June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224070] New: Missing Ark context menu in dolphin
by bugzilla_noreply＠suse.com 05 Oct '24

05 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224070 Bug ID: 1224070 Summary: Missing Ark context menu in dolphin Classification: openSUSE Product: openSUSE Kalpa Version: Current Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Desktop Environment Assignee: sfalken(a)cloverleaf-linux.org Reporter: mh306602(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Because Dolphin is installed through rpm and ark through flatpak, the integration is flawed between the 2. Could be fixed by either having both be installed through rpm's or both through flatpak. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1219525] New: Notification on successful transactional-update is not persistent
by bugzilla_noreply＠suse.com 05 Oct '24

05 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1219525 Bug ID: 1219525 Summary: Notification on successful transactional-update is not persistent Classification: openSUSE Product: openSUSE Kalpa Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Transactional Update Assignee: sfalken(a)cloverleaf-linux.org Reporter: sfalken(a)cloverleaf-linux.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- On Kalpa, transactional-update-notifier does operate correctly on Kalpa, but it pops up when run, and only survives as long as the delay set in `System Settings->Notifications->Hide After` is set to. This isn't the intended behavior, the notification should be persistent, so the user is aware that an update has been applied, and can choose whether to reboot or not -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1219803] New: Lenovo Yoga 14APH8 headphones jack requires bass speaker to be full volume
by bugzilla_noreply＠suse.com 05 Oct '24

05 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1219803 Bug ID: 1219803 Summary: Lenovo Yoga 14APH8 headphones jack requires bass speaker to be full volume Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: pinchon.guillaume(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Symptoms : When connecting headphones to the laptop's jack it's required to set the Bass Speaker to full volume through alsamixer otherwise we get no sound. Either that or replacing in /usr/share/alsa-card-profile/mixer/paths/analog-output-headphones.conf : [Element Bass Speaker] switch = off volume = off with : [Element Bass Speaker] switch = off volume = merge System info : Operating System: openSUSE Tumbleweed 20240209 KDE Plasma Version: 5.27.10 KDE Frameworks Version: 5.114.0 Qt Version: 5.15.12 Kernel Version: 6.8.0-rc3-3.g7450939-default (64-bit) Graphics Platform: X11 Processors: 16 × AMD Ryzen 7 7840HS with Radeon 780M Graphics Memory: 27.1 Gio of RAM Graphics Processor: AMD Radeon Graphics Manufacturer: LENOVO Product Name: 82Y8 System Version: Yoga Pro 7 14APH8 hwinfo --sound : 12: PCI 6300.1: 0403 Audio device [Created at pci.386] Unique ID: UGCg.OQPqPLYNCh0 Parent ID: JZZT.maS73mB38XF SysFS ID: /devices/pci0000:00/0000:00:08.1/0000:63:00.1 SysFS BusID: 0000:63:00.1 Hardware Class: sound Model: "ATI Audio device" Vendor: pci 0x1002 "ATI Technologies Inc" Device: pci 0x1640 SubVendor: pci 0x17aa "Lenovo" SubDevice: pci 0x3824 Driver: "snd_hda_intel" Driver Modules: "snd_hda_intel" Memory Range: 0x785c8000-0x785cbfff (rw,non-prefetchable) IRQ: 90 (no events) Module Alias: "pci:v00001002d00001640sv000017AAsd00003824bc04sc03i00" Driver Info #0: Driver Status: snd_hda_intel is active Driver Activation Cmd: "modprobe snd_hda_intel" Config Status: cfg=new, avail=yes, need=no, active=unknown Attached to: #27 (PCI bridge) 22: PCI 6300.6: 0403 Audio device [Created at pci.386] Unique ID: puer.m6xb4yIjnP9 Parent ID: JZZT.maS73mB38XF SysFS ID: /devices/pci0000:00/0000:00:08.1/0000:63:00.6 SysFS BusID: 0000:63:00.6 Hardware Class: sound Model: "AMD Family 17h (Models 10h-1fh) HD Audio Controller" Vendor: pci 0x1022 "AMD" Device: pci 0x15e3 "Family 17h (Models 10h-1fh) HD Audio Controller" SubVendor: pci 0x17aa "Lenovo" SubDevice: pci 0x3882 Driver: "snd_hda_intel" Driver Modules: "snd_hda_intel" Memory Range: 0x785c0000-0x785c7fff (rw,non-prefetchable) IRQ: 43 (327 events) Module Alias: "pci:v00001022d000015E3sv000017AAsd00003882bc04sc03i00" Driver Info #0: Driver Status: snd_hda_intel is active Driver Activation Cmd: "modprobe snd_hda_intel" Config Status: cfg=new, avail=yes, need=no, active=unknown Attached to: #27 (PCI bridge) -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1224068] New: Budgie crashes session if it crashes twice
by bugzilla_noreply＠suse.com 05 Oct '24

05 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224068 Bug ID: 1224068 Summary: Budgie crashes session if it crashes twice Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: x86-64 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: asdhio(a)tuta.io QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 874777 --> https://bugzilla.suse.com/attachment.cgi?id=874777&action=edit A screen saying "Oh no! Something has gone wrong." Budgie will throw a screen "Oh no! Something has gone wrong." if Budgie crashes more than one time. A common case of it happening is if Bugdie panel crashes more than once. The likelihood of such crashes can be increased if budgie-appmenu-applet or any applets from budgie-extras are applied. The problem is that Budgie won't just restart its panels and let the user do their job (like XFCE and MATE would). Budgie will stop after second crash even though those applications are still running. But Budgie gives no option other than to log out. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1222815] New: Performance CoPilot 6 is not starting due to missing pmlogger_daily.timer
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1222815 Bug ID: 1222815 Summary: Performance CoPilot 6 is not starting due to missing pmlogger_daily.timer Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dmueller(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- just installing pcp and pmlogger leads to: # systemctl start pmlogger Failed to start pmlogger.service: Unit pmlogger_daily.timer not found. this unit is currently in pcp-zeroconf. however pmlogger.service is in pcp (main package). if zeroconf is supposed to be optional, then the pmlogger_daily.timer dependency is supposed to be made optional. otherwise the timer needs to be moved into the main package (like it appears to be upstream) -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223269] New: VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in libavcodec/jpegxl_parser.c
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1223269 Bug ID: 1223269 Summary: VUL-0: CVE-2023-51791: ffmpeg: buffer overflow via function gen_alias_map in libavcodec/jpegxl_parser.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/402764/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map. References: https://ffmpeg.org/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51791 https://www.cve.org/CVERecord?id=CVE-2023-51791 https://trac.ffmpeg.org/ticket/10738 https://bugzilla.redhat.com/show_bug.cgi?id=2276114 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223276] New: VUL-0: CVE-2023-51797: ffmpeg: buffer overflow in the showwaves_filter_frame function in libavfilter/avf_showwaves.c
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1223276 Bug ID: 1223276 Summary: VUL-0: CVE-2023-51797: ffmpeg: buffer overflow in the showwaves_filter_frame function in libavfilter/avf_showwaves.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/402769/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Other Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavfilter/avf_showwaves.c:722:24 in showwaves_filter_frame References: https://github.com/FFmpeg/FFmpeg https://ffmpeg.org/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51797 https://www.cve.org/CVERecord?id=CVE-2023-51797 https://trac.ffmpeg.org/ticket/10756 https://bugzilla.redhat.com/show_bug.cgi?id=2276120 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1224233] New: VUL-0: CVE-2024-30268: cacti: reflected cross-site scripting vulnerability in display_settings
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224233 Bug ID: 1224233 Summary: VUL-0: CVE-2024-30268: cacti: reflected cross-site scripting vulnerability in display_settings Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405121/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Andreas.Stieger(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Cacti provides an operational monitoring and fault management framework. A reflected cross-site scripting vulnerability on the 1.3.x DEV branch allows attackers to obtain cookies of administrator and other users and fake their login using obtained cookies. This issue is fixed in commit a38b9046e9772612fda847b46308f9391a49891e. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-30268 https://www.cve.org/CVERecord?id=CVE-2024-30268 https://github.com/Cacti/cacti/blob/08497b8bcc6a6037f7b1aae303ad8f7dfaf7364… https://github.com/Cacti/cacti/commit/a38b9046e9772612fda847b46308f9391a498… https://github.com/Cacti/cacti/security/advisories/GHSA-9m3v-whmr-pc2q -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1224232] New: VUL-0: CVE-2024-29895: cacti: command injection in cmd_realtime.php
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224232 Bug ID: 1224232 Summary: VUL-0: CVE-2024-29895: cacti: command injection in cmd_realtime.php Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/405105/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: Andreas.Stieger(a)gmx.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `cmd_realtime.php` line 119, the `$poller_id` used as part of the command execution is sourced from `$_SERVER['argv']`, which can be controlled by URL when `register_argc_argv` option of PHP is `On`. And this option is `On` by default in many environments such as the main PHP Docker image for PHP. Commit 53e8014d1f082034e0646edc6286cde3800c683d contains a patch for the issue, but this commit was reverted in commit 99633903cad0de5ace636249de16f77e57a3c8fc. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29895 https://www.cve.org/CVERecord?id=CVE-2024-29895 https://github.com/Cacti/cacti/blob/501712998589763d411a68d35e3cda98fd9cfd1… https://github.com/Cacti/cacti/commit/53e8014d1f082034e0646edc6286cde3800c6… https://github.com/Cacti/cacti/commit/99633903cad0de5ace636249de16f77e57a3c… https://github.com/Cacti/cacti/security/advisories/GHSA-cr28-x256-xf5m -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1224789] New: VUL-0: CVE-2024-33900: keepassxc: recovery of cleartext credentials
by bugzilla_noreply＠suse.com 04 Oct '24

04 Oct '24

https://bugzilla.suse.com/show_bug.cgi?id=1224789 Bug ID: 1224789 Summary: VUL-0: CVE-2024-33900: keepassxc: recovery of cleartext credentials Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/406770/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mrueckert(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- KeePassXC 2.7.7 allows attackers to recover cleartext credentials. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-33900 https://www.cve.org/CVERecord?id=CVE-2024-33900 https://gist.github.com/Fastor01/30c6d89c842feb1865ec2cd2d3806838 https://keepassxc.org/blog/ -- You are receiving this mail because: You are on the CC list for the bug.

1 3