October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1232643] New: VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232643 Bug ID: 1232643 Summary: VUL-0: CVE-2024-50602: giada: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: edogawa(a)aon.at Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de CC: andrea.mattiazzo(a)suse.com, security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1232611 +++ An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 The packages below are or contain embedded packages that are vulnerable to CVE-2024-50602. Tracking as affected: - openSUSE:Factory/giada contains embedded package: libexpat (R_2_1_0-26-gb3a467e) Please consider version bumping or patching the affected dependencies. The listed codestreams are affected. All other codestreams should not be affected, but feel free to double-check. This is a auto-generated message, please reach out to the reporter directly if you think this is incorrect. No bug-owner found for these packages, if the assignation is not correct feel free to re-assign. ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat/expat_external.h ./giada-1.0.0/src/deps/vst3sdk/vstgui4/vstgui/uidescription/expat/expat.h -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231800] Many problems with kernel prior 6.9 release. AMD platform.
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231800 https://bugzilla.suse.com/show_bug.cgi?id=1231800#c36 Anthony Iliopoulos <ailiopoulos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo? | --- Comment #36 from Anthony Iliopoulos <ailiopoulos(a)suse.com> --- (In reply to Sławomir Lach from comment #35) > > uname -a > Linux localhost.localdomain 6.11.5-1-default #1 SMP PREEMPT_DYNAMIC Wed Oct > 23 04:27:11 UTC 2024 (b4e3aa9) x86_64 x86_64 x86_64 GNU/Linux > > So OpenSUSE team release a fixed version of kernel currently? Yes, it always reflects the upstream stable kernel, and given that the fix was included in the v6.11.4 stable release, it is already in TW. You can check the kernel package changelog and look for the related fix subject line (rpm -q --changelog kernel-default | less). The patch is at [1]. [1] https://github.com/openSUSE/kernel-source/blob/stable/patches.kernel.org/6.… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227420] openSUSE missing fi keymap vs. fi-kotoistus
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227420 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jarkko.torvinen@i | |ki.fi), | |needinfo?(lassi.vaatamoinen | |(a)gmail.com) | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227420] openSUSE missing fi keymap vs. fi-kotoistus
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227420 https://bugzilla.suse.com/show_bug.cgi?id=1227420#c31 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #31 from Stefan Dirsch <sndirsch(a)suse.com> --- Closing. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227420] openSUSE missing fi keymap vs. fi-kotoistus
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1227420 https://bugzilla.suse.com/show_bug.cgi?id=1227420#c30 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS Priority|P5 - None |P3 - Medium --- Comment #30 from Stefan Dirsch <sndirsch(a)suse.com> --- Let's assume my patch fixes this issue. Fix is now submitted to factory/Tumbleweed. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231800] Many problems with kernel prior 6.9 release. AMD platform.
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231800 https://bugzilla.suse.com/show_bug.cgi?id=1231800#c34 Anthony Iliopoulos <ailiopoulos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(slawek(a)lach.art.p | |l) | Status|NEW |IN_PROGRESS --- Comment #34 from Anthony Iliopoulos <ailiopoulos(a)suse.com> --- (In reply to Sławomir Lach from comment #33) > Backup done. > > So, if I understood, I should debug case of remounting fs to read only mode? > But how to debug this case? Should I wrote 'echo c > /proc/sysrq-trigger' > into terminal? How to detect case, when it occur? Should I listen some > udiskctl dbus signal? So according to your comment #32 everything works as expected when the amd_sfh module is blacklisted. Presumably this is causing memory corruptions (comment #17). The amd_sfh fix [1] landed on v6.11.4 and the commit message mentions: "resolve memory errors, page faults, btrfs going read-only, and btrfs disk corruption." Thus my recommendation would be to update to v6.11.5, remove amd_sfh from the blacklist, and see how it goes. [1] commit c56f9ecb7fb6 ("HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()") -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232567] With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 https://bugzilla.suse.com/show_bug.cgi?id=1232567#c8 Frank Krüger <fkrueger(a)mailbox.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fkrueger(a)mailbox.org --- Comment #8 from Frank Krüger <fkrueger(a)mailbox.org> --- Fixed for Tumbleweed as well. Thx. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229570] python3-pygit2 broken due to runtime requirement on unsatisfied cffi version
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1229570 https://bugzilla.suse.com/show_bug.cgi?id=1229570#c5 --- Comment #5 from Nathan Cutler <ncutler(a)suse.com> --- (In reply to Nathan Cutler from comment #4) > I'm thinking how to solve this problem, and the only solution that occurs to > me is to build and ship python311-pygit2. That will then require > python311-cffi which is in the Python 3 module at version 1.15.1. Ah, but even that won't be enough to meet the requirement: Requirement.parse('cffi>=1.16.0'), {'pygit2'}) So the first thing would be to land an update of python311-cffi in the Python 3 module, but even that will probably require an ECO (back to Comment 1). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204842] [trackerbug] lxc 5.0.1 update
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1204842 https://bugzilla.suse.com/show_bug.cgi?id=1204842#c4 --- Comment #4 from Marcus Meissner <meissner(a)suse.com> --- openSUSE-SU-2024:0342-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 1204842,1206779 CVE References: CVE-2022-47952 JIRA References: Sources used: openSUSE Backports SLE-15-SP6 (src): lxc-6.0.2-bp156.2.3.1 openSUSE Backports SLE-15-SP5 (src): lxc-6.0.2-bp155.4.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1230414] kernel: reproducible builds issue with BTF
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1230414 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS -- You are receiving this mail because: You are on the CC list for the bug.

1 0