May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224068] New: Budgie crashes session if it crashes twice
by bugzilla_noreply＠suse.com 05 Oct '24

05 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224068 Bug ID: 1224068 Summary: Budgie crashes session if it crashes twice Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: asdhio(a)tuta.io QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 874777 --> https://bugzilla.suse.com/attachment.cgi?id=874777&action=edit A screen saying "Oh no! Something has gone wrong." Budgie will throw a screen "Oh no! Something has gone wrong." if Budgie crashes more than one time. A common case of it happening is if Bugdie panel crashes more than once. The likelihood of such crashes can be increased if budgie-appmenu-applet or any applets from budgie-extras are applied. The problem is that Budgie won't just restart its panels and let the user do their job (like XFCE and MATE would). Budgie will stop after second crash even though those applications are still running. But Budgie gives no option other than to log out. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1223269] New: VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in libavcodec/jpegxl_parser.c
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1223269 Bug ID: 1223269 Summary: VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in libavcodec/jpegxl_parser.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/402764/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map. References: https://ffmpeg.org/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51791 https://www.cve.org/CVERecord?id=CVE-2023-51791 https://trac.ffmpeg.org/ticket/10738 https://bugzilla.redhat.com/show_bug.cgi?id=2276114 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223276] New: VUL-0: CVE-2023-51797: ffmpeg: buffer overflow in the showwaves_filter_frame function in libavfilter/avf_showwaves.c
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1223276 Bug ID: 1223276 Summary: VUL-0: CVE-2023-51797: ffmpeg: buffer overflow in the showwaves_filter_frame function in libavfilter/avf_showwaves.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/402769/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame References: https://github.com/FFmpeg/FFmpeg https://ffmpeg.org/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51797 https://www.cve.org/CVERecord?id=CVE-2023-51797 https://trac.ffmpeg.org/ticket/10756 https://bugzilla.redhat.com/show_bug.cgi?id=2276120 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1224233] New: VUL-0: CVE-2024-30268: cacti: reflected cross-site scripting vulnerability in display_settings
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224233 Bug ID: 1224233 Summary: VUL-0: CVE-2024-30268: cacti: reflected cross-site scripting vulnerability in display_settings Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405121/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Andreas.Stieger(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-30268 https://www.cve.org/CVERecord?id=CVE-2024-30268 https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364… https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a498… https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1224232] New: VUL-0: CVE-2024-29895: cacti: command injection in cmd_realtime.php
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224232 Bug ID: 1224232 Summary: VUL-0: CVE-2024-29895: cacti: command injection in cmd_realtime.php Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405105/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Andreas.Stieger(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29895 https://www.cve.org/CVERecord?id=CVE-2024-29895 https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd1… https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c6… https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c… https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1224789] New: VUL-0: CVE-2024-33900: keepassxc: recovery of cleartext credentials
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224789 Bug ID: 1224789 Summary: VUL-0: CVE-2024-33900: keepassxc: recovery of cleartext credentials Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/406770/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- KeePassXC 2.7.7 allows attackers to recover cleartext credentials. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-33900 https://www.cve.org/CVERecord?id=CVE-2024-33900 https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838 https://keepassxc.org/blog/ -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1215701] New: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1215701 Bug ID: 1215701 Summary: VUL-0: CVE-2023-40581: yt-dlp: template expansion in `--exec` flag Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/379815/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: rfrohl(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp to version 2023.09.24 as soon as possible. Also, always be careful when using --exec, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade: 1. Avoid using any output template expansion in --exec other than {} (filepath). 2. If expansion in --exec is needed, verify the fields you are using do not contain ", | or &. 3. Instead of using --exec, write the info json and load the fields from it instead. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40581 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1222859] New: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1222859 Bug ID: 1222859 Summary: VUL-0: CVE-2024-32019: netdata: local privilege escalation and command execution via untrusted search path Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/401694/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mia(a)0x0.st Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32019 https://www.cve.org/CVERecord?id=CVE-2024-32019 https://github.com/netdata/netdata/pull/17377 https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93 https://bugzilla.redhat.com/show_bug.cgi?id=2274984 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1214211] New: "Loading basic drivers" is printed twice on the screen when loading installation system
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1214211 Bug ID: 1214211 Summary: "Loading basic drivers" is printed twice on the screen when loading installation system Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: dheidler(a)suse.com QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 868778 --> https://bugzilla.suse.com/attachment.cgi?id=868778&action=edit screenshot Something like this is printed: Loading basic drivers...Loading basic drivers ok Expected: Loading basic drivers... ok -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1221918] New: VUL-0: CVE-2024-2824: jhead: heap-based buffer overflow in function PrintFormatNumber
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1221918 Bug ID: 1221918 Summary: VUL-0: CVE-2024-2824: jhead: heap-based buffer overflow in function PrintFormatNumber Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/398716/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: pgajdos(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- A vulnerability was found in Matthias-Wandel jhead 3.08 and classified as critical. This issue affects the function PrintFormatNumber of the file exif.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257711. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-2824 https://www.cve.org/CVERecord?id=CVE-2024-2824 https://github.com/Matthias-Wandel/jhead/files/14613084/poc.zip https://github.com/Matthias-Wandel/jhead/issues/84 https://vuldb.com/?ctiid.257711 https://vuldb.com/?id.257711 -- You are receiving this mail because: You are on the CC list for the bug.

1 7