June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1226243] New: VUL-0: CVE-2024-36761: coppwr: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226243 Bug ID: 1226243 Summary: VUL-0: CVE-2024-36761: coppwr: naga: front-end aborts due to a stack overflow when given too many parenthesis as input Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/410376/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mantarimay(a)pm.me Reporter: camila.matos(a)suse.com QA Contact: qa-bugs(a)suse.de CC: camila.matos(a)suse.com, qa-bugs(a)suse.de, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1226242 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1226242 +++ naga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36761 https://www.cve.org/CVERecord?id=CVE-2024-36761 https://github.com/MageWeiG/VulnerabilityCollection/blob/main/CVE-2024-3676… https://github.com/gfx-rs/naga/issues/2591 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1226242] VUL-0: CVE-2024-36761: TRACKERBUG: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226242 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226242] VUL-0: CVE-2024-36761: TRACKERBUG: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226242 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1226245 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226242] VUL-0: CVE-2024-36761: TRACKERBUG: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226242 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- QA Contact|qa-bugs(a)suse.de |security-team(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226242] VUL-0: CVE-2024-36761: TRACKERBUG: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226242 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1226244 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226242] VUL-0: CVE-2024-36761: TRACKERBUG: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226242 Camila Camargo de Matos <camila.matos(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1226243 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226242] VUL-0: CVE-2024-36761: TRACKERBUG: naga: front-end aborts due to a stack overflow when given too many parenthesis as input
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

1 0

[Bug 1226105] Snapshot 20240606 breaks libvirt NAT networks
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226105 https://bugzilla.suse.com/show_bug.cgi?id=1226105#c9 James Fehlig <jfehlig(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(alexander.graul@s | |use.com) --- Comment #9 from James Fehlig <jfehlig(a)suse.com> --- (In reply to Alexander Graul from comment #7) > i | iptables-backend-nft | Metapackage to make nft the default backend for > iptables/arptables/ebtables | package iptables-backend-nft creates two top level nftable tables that are shared by all applications using iptables. You can see them in your 'nft list ruleset ip' output, with a warning not to touch :-). With libvirt's switch to using nftables directly, it now creates its own top level table. And recall in nftables, for a packet to get through it must be allowed by all top level tables. Notice in your output the 'ip filter' table has type filter hook forward priority filter; policy drop; This github issue comment has more details https://gitlab.com/libvirt/libvirt/-/issues/644#note_1940628451 The issue also describes why it works prior to the switch to using nftables directly, and a workaround. E.g. in /etc/libvirt/network.conf, set firewall_backend = "iptables" and restart virtnetworkd (or libvirtd if you're using monolithic daemon). Does this work for you? FYI, this post has a nice description of relationship between iptables, iptables-nft, and nftables https://developers.redhat.com/blog/2020/08/18/iptables-the-two-variants-and… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226122] TW installation with bootloader not managed leaves /boot/ empty when suse-module-tools-scriptlets not installed instead of sdbootutil-rpm-scriptlets
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226122 https://bugzilla.suse.com/show_bug.cgi?id=1226122#c47 --- Comment #47 from Alberto Planas Dominguez <aplanas(a)suse.com> --- (In reply to Felix Miata from comment #46) > I've spent the past nearly 3 hours composing a reply to comment #39. Oh ... I did not mean to sound rude in my comment. Did it read as rude? When I meant that I did not understood your comment I was referring that I was failing to see the connection between what I saw as a bug in the new scriptlets package and your answer. I am assuming that is lack of context from my side. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223967] %suse_build_hwcaps_libs fails to generate -x86_64-v3 packages when shared library is an update-alternatives link
by bugzilla_noreply＠suse.com 12 Jun '24

12 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1223967 https://bugzilla.suse.com/show_bug.cgi?id=1223967#c21 --- Comment #21 from Atri Bhattacharya <badshah400(a)gmail.com> --- Also kudos for the great catch as to where the problem lay! -- You are receiving this mail because: You are on the CC list for the bug.

1 0