- openSUSE Bugs

[Bug 1054802] VUL-0: CVE-2017-7557: dnsdist: Alteration of ACLs via API authentication bypass
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1054802 Marcus Rückert <mrueckert(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mrueckert(a)suse.com |screening-team-bugs(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1054799] VUL-0: CVE-2016-7069: dnsdist: Crafted backend responses can cause a denial of service
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1054799 Marcus Rückert <mrueckert(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|mrueckert(a)suse.com |screening-team-bugs(a)suse.de -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234331] New: please consider upgrading clamav to latest release 1.3.1 -> 1.4.1
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234331 Bug ID: 1234331 Summary: please consider upgrading clamav to latest release 1.3.1 -> 1.4.1 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: silviucc(a)outlook.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Hello. Currently clamav on tumbleweed is at version 1.3.1. The latest release of clamav is 1.4.1. Version 1.3.x is left unmaintained. Unless there's some major performance regression, maybe it's worth having 1.4.1 available. Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1234692] New: Moval of dbus-launch to dbus-daemon prevents start of Dolphin super user mode
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234692 Bug ID: 1234692 Summary: Moval of dbus-launch to dbus-daemon prevents start of Dolphin super user mode Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: sturm-fr(a)web.de QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Since moval of dbus-launch to the subpackage dbus-daemon (dbus-1-daemon), applications which need dbus-launch won't start anymore. Related change: https://build.opensuse.org/projects/Base:System/packages/dbus-1/files/dbus-… dbus-1-daemon is not part of any pattern and does not get installed by default when you install Tumbleweed from any actual sbnapshot ISO (broken since at least snapshot 20241208). As example in KDE Plasma 6, Doplphin super user mode (application starter) fails to open as it calls following command: dbus-launch dolphin -qwindowtitle %c %u See https://build.opensuse.org/projects/openSUSE:Factory/packages/dolphin/files… There are already several reports in the forum regarding this topic. Either make dbus-1-daemon a part of a base pattern or adapt the Dolphin-super use mode starter to work in other ways. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1229913] New: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1229913 Bug ID: 1229913 Summary: AUDIT-1: kio-admin: revisit kio-admin privileged file operations via D-Bus Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: matthias.gerstner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: popov895(a)ukr.net Target Milestone: --- Found By: --- Blocker: --- +++ This bug was initially created as a clone of Bug #1205607 We've been asked to have a fresh look ad kio-admin, formerly rejected in bug 1205607. AFAIK upstream activities to come up with a robust API have been abandoned, but we can still have another look at the current production code. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1233853] New: VUL-0: CVE-2024-21538: python-jupyterlab-templates,jupyter-jupyterlab-latex: cross-spawn: regular expression denial of service
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233853 Bug ID: 1233853 Summary: VUL-0: CVE-2024-21538: python-jupyterlab-templates,jupyter-jupyterlab-latex: cross-spawn: regular expression denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/427356/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-21538:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: python-maintainers(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1233843 Target Milestone: --- Found By: --- Blocker: --- Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21538 https://www.cve.org/CVERecord?id=CVE-2024-21538 https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d80… https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601… https://github.com/moxystudio/node-cross-spawn/pull/160 https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349 https://bugzilla.redhat.com/show_bug.cgi?id=2324550 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/21xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1233852] New: VUL-0: CVE-2024-21538: python-furo,python-jupyter-ydoc,python-ipympl,python-nbdime,python-pytest-html,python-panel: cross-spawn: regular expression denial of service
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1233852 Bug ID: 1233852 Summary: VUL-0: CVE-2024-21538: python-furo,python-jupyter-ydoc,python-ipympl,python-n bdime,python-pytest-html,python-panel: cross-spawn: regular expression denial of service Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other URL: https://smash.suse.de/issue/427356/ OS: Other Status: NEW Whiteboard: CVSSv3.1:SUSE:CVE-2024-21538:5.5:(AV:L/AC:L/PR:N/UI:R/ S:U/C:N/I:N/A:H) Severity: Normal Priority: P5 - None Component: Security Assignee: daniel.garcia(a)suse.com Reporter: andrea.mattiazzo(a)suse.com QA Contact: security-team(a)suse.de Blocks: 1233843 Target Milestone: --- Found By: --- Blocker: --- Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-21538 https://www.cve.org/CVERecord?id=CVE-2024-21538 https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d80… https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601… https://github.com/moxystudio/node-cross-spawn/pull/160 https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349 https://bugzilla.redhat.com/show_bug.cgi?id=2324550 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/21xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1234691] New: Yast2: Add "About" section or button to show program and module versions, show yast version in terminal
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234691 Bug ID: 1234691 Summary: Yast2: Add "About" section or button to show program and module versions, show yast version in terminal Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: 64bit OS: All Status: NEW Severity: Enhancement Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: blst(a)arcor.de QA Contact: jsrain(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Currently it is complicated to determine the installed/running yast2 version. The version seems not to be mentioned when running a module. It is also not mentioned when calling yast from the command line. Enhancement: -Mentioning the version number within a module window/screen -Add an "About" button to open a window containing the version number -Add a command line argument to show the yast version -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234688] VUL-0: CVE-2024-54662: dante: incorrect access control for some sockd.conf configurations
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234688 https://bugzilla.suse.com/show_bug.cgi?id=1234688#c1 --- Comment #1 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1234688) was mentioned in https://build.opensuse.org/request/show/1231897 Backports:SLE-15-SP5 / dante https://build.opensuse.org/request/show/1231898 Backports:SLE-15-SP6 / dante -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234065] New: VUL-0: CVE-2024-29645: radare2: buffer overflow vulnerability allows an attacker to execute arbitrary code via the parse_die function
by bugzilla_noreply＠suse.com 18 Dec '24

18 Dec '24

https://bugzilla.suse.com/show_bug.cgi?id=1234065 Bug ID: 1234065 Summary: VUL-0: CVE-2024-29645: radare2: buffer overflow vulnerability allows an attacker to execute arbitrary code via the parse_die function Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/430859/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: abergmann(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse_die function. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29645 https://www.cve.org/CVERecord?id=CVE-2024-29645 https://gist.github.com/Crispy-fried-chicken/83f0f5e8a475284d64bf99fb342e90… https://github.com/radareorg/radare2/commit/72bf3a486fa851797aa21887a40ba0e… https://github.com/radareorg/radare2/pull/22561 https://github.com/CVEProject/cvelistV5/blob/main//cves/2024/29xxx/CVE-2024… -- You are receiving this mail because: You are on the CC list for the bug.

1 4