June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1225833] New: VUL-0: CVE-2024-36845: libmodbus: denial of service due to an invalid pointer in the modbus_receive() function
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1225833 Bug ID: 1225833 Summary: VUL-0: CVE-2024-36845: libmodbus: denial of service due to an invalid pointer in the modbus_receive() function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408372/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the unit-test-server. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36845 https://www.cve.org/CVERecord?id=CVE-2024-36845 https://github.com/stephane/libmodbus/issues/750 https://bugzilla.redhat.com/show_bug.cgi?id=2284259 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1226173] virt-manager: Browse local does not work anymore
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226173 https://bugzilla.suse.com/show_bug.cgi?id=1226173#c1 Charles Arnold <carnold(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #1 from Charles Arnold <carnold(a)suse.com> --- Thanks for catching this. Fix submitted to Factory with SR#1180071 It should show up in a Tumbleweed build in a few days. If you need the fix now, see the repo Virtualization/virt-manager -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225828] New: VUL-0: CVE-2024-36844: libmodbus: use-after-free via the ctx->backend pointer in modbus.c
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1225828 Bug ID: 1225828 Summary: VUL-0: CVE-2024-36844: libmodbus: use-after-free via the ctx->backend pointer in modbus.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408371/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the unit-test-server. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36844 https://www.cve.org/CVERecord?id=CVE-2024-36844 https://github.com/stephane/libmodbus/issues/749 https://bugzilla.redhat.com/show_bug.cgi?id=2284255 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1226064] New: `libQt5Svg5` depends on a non-existent version of `libQt5Core5` in Slowroll
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226064 Bug ID: 1226064 Summary: `libQt5Svg5` depends on a non-existent version of `libQt5Core5` in Slowroll Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: marek(a)sapota.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 875363 --> https://bugzilla.suse.com/attachment.cgi?id=875363&action=edit zypper in libQt5Core5 This package https://build.opensuse.org/package/show/home:mareksapota/obs-studio used to build fine for Slowroll (you can see a published Slowroll community package at https://software.opensuse.org/package/obs-studio) but now fails with: unresolvable: nothing provides libQt5Core.so.5(Qt_5.15.13_PRIVATE_API)(64bit) needed by libQt5Svg5, nothing provides libQt5Gui.so.5(Qt_5.15.13_PRIVATE_API)(64bit) needed by libQt5Svg5, nothing provides libQt5Widgets.so.5(Qt_5.15.13_PRIVATE_API)(64bit) needed by libQt5Svg5 This seems to be due to a version mismatch in Slowroll: testuser@localhost:~> sudo zypper info libQt5Core5 | grep Version Version : 5.15.14+kde140-1.0.2.1.sr20240429 testuser@localhost:~> sudo zypper info libQt5Svg5 | grep Version Version : 5.15.13+kde6-1.2 How to reproduce: `zypper in libQt5Core5` in Slowroll (zypper error attached) -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1226063] New: `nodejs-default` depends on `nodejs22` which doesn't exist in Slowroll
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226063 Bug ID: 1226063 Summary: `nodejs-default` depends on `nodejs22` which doesn't exist in Slowroll Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: marek(a)sapota.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- `nodejs-default` depends on `nodejs22` which is not available in Slowroll. This package https://build.opensuse.org/package/show/home:mareksapota/zsa-wally used to build fine on Slowroll but is now failing with: unresolvable: nothing provides nodejs22 needed by nodejs-default, nothing provides npm22 needed by npm-default, nothing provides nodejs22-devel needed by nodejs-devel-default I presume it's due to `nodejs22` being released, not yet available in Slowroll but the meta package has already been updated to the Tumbleweed version. How to reproduce: `zypper in nodejs-default` on Slowroll. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1225826] New: VUL-0: CVE-2024-36843: libmodbus: heap overflow via the modbus_mapping_free() function
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1225826 Bug ID: 1225826 Summary: VUL-0: CVE-2024-36843: libmodbus: heap overflow via the modbus_mapping_free() function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408370/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36843 https://www.cve.org/CVERecord?id=CVE-2024-36843 https://github.com/stephane/libmodbus/issues/748 https://bugzilla.redhat.com/show_bug.cgi?id=2284252 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1215337] python-onnx does not build s390x
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1215337 https://bugzilla.suse.com/show_bug.cgi?id=1215337#c20 --- Comment #20 from Sarah Kriesch <ada.lovelace(a)gmx.de> --- Fedora has to exclude the s390x architecture because of build failures in python-onnx: https://bugzilla.redhat.com/show_bug.cgi?id=2212096 I try to exclude python310 for solving our issue. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226105] Snapshot 20240606 breaks libvirt NAT networks
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226105 https://bugzilla.suse.com/show_bug.cgi?id=1226105#c6 James Fehlig <jfehlig(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(alexander.graul@s | |use.com) --- Comment #6 from James Fehlig <jfehlig(a)suse.com> --- I'm using similar network and VM '<interface>' config, but don't see the problem. Do you have nftables installed? If so, what's the output of 'nft list ruleset ip'? Also, any iptables* packages installed? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1199543] Please add libjxl for JPEG XL support
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1199543 https://bugzilla.suse.com/show_bug.cgi?id=1199543#c4 Enrico Belleri <idesmi(a)protonmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |idesmi(a)protonmail.com Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #4 from Enrico Belleri <idesmi(a)protonmail.com> --- libjxl is in Tumbleweed and all the programs mentioned above are built with support for it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225811] [Build 20240531] samba 4.20.1 gives DENIED in audit.log
by bugzilla_noreply＠suse.com 11 Jun '24

11 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1225811 https://bugzilla.suse.com/show_bug.cgi?id=1225811#c7 Noel Power <nopower(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |suse-beta(a)cboltz.de Flags|needinfo?(nopower(a)suse.com) |needinfo?(suse-beta@cboltz. | |de) --- Comment #7 from Noel Power <nopower(a)suse.com> --- (In reply to Christian Boltz from comment #6) > Your patch from comment 5 looks good :-) > > I submitted it upstream as > https://gitlab.com/apparmor/apparmor/-/merge_requests/1256 do we need to make a submission here to factory? I can do that if it helps -- You are receiving this mail because: You are on the CC list for the bug.

1 0