May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1215172] VUL-0: croc: multiple security issues in croc
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1215172 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1224165 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225350] New: on 15.6 - old 0.79 putty shipped
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225350 Bug ID: 1225350 Summary: on 15.6 - old 0.79 putty shipped Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: abittner(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Apparently 15.6 still ships a 0.79 putty currently when I install todays RC or nearly final bits, not even the 0.80 from december 2023 made it? (CVE exists) > <https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html> thanks for updating this as soon as possible to the current 0.81 which also been released for 15.5 thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1224165] AUDIT-0: openSUSE Leap 15.6 Gold Master security audit
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224165 https://bugzilla.suse.com/show_bug.cgi?id=1224165#c3 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1215172, 1225350 CC| |Andreas.Stieger(a)gmx.de --- Comment #3 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Could you maybe please run at least the following easy things: * Packages that were added to openSUSE:Backports:SLE-15-SP6 but since dropped from Factory due to security issues: bug 1215172 * Packages that were updated in openSUSE:Backports:SLE-15-SP5:Update but not submitted to openSUSE:Backports:SLE-15-SP6 in the same or a newer version? Also containing known security issues like bug 1225350. These are particularity dangerous as the issues are never re-evaluated again. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1213470] timezone-java 2023c contains corrupt data for some timezones
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1213470 https://bugzilla.suse.com/show_bug.cgi?id=1213470#c28 --- Comment #28 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-SU-2024:1793-1: An update that solves four vulnerabilities and has one security fix can now be installed. Category: security (moderate) Bug References: 1213470, 1222979, 1222983, 1222984, 1222986 CVE References: CVE-2024-21011, CVE-2024-21068, CVE-2024-21085, CVE-2024-21094 Maintenance Incident: [SUSE:Maintenance:34021](https://smelt.suse.de/incident/34021/) Sources used: openSUSE Leap 15.6 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 SUSE Package Hub 15 15-SP5 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 SUSE Package Hub 15 15-SP6 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 openSUSE Leap 15.5 (src): java-1_8_0-openj9-1.8.0.412-150200.3.45.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225292] games:tools/steam: Bug
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225292 https://bugzilla.suse.com/show_bug.cgi?id=1225292#c4 --- Comment #4 from Dirk Stoecker <opensuse(a)dstoecker.de> --- Still looks like a false positive to me. The reported results are all Generic or Heuristic. Happens to a least one of my own software as well for freshly compiled binaries as it includes a HTTP server component. But there is a slight chance it's real. I'd suggest a) In VirusTotal was something like "report as false positive" in two forms if I remember correct. Something like "I'm the author and sure it's a false positive" and "I suspect it may be wrong". I recommend to report it as false with the second category. They will check it then and either mark it as a virus/trojan with a real name or flag it as false. b) Report it to Steam: https://github.com/ValveSoftware/Proton/issues - Again they will need more details: File names, file sizes, dates, ... The screenshot is not enough. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 998270] tumbleweed: after installation KDE won't start. Fresh install
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=998270 John Shand <jshand2013(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|NORESPONSE |INVALID -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218393] Weird screen blanking (power mgmt?) issue
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218393 https://bugzilla.suse.com/show_bug.cgi?id=1218393#c7 --- Comment #7 from Stefan Dirsch <sndirsch(a)suse.com> --- Ok. Thanks for the feedback! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225292] games:tools/steam: Bug
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225292 https://bugzilla.suse.com/show_bug.cgi?id=1225292#c3 --- Comment #3 from Argenis Mangual Velazquez <argenis(a)protonmail.com> --- Hi, I scanned the entire Proton Experimental i388 Windows directory that seems to have the malware, and it's definitively not a false positive. Though this is probably Steam's fault, and at least I cannot submit a ticket with them for this specific item for some reason. At least it would be nice for OpenSuse/Suse to know about this, it's a massive problem for those migrating from windows as that is the Proton that plays the most amount of Windows games. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225292] games:tools/steam: Bug
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225292 https://bugzilla.suse.com/show_bug.cgi?id=1225292#c2 --- Comment #2 from Argenis Mangual Velazquez <argenis(a)protonmail.com> --- Created attachment 875141 --> https://bugzilla.suse.com/attachment.cgi?id=875141&action=edit Virustotal scan of the Proton Experimental i386 windows folder It's definitively not a false positive, but I'd guess this is Steam's fault not so much Opensuse, though it is a malware vector. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225401] New: Repositories fail, and signatures bad
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225401 Bug ID: 1225401 Summary: Repositories fail, and signatures bad Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: jamesrome(a)alum.mit.edu QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Signature verification failed for file 'repomd.xml' from repository 'update-backports (15.5)'. Continue? [yes/no] (no): Repository 'SUSE:SLE-15-SP2:GA' is invalid. [https-download.opensuse.org-041a161e|https://download.opensuse.org/repositories/SUSE:/SLE-15-SP2:/GA/pool/] Valid metadata not found at specified URL History: - [https-download.opensuse.org-041a161e|https://download.opensuse.org/repositories/SUSE:/SLE-15-SP2:/GA/pool/] Repository type can't be determined. Repository 'SUSE:SLE-15-SP5:GA' is invalid. [https-download.opensuse.org-c13b8881|https://download.opensuse.org/repositories/SUSE:/SLE-15-SP5:/GA/pool/] Valid metadata not found at specified URL History: - [https-download.opensuse.org-c13b8881|https://download.opensuse.org/repositories/SUSE:/SLE-15-SP5:/GA/pool/] Repository type can't be determined.Repository 'SUSE:SLE-15-SP3:GA' is invalid. [https-download.opensuse.org-d72f1575|https://download.opensuse.org/repositories/SUSE:/SLE-15-SP3:/GA/pool/] Valid metadata not found at specified URL History: - [https-download.opensuse.org-d72f1575|https://download.opensuse.org/repositories/SUSE:/SLE-15-SP3:/GA/pool/] Repository type can't be determined. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1208003] Support EFI 32/64 bit mixed mode (Was: installation images do not support 32-bit EFI)
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1208003 roke beedell <rokejulianlockhart+1674683091(a)outlook.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL|http://forums.opensuse.org/ |https://forums.opensuse.org |t/164192/4 |/t/32-bit-efi-support-for-x | |86-version-of-tumbleweed/16 | |4192/4 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225217] OpenSUSE TW won’t boot without the “dis_ucode_ldr” parameter
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225217 https://bugzilla.suse.com/show_bug.cgi?id=1225217#c7 --- Comment #7 from Charaf Rais <charafweb(a)gmail.com> --- on kernel 6.9 the boot hangs as always. on kernel 6.1 the system boots normally. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218393] New: Weird screen blanking (power mgmt?) issue
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218393 Bug ID: 1218393 Summary: Weird screen blanking (power mgmt?) issue Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: X.Org Assignee: gfx-bugs(a)suse.de Reporter: rs.opensuse(a)spitzenpfeil.org QA Contact: gfx-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- My screen blanks after screen power mgmt kicks in - as expected. Unfortunately the timer doesn't seem to reset. As long as I move the mouse (even after switching to a console) the screen stays on, once any screen update stops, it goes dark. Currently I to run 'xsnow' !! to keep the screen updating, so it doesn't go dark all the time. This is not fun :-( Where to look? CPU: i7-7700T Graphics: HD 630 P.S.: https://forums.opensuse.org/t/internal-lcd-of-laptop-turning-off-comes-back… -- # VERSION="20231222" ID="opensuse-tumbleweed" -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1222864] New: VUL-0: CVE-2024-31497: putty: NIST P521 private keys are exposed by biased signature generation
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222864 Bug ID: 1222864 Summary: VUL-0: CVE-2024-31497: putty: NIST P521 private keys are exposed by biased signature generation Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: Andreas.Stieger(a)gmx.de QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick lattice-based attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. One scenario is that the adversary is an operator of an SSH server to which the victim authenticates (for remote login or file copy), even though this server is not fully trusted by the victim, and the victim uses the same private key for SSH connections to other services operated by other entities. Here, the rogue server operator (who would otherwise have no way to determine the victim's private key) can derive the victim's private key, and then use it for unauthorized access to those other services. Because SSH is sometimes used to authenticate to Git services, it is possible that this vulnerability could be leveraged for supply-chain attacks on software maintained in Git. It is also conceivable that signed messages from PuTTY or Pageant are readable by adversaries more easily in other scenarios, but none have yet been disclosed. https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.… https://www.openwall.com/lists/oss-security/2024/04/15/6 https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=c193fe9848f50a88… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1223858] Cannot mount kerberized nfs4 share with kernel 5.14.21-150500.55.59-default
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223858 https://bugzilla.suse.com/show_bug.cgi?id=1223858#c16 --- Comment #16 from Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> --- SUSE-SU-2024:1787-1: An update that has three security fixes can now be installed. Category: security (important) Bug References: 1223858, 1224169, 1224340 Maintenance Incident: [SUSE:Maintenance:34010](https://smelt.suse.de/incident/34010/) Sources used: openSUSE Leap 15.5 (src): kernel-default-base-5.14.21-150500.55.65.1.150500.6.29.1, kernel-obs-build-5.14.21-150500.55.65.1, kernel-source-5.14.21-150500.55.65.1, kernel-obs-qa-5.14.21-150500.55.65.1, kernel-syms-5.14.21-150500.55.65.1, kernel-livepatch-SLE15-SP5_Update_14-1-150500.11.3.1 SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.65.1.150500.6.29.1 Basesystem Module 15-SP5 (src): kernel-default-base-5.14.21-150500.55.65.1.150500.6.29.1, kernel-source-5.14.21-150500.55.65.1 Development Tools Module 15-SP5 (src): kernel-obs-build-5.14.21-150500.55.65.1, kernel-source-5.14.21-150500.55.65.1, kernel-syms-5.14.21-150500.55.65.1 SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_14-1-150500.11.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224782] VUL-0: CVE-2024-36048: qtnetworkauth: data race and poor seeding in generateRandomString()
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1224782 https://bugzilla.suse.com/show_bug.cgi?id=1224782#c5 --- Comment #5 from Marcus Meissner <meissner(a)suse.com> --- openSUSE-SU-2024:0143-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1224782 CVE References: CVE-2024-36048 JIRA References: Sources used: openSUSE Backports SLE-15-SP5 (src): libqt5-qtnetworkauth-5.15.2+kde2-bp155.3.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225217] OpenSUSE TW won’t boot without the “dis_ucode_ldr” parameter
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225217 https://bugzilla.suse.com/show_bug.cgi?id=1225217#c6 --- Comment #6 from Takashi Iwai <tiwai(a)suse.com> --- Just a blind shot: is there any change if you pass mitigations=off option? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225296] nouveau/GT 218 from 2009: Dual monitor not recognised after upgrade 15.5 to 15.6 (kernel driver regression?)
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225296 https://bugzilla.suse.com/show_bug.cgi?id=1225296#c6 Takashi Iwai <tiwai(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tiwai(a)suse.com Flags| |needinfo?(martin.schmidt@io | |-warnemuende.de) --- Comment #6 from Takashi Iwai <tiwai(a)suse.com> --- First off, please verify that the problem persists with X11 modesetting driver without X11 nouveau driver as suggested in the above. If yes, install the Leap 15.5 kernel on your Leap 15.6 system with zypper install --oldpackage option, reboot with it and check whether it still works as expected. If Leap 15.5 kernel is confirmed to work, please boot with drm.debug=0x1e log_buf_len=1M options, get dmesg output after the boot. Take the logs from both Leap 15.5 and Leap 15.6 kernels for comparison, and upload to Bugzilla. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1218995] Firefox fails to build randomly due to missing lang files
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1218995 Matej Cepl <mcepl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(mcepl(a)suse.com) | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225398] New: [Build 20240524] ksh segfaults on ppc64le
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225398 Bug ID: 1225398 Summary: [Build 20240524] ksh segfaults on ppc64le Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/4223919/modules/shel ls/steps/7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation The test tries to launch ksh, but this is terminated directly The error is not new, but was masked by other errors in the same test suite (so unclear when it last worked) openQA test in scenario opensuse-Tumbleweed-DVD-ppc64le-extra_tests_textmode@ppc64le fails in [shells](https://openqa.opensuse.org/tests/4223919/modules/shells/steps/7) ## Test suite description Maintainer: slindomansilla(a)suse.de. Mainly post-installation console extra tests. ## Reproducible Fails since (at least) Build [20201109](https://openqa.opensuse.org/tests/1466287) ## Expected result Last good: (unknown) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=ppc64le&distri=opensu… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1208066] osc vc: too few X's in template
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1208066 https://bugzilla.suse.com/show_bug.cgi?id=1208066#c1 Daniel Mach <daniel.mach(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|IN_PROGRESS |RESOLVED --- Comment #1 from Daniel Mach <daniel.mach(a)suse.com> --- Fixed in obs-build: https://github.com/openSUSE/obs-build/pull/988 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210865] Latest osc build command does always clean source below BUILD
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1210865 https://bugzilla.suse.com/show_bug.cgi?id=1210865#c3 Daniel Mach <daniel.mach(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #3 from Daniel Mach <daniel.mach(a)suse.com> --- From `osc build --help`: --buildtool-opt OPT pass option OPT to the build tool command (rpmbuild), for example: * don't clean build environment after a successful build: --buildtool-opt=--noclean I think it's sufficiently documented. As I explained in the issue that requested this, I don't want to add an option for everything, it's better to document commonly used options this way. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222715] segmentation fault with vdr-plugin-xineliboutput and libvdpau
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222715 https://bugzilla.suse.com/show_bug.cgi?id=1222715#c4 --- Comment #4 from Peter Münster <pmlists(a)free.fr> --- (In reply to Stefan Seyfried from comment #3) > Then please check if it is a generic xine problem, with something like > > xine -V vdpau file.mp4 No segfault here... -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1034348] Installer loops on searching for system files (LUKS)
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1034348 https://bugzilla.suse.com/show_bug.cgi?id=1034348#c9 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WONTFIX Status|NEW |RESOLVED --- Comment #9 from Stefan Hundhammer <shundhammer(a)suse.com> --- This bug is 7 years old, and back then TW was very much different from the TW today, especially in the storage area. As Arvin wrote in comment #8, this was before yast-storage-ng and libstorage-ng. There were no duplicate bugs during all that time. It is entirely possible that this was a one-time problem back then, maybe specific to this specific setup. Closing. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225356] New: Falha na atualização
by bugzilla_noreply＠suse.com 27 May '24

27 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1225356 Bug ID: 1225356 Summary: Falha na atualização Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Upgrade Problems Assignee: screening-team-bugs(a)suse.de Reporter: matoscelsop(a)gmail.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Abortado devido a falha (Flatpak system operation Deploy not allowed for user) Abortado devido a falha (Flatpak system operation Deploy not allowed for user <html>Falha ao resolver a dependência:<br/><br/>o tlp-1.6.1-2.1.noarch a ser instalado está em conflito com 'tuned' fornecido pelo tuned-2.22.1.2+git.86ac977-3.1.noarch instalado</html> -- You are receiving this mail because: You are on the CC list for the bug.

1 1