October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1232489] YaST NTP Configuration generates improper Transmit Timestamp values in tcpdump
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232489 https://bugzilla.suse.com/show_bug.cgi?id=1232489#c7 --- Comment #7 from Reinhard Max <max(a)suse.com> --- This might better be discussed with upstream. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232642] New: VUL-0: CVE-2024-48241: radare2: out-of-bounds write in libbf.c due to a possible integer overflow when performing memory allocation
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232642 Bug ID: 1232642 Summary: VUL-0: CVE-2024-48241: radare2: out-of-bounds write in libbf.c due to a possible integer overflow when performing memory allocation Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426338/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: daniel(a)molkentin.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-48241 https://www.cve.org/CVERecord?id=CVE-2024-48241 https://github.com/St-Andrews-Bug-Busters/Vuln_info/blob/main/radare2/CVE-2… https://github.com/radareorg/radare2/issues/23317 https://github.com/radareorg/radare2/pull/23318 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1232643] VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232643 SMASH SMASH <smash_bz(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232603] VUL-0: CVE-2024-50602: chromium: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232603 https://bugzilla.suse.com/show_bug.cgi?id=1232603#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WORKSFORME CC| |Andreas.Stieger(a)gmx.de Status|NEW |RESOLVED --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- It is shipped in the tarball but not used during the build, we use the system library (which itself is not patched), Chromium regularly bumps the version in the tarball so we should be fine. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232550] superlu: build fails with --nocheck
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232550 https://bugzilla.suse.com/show_bug.cgi?id=1232550#c5 Christoph G <foss(a)grueninger.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #5 from Christoph G <foss(a)grueninger.de> --- Then it is my lack of understanding OBS. Thanks for the fix, closing this ticket. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227364] trackerbug: packages build differently without %check
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227364 Bug 1227364 depends on bug 1232550, which changed state. Bug 1232550 Summary: superlu: build fails with --nocheck https://bugzilla.suse.com/show_bug.cgi?id=1232550 What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232489] YaST NTP Configuration generates improper Transmit Timestamp values in tcpdump
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232489 https://bugzilla.suse.com/show_bug.cgi?id=1232489#c6 --- Comment #6 from Steven Mishos <smishos(a)flyzipper.com> --- (In reply to Stefan Hundhammer from comment #5) > So this is very likely not a problem at all. > But maybe the chrony maintainer are still interested. Perhaps, but unless there's a good reason for those random transmit timestamps, they may create unnecessary confusion for people who look at network traces even if they don't negatively affect the system. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227420] New: openSUSE missing fi keymap
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227420 Bug ID: 1227420 Summary: openSUSE missing fi keymap Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: jarkko.torvinen(a)iki.fi QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On Tumbleweed installer, when selecting keyboard "Finnish", it results in "fi-kotoistus" in /etc/vconsole.conf. Gnome is not aware of such layout, resulting in non-working keymap in Gnome desktop, gnome-settings listing input source as "fi+kotoistus", and you need to change it to "Finnish" or "Finnish (classic)" to have working keyboard. On Aeon, keyboard selection is done with gnome initial setup. It has options "Finnish" and "Finnish (classic)" (as above with TW gnome-settins). 1) "Finnish" results in "fi" in /etc/vconsole.conf, but fi.map.gz does not exist in openSUSE, resulting in failing unit systemd-vconsole-setup 2) "Finnish (classic)" results in "fi-classic" in /etc/vconsole.conf, and everything works fine So both TW and Aeon are broken if you simply select obvious choices "Finnish". TW in GNOME, Aeon in form of failing unit during boot. On TW, selecting "Finnish" does not alter /etc/vconsole.conf anymore, so it does not break it, only initial setup with Aeon. Other distros (Debian,Arch for example) ship with "fi" map, and works as should. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232611] VUL-0: CVE-2024-50602: gama: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232611 https://bugzilla.suse.com/show_bug.cgi?id=1232611#c2 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-0: CVE-2024-50602: |VUL-0: CVE-2024-50602: |gama,giada: libexpat: DoS |gama: libexpat: DoS via |via XML_ResumeParser |XML_ResumeParser Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #2 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- https://build.opensuse.org/request/show/1219709 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232643] New: VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232643 Bug ID: 1232643 Summary: VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: edogawa(a)aon.at Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: andrea.mattiazzo(a)suse.com, security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1232611 +++ An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 The packages below are or contain embedded packages that are vulnerable to CVE-2024-50602. Tracking as affected: - openSUSE:Factory/giada contains embedded package: libexpat (R_2_1_0-26-gb3a467e) Please consider version bumping or patching the affected dependencies. The listed codestreams are affected. All other codestreams should not be affected, but feel free to double-check. This is a auto-generated message, please reach out to the reporter directly if you think this is incorrect. No bug-owner found for these packages, if the assignation is not correct feel free to re-assign. ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat/expat_external.h ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat/expat.h -- You are receiving this mail because: You are on the CC list for the bug.

1 0