf8 2023-09-20T15:06:06.968573+02:00 fermium kernel: [ 219.037619][ T8062] RBP: ffff9c1327f51cf8 R08: 0000000000000020 R09: 0000000000000000 2023-09-20T15:06:06.968575+02:00 fermium kernel: [ 219.037622][ T8062] R10: ffff9c1244b00e38 R11: 0000000000000003 R12: 0000000000000000 2023-09-20T15:06:06.968578+02:00 fermium kernel: [ 219.037625][ T8062] R13: 0000000000000000 R14: 0000000000000000 R15: ffff9c12556e9948 2023-09-20T15:06:06.968582+02:00 fermium kernel: [ 219.037629][ T8062] FS: 00007fbac6fa8700(0000) GS:ffff9c153f880000(0000) knlGS:0000000000000000 2023-09-20T15:06:06.968584+02:00 fermium kernel: [ 219.037634][ T8062] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 2023-09-20T15:06:06.968587+02:00 fermium kernel: [ 219.037637][ T8062] CR2: 00007f773801e0b0 CR3: 0000000178bfc000 CR4: 0000000000350ee0 2023-09-20T15:06:06.968590+02:00 fermium kernel: [ 219.037641][ T8062] Call Trace: 2023-09-20T15:06:06.968594+02:00 fermium kernel: [ 219.037645][ T8062] <TASK> 2023-09-20T15:06:06.968596+02:00 fermium kernel: [ 219.037649][ T8062] amdgpu_sync_vm_fence+0x1e/0x40 [amdgpu 28d5a9707e1f6057a70f2fd1d73854000d464e2e] 2023-09-20T15:06:06.968599+02:00 fermium kernel: [ 219.037834][ T8062] amdgpu_cs_ioctl+0x1574/0x1ca0 [amdgpu 28d5a9707e1f6057a70f2fd1d73854000d464e2e] 2023-09-20T15:06:06.968603+02:00 fermium kernel: [ 219.038037][ T8062] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu 28d5a9707e1f6057a70f2fd1d73854000d464e2e] 2023-09-20T15:06:06.968606+02:00 fermium kernel: [ 219.038249][ T8062] drm_ioctl_kernel+0xb6/0x100 [drm b72f874ec848c4be9b8c39c6d4b6cda18e282a1a] 2023-09-20T15:06:06.968609+02:00 fermium kernel: [ 219.038285][ T8062] drm_ioctl+0x35a/0x400 [drm b72f874ec848c4be9b8c39c6d4b6cda18e282a1a] 2023-09-20T15:06:06.968612+02:00 fermium kernel: [ 219.038318][ T8062] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu 28d5a9707e1f6057a70f2fd1d73854000d464e2e] 2023-09-20T15:06:06.968615+02:00 fermium kernel: [ 219.038500][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968618+02:00 fermium kernel: [ 219.038505][ T8062] ? try_to_wake_up+0x177/0x550 2023-09-20T15:06:06.968740+02:00 fermium kernel: [ 219.038519][ T8062] amdgpu_drm_ioctl+0x49/0x80 [amdgpu 28d5a9707e1f6057a70f2fd1d73854000d464e2e] 2023-09-20T15:06:06.968743+02:00 fermium kernel: [ 219.038694][ T8062] __x64_sys_ioctl+0x92/0xd0 2023-09-20T15:06:06.968746+02:00 fermium kernel: [ 219.038702][ T8062] do_syscall_64+0x5b/0x80 2023-09-20T15:06:06.968750+02:00 fermium kernel: [ 219.038708][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968753+02:00 fermium kernel: [ 219.038711][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968756+02:00 fermium kernel: [ 219.038715][ T8062] ? __x64_sys_futex+0x5e/0x1d0 2023-09-20T15:06:06.968760+02:00 fermium kernel: [ 219.038721][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968762+02:00 fermium kernel: [ 219.038725][ T8062] ? syscall_exit_to_user_mode+0x28/0x40 2023-09-20T15:06:06.968765+02:00 fermium kernel: [ 219.038731][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968768+02:00 fermium kernel: [ 219.038735][ T8062] ? syscall_exit_to_user_mode+0x28/0x40 2023-09-20T15:06:06.968771+02:00 fermium kernel: [ 219.038740][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968775+02:00 fermium kernel: [ 219.038743][ T8062] ? do_syscall_64+0x67/0x80 2023-09-20T15:06:06.968780+02:00 fermium kernel: [ 219.038747][ T8062] ? syscall_exit_to_user_mode+0x28/0x40 2023-09-20T15:06:06.968783+02:00 fermium kernel: [ 219.038752][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968786+02:00 fermium kernel: [ 219.038756][ T8062] ? do_syscall_64+0x67/0x80 2023-09-20T15:06:06.968789+02:00 fermium kernel: [ 219.038760][ T8062] ? do_syscall_64+0x67/0x80 2023-09-20T15:06:06.968792+02:00 fermium kernel: [ 219.038764][ T8062] ? do_syscall_64+0x67/0x80 2023-09-20T15:06:06.968795+02:00 fermium kernel: [ 219.038768][ T8062] ? srso_return_thunk+0x5/0x10 2023-09-20T15:06:06.968798+02:00 fermium kernel: [ 219.038772][ T8062] entry_SYSCALL_64_after_hwframe+0x61/0xcb 2023-09-20T15:06:06.968801+02:00 fermium kernel: [ 219.038778][ T8062] RIP: 0033:0x7fbae5d02437 2023-09-20T15:06:06.968804+02:00 fermium kernel: [ 219.038782][ T8062] Code: 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 29 da 0d 00 f7 d8 64 89 01 48 2023-09-20T15:06:06.968807+02:00 fermium kernel: [ 219.038786][ T8062] RSP: 002b:00007fbac6fa7888 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 2023-09-20T15:06:06.968811+02:00 fermium kernel: [ 219.038791][ T8062] RAX: ffffffffffffffda RBX: 00007fbac6fa79e8 RCX: 00007fbae5d02437 2023-09-20T15:06:06.968813+02:00 fermium kernel: [ 219.038794][ T8062] RDX: 00007fbac6fa7900 RSI: 00000000c0186444 RDI: 0000000000000009 2023-09-20T15:06:06.968817+02:00 fermium kernel: [ 219.038797][ T8062] RBP: 00007fbac6fa7900 R08: 00007fbac6fa7a40 R09: 0000000000000020 2023-09-20T15:06:06.968822+02:00 fermium kernel: [ 219.038800][ T8062] R10: 00007fbac6fa7a40 R11: 0000000000000246 R12: 00000000c0186444 2023-09-20T15:06:06.968826+02:00 fermium kernel: [ 219.038802][ T8062] R13: 0000000000000009 R14: 00005636906067b0 R15: 0000000000000020 2023-09-20T15:06:06.968830+02:00 fermium kernel: [ 219.038813][ T8062] </TASK> 2023-09-20T15:06:06.968833+02:00 fermium kernel: [ 219.038815][ T8062] ---[ end trace 3d22bee0ff27a2c8 ]--- -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1215844] New: Adding ACS override patch
by bugzilla_noreply＠suse.com 06 Oct '23

06 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1215844 Bug ID: 1215844 Summary: Adding ACS override patch Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: m.szczepaniak.000(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello I would like to request addition of acs override patch https://github.com/zen-kernel/zen-kernel/commit/e1b127aa22601f9cb2afa3daad4… It's not enabled by default so it doesn't affect users whatsoever but it would be useful to me and maybe some other people rather than going through effort of adding patch myself. Optionally it could be just in like separate kernel flavour https://build.opensuse.org/project/show/home:Mister_Magister:branches:Kerne… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1215007] New: Zypper - Patch openSUSE-SLE-15.5-2023-3514 killed CLI completion
by bugzilla_noreply＠suse.com 05 Oct '23

05 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1215007 Bug ID: 1215007 Summary: Zypper - Patch openSUSE-SLE-15.5-2023-3514 killed CLI completion Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: bugrprt21882(a)online.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The change from Zypper version 1.14.61 to version 1.14.63 has killed the CLI completion of the Zypper commands. For example: "zypper patch[Tab]" no longer allows the selection of the Zypper command “patch-info”. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1213822] New: invalid grub.cfg created with INITRD_IN_POSTTRANS=1
by bugzilla_noreply＠suse.com 05 Oct '23

05 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1213822 Bug ID: 1213822 Summary: invalid grub.cfg created with INITRD_IN_POSTTRANS=1 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: martin.wilck(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Invalid boot entry is generated with latest TW update and INITRD_IN_POSTTRANS=1 set: echo 'Loading Linux 6.4.6-1-default ...' linux /boot/vmlinuz-6.4.6-1-default root=/dev/sda7 /dev/sda5 ${extra_cmdline} sysrq_always_enabled panic=100 ignore_loglevel unknown_nmi_panic resume=/dev/sda6 crashkernel=128M@256M showopts The root device in question is a btrfs device with two members, where grub2-probe prints this: # grub2-probe --target=device / /dev/sda7 /dev/sda5 The issue happened because the update transaction comprised both a grub2 update and a kernel-default update. With INITRD_IN_POSTTRANS=1, if the posttrans script of grub2-x86_64-efi is executed before the posttrans script of kernel-default, the initrd will not exist at the time grub2-mkconfig is run, and the following code from /etc/grub.d/10_linux will be executed: if test -z "${initramfs}" && test -z "${initrd_real}" ; then # "UUID=" and "ZFS=" magic is parsed by initrd or initramfs. Since there's # no initrd or builtin initramfs, it can't work here. if [ "x${GRUB_DEVICE_PARTUUID}" = "x" ] \ || [ "x${GRUB_DISABLE_LINUX_PARTUUID}" = "xtrue" ]; then linux_root_device_thisversion=${GRUB_DEVICE} else linux_root_device_thisversion=PARTUUID=${GRUB_DEVICE_PARTUUID} fi fi This will cause the wrong grub.cfg entry shown above. The script assumes that if no initrd exists at the time it is running, there will be none later, either. This assumption is arguably wrong under SUSE and openSUSE, where we always have an initrd — it would be smarter to assume that if no initrd exists, it will be created later. Also, it's very questionable to create a syntactically wrong boot entry rather than a (possibly) unparseable UUID= entry. The initramfs is created later in the installation process, when the posttrans script of kernel-default is run; but that won't cause the grub.cfg file to be regenerated. We need to make sure that grub2-mkconfig is run after initrd creation. This needs to be fixed in suse-module-tools. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1213754] New: liblinphone_tester and linphone do not start: undefined symbol
by bugzilla_noreply＠suse.com 05 Oct '23

05 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1213754 Bug ID: 1213754 Summary: liblinphone_tester and linphone do not start: undefined symbol Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: b-h-dra(a)t-online.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When I start linphone,, I get the error message linphone: symbol lookup error: /lib64/liblinphone.so.10: undefined symbol: _ZN4lime11LimeManager6updateERKSt8functionIFvNS_14CallbackReturnENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEE The same applies for liblinphone_tester: liblinphone_tester: symbol lookup error: /lib64/liblinphone.so.10: undefined symbol: _ZN4lime11LimeManager6updateERKSt8functionIFvNS_14CallbackReturnENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEEE -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1215786] New: VUL-0: CVE-2023-42116: exim: SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability
by bugzilla_noreply＠suse.com 05 Oct '23

05 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1215786 Bug ID: 1215786 Summary: VUL-0: CVE-2023-42116: exim: SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/380211/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: wullinger(a)rz.uni-kiel.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: abergmann(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. 06/06/22 – ZDI requested a PSIRT contact. 06/14/22 – ZDI reported the vulnerability to the vendor. 04/25/23 – ZDI asked for an update. 04/25/23 – The vendor asked us to re-send the reports. 05/10/23 – ZDI sent the vulnerability to the vendor. 09/25/23 – ZDI asked for an update and informed the vendor that we intend to publish the case as a zero-day advisory on 09/27/23. -- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-42116 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1215785] New: VUL-0: CVE-2023-42115: exim: AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability
by bugzilla_noreply＠suse.com 05 Oct '23

05 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1215785 Bug ID: 1215785 Summary: VUL-0: CVE-2023-42115: exim: AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/380212/ OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Sound Assignee: wullinger(a)rz.uni-kiel.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: abergmann(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. 06/06/22 – ZDI requested a PSIRT contact. 06/14/22 – ZDI reported the vulnerability to the vendor. 04/25/23 – ZDI asked for an update. 04/25/23 – The vendor asked us to re-send the reports. 05/10/23 – ZDI sent the vulnerability to the vendor. 09/25/23 – ZDI asked for an update and informed the vendor that we intend to publish the case as a zero-day advisory on 09/27/23. -- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-42115 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1215784] New: VUL-0: CVE-2023-42114: exim: NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability
by bugzilla_noreply＠suse.com 05 Oct '23

05 Oct '23

https://bugzilla.suse.com/show_bug.cgi?id=1215784 Bug ID: 1215784 Summary: VUL-0: CVE-2023-42114: exim: NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/380213/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: wullinger(a)rz.uni-kiel.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: abergmann(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to disclose information in the context of the service account. 06/06/22 – ZDI requested a PSIRT contact. 06/14/22 – ZDI reported the vulnerability to the vendor. 04/25/23 – ZDI asked for an update. 04/25/23 – The vendor asked us to re-send the reports. 05/10/23 – ZDI sent the vulnerability to the vendor. 09/25/23 – ZDI asked for an update and informed the vendor that we intend to publish the case as a zero-day advisory on 09/27/23. -- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-42114 -- You are receiving this mail because: You are on the CC list for the bug.

1 4