August 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1215347] New: VUL-0: CVE-2023-4863: zola: Heap buffer overflow in WebP
by bugzilla_noreply＠suse.com 27 Nov '24

27 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1215347 Bug ID: 1215347 Summary: VUL-0: CVE-2023-4863: zola: Heap buffer overflow in WebP Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://smash.suse.de/issue/377966/ OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Security Assignee: socvirnyl.estela(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de CC: Andreas.Stieger(a)gmx.de, gianluca.gabrielli(a)suse.com, gmbr3(a)opensuse.org, gnome-bugs(a)suse.de, jengelh(a)inai.de, m.szczepaniak.000(a)gmail.com, martin.sirringhaus(a)suse.com, meissner(a)suse.com, security-team(a)suse.de, wolfgang(a)rosenauer.org, xiaoguang.wang(a)suse.com Depends on: 1215231 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1215231 +++ CVE-2023-4863 The Stable and Extended stable channels has been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. This update includes 1 security fix. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information. CVE-2023-4863: Heap buffer overflow in WebP. Reported by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06 Google is aware that an exploit for CVE-2023-4863 exists in the wild. Upstream bug(s): https://code.google.com/p/chromium/issues/detail?id=1479274 References: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-des… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4863 https://bugzilla.redhat.com/show_bug.cgi?id=2238431 -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1225509] New: AUDIT-FIND: 4Pane: predictable /tmp path in PreviewPopup::DisplayImage
by bugzilla_noreply＠suse.com 27 Nov '24

27 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1225509 Bug ID: 1225509 Summary: AUDIT-FIND: 4Pane: predictable /tmp path in PreviewPopup::DisplayImage Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: wolfgang.frisch(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- 4Pane uses predictable /tmp paths in PreviewPopup::DisplayImage() > 2054 pngfilepath = "/tmp/" + fn.GetName() + ".png"; > 2055 if (SvgToPng(filepath, pngfilepath, handle)) > 2056 image = wxImage(pngfilepath); > 2057 wxRemoveFile(pngfilepath); If fs.protected_symlinks=1, an unprivileged user can prevent 4Pane from displaying previews for SVG images. If fs.protected_symlinks=0, an unprivileged user can overwrite arbitrary world-readable files owned by the 4Pane user. Steps to reproduce: nobody@localhost:/tmp> ln -s /home/user/somefile foo.png # ... wait until the user previews a file named foo.svg # somefile will be overwritten An attacker can pre-create symlinks for the names of all existing SVG files on the system to increase the likelihood of triggering the bug. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1213370] New: tesseract-ocr should not be built with experimantal opencl support
by bugzilla_noreply＠suse.com 25 Nov '24

25 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1213370 Bug ID: 1213370 Summary: tesseract-ocr should not be built with experimantal opencl support Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: opensuse(a)titlis.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- opencl in tesseract-ocr is considered experimental, according to this thread (https://groups.google.com/g/tesseract-ocr/c/eIQbsurfSEM/m/mVb_4GF1BgAJ) it is considered just an entry point for possible developers. Their own doucmentantion (https://tesseract-ocr.github.io/tessdoc/TesseractOpenCL.html) states: "Important note: OpenCL support in Tesseract is still considered experimental. There are some major bugs associated with it (see issue 837). Building Tesseract with OpenCL support is not recommended (for any version of Tesseract), unless you are a developer and want to improve the OpenCL code" Please remove the flag "--enable-opencl" from https://build.opensuse.org/package/view_file/openSUSE:Factory/tesseract-ocr… This would also resolve https://bugzilla.opensuse.org/show_bug.cgi?id=1207570 PS: I indeed encounter problems with the opencl code path -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1226321] New: HTTPie SSL certificate problems with python-requests 2.32.3 (fine with 2.32.2)
by bugzilla_noreply＠suse.com 24 Nov '24

24 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1226321 Bug ID: 1226321 Summary: HTTPie SSL certificate problems with python-requests 2.32.3 (fine with 2.32.2) Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: w01dnick(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- After update of python311-requests to version 2.32.3 HTTPie stopped accepting SSL certificates: ``` https google.com https: error: SSLError: HTTPSConnectionPool(host='google.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))) while doing a GET request to URL: https://google.com/ ``` Downgrading python311-requests to 2.32.2 from history [1] solves the problem and HTTPie works fine again. IDK if it's a python-requests API change and this should be reported upstream. [1] https://cdn.opensuse.org/history/20240610/tumbleweed/repo/oss/noarch/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1226112] New: Supersede kmozillahelper by xdg-desktop-portal integration
by bugzilla_noreply＠suse.com 21 Nov '24

21 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1226112 Bug ID: 1226112 Summary: Supersede kmozillahelper by xdg-desktop-portal integration Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Enhancement Priority: P5 - None Component: Firefox Assignee: factory-mozilla(a)lists.opensuse.org Reporter: fabian(a)ritter-vogt.de QA Contact: qa-bugs(a)suse.de CC: opensuse-kde-bugs(a)opensuse.org Target Milestone: --- Found By: --- Blocker: --- For some time now, Firefox (and Thunderbird I hope) can use xdg-desktop-portal APIs for DE integration. We should try to migrate away from kmozillahelper in favor of using the builtin xdg-desktop-portal integration. For that, we need to make sure that on Plasma it uses xdg-desktop-portal instead of GTK file dialogs out of the box. Currently this needs to be done manually by setting widget.use-xdg-desktop-portal.file-picker=1 widget.use-xdg-desktop-portal.mime-handler=1 I'm not sure about widget.use-xdg-desktop-portal.open-uri. Can we get FF and TB configured such that it uses xdg-desktop-portal by default if it detects a Plasma session? -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1219306] New: [Tracker[ Remove python2 from openSUSE:Factory
by bugzilla_noreply＠suse.com 21 Nov '24

21 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1219306 Bug ID: 1219306 Summary: [Tracker[ Remove python2 from openSUSE:Factory Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Python Assignee: python-maintainers(a)suse.com Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This bug report serves as parent to file tickets against packages still using python2 (our long-awaited gimp 3 should be coming out in May - let's collect what else is still in need of python2, trying to eliminate these things) -- You are receiving this mail because: You are on the CC list for the bug.

1 26

[Bug 1219405] New: older clang package depends on latest libLLVM
by bugzilla_noreply＠suse.com 19 Nov '24

19 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1219405 Bug ID: 1219405 Summary: older clang package depends on latest libLLVM Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Development Assignee: screening-team-bugs(a)suse.de Reporter: shung-hsi.yu(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Trying to install older clang will pull in the latest llvm package (libclang13 and libLLVM17): > $ zypper install clang16 # (latest is clang17 at the moment) > > The following 11 NEW packages are going to be installed: > clang16 libLLVM16 libLLVM17 libclang-cpp16 libclang-cpp17 libclang13 > libedit0 libmpdec3 libpython3_11-1_0 python311-base update-alternatives The problem is likely that c-index-test-16 is incorrectly linked to /lib64/libclang.so.13 that is created from the latest llvm package (llvm17 at the moment), and that ends up making it linked to both the latest llvm shared library (libLLVM.so.17 from llvm17) as well as one in the corresponding package (libLLVM.so.16 from llvm16). > $ ldd /usr/bin/c-index-test-16.0.6 > linux-vdso.so.1 (0x00007ffce2336000) > libclang.so.13 => /lib64/libclang.so.13 (0x00007fb21ca18000) > libclang-cpp.so.16 => /lib64/libclang-cpp.so.16 (0x00007fb218800000) > libxml2.so.2 => /lib64/libxml2.so.2 (0x00007fb218690000) > libLLVM.so.16 => /lib64/libLLVM.so.16 (0x00007fb211200000) > libstdc++.so.6 => /lib64/libstdc++.so.6 (0x00007fb210e00000) > libc.so.6 => /lib64/libc.so.6 (0x00007fb210a00000) > libclang-cpp.so.17 => /lib64/libclang-cpp.so.17 (0x00007fb20c800000) > libLLVM.so.17 => /lib64/libLLVM.so.17 (0x00007fb205200000) > libm.so.6 => /lib64/libm.so.6 (0x00007fb21c92f000) > /lib64/ld-linux-x86-64.so.2 (0x00007fb21cb11000) > libz.so.1 => /lib64/glibc-hwcaps/x86-64-v3/libz.so.1.3 (0x00007fb218676000) > liblzma.so.5 => /lib64/glibc-hwcaps/x86-64-v3/liblzma.so.5.4.5 (0x00007fb21863d000) > libedit.so.0 => /lib64/libedit.so.0 (0x00007fb218601000) > libtinfo.so.6 => /lib64/libtinfo.so.6 (0x00007fb2111c5000) > libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fb2111a0000) c-index-test-16.0.6 thus will segfault when ran > #0 0x00007fccc253d319 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/lib64/libLLVM.so.17+0x3b3d319) > #1 0x00007fccc253aed2 llvm::sys::RunSignalHandlers() (/lib64/libLLVM.so.17+0x3b3aed2) > #2 0x00007fccc253db9b (/lib64/libLLVM.so.17+0x3b3db9b) > #3 0x00007fccca23f190 __restore_rt (/lib64/libc.so.6+0x3f190) > #4 0x00007fccc724587a (/lib64/libclang-cpp.so.17+0x124587a) > #5 0x00007fccca2414e1 __cxa_finalize (/lib64/libc.so.6+0x414e1) > #6 0x00007fccc719c0f7 (/lib64/libclang-cpp.so.17+0x119c0f7) > Segmentation fault (core dumped) -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1229339] New: Leap 15.5 sle-update repo key expires soon
by bugzilla_noreply＠suse.com 18 Nov '24

18 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1229339 Bug ID: 1229339 Summary: Leap 15.5 sle-update repo key expires soon Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Critical Priority: P5 - None Component: Maintenance Assignee: maintenance(a)opensuse.org Reporter: fvogt(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Repository: Update repository with updates from SUSE Linux Enterprise 15 Key Fingerprint: FEAB 5025 39D8 46DB 2C09 61CA 70AF 9E81 39DB 7C82 Key Name: SuSE Package Signing Key <build(a)suse.de> Key Algorithm: RSA 2048 Key Created: Mon Sep 21 10:21:47 2020 Key Expires: Fri Sep 20 10:21:47 2024 (expires in 31 days) Rpm Name: gpg-pubkey-39db7c82-5f68629b Leap 15.5 will receive until December, so this needs to be dealt with. -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1219879] New: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0
by bugzilla_noreply＠suse.com 18 Nov '24

18 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1219879 Bug ID: 1219879 Summary: [TRACKERBUG] Remove EOL OpenSSL 1.1.1 and OpenSSL 1.0.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: otto.hollmann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- This bug collects the challenges and packages that need to be adapted before removing OpenSSL 1.1.1 and OpenSSL 1.0.0 OpenSSL 1.1.1 (package openssl1_1) is EOL since 11th September 2023. OpenSSL 1.0.0 (package openssl1_0_0) is EOL since 31th December 2019. Therefore, it makes sense to get rid of them and we are going to remove them from Factory in the near future. Unfortunately some packages still rely/depend on these old OpenSSL versions. If we would like to keep these packages, they must be adapted to use OpenSSL 3. Currently these packages are usually hardcoded to use specific openssl package, e.g.: > BuildRequires: libopenssl-1_1-devel The preferred way is to use our meta package > BuildRequires: libopenssl or > BuildRequires: libopenssl-devel that will always pull respective packages with the default OpenSSL version (at the moment libopenssl3 or libopenssl-3-devel). Migration guide can be found here: https://www.openssl.org/docs/man3.0/man7/migration_guide.html List of packages that are using old OpenSSL: dd_rescue EternalTerminal fdo-client libredfish libzrtpcpp python -- You are receiving this mail because: You are on the CC list for the bug.

1 22

[Bug 1228610] New: Mail Makefile error finding alias directory
by bugzilla_noreply＠suse.com 18 Nov '24

18 Nov '24

https://bugzilla.suse.com/show_bug.cgi?id=1228610 Bug ID: 1228610 Summary: Mail Makefile error finding alias directory Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: x86-64 OS: openSUSE Leap 15.5 Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: marc(a)marcchamberlin.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- The macro shell script for ALIAS_FILE is searching for a file. Instead it should be searching for a directory. Change the ALIAS_FILE environment variable in /etc/mail/Makefile from ALIAS_FILE = $(shell find $(ETC)aliases.d/ -type f) to ALIAS_FILE = $(shell find $(ETC)aliases.d/ -type d) Recommend changing the name of this environment variable to ALIAS_DIR to avoid confusion. -- You are receiving this mail because: You are on the CC list for the bug.

1 4