October 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1231686] AusweisApp and AusweisApp2 broken with OpenSSL 3.3
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231686 https://bugzilla.suse.com/show_bug.cgi?id=1231686#c10 --- Comment #10 from Klitzing <aklitzing(a)gmail.com> --- (In reply to Michael Hirmke from comment #9) > So this has be fixed in openSUSE, nothing I could do? I wouldn't call it "fixed". :-) That patch breaks correct openssl API. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232567] New: With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 Bug ID: 1232567 Summary: With Firefox 132 cannot download files - firefox is from mozilla repo Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Major Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: llrainey15(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Had to rollback to 131.0.3 to download files. It acts like it is downloading but nothing happens. easy to test - just go to any repo and try to download an rpm file - nothing happens. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1231686] AusweisApp and AusweisApp2 broken with OpenSSL 3.3
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231686 https://bugzilla.suse.com/show_bug.cgi?id=1231686#c9 --- Comment #9 from Michael Hirmke <opensuse(a)mike.franken.de> --- (In reply to Klitzing from comment #8) > Looks like you used a patch [1] from Fedora project. That patch will disable > raw EC API of openssl. The only work-around is to use legacy openssl API [2] > as Fedora does. This will do the same but with legacy API as the "security > patch" of openssl disables new API only. > > The AusweisApp CANNOT change that as this EC usage is a defined protocol > with server, app and identity card. > > > See Fedora bug report 2259403 [3] for this. > > > [1] > https://build.opensuse.org/projects/security:tls/packages/openssl-3/files/ > openssl-Disable-explicit-ec.patch?expand=1 > > [2] > https://src.fedoraproject.org/rpms/AusweisApp2/blob/rawhide/f/AusweisApp2-2. > 0.1-use-legacy-openssl-api.patch > > [3] https://bugzilla.redhat.com/show_bug.cgi?id=2259403 So this has be fixed in openSUSE, nothing I could do? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231806] Thunderbird has wrong icon within Wayland
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231806 https://bugzilla.suse.com/show_bug.cgi?id=1231806#c10 --- Comment #10 from Magnitude <firnefex(a)gmail.com> --- (In reply to Frank Krüger from comment #9) > (In reply to Magnitude from comment #7) > > I have the same problem. > > > > > > "WAYLAND_DEBUG=1 thunderbird |& grep app_id" shows me an empty line. > > If I change /usr/share/applications/thunderbird.desktop to > > .../thunderbird-esr.desktop, Thunderbird loses its icon, but the Wayland > > icon is still there. > > > > > > So there must be another solution. > > Have you closed TB before checking from the command line? In fact not, thanks. :-) I tried it again with changing to -esr.dektop, relogged, opened Thunderbird from Krunner (Link in taskbar broken), have detached that white Symbol from the taskbar and pinned the newly opened Thunderbird. Now it works. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232598] New: VUL-0: CVE-2024-50602: gammaray: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232598 Bug ID: 1232598 Summary: VUL-0: CVE-2024-50602: gammaray: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: christophe(a)krop.fr Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1232567] With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 https://bugzilla.suse.com/show_bug.cgi?id=1232567#c4 René Neumaier <r.neumaier(a)mailbox.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |r.neumaier(a)mailbox.org --- Comment #4 from René Neumaier <r.neumaier(a)mailbox.org> --- Can confirm for multiple Leap 15.6 installations from "http://download.opensuse.org/repositories/mozilla/openSUSE_Leap_15.6/". Download is not starting after clicking a link, while files which can be "opened inside Firefox" are working. For example PDFs. If you do a right click on a PDF-Link and choose "Save Link As..." nothing happens like with *.iso *.rpm etc. It seems like a download manager or "file plugin/connection/handler"? issue to me. Just for the sake of completeness: Gnome 45.3 here. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232567] With Firefox 132 cannot download files - firefox is from mozilla repo
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232567 https://bugzilla.suse.com/show_bug.cgi?id=1232567#c3 --- Comment #3 from Wolfgang Rosenauer <wolfgang(a)rosenauer.org> --- New package underway in the mozilla repo. Please feel free to update as soon as it's available. It hasn't built for all versions yet. It fixed the issue for me but is not the REAL fix because I removed two patches temporarily which apparently caused the issue and I need to carefully review them why they broke things. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226021] New: VUL-0: CVE-2024-5171: chromium: libaom: heap buffer overflow in img_alloc_helper() caused by integer overflow
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1226021 Bug ID: 1226021 Summary: VUL-0: CVE-2024-5171: chromium: libaom: heap buffer overflow in img_alloc_helper() caused by integer overflow Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/408840/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Andreas.Stieger(a)gmx.de Reporter: rfrohl(a)suse.com QA Contact: qa-bugs(a)suse.de CC: coldpool(a)suse.de, rfrohl(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Depends on: 1226020 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1226020 +++ Integer overflow in libaom internal function img_alloc_helper can lead to heap buffer overflow. This function can be reached via 3 callers: * Calling aom_img_alloc() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_wrap() with a large value of the d_w, d_h, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. * Calling aom_img_alloc_with_border() with a large value of the d_w, d_h, align, size_align, or border parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned aom_image_t struct may be invalid. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-5171 https://www.cve.org/CVERecord?id=CVE-2024-5171 https://issues.chromium.org/issues/332382766 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1231686] AusweisApp and AusweisApp2 broken with OpenSSL 3.3
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1231686 https://bugzilla.suse.com/show_bug.cgi?id=1231686#c8 Klitzing <aklitzing(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aklitzing(a)gmail.com --- Comment #8 from Klitzing <aklitzing(a)gmail.com> --- Looks like you used a patch [1] from Fedora project. That patch will disable raw EC API of openssl. The only work-around is to use legacy openssl API [2] as Fedora does. This will do the same but with legacy API as the "security patch" of openssl disables new API only. The AusweisApp CANNOT change that as this EC usage is a defined protocol with server, app and identity card. See Fedora bug report 2259403 [3] for this. [1] https://build.opensuse.org/projects/security:tls/packages/openssl-3/files/o… [2] https://src.fedoraproject.org/rpms/AusweisApp2/blob/rawhide/f/AusweisApp2-2… [3] https://bugzilla.redhat.com/show_bug.cgi?id=2259403 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1232603] New: VUL-0: CVE-2024-50602: chromium: libexpat: DoS via XML_ResumeParser
by bugzilla_noreply＠suse.com 30 Oct '24

30 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1232603 Bug ID: 1232603 Summary: VUL-0: CVE-2024-50602: chromium: libexpat: DoS via XML_ResumeParser Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/425799/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-50602:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: ro(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1232579 Target Milestone: --- Found By: --- Blocker: --- An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-50602 https://www.cve.org/CVERecord?id=CVE-2024-50602 https://github.com/libexpat/libexpat/pull/915 https://bugzilla.redhat.com/show_bug.cgi?id=2321987 -- You are receiving this mail because: You are on the CC list for the bug.

1 3