July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228272] New: When using systemd-boot, dracut uses wrong target file
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228272 Bug ID: 1228272 Summary: When using systemd-boot, dracut uses wrong target file Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: tilman.vogel(a)web.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- When after an upgrade, /usr/lib/module-init-tools/regenerate-initrd-posttrans runs dracut -f --kver "$kver" the generated initrd goes to /boot/efi/<somehexid>/$kver/initrd which looks right but is in fact incorrect because /boot/efi/loader/entries/<somehexid>-$kver.conf actually uses initrd /<somehexid>/$kver/initrd-$kver Note the trailing "-$kver". So, after running dracut, there are two initrds: /boot/efi/<somehexid>/$kver/initrd /boot/efi/<somehexid>/$kver/initrd-$kver of which the former is the new one but ignored and the latter is an older one which will still be used. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228222] New: VUL-0: CVE-2024-32484: anki: arbitrary file read through reflected XSS when handling invalid paths in the Flask server
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228222 Bug ID: 1228222 Summary: VUL-0: CVE-2024-32484: anki: arbitrary file read through reflected XSS when handling invalid paths in the Flask server Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/414904/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mvetter(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32484 https://www.cve.org/CVERecord?id=CVE-2024-32484 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1995 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1228220] New: VUL-0: CVE-2024-32152: anki: arbitrary file creation at a fixed path through the LaTeX functionality
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228220 Bug ID: 1228220 Summary: VUL-0: CVE-2024-32152: anki: arbitrary file creation at a fixed path through the LaTeX functionality Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/414903/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mvetter(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32152 https://www.cve.org/CVERecord?id=CVE-2024-32152 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1994 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1228217] New: VUL-0: CVE-2024-26020: anki: arbitrary script execution through the MPV functionality
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228217 Bug ID: 1228217 Summary: VUL-0: CVE-2024-26020: anki: arbitrary script execution through the MPV functionality Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/414901/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mvetter(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-26020 https://www.cve.org/CVERecord?id=CVE-2024-26020 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1220103] New: parcellite locks up when 'clear option is selected from the toolbar popup menu
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1220103 Bug ID: 1220103 Summary: parcellite locks up when 'clear option is selected from the toolbar popup menu Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: X11 Applications Assignee: screening-team-bugs(a)suse.de Reporter: msuchanek(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- parcellite-1.2.1-bp155.3.13.x86_64 When the 'clear' option is selected from parcellite toolbar popup menu a dialog with two buttons is displayed. It does not react to mouse clicks not keyboard input, and blocks further interaction with parcellite. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1228169] VM with passed through GPU no longer boots ("Deprecated CPU topology")
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228169 https://bugzilla.suse.com/show_bug.cgi?id=1228169#c3 --- Comment #3 from Dario Faggioli <dfaggioli(a)suse.com> --- (In reply to Alan Lima from comment #2) > (In reply to Dario Faggioli from comment #1) > > A backport of that commit is included in 9.0.2. > > > > I'll get that packaged ASAP, so that we get the fix in Tumbleweed. > > thanks for the response, is there any ETA for it ? No -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228263] New: Unable to set locale to Australian english en_AU
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228263 Bug ID: 1228263 Summary: Unable to set locale to Australian english en_AU Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: 64bit OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Translations Assignee: ke(a)suse.com Reporter: brian.butler(a)internode.on.net QA Contact: ke(a)suse.com Target Milestone: --- Found By: --- Blocker: --- There is no option to set my system locale to en_AU even though I can set my time zone to Australian CST. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228252] Please provide wxPython for Python 3.11
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228252 https://bugzilla.suse.com/show_bug.cgi?id=1228252#c2 Daniel Garcia <daniel.garcia(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(aaron.w2(a)gmail.co | |m) CC| |aaron.w2(a)gmail.com, | |daniel.garcia(a)suse.com Assignee|python-maintainers(a)suse.com |daniel.garcia(a)suse.com Status|NEW |IN_PROGRESS --- Comment #2 from Daniel Garcia <daniel.garcia(a)suse.com> --- I've tried to patch the python-wxPython to build with python 3.11 in Leap 15.4 and greater. https://build.opensuse.org/package/show/home:dgarcia:branches:SUSE:SLE-15-S… Can you try this version? If you can confirm that it's working correctly I can try to push to the SLE modern python stack or we can think about sending it just for Leap 15.6. I'll need to review the case to see what's better. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228058] AUDIT-0: emacs: setgid-games shared highscore helper program
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228058 https://bugzilla.suse.com/show_bug.cgi?id=1228058#c10 Matthias Gerstner <matthias.gerstner(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Flags|needinfo?(matthias.gerstner | |(a)suse.com) | Resolution|--- |FIXED --- Comment #10 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to Dr. Werner Fink from comment #8) > Means it is up on the system admin to add trustworthy users to the group > games Indeed, such an opt-in solution is much preferred. You can add this to the package's documentation. Closing this bug as fixed otherwise. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228058] AUDIT-0: emacs: setgid-games shared highscore helper program
by bugzilla_noreply＠suse.com 24 Jul '24

24 Jul '24

https://bugzilla.suse.com/show_bug.cgi?id=1228058 https://bugzilla.suse.com/show_bug.cgi?id=1228058#c9 --- Comment #9 from Matthias Gerstner <matthias.gerstner(a)suse.com> --- (In reply to Matthias Gerstner from comment #6) > Otherwise running the update-game-score helper as setgid-games is not a good > idea. There's a bunch of issues: I forgot to list one more problem: Environment variables are not sanitized. This allows to e.g. set malloc debugging settings like MALLOC_ARENA_MAX and others that influence the malloc() behaviour. -- You are receiving this mail because: You are on the CC list for the bug.

1 0