October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1190048] VUL-1: CVE-2021-34434: mosquitto: Existing subscriptions for that client are not revoked
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1190048 https://bugzilla.suse.com/show_bug.cgi?id=1190048#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1190048) was mentioned in https://build.opensuse.org/request/show/1219728 Backports:SLE-15-SP5 / mosquitto -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232489] YaST NTP Configuration generates improper Transmit Timestamp values in tcpdump
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232489 https://bugzilla.suse.com/show_bug.cgi?id=1232489#c8 --- Comment #8 from Steven Mishos <smishos(a)flyzipper.com> --- (In reply to Reinhard Max from comment #7) > This might better be discussed with upstream. Is that something I should do, or a suggestion for the chrony maintainer? It may be chrony working as designed, but the way it's implemented in Tumbleweed could be leading to the observed behaviour -- which could therefore be resolved with a different Tumbleweed config. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232489] YaST NTP Configuration generates improper Transmit Timestamp values in tcpdump
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232489 https://bugzilla.suse.com/show_bug.cgi?id=1232489#c7 --- Comment #7 from Reinhard Max <max(a)suse.com> --- This might better be discussed with upstream. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232642] New: VUL-0: CVE-2024-48241: radare2: out-of-bounds write in libbf.c due to a possible integer overflow when performing memory allocation
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232642 Bug ID: 1232642 Summary: VUL-0: CVE-2024-48241: radare2: out-of-bounds write in libbf.c due to a possible integer overflow when performing memory allocation Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/426338/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: daniel(a)molkentin.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-48241 https://www.cve.org/CVERecord?id=CVE-2024-48241 https://github.com/St-Andrews-Bug-Busters/Vuln_info/blob/main/radare2/CVE-2… https://github.com/radareorg/radare2/issues/23317 https://github.com/radareorg/radare2/pull/23318 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1232643] VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232643 SMASH SMASH <smash_bz(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232603] VUL-0: CVE-2024-50602: chromium: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232603 https://bugzilla.suse.com/show_bug.cgi?id=1232603#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WORKSFORME CC| |Andreas.Stieger(a)gmx.de Status|NEW |RESOLVED --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- It is shipped in the tarball but not used during the build, we use the system library (which itself is not patched), Chromium regularly bumps the version in the tarball so we should be fine. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232550] superlu: build fails with --nocheck
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232550 https://bugzilla.suse.com/show_bug.cgi?id=1232550#c5 Christoph G <foss(a)grueninger.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #5 from Christoph G <foss(a)grueninger.de> --- Then it is my lack of understanding OBS. Thanks for the fix, closing this ticket. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227364] trackerbug: packages build differently without %check
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227364 Bug 1227364 depends on bug 1232550, which changed state. Bug 1232550 Summary: superlu: build fails with --nocheck https://bugzilla.suse.com/show_bug.cgi?id=1232550 What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232489] YaST NTP Configuration generates improper Transmit Timestamp values in tcpdump
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232489 https://bugzilla.suse.com/show_bug.cgi?id=1232489#c6 --- Comment #6 from Steven Mishos <smishos(a)flyzipper.com> --- (In reply to Stefan Hundhammer from comment #5) > So this is very likely not a problem at all. > But maybe the chrony maintainer are still interested. Perhaps, but unless there's a good reason for those random transmit timestamps, they may create unnecessary confusion for people who look at network traces even if they don't negatively affect the system. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232611] VUL-0: CVE-2024-50602: gama: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232611 https://bugzilla.suse.com/show_bug.cgi?id=1232611#c2 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-0: CVE-2024-50602: |VUL-0: CVE-2024-50602: |gama,giada: libexpat: DoS |gama: libexpat: DoS via |via XML_ResumeParser |XML_ResumeParser Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #2 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- https://build.opensuse.org/request/show/1219709 -- You are receiving this mail because: You are on the CC list for the bug.

1 0