May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224165] AUDIT-0: openSUSE Leap 15.6 Gold Master security audit
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224165 Bug 1224165 depends on bug 1215172, which changed state. Bug 1215172 Summary: VUL-0: croc: multiple security issues in croc https://bugzilla.suse.com/show_bug.cgi?id=1215172 What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|WONTFIX |--- -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1215172] VUL-0: croc: multiple security issues in croc
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1215172 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1224165 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225350] New: on 15.6 - old 0.79 putty shipped
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225350 Bug ID: 1225350 Summary: on 15.6 - old 0.79 putty shipped Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: abittner(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Apparently 15.6 still ships a 0.79 putty currently when I install todays RC or nearly final bits, not even the 0.80 from december 2023 made it? (CVE exists) > <https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html> thanks for updating this as soon as possible to the current 0.81 which also been released for 15.5 thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1224165] AUDIT-0: openSUSE Leap 15.6 Gold Master security audit
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224165 https://bugzilla.suse.com/show_bug.cgi?id=1224165#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1215172, 1225350 CC| |Andreas.Stieger(a)gmx.de --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Could you maybe please run at least the following easy things: * Packages that were added to openSUSE:Backports:SLE-15-SP6 but since dropped from Factory due to security issues: bug 1215172 * Packages that were updated in openSUSE:Backports:SLE-15-SP5:Update but not submitted to openSUSE:Backports:SLE-15-SP6 in the same or a newer version? Also containing known security issues like bug 1225350. These are particularity dangerous as the issues are never re-evaluated again. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1213470] timezone-java 2023c contains corrupt data for some timezones
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1213470 https://bugzilla.suse.com/show_bug.cgi?id=1213470#c28 --- Comment #28 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-SU-2024:1793-1: An update that solves four vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1213470, 1222979, 1222983, 1222984, 1222986 CVE References: CVE-2024-21011, CVE-2024-21068, CVE-2024-21085, CVE-2024-21094 Maintenance Incident: [SUSE:Maintenance:34021](https://smelt.suse.de/incident/34021/) Sources used: openSUSE Leap 15.6 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 SUSE Package Hub 15 15-SP5 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 SUSE Package Hub 15 15-SP6 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 openSUSE Leap 15.5 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225292] games:tools/steam: Bug
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225292 https://bugzilla.suse.com/show_bug.cgi?id=1225292#c4 --- Comment #4 from Dirk Stoecker <opensuse(a)dstoecker.de> --- Still looks like a false positive to me. The reported results are all Generic or Heuristic. Happens to a least one of my own software as well for freshly compiled binaries as it includes a HTTP server component. But there is a slight chance it's real. I'd suggest a) In VirusTotal was something like "report as false positive" in two forms if I remember correct. Something like "I'm the author and sure it's a false positive" and "I suspect it may be wrong". I recommend to report it as false with the second category. They will check it then and either mark it as a virus/trojan with a real name or flag it as false. b) Report it to Steam: https://github.com/ValveSoftware/Proton/issues - Again they will need more details: File names, file sizes, dates, ... The screenshot is not enough. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 998270] tumbleweed: after installation KDE won't start. Fresh install
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=998270 John Shand <jshand2013(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|NORESPONSE |INVALID -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218393] Weird screen blanking (power mgmt?) issue
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218393 https://bugzilla.suse.com/show_bug.cgi?id=1218393#c7 --- Comment #7 from Stefan Dirsch <sndirsch(a)suse.com> --- Ok. Thanks for the feedback! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225292] games:tools/steam: Bug
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225292 https://bugzilla.suse.com/show_bug.cgi?id=1225292#c3 --- Comment #3 from Argenis Mangual Velazquez <argenis(a)protonmail.com> --- Hi, I scanned the entire Proton Experimental i388 Windows directory that seems to have the malware, and it's definitively not a false positive. Though this is probably Steam's fault, and at least I cannot submit a ticket with them for this specific item for some reason. At least it would be nice for OpenSuse/Suse to know about this, it's a massive problem for those migrating from windows as that is the Proton that plays the most amount of Windows games. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225292] games:tools/steam: Bug
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225292 https://bugzilla.suse.com/show_bug.cgi?id=1225292#c2 --- Comment #2 from Argenis Mangual Velazquez <argenis(a)protonmail.com> --- Created attachment 875141 --> https://bugzilla.suse.com/attachment.cgi?id=875141&action=edit Virustotal scan of the Proton Experimental i386 windows folder It's definitively not a false positive, but I'd guess this is Steam's fault not so much Opensuse, though it is a malware vector. -- You are receiving this mail because: You are on the CC list for the bug.

1 0