August 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228808] grub error: ../../grub-core/script/function.c:119:can't find command `None'. error: ../../grub-core/commands/terminal.c:113:terminal `serial' isn't found. error: ../../grub-core/commands/terminal.c:113:terminal `serial' isn't found.
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228808 https://bugzilla.suse.com/show_bug.cgi?id=1228808#c1 Gary Ching-Pang Lin <glin(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |glin(a)suse.com --- Comment #1 from Gary Ching-Pang Lin <glin(a)suse.com> --- Why is GRUB_SERIAL_COMMAND set as "None"? Per the description of GRUB_SERIAL_COMMAND in the document(*), it's "A command to configure the serial port when using the serial console.", so it's supposed to be "serial", so something like "serial --port=0x3f8 --speed=9600" in case you need some extra configuration for the serial console. (*) https://www.gnu.org/software/grub/manual/grub/html_node/Simple-configuratio… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228849] [SELinux] various AVC denials related to libvirt
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228849 https://bugzilla.suse.com/show_bug.cgi?id=1228849#c1 Filippo Bonazzi <filippo.bonazzi(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |filippo.bonazzi(a)suse.com --- Comment #1 from Filippo Bonazzi <filippo.bonazzi(a)suse.com> --- We have some updates related to qemu/libvirt in the upcoming policy update for august, so this could already be solved. Let's re-evaluate once the update is released (should be released Thursday I believe). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228891] New: VUL-0: CVE-2024-28583: freeimage: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the readLine() function when reading images in XPM format.
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228891 Bug ID: 1228891 Summary: VUL-0: CVE-2024-28583: freeimage: Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the readLine() function when reading images in XPM format. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416380/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: adrian.schroeter(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the readLine() function when reading images in XPM format. References: https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28583 https://www.cve.org/CVERecord?id=CVE-2024-28583 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1228895] New: VUL-0: CVE-2024-6782: calibre: Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228895 Bug ID: 1228895 Summary: VUL-0: CVE-2024-6782: calibre: Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416447/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jnweiger(a)gmail.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6782 https://www.cve.org/CVERecord?id=CVE-2024-6782 https://github.com/kovidgoyal/calibre/commit/38a1bf50d8cd22052ae59c51381670… https://starlabs.sg/advisories/24/24-6782/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228894] New: VUL-0: CVE-2024-7009: calibre: Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228894 Bug ID: 1228894 Summary: VUL-0: CVE-2024-7009: calibre: Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416450/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jnweiger(a)gmail.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7009 https://www.cve.org/CVERecord?id=CVE-2024-7009 https://github.com/kovidgoyal/calibre/commit/d56574285e8859d3d715eb7829784e… https://starlabs.sg/advisories/24/24-7009/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228893] New: VUL-0: CVE-2024-7008: calibre: Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228893 Bug ID: 1228893 Summary: VUL-0: CVE-2024-7008: calibre: Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416449/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jnweiger(a)gmail.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7008 https://www.cve.org/CVERecord?id=CVE-2024-7008 https://github.com/kovidgoyal/calibre/commit/863abac24e7bc3e5ca0b3307362ff1… https://starlabs.sg/advisories/24/24-7008/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228892] New: VUL-0: CVE-2024-6781: calibre: Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228892 Bug ID: 1228892 Summary: VUL-0: CVE-2024-6781: calibre: Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/416446/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jnweiger(a)gmail.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: thomas.leroy(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6781 https://www.cve.org/CVERecord?id=CVE-2024-6781 https://github.com/kovidgoyal/calibre/commit/bcd0ab12c41a887f8290a9b56e46c3… https://starlabs.sg/advisories/24/24-6781/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228833] systemd-sleep - suspend not working
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228833 https://bugzilla.suse.com/show_bug.cgi?id=1228833#c5 --- Comment #5 from Thomas Blume <thomas.blume(a)suse.com> --- (In reply to Michael Hirmke from comment #4) > Thx - I read that section, but "undesired behavior" is not really concrete. > What may happen? You can find a good explanation here: https://github.com/systemd/systemd/issues/33083#issuecomment-2191889790 You might not see a difference to older systems since user session freezing was implemented with systemd version 2.5.2. With: SYSTEMD_SLEEP_FREEZE_USER_SESSIONS=false you just restore the old behaviour (before systemd version 2.5.2). So, if you had an older system and suspend was working there it should also work with the above setting. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228601] AsmediaUSB4 1b21:2425 unreliable
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228601 https://bugzilla.suse.com/show_bug.cgi?id=1228601#c3 --- Comment #3 from Takashi Iwai <tiwai(a)suse.com> --- Did you install from the repo above, not from OBS Kernel:stable? Kernel:stable:Backport is compatible with Leap, while Kernel:stable is only for TW. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228808] grub error: ../../grub-core/script/function.c:119:can't find command `None'. error: ../../grub-core/commands/terminal.c:113:terminal `serial' isn't found. error: ../../grub-core/commands/terminal.c:113:terminal `serial' isn't found.
by bugzilla_noreply＠suse.com 06 Aug '24

06 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228808 Chenzi Cao <chcao(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|screening-team-bugs(a)suse.de |bootloader-maintainers@suse | |.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0