May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1216403] VUL-0: CVE-2023-46009: gifsicle: floating point exception vulnerability via resize_stream at src/xform.c
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1216403 https://bugzilla.suse.com/show_bug.cgi?id=1216403#c5 --- Comment #5 from Manfred Schwarb <manfred99(a)gmx.ch> --- Or do you mean Leap 15.5? Yes, I did no maintenance request for Leap 15.5, as the mentioned bug seemed not terribly crucial to me. But backporting would be fine by me. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1216403] VUL-0: CVE-2023-46009: gifsicle: floating point exception vulnerability via resize_stream at src/xform.c
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1216403 https://bugzilla.suse.com/show_bug.cgi?id=1216403#c4 --- Comment #4 from Manfred Schwarb <manfred99(a)gmx.ch> --- Hmm, there was https://build.opensuse.org/request/show/1152098 and so the version 1.95 does appear in the in the "Inherited packages" section of https://build.opensuse.org/project/show/openSUSE:Leap:15.6#tab-pane-inherit… I'm surprised that version 1.95 should be missing in Leap 15.6 ? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225526] Tumbleweed KDE install does not include terminus-bitmap fonts or set /etc/vconsole.conf properly on hiDPI systems
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225526 Christophe Marin <christophe(a)krop.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Installation |Patterns QA Contact|jsrain(a)suse.com |qa-bugs(a)suse.de Assignee|yast2-maintainers(a)suse.de |dimstar(a)opensuse.org -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224165] AUDIT-0: openSUSE Leap 15.6 Gold Master security audit
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224165 https://bugzilla.suse.com/show_bug.cgi?id=1224165#c4 --- Comment #4 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- See bugs linked to bug 1224165. We should not ship security regressions. Also bug 1225540 for version downgrades. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1217153] VUL-0: CVE-2023-46121: yt-dlp: MITM from yt-dlp's HTTP session
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217153 https://bugzilla.suse.com/show_bug.cgi?id=1217153#c2 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Andreas.Stieger(a)gmx.de Blocks| |1225537 --- Comment #2 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Missing in Leap 15.6. Please process incoming submission or fix in Leap 15.6 in your chosen way. (bug 1225537) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222594] VUL-0: CVE-2024-3120: sngrep: stack-buffer overflow due to inadequate bounds checking when copying 'Content-Length' and 'Warning' headers into fixed-size buffers
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222594 https://bugzilla.suse.com/show_bug.cgi?id=1222594#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Andreas.Stieger(a)gmx.de Blocks| |1225537 --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Missing in Leap 15.6. Please process incoming submission or fix in Leap 15.6 in your chosen way. (bug 1225537) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222593] VUL-0: CVE-2024-3119: sngrep: buffer overflow due to improper handling of 'Call-ID' and 'X-Call-ID' SIP headers
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222593 https://bugzilla.suse.com/show_bug.cgi?id=1222593#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Andreas.Stieger(a)gmx.de Blocks| |1225537 --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Missing in Leap 15.6. Please process incoming submission or fix in Leap 15.6 in your chosen way. (bug 1225537) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1216429] VUL-0: CVE-2023-46267: roundcube: XSS via a text/html e-mail message containing an SVG image with a USE element
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1216429 https://bugzilla.suse.com/show_bug.cgi?id=1216429#c4 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Andreas.Stieger(a)gmx.de Blocks| |1225537 --- Comment #4 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Missing in Leap 15.6. Please process incoming submission or fix in Leap 15.6 in your chosen way. (bug 1225537) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1216403] VUL-0: CVE-2023-46009: gifsicle: floating point exception vulnerability via resize_stream at src/xform.c
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1216403 https://bugzilla.suse.com/show_bug.cgi?id=1216403#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FIXED |--- CC| |Andreas.Stieger(a)gmx.de Blocks| |1225537 --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Reopening: Missing in Leap 15.6. Please process incoming submission or fix in Leap 15.6 in your chosen way. (bug 1225537) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223420] VUL-0: CVE-2024-31755: cJSON: NULL pointer dereference via cJSON_SetValuestring()
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223420 https://bugzilla.suse.com/show_bug.cgi?id=1223420#c4 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1225537 --- Comment #4 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- (In reply to Andreas Stieger from comment #2) > Please process https://build.opensuse.org/request/show/1176529 Still missing in Leap 15.6. Please process. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1217918] VUL-0: tor: UAF and NULL pointer dereference crash on Exit relays (TROVE-2023-007)
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1217918 https://bugzilla.suse.com/show_bug.cgi?id=1217918#c4 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Assignee|security-team(a)suse.de |bwiedemann(a)suse.com Resolution|FIXED |--- Blocks| |1225537 --- Comment #4 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Reopening: Missing in Leap 15.6. Please process incoming submission or fix in Leap 15.6 in your chosen way. (bug 1225537) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224165] AUDIT-0: openSUSE Leap 15.6 Gold Master security audit
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224165 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1225537 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225526] Tumbleweed KDE install does not include terminus-bitmap fonts or set /etc/vconsole.conf properly on hiDPI systems
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225526 https://bugzilla.suse.com/show_bug.cgi?id=1225526#c4 --- Comment #4 from Eric Benton <erbenton(a)comcast.net> --- Well,it seems to me if the laptop or pc screen resolution and dpi is properly detected, which should be a simple task, a decision can easily be made, no? The terminus-bitmap font can be installed by default - that's easy enough, then the selected font to use in /etc/vconsole.conf can be determined by the screen resolution. I guess I don't see a blocking issue to resolving this, which is going to help out a lot of people and will need to be dealt with sooner or later as hi res screens become more and more prevalent. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225536] New: latest ICU headers fails when compiling against them:
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225536 Bug ID: 1225536 Summary: latest ICU headers fails when compiling against them: Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: jengelh(a)inai.de Reporter: mrueckert(a)suse.com QA Contact: qa-bugs(a)suse.de CC: qzhao(a)suse.com Target Milestone: --- Found By: --- Blocker: --- https://build.opensuse.org/package/live_build_log/home:darix:apps/rubygem-c… ``` compiling transliterator.cpp cc1plus: warning: command-line option ‘-std=gnu99’ is valid for C/ObjC but not for C++ In file included from /usr/include/unicode/unistr.h:39, from /usr/include/unicode/translit.h:27, from transliterator.cpp:5: /usr/include/unicode/stringpiece.h:133:29: error: ‘enable_if_t’ in namespace ‘std’ does not name a template type 133 | typename = std::enable_if_t< | ^~~~~~~~~~~ /usr/include/unicode/stringpiece.h:133:24: note: ‘std::enable_if_t’ is only available from C++14 onwards 133 | typename = std::enable_if_t< | ^~~ /usr/include/unicode/stringpiece.h:133:40: error: expected ‘>’ before ‘<’ token 133 | typename = std::enable_if_t< | ^ In file included from /usr/include/unicode/uenum.h:25, from /usr/include/unicode/utrans.h:22, from /usr/include/unicode/translit.h:29: /usr/include/unicode/localpointer.h:561:26: error: parameter declared ‘auto’ 561 | template <typename Type, auto closeFunction> | ^~~~ /usr/include/unicode/localpointer.h:573:76: error: template argument 2 is invalid 573 | explicit LocalOpenPointer(std::unique_ptr<Type, decltype(closeFunction)> &&p) | ^ /usr/include/unicode/localpointer.h:583:78: error: template argument 2 is invalid 583 | LocalOpenPointer &operator=(std::unique_ptr<Type, decltype(closeFunction)> &&p) { | ^ /usr/include/unicode/localpointer.h:599:59: error: template argument 2 is invalid 599 | operator std::unique_ptr<Type, decltype(closeFunction)> () && { | ^ /usr/include/unicode/uenum.h:69:1: note: invalid template non-type parameter 69 | U_DEFINE_LOCAL_OPEN_POINTER(LocalUEnumerationPointer, UEnumeration, uenum_close); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ /usr/include/unicode/uset.h:358:1: note: invalid template non-type parameter 358 | U_DEFINE_LOCAL_OPEN_POINTER(LocalUSetPointer, USet, uset_close); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ /usr/include/unicode/utrans.h:258:1: note: invalid template non-type parameter 258 | U_DEFINE_LOCAL_OPEN_POINTER(LocalUTransliteratorPointer, UTransliterator, utrans_close); ``` -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1225526] Tumbleweed KDE install does not include terminus-bitmap fonts or set /etc/vconsole.conf properly on hiDPI systems
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225526 https://bugzilla.suse.com/show_bug.cgi?id=1225526#c3 Christophe Marin <christophe(a)krop.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|qa-bugs(a)suse.de |jsrain(a)suse.com Assignee|opensuse-kde-bugs@opensuse. |yast2-maintainers(a)suse.de |org | Component|KDE Workspace (Plasma) |Installation --- Comment #3 from Christophe Marin <christophe(a)krop.fr> --- That's also not a KDE issue. We have no reason to require this particular font. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225526] Tumbleweed KDE install does not include terminus-bitmap fonts or set /etc/vconsole.conf properly on hiDPI systems
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225526 https://bugzilla.suse.com/show_bug.cgi?id=1225526#c2 --- Comment #2 from Stefan Hundhammer <shundhammer(a)suse.com> --- First of all, what packages get installed is a matter of the software patterns. The installer (YaST) uses the patterns that the project managers provide. If they are missing something, it's not the fault of the installer. As for default console font, that might depend on a gazillion factors. A laptop screen with 4k resolution is just about the worst case scenario; of course any font that would not be insanely huge on a normal screen will be much too tiny on that setup. If you have such a setup, it might be time for some manual interaction, especially for a graphical console. How large you want your fonts to be is also a matter of personal preferences and use case. You might have to edit some config file manually. Any attempt of a one-fits-all installer automatic is bound to fail, and one or the other group of users is always going to be mad at us. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225526] Tumbleweed KDE install does not include terminus-bitmap fonts or set /etc/vconsole.conf properly on hiDPI systems
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225526 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|KDE Applications |KDE Workspace (Plasma) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225526] Tumbleweed KDE install does not include terminus-bitmap fonts or set /etc/vconsole.conf properly on hiDPI systems
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225526 https://bugzilla.suse.com/show_bug.cgi?id=1225526#c1 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|yast2-maintainers(a)suse.de |opensuse-kde-bugs@opensuse. | |org QA Contact|jsrain(a)suse.com |qa-bugs(a)suse.de Component|Installation |KDE Applications --- Comment #1 from Stefan Hundhammer <shundhammer(a)suse.com> --- This is not at all installer related. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225457] New: [Build 20240527] openQA test fails in apache2_changehat
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225457 Bug ID: 1225457 Summary: [Build 20240527] openQA test fails in apache2_changehat Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/4227639/modules/apac he2_changehat/steps/10 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor Assignee: suse-beta(a)cboltz.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation aa-teardown fails with errors like: /lib/apparmor/rc.apparmor.functions: line 259: printf: write error: No such file or directory openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-apparmor_profile@64bit fails in [apache2_changehat](https://openqa.opensuse.org/tests/4227639/modules/apache… ## Test suite description Maintained by QE Security ## Reproducible Fails since (at least) Build [20240527](https://openqa.opensuse.org/tests/4226865) ## Expected result Last good: [20240524](https://openqa.opensuse.org/tests/4221575) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1224243] virt-manager doesn't appear in "System" category in KDE's Application Launcher
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224243 https://bugzilla.suse.com/show_bug.cgi?id=1224243#c1 Charles Arnold <carnold(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #1 from Charles Arnold <carnold(a)suse.com> --- (In reply to Kostadin Shishmanov from comment #0) > The virtman-desktop.patch for virt-manager makes it not appear in KDE's > Application Launcher under the "System" category/submenu, and it has to be > searched for manually. When virt-manager is built without the patch, it > appears. > > This is a very tiny thing, and I don't know how removing the patch would > affect other DEs like GNOME and XFCE. This is fixed and should show up in a future Tumbleweed release sometime after 20240524 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224452] installing audacious pulls in -devel packages
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224452 https://bugzilla.suse.com/show_bug.cgi?id=1224452#c3 Michael Andres <ma(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |foss(a)grueninger.de --- Comment #3 from Michael Andres <ma(a)suse.com> --- Not common that the runtime package requires -devel packages. Something for the audacious package maintainer to judge. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225526] Tumbleweed KDE install does not include terminus-bitmap fonts or set /etc/vconsole.conf properly on hiDPI systems
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225526 Thorsten Kukuk <kukuk(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |kukuk(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224327] "Client hit max requests limit 1" during live migrations
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224327 https://bugzilla.suse.com/show_bug.cgi?id=1224327#c8 James Fehlig <jfehlig(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Assignee|kvm-bugs(a)suse.de |jfehlig(a)suse.com Status|NEW |RESOLVED --- Comment #8 from James Fehlig <jfehlig(a)suse.com> --- (In reply to Lin Ma from comment #7) Hi Lin, Thanks for helping with this bug while I was on vacation! > @Jim, The issue can be fixed by libvirt upstream commit b3f8e072. > Could you please help to backport it into SLE15SP5 and leap 15.5? I've added b3f8e072 to the SLE15 SP5 libvirt package and submitted it for maintenance. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225525] New: Aeon is too boring
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225525 Bug ID: 1225525 Summary: Aeon is too boring Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Base Assignee: rbrown(a)suse.com Reporter: rbrown(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Originally reported on https://www.reddit.com/r/openSUSE/s/tBiZiuVaBd /u/mwyvr reports: “I've discovered a serious problem but there's no category in Bugzilla for it. All this auto-updating and atomic-core and containerized user apps makes Aeon so much less thrilling. I've been running it for months without any hiccups. Working-as-designed. Maybe I'll write a system-breakage-simulation app just to give people some thrills, like a Pomodoro app but with tension.” -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1224369] kernel-longterm only built for x86_64
by bugzilla_noreply＠suse.com 28 May '24

28 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224369 https://bugzilla.suse.com/show_bug.cgi?id=1224369#c2 Robert Frohl <rfrohl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #2 from Robert Frohl <rfrohl(a)suse.com> --- submitted: https://build.opensuse.org/request/show/1177387 -- You are receiving this mail because: You are on the CC list for the bug.

1 0