June 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1224062] New: VUL-0: CVE-2024-34244: libmodbus: buffer overflow via the modbus_write_bits function
by bugzilla_noreply＠suse.com 26 Aug '24

26 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224062 Bug ID: 1224062 Summary: VUL-0: CVE-2024-34244: libmodbus: buffer overflow via the modbus_write_bits function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/404865/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function. This issue can be triggered when the function is fed with specially crafted input, which leads to out-of-bounds read and can potentially cause a crash or other unintended behaviors. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-34244 https://www.cve.org/CVERecord?id=CVE-2024-34244 https://github.com/stephane/libmodbus/issues/743 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1223697] New: VUL-0: CVE-2023-26793: libmodbus: heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c.
by bugzilla_noreply＠suse.com 26 Aug '24

26 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1223697 Bug ID: 1223697 Summary: VUL-0: CVE-2023-26793: libmodbus: heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/403923/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read_io_status function in src/modbus.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26793 https://www.cve.org/CVERecord?id=CVE-2023-26793 https://github.com/stephane/libmodbus/issues/683 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1225833] New: VUL-0: CVE-2024-36845: libmodbus: denial of service due to an invalid pointer in the modbus_receive() function
by bugzilla_noreply＠suse.com 26 Aug '24

26 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225833 Bug ID: 1225833 Summary: VUL-0: CVE-2024-36845: libmodbus: denial of service due to an invalid pointer in the modbus_receive() function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408372/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the unit-test-server. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36845 https://www.cve.org/CVERecord?id=CVE-2024-36845 https://github.com/stephane/libmodbus/issues/750 https://bugzilla.redhat.com/show_bug.cgi?id=2284259 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1225828] New: VUL-0: CVE-2024-36844: libmodbus: use-after-free via the ctx->backend pointer in modbus.c
by bugzilla_noreply＠suse.com 26 Aug '24

26 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225828 Bug ID: 1225828 Summary: VUL-0: CVE-2024-36844: libmodbus: use-after-free via the ctx->backend pointer in modbus.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408371/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the unit-test-server. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36844 https://www.cve.org/CVERecord?id=CVE-2024-36844 https://github.com/stephane/libmodbus/issues/749 https://bugzilla.redhat.com/show_bug.cgi?id=2284255 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1225826] New: VUL-0: CVE-2024-36843: libmodbus: heap overflow via the modbus_mapping_free() function
by bugzilla_noreply＠suse.com 26 Aug '24

26 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225826 Bug ID: 1225826 Summary: VUL-0: CVE-2024-36843: libmodbus: heap overflow via the modbus_mapping_free() function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/408370/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: sbrabec(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36843 https://www.cve.org/CVERecord?id=CVE-2024-36843 https://github.com/stephane/libmodbus/issues/748 https://bugzilla.redhat.com/show_bug.cgi?id=2284252 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1226546] New: gnome terminal fails to start on aarch64 Live
by bugzilla_noreply＠suse.com 26 Aug '24

26 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1226546 Bug ID: 1226546 Summary: gnome terminal fails to start on aarch64 Live Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 URL: https://openqa.opensuse.org/tests/4285143/modules/gnom e_terminal/steps/5 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: GNOME Assignee: gnome-bugs(a)suse.de Reporter: guillaume.gardet(a)arm.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes Created attachment 875588 --> https://bugzilla.suse.com/attachment.cgi?id=875588&action=edit journal.log ## Observation openQA test in scenario opensuse-Tumbleweed-GNOME-Live-aarch64-gnome-live@USBboot_aarch64 fails in [gnome_terminal](https://openqa.opensuse.org/tests/4285143/modules/gnome_ter… Log: Jun 20 03:00:55.266967 susetest systemd[1774]: Started Application launched by gnome-shell. Jun 20 03:00:55.298298 susetest gnome-shell[10671]: # Locale not supported by C library. Jun 20 03:00:55.298679 susetest gnome-shell[10671]: # Using the fallback 'C' locale. Jun 20 03:00:55.370814 susetest dbus-daemon[1969]: [session uid=1000 pid=1969] Activating via systemd: service name='org.gnome.Terminal' unit='gnome-terminal-server.service' requested by ':1.73' (uid=1000 pid=10671 comm="gnome-terminal") Jun 20 03:00:55.372369 susetest systemd[1774]: Created slice Slice /app/org.gnome.Terminal. Jun 20 03:00:55.390332 susetest systemd[1774]: Starting GNOME Terminal Server... Jun 20 03:00:55.451283 susetest gnome-terminal-server[10675]: Locale not supported. Jun 20 03:00:55.453825 susetest systemd[1774]: gnome-terminal-server.service: Main process exited, code=exited, status=9/n/a Jun 20 03:00:55.453931 susetest systemd[1774]: gnome-terminal-server.service: Failed with result 'exit-code'. Jun 20 03:00:55.454169 susetest systemd[1774]: Failed to start GNOME Terminal Server. Jun 20 03:01:20.415387 susetest gnome-shell[10671]: # Error constructing proxy for org.gnome.Terminal:/org/gnome/Terminal/Factory0: Error calling StartServiceByName for org.gnome.Terminal: Timeout was reached ## Test suite description Maintainer: dimstar(a)opensuse.org Test for openSUSE GNOME Next Live-Media EXCLUDE_MODULES is a workaround for https://bugzilla.opensuse.org/show_bug.cgi?id=1138401#c10 (except for opensuse_welcome, which is blacklisted on the GNOME live for space reasons) ## Reproducible Fails since (at least) Build [20240617](https://openqa.opensuse.org/tests/4279106) ## Expected result Last good: [20240614](https://openqa.opensuse.org/tests/4276064) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=aarch64&distri=opensu… -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1223886] New: mlterm does not build with gcc14
by bugzilla_noreply＠suse.com 26 Aug '24

26 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1223886 Bug ID: 1223886 Summary: mlterm does not build with gcc14 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- With gcc14 incompatible pointer assignment becomes an error, and mlterm has a lot of cases of incompatible pointer assignments in the source. This is something that needs to be addressed with upstream over time. Build with -fpermissive for now. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1226438] New: Nvidia drivers not loaded with kernel bigger than 6.3.9-1
by bugzilla_noreply＠suse.com 25 Aug '24

25 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1226438 Bug ID: 1226438 Summary: Nvidia drivers not loaded with kernel bigger than 6.3.9-1 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Kernel:Drivers Assignee: kernel-bugs(a)suse.de Reporter: ioannis.bonatakis(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I running TW on 6.3.9-1-default and until that version the Nvidia drivers works ``` ❯ lspci | grep -i nvidia 0000:65:00.0 VGA compatible controller: NVIDIA Corporation GP107GL [Quadro P600] (rev a1) 0000:65:00.1 Audio device: NVIDIA Corporation GP107GL High Definition Audio Controller (rev a1) S | Name | Summary | Type ---+---------------------------+-----------------------------------------------------------------------+-------- i+ | kernel-firmware-nvidia | Kernel firmware files for Nvidia Tegra and graphics drivers | package i | libnvidia-egl-wayland1 | The EGLStream-based Wayland external platform | package il | nvidia-computeG05 | NVIDIA driver for computing with GPGPU | package il | nvidia-computeG05-32bit | 32bit NVIDIA driver for computing with GPGPU | package il | nvidia-gfxG05-kmp-default | NVIDIA graphics driver kernel module for GeForce 600 series and newer | package il | nvidia-glG05 | NVIDIA OpenGL libraries for OpenGL acceleration | package il | nvidia-glG05-32bit | 32bit NVIDIA OpenGL libraries for OpenGL acceleration | package il | x11-video-nvidiaG05 | NVIDIA graphics driver for GeForce 600 series and newer | package il | x11-video-nvidiaG05-32bit | 32bit NVIDIA graphics driver for GeForce 600 series and newer | package ``` However with every kernel version after this, there is a prompt for MOK, which is accepted and then, after boot screen is black. The Nvidia drivers are not loaded. I tried the steps in the documentation and also installed nvidiaG07 but I think there was the same problem -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1225784] New: clang: Please subpackage compiler-rt libraries
by bugzilla_noreply＠suse.com 24 Aug '24

24 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1225784 Bug ID: 1225784 Summary: clang: Please subpackage compiler-rt libraries Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: daan.j.demeyer(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- In systemd when building with sanitizers we link against clang's shared ASAN libraries with -shared-libasan. The opensuse rpm we build with sanitizers is then installed into the initramfs. Currently we have to install the entire clang package into the initramfs to make sure the shared ASAN libraries are available. Please create a compiler-rt subpackage (as exists on Fedora, CentOS and Arch Linux already) which contains the shared ASAN libraries among other things so we don't have to install the full clang package into the initramfs when building with sanitizers. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1223909] New: Package vlc fails to build with gcc 14 because of assignments from incompatible pointer types
by bugzilla_noreply＠suse.com 24 Aug '24

24 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1223909 Bug ID: 1223909 Summary: Package vlc fails to build with gcc 14 because of assignments from incompatible pointer types Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1220571 Target Milestone: --- Found By: --- Blocker: --- Vlc fails when built with GCC 14 because of use incompatible pointer types, which used to be warnings in previous versions of GCC but are errors by default in GCC 14: https://build.opensuse.org/package/live_build_log/home:rguenther:plgrnd/vlc… The bug seems to have been reported upstream as https://code.videolan.org/videolan/vlc/-/issues/28441 and to Gentoo as https://bugs.gentoo.org/919068. but there is also yet unresolved) Gentoo issue https://bugs.gentoo.org/919296 so the particular error might not be the only one. For more information on porting to gcc 14, see https://gcc.gnu.org/gcc-14/porting_to.html -- You are receiving this mail because: You are on the CC list for the bug.

1 2