June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1225638] VUL-0: CVE-2024-35434: sngrep: Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function rtp_check_packet at /sngrep/src/rtp.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted SIP packet.
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1225638 https://bugzilla.suse.com/show_bug.cgi?id=1225638#c2 --- Comment #2 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1225638) was mentioned in https://build.opensuse.org/request/show/1180356 Backports:SLE-15-SP6 / sngrep -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1223366] nodejs-electron: segfault in electron::ElectronDesktopWindowTreeHostLinux::OnWindowTiledStateChanged(ui::WindowTiledEdges)
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1223366 https://bugzilla.suse.com/show_bug.cgi?id=1223366#c16 John Veness <john-susecom(a)pelago.org.uk> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(john-susecom@pela | |go.org.uk) | --- Comment #16 from John Veness <john-susecom(a)pelago.org.uk> --- (In reply to Bruno Pitrus from comment #15) > Please check this build of Electron whether it crashes (it should not): > https://download.opensuse.org/repositories/home:/dziobian:/gulgul-ultron:/1… > openSUSE_Tumbleweed/x86_64/nodejs-electron-29.4.2-407.2.x86_64.rpm Thanks Bruno, Signal does not crash for me with that build of Electron. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1188745] nvidia gfx kernel module: kexec reboot fails since 5.13.4
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1188745 https://bugzilla.suse.com/show_bug.cgi?id=1188745#c54 --- Comment #54 from Stefan Dirsch <sndirsch(a)suse.com> --- Just had another try on freshly installed sle15-sp6. Before testing with current nvidia drivers I gave it a try with amdgpu driver (AMD gfx card of course). jumphost:~ # systemctl kexec jumphost:~ # Connection to jumphost closed by remote host. Connection to jumphost closed. Monitor gets black. Blinking cursor for a few seconds on the top left. Then monitor goes into power-safe. That's it. Machine dead. Press power to turn it off completely and press power again to start it again. I think we should first need to get things working with non-nividia drivers before digging into this with nvidia drivers. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226043] kernel: EXT4-fs error (device dm-0): ext4_mark_recovery_complete:6245: comm mount: Orphan file not empty on read-only fs.
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226043 https://bugzilla.suse.com/show_bug.cgi?id=1226043#c6 --- Comment #6 from Luis Henriques <lhenriques(a)suse.com> --- (In reply to Jonas Kvinge from comment #5) > Thank you. After I added "fsck.mode=force" I could no longer reproduce the > issue when cutting power, as soon as I removed "fsck.mode=force" it's stuck > almost every time the power is cut. > > Even if you fixed the issue, is it a good idea to keep fsck.mode=force for > machines that are often shut down by cutting power? I assume it does not > hurt, since it only takes a few seconds more when booting. I guess that what 'fsck.mode=force' will do is to run e2fsck with '-f' even if the filesystem seems to be clean (but I'm not familiar with the details on how this parameter is handled, probably by systemd). In general, forcing the filesystem check shouldn't be needed in most cases, but it should also be harmless. On the other hand, my patch to e2fsck is to actually force it to do a full check in the presence of the orphan files inode. So using that kernel parameter seems to be a good workaround to the issue. (In the meantime, I haven't had any feedback on my patch yet.) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1212476] patch shebang line match the python version required in the package
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1212476 https://bugzilla.suse.com/show_bug.cgi?id=1212476#c22 --- Comment #22 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1212476) was mentioned in https://build.opensuse.org/request/show/1180338 Factory / asymptote -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224059] Bumblebee freezes laptop at boot
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1224059 https://bugzilla.suse.com/show_bug.cgi?id=1224059#c6 Stefan Dirsch <sndirsch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(aleksey.rukhlenko | |(a)gmail.com) | --- Comment #6 from Stefan Dirsch <sndirsch(a)suse.com> --- Sounds great! Thanks for the late feedback! :-) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c14 --- Comment #14 from David Anes <david.anes(a)suse.com> --- (In reply to Dirk Stoecker from comment #12) > If it would strip the content-length in the transfer encoding coming from > the script case because of the information in the link you provided I can > live with this. I don't think that combination is used anywhere that we have > a receiver relying on the content length and using transfer encoding. Also > doesn't make much sense anyway: If I know the length of the transfer at the > beginning chunked transfer is wasted bandwidth. I fully agree. Let me investigate now the problem has been narrowed down to a very simple case. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c13 --- Comment #13 from Dirk Stoecker <opensuse(a)dstoecker.de> --- Yes. curl → apache → cgi. The apache running mainly with defaults (I use different systems for ok/error instead of installing/reinstalling for each test :-). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c12 --- Comment #12 from Dirk Stoecker <opensuse(a)dstoecker.de> --- > Isn't this wrong as per http spec? It's not wrong, only superfluous (both state the same value). It get's wrong because apache now always enforces chunked encoding ignoring the input. If it would strip the content-length in the transfer encoding coming from the script case because of the information in the link you provided I can live with this. I don't think that combination is used anywhere that we have a receiver relying on the content length and using transfer encoding. Also doesn't make much sense anyway: If I know the length of the transfer at the beginning chunked transfer is wasted bandwidth. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
by bugzilla_noreply＠suse.com 13 Jun '24

13 Jun '24

https://bugzilla.suse.com/show_bug.cgi?id=1226217 https://bugzilla.suse.com/show_bug.cgi?id=1226217#c11 --- Comment #11 from David Anes <david.anes(a)suse.com> --- Just for completeness. Is this your current setup or is there anything in between? client <-> apache <-> cgi -- You are receiving this mail because: You are on the CC list for the bug.

1 0