August 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1227873] lightdm doesn't respawn X-Server when it was terminated / dm-tool accepts arbitray "display numbers"
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1227873 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |sor.alexei(a)meowr.ru -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228100] Linking error in package perl-PCP-PMDA
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228100 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |ddiss(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228910] New: VUL-0: CVE-2024-7543: ofono: lack of proper validation of the length of user-supplied data when parsing STK command PDUs leads to heap-based buffer overflow
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228910 Bug ID: 1228910 Summary: VUL-0: CVE-2024-7543: ofono: lack of proper validation of the length of user-supplied data when parsing STK command PDUs leads to heap-based buffer overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416429/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23456. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7543 https://www.cve.org/CVERecord?id=CVE-2024-7543 http://www.zerodayinitiative.com/advisories/ZDI-24-1083/ https://bugzilla.redhat.com/show_bug.cgi?id=2303006 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228913] New: VUL-0: CVE-2024-7544: ofono: lack of proper validation of the length of user-supplied data when parsing the STK command PDUs leads to heap-based buffer overflow
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228913 Bug ID: 1228913 Summary: VUL-0: CVE-2024-7544: ofono: lack of proper validation of the length of user-supplied data when parsing the STK command PDUs leads to heap-based buffer overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416430/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23457. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7544 https://www.cve.org/CVERecord?id=CVE-2024-7544 http://www.zerodayinitiative.com/advisories/ZDI-24-1084/ https://bugzilla.redhat.com/show_bug.cgi?id=2303007 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228914] New: VUL-0: CVE-2024-7545: ofono: lack of proper validation of the length of user-supplied data within the parsing of STK command PDUs leads to a heap-based buffer overflow
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228914 Bug ID: 1228914 Summary: VUL-0: CVE-2024-7545: ofono: lack of proper validation of the length of user-supplied data within the parsing of STK command PDUs leads to a heap-based buffer overflow Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416431/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: mpluskal(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23458. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7545 https://www.cve.org/CVERecord?id=CVE-2024-7545 http://www.zerodayinitiative.com/advisories/ZDI-24-1085/ https://bugzilla.redhat.com/show_bug.cgi?id=2303008 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228805] Uninstall orphaned "openSUSE-release-dvd" will uninstall whole system
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228805 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |lubos.kocman(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228826] On MicroOS "btrfs qgroup clear-stale" fails in snapper-cleanup.service
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228826 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |dsterba(a)suse.com -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228821] amdgpu: IP block:gfx_v8_0 is hung!
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228821 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Other |Kernel Assignee|screening-team-bugs(a)suse.de |kernel-bugs(a)opensuse.org -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228824] libbotan 2 > 3 switch breaks dependencies?
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228824 https://bugzilla.suse.com/show_bug.cgi?id=1228824#c13 Andreas Stieger <Andreas.Stieger(a)gmx.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED --- Comment #13 from Andreas Stieger <Andreas.Stieger(a)gmx.de> --- Fixed in keepassxc 2.7.9-2.1 zypper info --requires keepassxc | grep botan libbotan-3.so.5()(64bit) (In reply to Thomas Rother from comment #12) > I don't know if this is related No. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1212118] [crun] "run.oci.keep_original_groups=1" causes "cannot find name for group ID" error
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1212118 https://bugzilla.suse.com/show_bug.cgi?id=1212118#c2 Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexandre.vicenzi(a)suse.com --- Comment #2 from Alexandre Vicenzi <alexandre.vicenzi(a)suse.com> --- By default, there's no group nobody in the Tumbleweed image, but Fedora has, as shown bellow: alexandre@localhost:~> podman run tumbleweed cat /etc/group root:x:0: shadow:x:15: trusted:x:42: users:x:100: alexandre@localhost:~> podman run fedora cat /etc/group root:x:0: bin:x:1: daemon:x:2: sys:x:3: adm:x:4: tty:x:5: disk:x:6: lp:x:7: mem:x:8: kmem:x:9: wheel:x:10: cdrom:x:11: mail:x:12: man:x:15: dialout:x:18: floppy:x:19: games:x:20: tape:x:33: video:x:39: ftp:x:50: lock:x:54: audio:x:63: users:x:100: nobody:x:65534: tss:x:59: This is due to system-user-nobody package not being installed in the image. Installing this package should fix the missing group. -- You are receiving this mail because: You are on the CC list for the bug.

1 0