August 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1228841] New: VUL-0: CVE-2024-28573: freeimage: buffer overflow in peg_read_exif_profile() function when reading images in JPEG format
by bugzilla_noreply＠suse.com 05 Aug '24

05 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228841 Bug ID: 1228841 Summary: VUL-0: CVE-2024-28573: freeimage: buffer overflow in peg_read_exif_profile() function when reading images in JPEG format Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/398662/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: jengelh(a)inai.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the jpeg_read_exif_profile() function when reading images in JPEG format. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28573 https://bugzilla.redhat.com/show_bug.cgi?id=2270970 https://github.com/Ruanxingzhi/vul-report/tree/master/freeimage-r1909 https://www.cve.org/CVERecord?id=CVE-2024-28573 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1226112] Supersede kmozillahelper by xdg-desktop-portal integration
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1226112 https://bugzilla.suse.com/show_bug.cgi?id=1226112#c5 --- Comment #5 from Björn Bidar <bjorn.bidar(a)thaodan.de> --- (In reply to Fabian Vogt from comment #4) > (In reply to Björn Bidar from comment #3) > > What is left that kmozillahelper does that the new switch to use the > > XDG-Portal doesn't do? > > Nothing really relevant anymore FWICT. > > > From my point of view there should be no downside to use portals by default > > even outside of Plasma as it can useful for other use cases. > > Not sure whether there are any edgecases. Some DEs might not have portals > configured correctly or not available at all. So IMO doing this only for > Plasma for now is safer. I don't think that's needed since GTK will use the dialog that doesn't use portals as fallback if no portal can be found: https://gitlab.gnome.org/GNOME/gtk/-/blob/gtk-3-24/gtk/gtkfilechoosernative… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1224773] NVIDIA KMP: initrd not regenerated on transactional systems using systemd-boot like Aeon >= RC2
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1224773 https://bugzilla.suse.com/show_bug.cgi?id=1224773#c64 --- Comment #64 from Imo Hester <vortex(a)z-ray.de> --- Sorry for all the influx of emails. For now I have to enter the recovery key every single time I boot the system too. Hopefully this will fix itself as soon as the initial issue with the driver installation itself is solved. ^^" -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228836] New: scrcpy contains pre-built binaries
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228836 Bug ID: 1228836 Summary: scrcpy contains pre-built binaries Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: munix9(a)googlemail.com Reporter: Andreas.Stieger(a)gmx.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- scrcpy seems to contain pre-built binaries: URL: https://github.com/Genymobile/scrcpy Source0: %{url}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz Source1: %{url}/releases/download/v%{version}/scrcpy-server-v%{version} $ file scrcpy-server-v2.6.1 scrcpy-server-v2.6.1: Android package (APK), with gradle app-metadata.properties https://github.com/Genymobile/scrcpy/blob/master/doc/build.md#build https://github.com/Genymobile/scrcpy/blob/master/doc/build.md#option-2-use-… This appears to be in violation of packaging policy: https://en.opensuse.org/openSUSE:Packaging_guidelines#No_inclusion_of_pre-b… If the package can be made functional without this BLOB, please do so. If not, built the binary from sources either in the package or as a separate package. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1175644] windows:mingw:win{32|64}/mingw{32|64}-ngspice
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1175644 https://bugzilla.suse.com/show_bug.cgi?id=1175644#c1 Ralf Habacker <ralf.habacker(a)freenet.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #1 from Ralf Habacker <ralf.habacker(a)freenet.de> --- With actual ngspice version the mentioned libraries are loaded correctly. 0134:0138: loads DLL Z:\usr\i686-w64-mingw32\sys-root\mingw\lib\ngspice\spice2poly.cm @0000000078290000 (237056<1638>) 0134:0138: loads DLL Z:\usr\i686-w64-mingw32\sys-root\mingw\lib\ngspice\analog.cm @00000000781B0000 (795648<3588>) 0134:0138: loads DLL Z:\usr\i686-w64-mingw32\sys-root\mingw\lib\ngspice\digital.cm @0000000078090000 (1074688<3982>) 0134:0138: loads DLL Z:\usr\i686-w64-mingw32\sys-root\mingw\lib\ngspice\xtradev.cm @0000000077FF0000 (485376<2571>) 0134:0138: loads DLL Z:\usr\i686-w64-mingw32\sys-root\mingw\lib\ngspice\xtraevt.cm @0000000077F80000 (305152<1946>) 0134:0138: loads DLL Z:\usr\i686-w64-mingw32\sys-root\mingw\lib\ngspice\table.cm @0000000077EF0000 (460800<2212>) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1210211] windows:mingw:win{32|64}: Some packages overwrite definitions already provided by cmake macros
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1210211 https://bugzilla.suse.com/show_bug.cgi?id=1210211#c2 Ralf Habacker <ralf.habacker(a)freenet.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED --- Comment #2 from Ralf Habacker <ralf.habacker(a)freenet.de> --- Fixed with https://build.opensuse.org/package/rdiff/windows:mingw:win32/mingw32-libsat… and https://build.opensuse.org/package/rdiff/windows:mingw:win64/mingw64-libsat… -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1227294] New: windows:mingw:win{32|64}/mingw{32|64}-kxxxx: Update to 5.103.0 required
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1227294 Bug ID: 1227294 Summary: windows:mingw:win{32|64}/mingw{32|64}-kxxxx: Update to 5.103.0 required Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: 3rd party software Assignee: ralf.habacker(a)freenet.de Reporter: ralf.habacker(a)freenet.de QA Contact: screening-team-bugs(a)suse.de CC: mkbosmans(a)gmail.com Depends on: 1227293 Target Milestone: --- Found By: --- Blocker: --- KDE frameworks version >= 5.90 is required to create Windows binary files for the upcoming version 5.2 of KMyMoney. To correspond to the native version used on Leap, version 5.103.0 would be desirable. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1228691] YaST2 Qt: Missing Chinese glyphs
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

1 0

[Bug 1228659] Snapshot 20240730 - unbootable after transactional-update dup
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228659 https://bugzilla.suse.com/show_bug.cgi?id=1228659#c39 --- Comment #39 from Matej Cepl <mcepl(a)suse.com> --- And the distro is Moldavite (https://sr.ht/~mcepl/moldavite/, basically Richard’s Greybeard, MicroOS with Sway). -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1228659] Snapshot 20240730 - unbootable after transactional-update dup
by bugzilla_noreply＠suse.com 04 Aug '24

04 Aug '24

https://bugzilla.suse.com/show_bug.cgi?id=1228659 https://bugzilla.suse.com/show_bug.cgi?id=1228659#c38 Matej Cepl <mcepl(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mcepl(a)suse.com --- Comment #38 from Matej Cepl <mcepl(a)suse.com> --- Created attachment 876475 --> https://bugzilla.suse.com/attachment.cgi?id=876475&action=edit screenshot of the crash (In reply to Alberto Planas Dominguez from comment #17) > I cannot reproduce the issue here, maybe because my systems are in systemd > v256. > > Can I request that some one with the issue report the output of: > > bootctl 2>/dev/null | sed -ne 's/Firmware Arch: > *$\w\+$/firmware_arch="\1"/p;s/ *token: *$\w\+$/entry_token="\1"/p;s, > *\$BOOT: *$[^ ]\+$.*,boot_root="\1",p' > > It should return something like: > > firmware_arch="x64" > boot_root="/boot/efi" > entry_token="opensuse"-microos mitmanek:~ # bootctl 2>/dev/null | sed -ne 's/Firmware Arch: *$\w\+$/firmware_arch="\1"/p;s/ *token: *$\w\+$/entry_token="\1"/p;s, *\$BOOT: *$[^ ]\+$.*,boot_root="\1",p' firmware_arch="x64" boot_root="/boot/efi" entry_token="bfb41e21a4f34f10958f75adb1378666" mitmanek:~ # And yes that’s both in the transactional-update shell and the outside. And yes, inside the t-u shell I have transactional update # cat /etc/sysconfig/bootloader DEFAULT_APPEND="root=UUID=063dd8c0-910b-4d56-b14a-df6915277baf " FAILSAFE_APPEND="root=UUID=063dd8c0-910b-4d56-b14a-df6915277baf ide=nodma apm=off noresume edd=off nomodeset 3 " # LOADER_LOCATION=none LOADER_TYPE=systemd-boot SECURE_BOOT=yes transactional update # and transactional update # rpm -qa \*systemd\* coreutils-systemd-9.5-3.1.x86_64 systemd-experimental-256.4-1.2.x86_64 systemd-presets-common-SUSE-15-32.2.noarch systemd-rpm-macros-24-1.6.noarch systemd-presets-branding-Aeon-20231005-5.1.noarch systemd-default-settings-0.10-1.1.noarch systemd-default-settings-branding-openSUSE-0.10-1.1.noarch systemd-boot-256.4-1.2.x86_64 systemd-lang-256.4-1.2.noarch libsystemd0-256.4-1.2.x86_64 util-linux-systemd-2.40.1-5.1.x86_64 systemd-256.4-1.2.x86_64 transactional update # rpm -V coreutils-systemd systemd-experimental systemd-presets-common-SUSE systemd-rpm-macros systemd-presets-branding-Aeon systemd-default-settings systemd-default-settings-branding-openSUSE systemd-boot systemd-lang libsystemd0 util-linux-systemd systemd .....UG.. c /etc/machine-id transactional update # -- You are receiving this mail because: You are on the CC list for the bug.

1 0