January 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1118727] VUL-0: CVE-2018-19608: mbedtls: Local timing attack on RSA decryption
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1118727 https://bugzilla.suse.com/show_bug.cgi?id=1118727#c5 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|CONFIRMED |RESOLVED --- Comment #5 from Marcus Meissner <meissner(a)suse.com> --- newer leap have newer mbedtls version -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1103037] VUL-1: CVE-2018-0498: mbedtls: partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1103037 https://bugzilla.suse.com/show_bug.cgi?id=1103037#c4 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|REOPENED |RESOLVED --- Comment #4 from Marcus Meissner <meissner(a)suse.com> --- fix is in newer leap -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1103036] VUL-1: CVE-2018-0497: mbedtls: partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1103036 https://bugzilla.suse.com/show_bug.cgi?id=1103036#c4 Marcus Meissner <meissner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution|--- |FIXED --- Comment #4 from Marcus Meissner <meissner(a)suse.com> --- fixed by newer versions in newer leaps -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219337] New: VUL-0: CVE-2024-23775: mbedtls: buffer overflow in mbedtls_x509_set_extension()
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1219337 Bug ID: 1219337 Summary: VUL-0: CVE-2024-23775: mbedtls: buffer overflow in mbedtls_x509_set_extension() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/392472/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: meissner(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CVE-2024-23775 Buffer overflow in mbedtls_x509_set_extension(). When writing x509 extensions we failed to validate inputs passed in to mbedtls_x509_set_extension(), which could result in an integer overflow, causing a zero-length buffer to be allocated to hold the extension. The extension would then be copied into the buffer, causing a heap buffer overflow. https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-secur… Resolution: update net-libs/mbedtls to 2.28.7 and 3.5.2. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-23775 https://bugzilla.redhat.com/show_bug.cgi?id=2261598 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1218578] Unable to install OpenMW due to missing dependencies
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1218578 https://bugzilla.suse.com/show_bug.cgi?id=1218578#c15 --- Comment #15 from Michael Pujos <pujos.michael(a)gmail.com> --- Thanks, I got Ogre to compile successfully and will submit a request soon with the fix. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219192] On the intel AX200 WiFi there is an issue with 5 GHz (2.4 GHz is fine)
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1219192 https://bugzilla.suse.com/show_bug.cgi?id=1219192#c6 --- Comment #6 from Takashi Iwai <tiwai(a)suse.com> --- There was a typo in the repo name, now available at: http://download.opensuse.org/repositories/home:/tiwai:/bsc121919/standard/ -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219192] On the intel AX200 WiFi there is an issue with 5 GHz (2.4 GHz is fine)
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1219192 https://bugzilla.suse.com/show_bug.cgi?id=1219192#c5 --- Comment #5 from R N <R_Nik_C(a)proton.me> --- Still nothing there... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218578] Unable to install OpenMW due to missing dependencies
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1218578 https://bugzilla.suse.com/show_bug.cgi?id=1218578#c13 --- Comment #13 from Michael Pujos <pujos.michael(a)gmail.com> --- So do not remove OpenMW just yet, as this is fixable. In fact, the proper temporary fix would be to revert to glslang v13, until v14 works. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218578] Unable to install OpenMW due to missing dependencies
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1218578 https://bugzilla.suse.com/show_bug.cgi?id=1218578#c12 --- Comment #12 from Michael Pujos <pujos.michael(a)gmail.com> --- OpenMW does not build because glslang v14 removed some (installed) includes needed for Ogre to compile. It is been looked at by glslang dev to eventually re-add the missing includes: https://github.com/KhronosGroup/glslang/issues/3491 If that's fixed in glslang by an upstream patch, this patch can then be applied to glslang on OBS, making Ogre compile and finally OpenMW compile. So I'd say to wait a bit for glslang to eventually fix it. If they don't, glslang OBS .spec file could be modified to install the missing includes. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219284] increased ram usage after upgrading from 6.6.x to 6.7.x
by bugzilla_noreply＠suse.com 30 Jan '24

30 Jan '24

https://bugzilla.suse.com/show_bug.cgi?id=1219284 https://bugzilla.suse.com/show_bug.cgi?id=1219284#c12 --- Comment #12 from Andrea Manzini <andrea.manzini(a)suse.com> --- all the measurements were taken from the same fresh installed tumbleweed virtual machine with XFCE desktop environment, so same userspace. Just did these action to reproduce: - boot choosing the 6.6 kernel - start the DE - open a terminal to run commands - reboot - choose 6.7 kernel - start the DE - open a terminal to run commands -- You are receiving this mail because: You are on the CC list for the bug.

1 0