May 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1223773] New: zypper does not accept option: break <package> by ignoring some of its dependencies
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223773 Bug ID: 1223773 Summary: zypper does not accept option: break <package> by ignoring some of its dependencies Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: gcomes.obs(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On Leap 15.6 if I run: zypper in musescore I get: Reading installed packages... Resolving package dependencies... Problem: the to be installed musescore-4.2.1-bp156.1.2.x86_64 requires '(pipewire-alsa if pipewire)', but this requirement cannot be provided not installable providers: pipewire-alsa-1.0.4-150600.1.8.x86_64[openSUSE-Leap-15.6-1] pipewire-alsa-1.0.4-150600.2.pm.39.x86_64[packman_http_Essentials] Solution 1: Following actions will be done: deinstallation of pipewire-1.0.4-150600.1.8.x86_64 deinstallation of gnome-remote-desktop-45.1-150600.1.2.x86_64 deinstallation of pipewire-lang-1.0.4-150600.1.8.noarch deinstallation of plasma5-session-wayland-5.27.11-bp156.2.1.x86_64 deinstallation of wireplumber-0.5.1-150600.1.1.x86_64 deinstallation of wireplumber-lang-0.5.1-150600.1.1.noarch deinstallation of wireplumber-zsh-completion-0.5.1-150600.1.1.x86_64 deinstallation of gnome-remote-desktop-lang-45.1-150600.1.2.noarch Solution 2: Following actions will be done: deinstallation of alsa-plugins-pulse-1.2.7.1-150500.1.1.x86_64 deinstallation of pulseaudio-17.0-150600.2.2.x86_64 deinstallation of pulseaudio-lang-17.0-150600.2.2.noarch deinstallation of pulseaudio-module-bluetooth-17.0-150600.2.2.x86_64 deinstallation of pulseaudio-module-gsettings-17.0-150600.2.2.x86_64 deinstallation of pulseaudio-module-lirc-17.0-150600.2.2.x86_64 deinstallation of pulseaudio-module-x11-17.0-150600.2.2.x86_64 deinstallation of pulseaudio-module-zeroconf-17.0-150600.2.2.x86_64 Solution 3: do not install musescore-4.2.1-bp156.1.2.x86_64 Solution 4: break musescore-4.2.1-bp156.1.2.x86_64 by ignoring some of its dependencies If I select solution 1,2 or 3, zypper does what it is proposing to do. But if I select solution 4 (which is the correct action in this case, see boo#1220821), then zypper does not install musescore as it is supposed to do following my decision, but it shows again the same prompt. The end result is that option 4, while it is offered, it does not get executed. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1223853] New: podman doesn't display pasta version
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223853 Bug ID: 1223853 Summary: podman doesn't display pasta version Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: rbranco(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- $ podman info -f '{{.Host.Pasta.Version}}' pasta unknown version [GNU Copyright notice follows...] In Fedora I get: $ podman info -f '{{.Host.Pasta.Version}}' pasta 0^20240426.gd03c4e2-1.fc40.x86_64 podman version 5.0.2 in TW 20240430. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223851] New: VUL-0: CVE-2023-44428: musescore: heap-based buffer overflow within the parsing of CAP files
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223851 Bug ID: 1223851 Summary: VUL-0: CVE-2023-44428: musescore: heap-based buffer overflow within the parsing of CAP files Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/380869/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: cornelis(a)solcon.nl Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769. References: https://www.zerodayinitiative.com/advisories/ZDI-23-1526/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-44428 https://www.cve.org/CVERecord?id=CVE-2023-44428 http://www.zerodayinitiative.com/advisories/ZDI-23-1526/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1223609] kernel panic - unable to mount root fs on unknown-block - first boot into 15.6 RC from a simple 15.5 via zypper dup
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223609 https://bugzilla.suse.com/show_bug.cgi?id=1223609#c6 Antonio Feijoo <antonio.feijoo(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |antonio.feijoo(a)suse.com Assignee|screening-team-bugs(a)suse.de |dracut-maintainers(a)suse.de --- Comment #6 from Antonio Feijoo <antonio.feijoo(a)suse.com> --- (In reply to andreas bittner from comment #5) > -------------- > > zypp-history-log-0000.txt-# dracut[E]: FAILED: > /usr/lib/dracut/dracut-install -D /var/tmp/dracut.7LMEwP/initramfs -N > ^i2o_scsi$ --kerneldir /lib/modules/5.14.21-150500.55.49-default/ -m > pata_atiixp ahci ata_generic sata_nv pata_amd fan amd74xx ide_pci_generic > reiserfs edd > zypp-history-log-0000.txt:# dracut[F]: installkernel failed in module > suse-initrd > zypp-history-log-0000.txt-# warning: > %postun(kernel-default-extra-5.14.21-150500.55.49.1.x86_64) scriptlet > failed, exit status 1 > > --------------- This issue has already been reported and the fix is in progress: https://github.com/openSUSE/dracut/pull/328 tl;dr: your system probably has some leftover legacy kernel modules that were tried to be added using a `INITRD_MODULES=` entry in /etc/sysconfig/kernel or `# SUSE INITRD:` comment in any modprobe config file. The fix restores the old behavior to avoid breaking the build of the initrd. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222088] Packages install at some point after deselecting in installer
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222088 Danilo Spinella <danilo.spinella(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|danilo.spinella(a)suse.com |martin.schreiner(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1222180] New: openssh: rewrite systemd notification without linking systemd
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1222180 Bug ID: 1222180 Summary: openssh: rewrite systemd notification without linking systemd Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: dmueller(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- openssh carries this patch: https://build.opensuse.org/projects/openSUSE:Factory/packages/openssh/files… which is linking libsystemd, just for notifying systemd. given the large dependency tree of systemd, this increases the attack surface of openssh, as can be seen via https://www.suse.com/security/cve/CVE-2024-3094.html we should split out sd_notify() into a separate standalone library (or maybe it exists already?) and link that one instead -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1223793] VUL-0: CVE-2023-46565: TRACKERBUG: gobgp: buffer overflow via handlingError() function in pkg/server/fsm.go
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223793 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |security-team(a)suse.de QA Contact|qa-bugs(a)suse.de |security-team(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223793] VUL-0: CVE-2023-46565: TRACKERBUG: gobgp: buffer overflow via handlingError() function in pkg/server/fsm.go
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223793 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|Leap 15.5 |Leap 15.6 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223793] VUL-0: CVE-2023-46565: TRACKERBUG: gobgp: buffer overflow via handlingError() function in pkg/server/fsm.go
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223793 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|Current |Leap 15.5 Product|openSUSE Tumbleweed |openSUSE Distribution Component|Network |Network -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223820] GCC 14 fails to build libstorage-ng
by bugzilla_noreply＠suse.com 03 May '24

03 May '24

https://bugzilla.suse.com/show_bug.cgi?id=1223820 https://bugzilla.suse.com/show_bug.cgi?id=1223820#c4 Martin Jambor <mjambor(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://gcc.gnu.org/bugzill | |a/show_bug.cgi?id=114935 --- Comment #4 from Martin Jambor <mjambor(a)suse.com> --- This now https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114935 -- You are receiving this mail because: You are on the CC list for the bug.

1 0