April 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1213446] New: connecting dock station network enables wifi - reverse behaviour
by bugzilla_noreply＠suse.com 10 Oct '24

10 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1213446 Bug ID: 1213446 Summary: connecting dock station network enables wifi - reverse behaviour Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: dpbasti(a)wp.pl QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On Dell XPS 9700 I have a Dell WD19 dock. It used to work fine. Now when I have e dock station connected with the cable there WIFI is disabled as it should When I unplug Ethernet cable from the dock the wifi remains OFF and RFKILL shows hard block. When I plug the Ethernet cable back to the dock the wifi comes up for 2-3 seconds and sets up a connection and then I get e message that wifi gets disabled and connection is switched back to Ethernet. It used to work fine that unplugging the cable from dock would bring the wifi up. So having a dock station it is not possible to disconnect its ethernet and have laptop enable Wifi. It works ok in Ubuntu. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1218125] New: cmake outdated
by bugzilla_noreply＠suse.com 09 Oct '24

09 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1218125 Bug ID: 1218125 Summary: cmake outdated Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- All SLE service packs have a cmake except SP5, current version in Leap is 3.20, some projects insist on more recent version like 3.23, Factory has 3.27. Sounds like it's time to upgrade cmake again. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1217747] New: colord: reproducible builds: icc varies from CPU
by bugzilla_noreply＠suse.com 08 Oct '24

08 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1217747 Bug ID: 1217747 Summary: colord: reproducible builds: icc varies from CPU Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://github.com/omgovich/colord/issues/122 OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: gnome-bugs(a)suse.de Blocks: 1100677 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for ALP+openSUSE, I found that our colord package varied from differences in .icc files caused by differences in build machine CPU capabilities (probably AVX) Also filed upstream at https://github.com/omgovich/colord/issues/122 but they seem inactive. You find a reproducer and more details there. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1219525] New: Notification on successful transactional-update is not persistent
by bugzilla_noreply＠suse.com 05 Oct '24

05 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1219525 Bug ID: 1219525 Summary: Notification on successful transactional-update is not persistent Classification: openSUSE Product: openSUSE Kalpa Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Transactional Update Assignee: sfalken(a)cloverleaf-linux.org Reporter: sfalken(a)cloverleaf-linux.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On Kalpa, transactional-update-notifier does operate correctly on Kalpa, but it pops up when run, and only survives as long as the delay set in `System Settings->Notifications->Hide After` is set to. This isn't the intended behavior, the notification should be persistent, so the user is aware that an update has been applied, and can choose whether to reboot or not -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1219803] New: Lenovo Yoga 14APH8 headphones jack requires bass speaker to be full volume
by bugzilla_noreply＠suse.com 05 Oct '24

05 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1219803 Bug ID: 1219803 Summary: Lenovo Yoga 14APH8 headphones jack requires bass speaker to be full volume Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: pinchon.guillaume(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Symptoms : When connecting headphones to the laptop's jack it's required to set the Bass Speaker to full volume through alsamixer otherwise we get no sound. Either that or replacing in /usr/share/alsa-card-profile/mixer/paths/analog-output-headphones.conf : [Element Bass Speaker] switch = off volume = off with : [Element Bass Speaker] switch = off volume = merge System info : Operating System: openSUSE Tumbleweed 20240209 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.114.0 Qt Version: 5.15.12 Kernel Version: 6.8.0-rc3-3.g7450939-default (64-bit) Graphics Platform: X11 Processors: 16 × AMD Ryzen 7 7840HS with Radeon 780M Graphics Memory: 27.1 Gio of RAM Graphics Processor: AMD Radeon Graphics Manufacturer: LENOVO Product Name: 82Y8 System Version: Yoga Pro 7 14APH8 hwinfo --sound : 12: PCI 6300.1: 0403 Audio device [Created at pci.386] Unique ID: UGCg.OQPqPLYNCh0 Parent ID: JZZT.maS73mB38XF SysFS ID: /devices/pci0000:00/0000:00:08.1/0000:63:00.1 SysFS BusID: 0000:63:00.1 Hardware Class: sound Model: "ATI Audio device" Vendor: pci 0x1002 "ATI Technologies Inc" Device: pci 0x1640 SubVendor: pci 0x17aa "Lenovo" SubDevice: pci 0x3824 Driver: "snd_hda_intel" Driver Modules: "snd_hda_intel" Memory Range: 0x785c8000-0x785cbfff (rw,non-prefetchable) IRQ: 90 (no events) Module Alias: "pci:v00001002d00001640sv000017AAsd00003824bc04sc03i00" Driver Info #0: Driver Status: snd_hda_intel is active Driver Activation Cmd: "modprobe snd_hda_intel" Config Status: cfg=new, avail=yes, need=no, active=unknown Attached to: #27 (PCI bridge) 22: PCI 6300.6: 0403 Audio device [Created at pci.386] Unique ID: puer.m6xb4yIjnP9 Parent ID: JZZT.maS73mB38XF SysFS ID: /devices/pci0000:00/0000:00:08.1/0000:63:00.6 SysFS BusID: 0000:63:00.6 Hardware Class: sound Model: "AMD Family 17h (Models 10h-1fh) HD Audio Controller" Vendor: pci 0x1022 "AMD" Device: pci 0x15e3 "Family 17h (Models 10h-1fh) HD Audio Controller" SubVendor: pci 0x17aa "Lenovo" SubDevice: pci 0x3882 Driver: "snd_hda_intel" Driver Modules: "snd_hda_intel" Memory Range: 0x785c0000-0x785c7fff (rw,non-prefetchable) IRQ: 43 (327 events) Module Alias: "pci:v00001022d000015E3sv000017AAsd00003882bc04sc03i00" Driver Info #0: Driver Status: snd_hda_intel is active Driver Activation Cmd: "modprobe snd_hda_intel" Config Status: cfg=new, avail=yes, need=no, active=unknown Attached to: #27 (PCI bridge) -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1223269] New: VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in libavcodec/jpegxl_parser.c
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1223269 Bug ID: 1223269 Summary: VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in libavcodec/jpegxl_parser.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/402764/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map. References: https://ffmpeg.org/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51791 https://www.cve.org/CVERecord?id=CVE-2023-51791 https://trac.ffmpeg.org/ticket/10738 https://bugzilla.redhat.com/show_bug.cgi?id=2276114 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223276] New: VUL-0: CVE-2023-51797: ffmpeg: buffer overflow in the showwaves_filter_frame function in libavfilter/avf_showwaves.c
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1223276 Bug ID: 1223276 Summary: VUL-0: CVE-2023-51797: ffmpeg: buffer overflow in the showwaves_filter_frame function in libavfilter/avf_showwaves.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/402769/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame References: https://github.com/FFmpeg/FFmpeg https://ffmpeg.org/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51797 https://www.cve.org/CVERecord?id=CVE-2023-51797 https://trac.ffmpeg.org/ticket/10756 https://bugzilla.redhat.com/show_bug.cgi?id=2276120 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1215701] New: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1215701 Bug ID: 1215701 Summary: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/379815/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: rfrohl(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40581 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1222859] New: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1222859 Bug ID: 1222859 Summary: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401694/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mia(a)0x0.st Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32019 https://www.cve.org/CVERecord?id=CVE-2024-32019 https://github.com/netdata/netdata/pull/17377 https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93 https://bugzilla.redhat.com/show_bug.cgi?id=2274984 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1214211] New: "Loading basic drivers" is printed twice on the screen when loading installation system
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1214211 Bug ID: 1214211 Summary: "Loading basic drivers" is printed twice on the screen when loading installation system Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: dheidler(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 868778 --> https://bugzilla.suse.com/attachment.cgi?id=868778&action=edit screenshot Something like this is printed: Loading basic drivers...Loading basic drivers ok Expected: Loading basic drivers... ok -- You are receiving this mail because: You are on the CC list for the bug.

1 4