September 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1202160] AUDIT-FIND: libiio: libiio-usb-udev-rules: world-writable device permissions
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1202160 https://bugzilla.suse.com/show_bug.cgi?id=1202160#c2 --- Comment #2 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- Reported to upstream: https://github.com/analogdevicesinc/libiio/issues/1195 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1230035] missing dbus.service after upgrade to latest release (VERSION_ID="20240803")
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1230035 https://bugzilla.suse.com/show_bug.cgi?id=1230035#c1 Petr Valenta <petr(a)jevklidu.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #1 from Petr Valenta <petr(a)jevklidu.cz> --- it's repaired in dbus-1-1.14.10-2.3 > rpm -ql dbus-1-1.14.10-2.3 > /usr/bin/dbus-launch > /usr/bin/dbus-launch.nox11 > /usr/lib/systemd/system/dbus.service > /usr/lib/systemd/system/multi-user.target.wants > /usr/lib/systemd/system/multi-user.target.wants/dbus.service > /usr/lib/systemd/user/dbus.service > /usr/libexec/dbus-1 > /usr/libexec/dbus-1/dbus-daemon-launch-helper > /usr/sbin/rcdbus > /usr/share/doc/packages/dbus-1 > /usr/share/doc/packages/dbus-1/AUTHORS > /usr/share/doc/packages/dbus-1/NEWS > /usr/share/doc/packages/dbus-1/README > /usr/share/libalternatives > /usr/share/libalternatives/dbus-launch > /usr/share/libalternatives/dbus-launch/10.conf > /usr/share/licenses/dbus-1 > /usr/share/licenses/dbus-1/COPYING > /usr/share/man/man1/dbus-launch.1.gz -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229672] New: VUL-0: CVE-2024-43785: gitoxide: newlines, backspaces and control characters that appear in metadata written to terminals are not neutralized
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1229672 Bug ID: 1229672 Summary: VUL-0: CVE-2024-43785: gitoxide: newlines, backspaces and control characters that appear in metadata written to terminals are not neutralized Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/418576/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: dmueller(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: camila.matos(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including those that form ANSI escape sequences—that appear in a repository's paths, author and committer names, commit messages, or other metadata. Such text may be written as part of the output of a command, as well as appearing in error messages when an operation fails. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-43785 https://www.cve.org/CVERecord?id=CVE-2024-43785 https://github.com/Byron/gitoxide/security/advisories/GHSA-88g2-r9rw-g55h -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1230085] New: VUL-0: CVE-2024-45305: onefetch: gix-path: gix-path uses local config across repos when it is the highest scope
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1230085 Bug ID: 1230085 Summary: VUL-0: CVE-2024-45305: onefetch: gix-path: gix-path uses local config across repos when it is the highest scope Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other URL: https://smash.suse.de/issue/419537/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: jubalh(a)iodoru.org Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1230079 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1230079 +++ gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope. It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected. This issue has been addressed in release version 0.10.10. All users are advised to upgrade. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45305 https://www.cve.org/CVERecord?id=CVE-2024-45305 https://git-scm.com/docs/git-config#SCOPES https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1230087] New: VUL-0: CVE-2024-45305: starship: gix-path: gix-path uses local config across repos when it is the highest scope
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1230087 Bug ID: 1230087 Summary: VUL-0: CVE-2024-45305: starship: gix-path: gix-path uses local config across repos when it is the highest scope Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other URL: https://smash.suse.de/issue/419537/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: dead_mozay(a)opensuse.org Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1230079 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1230079 +++ gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope. It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected. This issue has been addressed in release version 0.10.10. All users are advised to upgrade. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45305 https://www.cve.org/CVERecord?id=CVE-2024-45305 https://git-scm.com/docs/git-config#SCOPES https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1230086] New: VUL-0: CVE-2024-45305: sile: gix-path: gix-path uses local config across repos when it is the highest scope
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1230086 Bug ID: 1230086 Summary: VUL-0: CVE-2024-45305: sile: gix-path: gix-path uses local config across repos when it is the highest scope Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other URL: https://smash.suse.de/issue/419537/ OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Security Assignee: pirateclip(a)protonmail.com Reporter: thomas.leroy(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1230079 Target Milestone: --- Found By: Security Response Team Blocker: --- +++ This bug was initially created as a clone of Bug #1230079 +++ gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to find the path of a configuration file that belongs to the `git` installation itself, but mistakenly treats the local repository's configuration as system-wide if no higher scoped configuration is found. In rare cases, this causes a less trusted repository to be treated as more trusted, or leaks sensitive information from one repository to another, such as sending credentials to another repository's remote. In `gix_path::env`, the underlying implementation of the `installation_config` and `installation_config_prefix` functions calls `git config -l --show-origin` and parses the first line of the output to extract the path to the configuration file holding the configuration variable of highest scope. It is believed to be very difficult to exploit this vulnerability deliberately, due to the need either to anticipate a situation in which higher-scoped configuration variables would be absent, or to arrange for this to happen. Although any operating system may be affected, users running Apple Git on macOS are much less likely to be affected. This issue has been addressed in release version 0.10.10. All users are advised to upgrade. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45305 https://www.cve.org/CVERecord?id=CVE-2024-45305 https://git-scm.com/docs/git-config#SCOPES https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/blob/12251eb052df30105538fa831e641eea557f… https://github.com/Byron/gitoxide/security/advisories/GHSA-v26r-4c9c-h3j6 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1230049] Godot doesn't have internet connection
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1230049 https://bugzilla.suse.com/show_bug.cgi?id=1230049#c1 Stefan Hundhammer <shundhammer(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(suse(a)poolitzer.eu | |) CC| |suse(a)poolitzer.eu --- Comment #1 from Stefan Hundhammer <shundhammer(a)suse.com> --- Please add at least SOME useful bug description, starting with what on earth that "Godot" is. https://en.wikipedia.org/wiki/Godot_(game_engine) ...and also what you are doing, what you see as a bug, and why it would be a bug of the distribution, and not of that Godot engine. Also, please add at least some useful error messages. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1229998] New: Installed Splash screens lists nothing
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1229998 Bug ID: 1229998 Summary: Installed Splash screens lists nothing Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: uzivatel919(a)seznam.cz QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 877074 --> https://bugzilla.suse.com/attachment.cgi?id=877074&action=edit Screenshot I have two extra 100 % working splashes installed. Showing in overview but Installed window does not show them. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1229992] New: Login screen broken after last zypper dup
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1229992 Bug ID: 1229992 Summary: Login screen broken after last zypper dup Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: uzivatel919(a)seznam.cz QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 877071 --> https://bugzilla.suse.com/attachment.cgi?id=877071&action=edit org.kde.plasma.private_sessions Aparently system is missing module org.kde.plasma.private_sessions to show login screen background. Tried multiple restarts, logouts and backgrounds. See attached screenshot. Happened after last zypper dup. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1229990] New: Splash screens cannot be removed
by bugzilla_noreply＠suse.com 03 Sep '24

03 Sep '24

https://bugzilla.suse.com/show_bug.cgi?id=1229990 Bug ID: 1229990 Summary: Splash screens cannot be removed Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Installation Assignee: yast2-maintainers(a)suse.de Reporter: uzivatel919(a)seznam.cz QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Created attachment 877068 --> https://bugzilla.suse.com/attachment.cgi?id=877068&action=edit One After last zypper dup, almost all splash screens are invalid. Cannot be removed or played. Operating System: openSUSE Tumbleweed 20240829 KDE Plasma Version: 6.1.4 KDE Frameworks Version: 6.5.0 Qt Version: 6.7.2 Kernel Version: 6.10.5-1-default (64-bit) Graphics Platform: X11 Observing various errors. -- You are receiving this mail because: You are on the CC list for the bug.

1 10