October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1232643] New: VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232643 Bug ID: 1232643 Summary: VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: edogawa(a)aon.at Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: andrea.mattiazzo(a)suse.com, security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1232611 +++ An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 The packages below are or contain embedded packages that are vulnerable to CVE-2024-50602. Tracking as affected: - openSUSE:Factory/giada contains embedded package: libexpat (R_2_1_0-26-gb3a467e) Please consider version bumping or patching the affected dependencies. The listed codestreams are affected. All other codestreams should not be affected, but feel free to double-check. This is a auto-generated message, please reach out to the reporter directly if you think this is incorrect. No bug-owner found for these packages, if the assignation is not correct feel free to re-assign. ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat/expat_external.h ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat/expat.h -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231800] Many problems with kernel prior 6.9 release. AMD platform.
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231800 https://bugzilla.suse.com/show_bug.cgi?id=1231800#c36 Anthony Iliopoulos <ailiopoulos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo? | --- Comment #36 from Anthony Iliopoulos <ailiopoulos(a)suse.com> --- (In reply to Sławomir Lach from comment #35) > > uname -a > Linux localhost.localdomain 6.11.5-1-default #1 SMP PREEMPT_DYNAMIC Wed Oct > 23 04:27:11 UTC 2024 (b4e3aa9) x86_64 x86_64 x86_64 GNU/Linux > > So OpenSUSE team release a fixed version of kernel currently? Yes, it always reflects the upstream stable kernel, and given that the fix was included in the v6.11.4 stable release, it is already in TW. You can check the kernel package changelog and look for the related fix subject line (rpm -q --changelog kernel-default | less). The patch is at [1]. [1] https://github.com/openSUSE/kernel-source/blob/stable/patches.kernel.org/6.… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227420] openSUSE missing fi keymap vs. fi-kotoistus
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227420 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jarkko.torvinen@i | |ki.fi), | |needinfo?(lassi.vaatamoinen | |(a)gmail.com) | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227420] openSUSE missing fi keymap vs. fi-kotoistus
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227420 https://bugzilla.suse.com/show_bug.cgi?id=1227420#c31 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #31 from Stefan Dirsch <sndirsch(a)suse.com> --- Closing. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227420] openSUSE missing fi keymap vs. fi-kotoistus
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227420 https://bugzilla.suse.com/show_bug.cgi?id=1227420#c30 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS Priority|P5 - None |P3 - Medium --- Comment #30 from Stefan Dirsch <sndirsch(a)suse.com> --- Let's assume my patch fixes this issue. Fix is now submitted to factory/Tumbleweed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231800] Many problems with kernel prior 6.9 release. AMD platform.
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231800 https://bugzilla.suse.com/show_bug.cgi?id=1231800#c34 Anthony Iliopoulos <ailiopoulos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(slawek(a)lach.art.p | |l) | Status|NEW |IN_PROGRESS --- Comment #34 from Anthony Iliopoulos <ailiopoulos(a)suse.com> --- (In reply to Sławomir Lach from comment #33) > Backup done. > > So, if I understood, I should debug case of remounting fs to read only mode? > But how to debug this case? Should I wrote 'echo c > /proc/sysrq-trigger' > into terminal? How to detect case, when it occur? Should I listen some > udiskctl dbus signal? So according to your comment #32 everything works as expected when the amd_sfh module is blacklisted. Presumably this is causing memory corruptions (comment #17). The amd_sfh fix [1] landed on v6.11.4 and the commit message mentions: "resolve memory errors, page faults, btrfs going read-only, and btrfs disk corruption." Thus my recommendation would be to update to v6.11.5, remove amd_sfh from the blacklist, and see how it goes. [1] commit c56f9ecb7fb6 ("HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()") -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232567] With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 https://bugzilla.suse.com/show_bug.cgi?id=1232567#c8 Frank Krüger <fkrueger(a)mailbox.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fkrueger(a)mailbox.org --- Comment #8 from Frank Krüger <fkrueger(a)mailbox.org> --- Fixed for Tumbleweed as well. Thx. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232640] New: tesseract-ocr fails to run
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232640 Bug ID: 1232640 Summary: tesseract-ocr fails to run Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: 64bit OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jcarricksmith(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When trying to run tesseract in openSUSE Leap 15.6 the error message:- tesseract: error while loading shared libraries: libOpenCL.so.1: cannot open shared object file: No such file or directory appears. Installing package libOpenCL1 package creates /usr/lib64/ocl-icd/libOpenCL.so.1 Creating a link to this in /usr/lib64/ gives me a workaround. I don't what the appropriate fix is. Many thanks John -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232583] New: VUL-0: CVE-2024-50602: paraview: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232583 Bug ID: 1232583 Summary: VUL-0: CVE-2024-50602: paraview: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: vicente.bolea(a)gmail.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1229570] python3-pygit2 broken due to runtime requirement on unsatisfied cffi version
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1229570 https://bugzilla.suse.com/show_bug.cgi?id=1229570#c5 --- Comment #5 from Nathan Cutler <ncutler(a)suse.com> --- (In reply to Nathan Cutler from comment #4) > I'm thinking how to solve this problem, and the only solution that occurs to > me is to build and ship python311-pygit2. That will then require > python311-cffi which is in the Python 3 module at version 1.15.1. Ah, but even that won't be enough to meet the requirement: Requirement.parse('cffi>=1.16.0'), {'pygit2'}) So the first thing would be to land an update of python311-cffi in the Python 3 module, but even that will probably require an ECO (back to Comment 1). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204842] [trackerbug] lxc 5.0.1 update
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1204842 https://bugzilla.suse.com/show_bug.cgi?id=1204842#c4 --- Comment #4 from Marcus Meissner <meissner(a)suse.com> --- openSUSE-SU-2024:0342-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1204842,1206779 CVE References: CVE-2022-47952 JIRA References: Sources used: openSUSE Backports SLE-15-SP6 (src): lxc-6.0.2-bp156.2.3.1 openSUSE Backports SLE-15-SP5 (src): lxc-6.0.2-bp155.4.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1230414] kernel: reproducible builds issue with BTF
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1230414 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229450] New: libbpf: failed to find '.BTF' ELF section in vmlinux
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1229450 Bug ID: 1229450 Summary: libbpf: failed to find '.BTF' ELF section in vmlinux Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 876820 --> https://bugzilla.suse.com/attachment.cgi?id=876820&action=edit Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586 build log The kernel builds result in random build failures while creating BTF. For example https://build.opensuse.org/package/live_build_log/Kernel:vanilla/kernel-sou…: > libbpf: failed to find '.BTF' ELF section in vmlinux > FAILED: load BTF from vmlinux: No data available > make[2]: *** [../scripts/Makefile.vmlinux:34: vmlinux] Error 255 > make[2]: *** Deleting file 'vmlinux' > make[1]: *** [/home/abuild/rpmbuild/BUILD/kernel-vanilla-6.11~rc3.338.gc3f2d783a459/linux-6.11-rc3-338-gc3f2d783a459/Makefile:1158: vmlinux] Error 2 > make: *** [../Makefile:224: __sub-make] Error 2 > error: Bad exit status from /var/tmp/rpm-tmp.olf5Nu (%build) arm seems to fail reliably. But for example in ibs://Devel:Kernel:master/kernel-source:kernel-vanilla/LEGACYX86/i586, it looks like it is sort of random. kernel-debug and kernel-vanilla fails for i586, but -default and -pae are built currently. See the job history for kernel-vanilla in there (the failed boot log is attached): > time package reason code build time worker > 2024-07-15 07:41:48 kernel-source:kernel-vanilla source change succeeded 47m 53s h01-ch5a:3 > 2024-07-15 23:56:48 kernel-source:kernel-vanilla source change succeeded 47m 57s h01-ch5b:5 > 2024-07-18 11:12:40 kernel-source:kernel-vanilla source change succeeded 48m 46s h01-ch5b:2 > 2024-07-26 20:01:29 kernel-source:kernel-vanilla source change succeeded 52m 40s h01-ch4b:2 > 2024-07-29 09:07:35 kernel-source:kernel-vanilla source change succeeded 52m 53s h01-ch4a:6 > 2024-08-03 11:38:55 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch4b:8 > 2024-08-04 23:48:15 kernel-source:kernel-vanilla source change failed 25m 14s h01-ch4b:7 > 2024-08-06 16:37:35 kernel-source:kernel-vanilla source change succeeded 53m 25s h01-ch4b:4 > 2024-08-09 19:44:44 kernel-source:kernel-vanilla source change failed 26m 4s h01-ch5a:2 > 2024-08-11 22:48:56 kernel-source:kernel-vanilla source change failed 0m 38s h01-ch4b:6 > 2024-08-12 16:44:52 kernel-source:kernel-vanilla source change succeeded 54m 0s h01-ch5b:5 > 2024-08-15 21:49:11 kernel-source:kernel-vanilla source change failed 25m 25s h01-ch4b:1 > 2024-08-19 01:53:01 kernel-source:kernel-vanilla source change succeeded 50m 9s h01-ch4a:5 > 2024-08-19 11:33:50 kernel-source:kernel-vanilla source change succeeded 55m 9s h01-ch5b:1 > 2024-08-19 17:23:59 kernel-source:kernel-vanilla source change failed 25m 16s h01-ch5a:3 -- You are receiving this mail because: You are on the CC list for the bug.

1 27

[Bug 1230992] ddclient 3.10.0 is a real mess (known issues) - please use upstream 3.11.2 at least
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1230992 https://bugzilla.suse.com/show_bug.cgi?id=1230992#c2 Giacomo Comes <gcomes.obs(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |gcomes.obs(a)gmail.com --- Comment #2 from Giacomo Comes <gcomes.obs(a)gmail.com> --- I have been using ddclient for many years and never got a problem. Since the update to version 3.10.0 I observe on several machines the following error message repeated during the day many times: WARNING: cannot connect to checkip.dyndns.org:80 socket: IO::Socket::INET: Bad hostname 'checkip.dyndns.org' WARNING: found neither IPv4 nor IPv6 address WARNING: cannot connect to api.xxx.com:80 socket: IO::Socket::INET: Bad hostname 'api.xxx.com' FAILED: updating <hostname>: Could not connect to api.xxx.com. On the machines that produced a lot of such error messages I updated ddclient to version 3.11.2 and now the error messages are gone. I'm therefore ditching ddclient 3.10.0 from all my Leap 15.6 installations replacing it with ddclient 3.11.2. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232596] New: VUL-0: CVE-2024-50602: vtk: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232596 Bug ID: 1232596 Summary: VUL-0: CVE-2024-50602: vtk: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: stefan.bruens(a)rwth-aachen.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232605] New: VUL-0: CVE-2024-50602: SimGear: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232605 Bug ID: 1232605 Summary: VUL-0: CVE-2024-50602: SimGear: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: stefan.bruens(a)rwth-aachen.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232612] New: VUL-0: CVE-2024-50602: Coin,Coin4: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232612 Bug ID: 1232612 Summary: VUL-0: CVE-2024-50602: Coin,Coin4: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: stefan.bruens(a)rwth-aachen.de Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232580] VUL-0: CVE-2024-50602: xsd: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232580 https://bugzilla.suse.com/show_bug.cgi?id=1232580#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1232580) was mentioned in https://build.opensuse.org/request/show/1219581 Factory / xsd https://build.opensuse.org/request/show/1219582 Backports:SLE-15-SP5 / xsd https://build.opensuse.org/request/show/1219583 Backports:SLE-15-SP6 / xsd -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231686] AusweisApp and AusweisApp2 broken with OpenSSL 3.3
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231686 https://bugzilla.suse.com/show_bug.cgi?id=1231686#c12 OpenSSL Maintainers <openssl-maintainers(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(openssl-maintaine | |rs(a)suse.de) | CC| |meissner(a)suse.com --- Comment #12 from OpenSSL Maintainers <openssl-maintainers(a)suse.de> --- (In reply to John Paul Adrian Glaubitz from comment #11) > This is something the OpenSSL maintainers need to comment on. Hi, We blocked non approved EC curves for the FIPS 140-3 certification round in the context of bsc#1221786 and we would like to keep the code as is. I'm adding also Marcus in CC also to see if we could relax this in Factory. Otherwise, I think we could follow the same approach as Fedora, this is using the patch [0] mentioned in comment#8. Regarding the openssl-3 versions in Factory, we do have version 3.1.7 at this moment and the version 3.2.3 is about to be released. Once this one is out, we'll move to 3.3.2 asap. [0] https://src.fedoraproject.org/rpms/AusweisApp2/blob/rawhide/f/AusweisApp2-2… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232581] New: VUL-0: CVE-2024-50602: seamonkey: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232581 Bug ID: 1232581 Summary: VUL-0: CVE-2024-50602: seamonkey: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: psychonaut(a)nothingisreal.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232567] With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 https://bugzilla.suse.com/show_bug.cgi?id=1232567#c7 --- Comment #7 from Larry Rainey <llrainey15(a)gmail.com> --- Confirmed - it is fixed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231686] AusweisApp and AusweisApp2 broken with OpenSSL 3.3
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231686 https://bugzilla.suse.com/show_bug.cgi?id=1231686#c11 John Paul Adrian Glaubitz <adrian.glaubitz(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |openssl-maintainers(a)suse.de Flags| |needinfo?(openssl-maintaine | |rs(a)suse.de) --- Comment #11 from John Paul Adrian Glaubitz <adrian.glaubitz(a)suse.com> --- This is something the OpenSSL maintainers need to comment on. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232567] With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 https://bugzilla.suse.com/show_bug.cgi?id=1232567#c6 --- Comment #6 from René Neumaier <r.neumaier(a)mailbox.org> --- Same here, it's working fine with 132.0-lp156.5.1. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231686] AusweisApp and AusweisApp2 broken with OpenSSL 3.3
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231686 https://bugzilla.suse.com/show_bug.cgi?id=1231686#c10 --- Comment #10 from Klitzing <aklitzing(a)gmail.com> --- (In reply to Michael Hirmke from comment #9) > So this has be fixed in openSUSE, nothing I could do? I wouldn't call it "fixed". :-) That patch breaks correct openssl API. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232567] New: With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 Bug ID: 1232567 Summary: With Firefox 132 cannot download files - firefox is from mozilla repo Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Major Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: llrainey15(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Had to rollback to 131.0.3 to download files. It acts like it is downloading but nothing happens. easy to test - just go to any repo and try to download an rpm file - nothing happens. -- You are receiving this mail because: You are on the CC list for the bug.

1 1