July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1227129] New: chromium GPU errors
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227129 Bug ID: 1227129 Summary: chromium GPU errors Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: elatllat(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Fresh Tumbleweed GNOME install in KVM. Chromium hangs before any GUI shows up. # chromium libva error: /usr/lib64/dri/virtio_gpu_drv_video.so init failed [28135:28135:0626/115134.122807:ERROR:viz_main_impl.cc(166)] Exiting GPU process due to errors during initialization # /usr/bin/chromium --enable-features=UseOzonePlatform --ozone-platform=wayland --force-dark-mode --enable-features=WebUIDarkMode libEGL warning: egl: failed to create dri2 screen libEGL warning: egl: failed to create dri2 screen libEGL warning: NEEDS EXTENSION: falling back to kms\_swrast libva error: /usr/lib64/dri/virtio\_gpu\_drv\_video.so init failed \[28226:28226:0626/115232.941494:ERROR:viz\_main\_impl.cc(166)\] Exiting GPU process due to errors during initialization -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1226088] Driver Audio Tiger Lake-LP Smart Sound Technology Audio Controller Speaker don't work
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1226088 https://bugzilla.suse.com/show_bug.cgi?id=1226088#c8 Michael Andres <ma(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Flags|needinfo?(gustavoblk1@hotma | |il.com) | Resolution|--- |NORESPONSE --- Comment #8 from Michael Andres <ma(a)suse.com> --- Feel free to repoen if the issue persists and the tescase can be provided. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1219720] New: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1219720 Bug ID: 1219720 Summary: VUL-0: CVE-2024-24815: python-django-ckeditor: attackers could inject malformed HTML content bypassing Advanced Content Filtering mechanism Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/393367/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: andrea.mattiazzo(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability has been discovered in the core HTML parsing module in versions of CKEditor4 prior to 4.24.0-lts. It may affect all editor instances that enabled full-page editing mode or enabled CDATA elements in Advanced Content Filtering configuration (defaults to `script` and `style` elements). The vulnerability allows attackers to inject malformed HTML content bypassing Advanced Content Filtering mechanism, which could result in executing JavaScript code. An attacker could abuse faulty CDATA content detection and use it to prepare an intentional attack on the editor. A fix is available in version 4.24.0-lts. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24815 https://www.cve.org/CVERecord?id=CVE-2024-24815 https://ckeditor.com/docs/ckeditor4/latest/api/CKEDITOR_dtd.html#property-S… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html) https://ckeditor.com/docs/ckeditor4/latest/guide/dev_advanced_content_filte… https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html Patch: https://github.com/ckeditor/ckeditor4/commit/8ed1a3c93d0ae5f49f4ecff5738ab8… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1228273] New: kde-apps/kdenlive-24+ missing dependency on kf6-qqc2-desktop-style
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228273 Bug ID: 1228273 Summary: kde-apps/kdenlive-24+ missing dependency on kf6-qqc2-desktop-style Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: KDE Applications Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: S48GS(a)hotmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Same as https://bugs.gentoo.org/931924 kdenlive 24.05.2 In openSUSE - kdenlive wont start and crash with error: qrc:/qml/kdenliveclipmonitor.qml: module "org.kde.desktop" is not installed KCrash: Application 'kdenlive' crashing... crashRecursionCounter = 2 After installing kf6-qqc2-desktop-style - kdenlive work. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228274] New: lxc-net does not work without iptables and dnsmasq, and lxc does not work without apparmor
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228274 Bug ID: 1228274 Summary: lxc-net does not work without iptables and dnsmasq, and lxc does not work without apparmor Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Leap 15.5 Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Other Assignee: virt-bugs(a)suse.de Reporter: fijik19(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- It seems, that lxc-net service does not work without iptables and dnsmasq, which is not required by lxc package, also, lxc-start fails without apparmor-profiles package installed -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228273] kde-apps/kdenlive-24+ missing dependency on kf6-qqc2-desktop-style
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228273 https://bugzilla.suse.com/show_bug.cgi?id=1228273#c2 Christophe Marin <christophe(a)krop.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #2 from Christophe Marin <christophe(a)krop.fr> --- SR#1189361 submitted. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228273] kde-apps/kdenlive-24+ missing dependency on kf6-qqc2-desktop-style
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228273 https://bugzilla.suse.com/show_bug.cgi?id=1228273#c1 --- Comment #1 from Christophe Marin <christophe(a)krop.fr> --- The error is worth reporting the issue upstream, there's no hint in the CMake log that qqc2-desktop-style is a runtime dependency -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1225457] New: [Build 20240527] openQA test fails in apache2_changehat
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1225457 Bug ID: 1225457 Summary: [Build 20240527] openQA test fails in apache2_changehat Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/4227639/modules/apac he2_changehat/steps/10 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor Assignee: suse-beta(a)cboltz.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation aa-teardown fails with errors like: /lib/apparmor/rc.apparmor.functions: line 259: printf: write error: No such file or directory openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-apparmor_profile@64bit fails in [apache2_changehat](https://openqa.opensuse.org/tests/4227639/modules/apache… ## Test suite description Maintained by QE Security ## Reproducible Fails since (at least) Build [20240527](https://openqa.opensuse.org/tests/4226865) ## Expected result Last good: [20240524](https://openqa.opensuse.org/tests/4221575) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1227255] New: VUL-0: CVE-2024-38998: nodejs-electron: requirejs: prototype pollution via function config
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227255 Bug ID: 1227255 Summary: VUL-0: CVE-2024-38998: nodejs-electron: requirejs: prototype pollution via function config Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/412486/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: brunopitrus(a)hotmail.com Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1227247 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1227247 +++ jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function config. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-38998 https://www.cve.org/CVERecord?id=CVE-2024-38998 https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a https://bugzilla.redhat.com/show_bug.cgi?id=2294942 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1227256] New: VUL-0: CVE-2024-38999: nodejs-electron: prototype pollution via function s.contexts._.configure
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1227256 Bug ID: 1227256 Summary: VUL-0: CVE-2024-38999: nodejs-electron: prototype pollution via function s.contexts._.configure Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/412487/ OS: Other Status: NEW Severity: Major Priority: P5 - None Component: Security Assignee: brunopitrus(a)hotmail.com Reporter: camila.matos(a)suse.com QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com, security-team(a)suse.de, smash_bz(a)suse.de Blocks: 1227251 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1227251 +++ jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. References: https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-38999 https://www.cve.org/CVERecord?id=CVE-2024-38999 -- You are receiving this mail because: You are on the CC list for the bug.

1 4