July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1226358] New: VUL-0: CVE-2024-35328: perl-YAML-LibYAML-API: libyaml: denial of service in yaml_parser_parse of the file /src/libyaml/src/parser.c.
by bugzilla_noreply＠suse.com 10 Sep '24

10 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1226358 Bug ID: 1226358 Summary: VUL-0: CVE-2024-35328: perl-YAML-LibYAML-API: libyaml: denial of service in yaml_parser_parse of the file /src/libyaml/src/parser.c. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/410659/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: tina.mueller(a)suse.com Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1226341 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1226341 +++ libyaml v0.2.5 is vulnerable to DDOS. Affected by this issue is the function yaml_parser_parse of the file /src/libyaml/src/parser.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35328 https://www.cve.org/CVERecord?id=CVE-2024-35328 https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35328.c https://bugzilla.redhat.com/show_bug.cgi?id=2292339 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1226365] New: VUL-0: CVE-2024-35325: petsc: libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c
by bugzilla_noreply＠suse.com 10 Sep '24

10 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1226365 Bug ID: 1226365 Summary: VUL-0: CVE-2024-35325: petsc: libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/410664/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: eich(a)suse.com Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1226342 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1226342 +++ A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is the function yaml_event_delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35325 https://www.cve.org/CVERecord?id=CVE-2024-35325 https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35325.c https://bugzilla.redhat.com/show_bug.cgi?id=2292350 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1226362] New: VUL-0: CVE-2024-35325: netdata: libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c
by bugzilla_noreply＠suse.com 10 Sep '24

10 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1226362 Bug ID: 1226362 Summary: VUL-0: CVE-2024-35325: netdata: libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/410664/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: mia(a)0x0.st Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1226342 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1226342 +++ A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is the function yaml_event_delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35325 https://www.cve.org/CVERecord?id=CVE-2024-35325 https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35325.c https://bugzilla.redhat.com/show_bug.cgi?id=2292350 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1226359] New: VUL-0: CVE-2024-35325: perl-YAML-LibYAML-API: libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c
by bugzilla_noreply＠suse.com 10 Sep '24

10 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1226359 Bug ID: 1226359 Summary: VUL-0: CVE-2024-35325: perl-YAML-LibYAML-API: libyaml: double-free in yaml_event_delete in /src/libyaml/src/api.c Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/410664/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: tina.mueller(a)suse.com Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1226342 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1226342 +++ A vulnerability was found in libyaml up to 0.2.5. Affected by this issue is the function yaml_event_delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35325 https://www.cve.org/CVERecord?id=CVE-2024-35325 https://github.com/idhyt/pocs/blob/main/libyaml/CVE-2024-35325.c https://bugzilla.redhat.com/show_bug.cgi?id=2292350 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1225861] New: Package libyui does not build with gcc14
by bugzilla_noreply＠suse.com 09 Sep '24

09 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1225861 Bug ID: 1225861 Summary: Package libyui does not build with gcc14 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1220574 Target Milestone: --- Found By: --- Blocker: --- Package libyui does not build with gcc14. One reason is a new C++ error: [ 17s] /home/abuild/rpmbuild/BUILD/libyui-4.6.1/libyui/src/TreeItem.h:49:23: error: template-id not allowed for constructor in C++20 [-Werror=template-id-cdtor] [ 17s] 49 | TreeItem<PAYLOAD> ( const PAYLOAD & val, [ 17s] | ^ [ 17s] /home/abuild/rpmbuild/BUILD/libyui-4.6.1/libyui/src/TreeItem.h:49:23: note: remove the ‘< >’ but when that is avoided by using option -Wno-error=template-id-cdtor, the compilation dies later on with: In file included from /home/abuild/rpmbuild/BUILD/libyui-4.6.1/libyui/src/FSize.cc:36: /usr/include/boost/multiprecision/cpp_bin_float.hpp:40:10: fatal error: quadmath.h: No such file or directory (ISTR a bootst mis-configuration issue resulting into this early in the GCC 14 development cycle). -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1226153] New: Recent versions of groff cause man pages to show hyphen (U+2010) instead of hyphen-minus (U+002D)
by bugzilla_noreply＠suse.com 09 Sep '24

09 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1226153 Bug ID: 1226153 Summary: Recent versions of groff cause man pages to show hyphen (U+2010) instead of hyphen-minus (U+002D) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: a.samirh78(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Most CLI tools use `-` and `--` to prefix options; if the man page renders the dashes in e.g. `--version` as two hyphens, copy/pasting to a terminal won't work, because it expects a minus or a hyphen-minus character. See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1041731 https://git.savannah.gnu.org/cgit/groff.git/tree/PROBLEMS#n48 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1227625] New: in %post (core dumped) ZYPP_READONLY_HACK=1 zypper refresh-services
by bugzilla_noreply＠suse.com 09 Sep '24

09 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1227625 Bug ID: 1227625 Summary: in %post (core dumped) ZYPP_READONLY_HACK=1 zypper refresh-services Classification: openSUSE Product: openSUSE Distribution Version: Leap 16.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)suse.de Reporter: lubos.kocman(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 875993 --> https://bugzilla.suse.com/attachment.cgi?id=875993&action=edit zypper.log from leap16 Using zypper refresh-services in %post crashes the post-script See line 345 in https://build.opensuse.org/projects/Base:System/packages/openSUSE-repos/fil… Using the add-service with READONLY_HACK and is working, however not regen of repos that most people complain about (missing after initial install etc). %post /var/tmp/rpm-tmp.4eukQ3: line 25: 8351 Aborted (core dumped) ZYPP_READONLY_HACK=1 zypper refresh-services -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1225267] New: openSUSE-release and sles-release can be removed and updated even with zypper lock applied
by bugzilla_noreply＠suse.com 09 Sep '24

09 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1225267 Bug ID: 1225267 Summary: openSUSE-release and sles-release can be removed and updated even with zypper lock applied Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)suse.de Reporter: vanda.barata(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This issue is happening on both SLES 15 SP4 and openSUSE Leap 15.4, as well as Tumbleweed. Zypper is able to lock, and resolve the locks, for the `sles-release` package and the `openSUSE-release` package (on their OS respectively), but the packages can still be upgraded and removed. `zypper ll --solvables` shows the lock ------------------------------------------------------------------------- 7 | openSUSE-release | 3 | package | (any) | Keep installed : openSUSE-release-15.4-lp154.166.1.x86_64 (@System) Do not install : [2] openSUSE-release-15.4-lp154.166.1.x86_64 (repo-update) openSUSE-release-15.4-lp154.153.1.x86_64 (repo-oss) ------------------------------------------------------------------------- but when saving the testcase, it doesn't containt said lock, and it's possible to remove the package. If the product itself is locked (shipped by the release package), it can't be removed, as expected: ------------------------------------------------------------------------- hobbes:~ (0)# zypper al product:Leap Specified lock has been successfully added. hobbes:~ (0)# zypper in -- -openSUSE-release Problem: 1: conflicting requests Solution 1: Following actions will be done: remove lock to allow removal of product:Leap-15.4-1.x86_64 remove lock to allow removal of product:Leap-15.4-1.x86_64 Solution 2: do not ask to delete all solvables providing openSUSE-release.x86_64 = 15.4-lp154.166.1 ------------------------------------------------------------------------- It seems the product lock is applied to the -release package but not the other way around. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1220589] New: lto1 does not finish
by bugzilla_noreply＠suse.com 09 Sep '24

09 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1220589 Bug ID: 1220589 Summary: lto1 does not finish Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- In OBS it crashes, probably because of OOM: https://build.opensuse.org/package/live_build_log/home:michals/ladybird/ope… locally it links forever: 17574 399 20 0 26.796g 0.026t 2156 R 100.0 42.43 40:18.79 lto1-wpa -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1226449] New: Intermittent sound Lenovo Legion Pro 7 16ARX8H
by bugzilla_noreply＠suse.com 09 Sep '24

09 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1226449 Bug ID: 1226449 Summary: Intermittent sound Lenovo Legion Pro 7 16ARX8H Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Sound Assignee: tiwai(a)suse.com Reporter: brynn(a)hotmail.co.uk QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 875531 --> https://bugzilla.suse.com/attachment.cgi?id=875531&action=edit alsa -info.sh With no sound I have intermittent sound from my speakers. Ive had this on a couple of forums for a while to try gather more info but no luck. The quirks have only recently been added to allow the speakers to work and they do but they stop after a few minutes if i open another window or click a notification. However, if i open a video in vlc before they have stopped it will play fine for half an hour. When they have stopped I can bring it back by setting my laptop to sleep and waking it up again the immediately playing something They have stopped in the time its taken to type this out. I’ve attached alsa-info.sh with the sound working and one without from the same boot a few minutes apart. To work around this i can play a long audio file on loop with the volume set to 0. This is somewhat related to Bug 1223462. I never noticed this being an issue with 6.7.9-1-default but don't have it any more and its too far back in the repo history for me to download. Thanks brynn. -- You are receiving this mail because: You are on the CC list for the bug.

1 9