--17447235653.2e1A87.16603
Date: Tue, 15 Apr 2025 13:26:05 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241235

            Bug ID: 1241235
           Summary: VUL-0: CVE-2025-24358: headscale: github.com/gorilla/csrf: gorilla/csrf CSRF vulnerability due to broken Referer validation
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
               URL: https://smash.suse.de/issue/450432/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-24358:5.3:(AV:N/AC:H/PR:N/UI:R/
                    S:U/C:N/I:H/A:N)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: emanuele.cappello-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241232
  Target Milestone: ---
          Found By: ---
           Blocker: ---

### Summary

gorilla/csrf is vulnerable to CSRF via form submission from origins that sh=
are
a top level domain with the target origin.

### Details

gorilla/csrf does not validate the Origin header against an allowlist. Its
executes its validation of the Referer header for cross-origin requests only
when it believes the request is being served over TLS. It determines this by
inspecting the `r.URL.Scheme` value. However, this value is never populated=
 for
"server" requests [per the Go spec](https://pkg.go.dev/net/http#Request), a=
nd
so this check does not run in practice.=20
```
        // URL specifies either the URI being requested (for server
        // requests) or the URL to access (for client requests).
        //
        // For server requests, the URL is parsed from the URI
        // supplied on the Request-Line as stored in RequestURI.  For
        // most requests, fields other than Path and RawQuery will be
        // empty. (See [RFC 7230, Section
5.3](https://rfc-editor.org/rfc/rfc7230.html#section-5.3))
        //
        // For client requests, the URL's Host specifies the server to
        // connect to, while the Request's Host field optionally
        // specifies the Host header value to send in the HTTP
        // request.
        URL
*[url](https://pkg.go.dev/net/url).[URL](https://pkg.go.dev/net/url#URL)
```

### PoC

- create trusted origin `target.example.test` protected with gorilla/csrf a=
nd
served over TLS hosting form on `/submit`
- create attacker origin `attack.example.test` served over TLS
- attacker exfiltrates token & cookie combination from `target.example.test=
`=20
- attacker sets exfiltrated cookie with `domain=3D.example.test and path=3D=
/submit`
  - as the cookie has a more specific path than `/` (the default for CSRF
cookies) it will be sent first by the browser on submit to our target origin
- submit form from `attack.example.test` with exfiltrated CSRF form token
- observe valid form submission as `attack.example.test` Origin / Referer
headers are not validated.=20

### Impact

This vulnerability allows an attacker who has gained XSS on a subdomain or =
top
level domain to perform authenticated form submissions against gorilla/csrf
protected targets that share the same top level domain.

This bug has existed in gorilla/csrf since its initial release in 2015.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-24358
https://bugzilla.redhat.com/show_bug.cgi?id=3D2359554
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17447235653.2e1A87.16603
Date: Tue, 15 Apr 2025 13:26:05 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241235

          Summary
          VUL-0: CVE-2025-24358: headscale: github.com/gorilla/csrf: go=
rilla/csrf CSRF vulnerability due to broken Referer validation

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450432/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-24358:5.3:(AV:N/AC:H/PR:N/UI:R/S:U/C:N=
/I:H/A:N)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          emanuele.cappello@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241232

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

### Summary

gorilla/csrf is vulnerable to CSRF via form submission from origins that sh=
are
a top level domain with the target origin.

### Details

gorilla/csrf does not validate the Origin header against an allowlist. Its
executes its validation of the Referer header for cross-origin requests only
when it believes the request is being served over TLS. It determines this by
inspecting the `r.URL.Scheme` value. However, this value is never populated=
 for
"server" requests [per the Go spec](https://pkg.go.dev/net/http#Request), and
so this check does not run in practice.=20
```
        // URL specifies either the URI being requested (for server
        // requests) or the URL to access (for client requests).
        //
        // For server requests, the URL is parsed from the URI
        // supplied on the Request-Line as stored in RequestURI.  For
        // most requests, fields other than Path and RawQuery will be
        // empty. (See [RFC 7230, Section
5.3](<a href=3D"https://rfc-editor.org/rfc/rfc7230.html#section-5.3">https:=
//rfc-editor.org/rfc/rfc7230.html#section-5.3</a>))
        //
        // For client requests, the URL's Host specifies the server to
        // connect to, while the Request's Host field optionally
        // specifies the Host header value to send in the HTTP
        // request.
        URL
*[url](<a href=3D"https://pkg.go.dev/net/url).[URL](https://pkg.go.dev/net/=
url#URL">https://pkg.go.dev/net/url).[URL](https://pkg.go.dev/net/url#URL</=
a>)
```

### PoC

- create trusted origin `target.example.test` protected with gorilla/csrf a=
nd
served over TLS hosting form on `/submit`
- create attacker origin `attack.example.test` served over TLS
- attacker exfiltrates token & cookie combination from `target.example.=
test`=20
- attacker sets exfiltrated cookie with `domain=3D.example.test and path=3D=
/submit`
  - as the cookie has a more specific path than `/` (the default for CSRF
cookies) it will be sent first by the browser on submit to our target origin
- submit form from `attack.example.test` with exfiltrated CSRF form token
- observe valid form submission as `attack.example.test` Origin / Referer
headers are not validated.=20

### Impact

This vulnerability allows an attacker who has gained XSS on a subdomain or =
top
level domain to perform authenticated form submissions against gorilla/csrf
protected targets that share the same top level domain.

This bug has existed in gorilla/csrf since its initial release in 2015.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-24358
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2359554

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17447235653.2e1A87.16603--


--17447308563.6B7cBB.17143
Date: Tue, 15 Apr 2025 15:27:36 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241245

            Bug ID: 1241245
           Summary: VUL-0: CVE-2025-3445: forgejo: github.com/mholt/archiver/v3: path traversal using a crafted ZIP file
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450239/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-3445:8.1:(AV:N/AC:H/PR:N/UI:N/S
                    :C/C:L/I:H/A:L)
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: serena.ferracci-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241242
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A Path Traversal "Zip Slip" vulnerability has been identified in mholt/arch=
iver
in Go. This vulnerability allows using a crafted ZIP file containing path
traversal symlinks to create or overwrite files with the user's privileges =
or
application utilizing the library.

When using the archiver.Unarchive functionality with ZIP files, like this:
archiver.Unarchive(zipFile, outputDir),=C2=A0 A crafted ZIP file can be ext=
racted in
such a way that it writes files to the affected system with the same privil=
eges
as the application executing this vulnerable functionality. Consequently,
sensitive files may be overwritten, potentially leading to privilege
escalation, code execution, and other severe outcomes in some cases.

It's worth noting that a similar vulnerability was found in TAR files
(CVE-2024-0406). Although a fix was implemented, it hasn't been officially
released, and the affected project has since been deprecated. The successor=
 to
mholt/archiver is a new project called mholt/archives, and its initial rele=
ase
(v0.1.0) removes the Unarchive() functionality.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3445
https://www.cve.org/CVERecord?id=3DCVE-2025-3445
https://github.com/mholt/archiver/
https://bugzilla.redhat.com/show_bug.cgi?id=3D2359334
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/3xxx/CVE-2025-=
3445.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17447308563.6B7cBB.17143
Date: Tue, 15 Apr 2025 15:27:36 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241245

          Summary
          VUL-0: CVE-2025-3445: forgejo: github.com/mholt/archiver/v3: =
path traversal using a crafted ZIP file

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450239/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-3445:8.1:(AV:N/AC:H/PR:N/UI:N/S:C/C:L/=
I:H/A:L)=20

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          serena.ferracci@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241242

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A Path Traversal "Zip Slip" vulnerability has been=
 identified in mholt/archiver
in Go. This vulnerability allows using a crafted ZIP file containing path
traversal symlinks to create or overwrite files with the user's privileges =
or
application utilizing the library.

When using the archiver.Unarchive functionality with ZIP files, like this:
archiver.Unarchive(zipFile, outputDir),=C2=A0 A crafted ZIP file can be ext=
racted in
such a way that it writes files to the affected system with the same privil=
eges
as the application executing this vulnerable functionality. Consequently,
sensitive files may be overwritten, potentially leading to privilege
escalation, code execution, and other severe outcomes in some cases.

It's worth noting that a similar vulnerability was found in TAR files
(CVE-2024-0406). Although a fix was implemented, it hasn't been officially
released, and the affected project has since been deprecated. The successor=
 to
mholt/archiver is a new project called mholt/archives, and its initial rele=
ase
(v0.1.0) removes the Unarchive() functionality.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3445
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-3445
https://github.com/mholt/arc=
hiver/
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2359334
https://github.com/CVEProject/cvelistV5/blob/main//cv=
es/2025/3xxx/CVE-2025-3445.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17447308563.6B7cBB.17143--


--17447452962.baBb77b1.17515
Date: Tue, 15 Apr 2025 19:28:16 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241254

            Bug ID: 1241254
           Summary: emacsclient -c fails with "Authorization required, but no authorization protocol specified"
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: psychonaut-at-nothingisreal.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

My user account has emacs running as a daemon with systemd.  (My emacs.serv=
ice
file is identical to the one provided by Tumbleweed in
/usr/lib/systemd/users/emacs.service except that it sets an additional PATH
environment variable.)

Following an upgrade from emacs-29.4 to emacs-30.1, invoking emacsclient no
longer works.  Trying to do so results in the program immediately exiting, =
with
the following logged to the user systemd journal:

emacs[2366]: Invalid MIT-MAGIC-COOKIE-1 key
emacs[2366]: Authorization required, but no authorization protocol specified

Restarting the emacs service has no effect.  However, the problem can be wo=
rked
around by running `xhost +local:` before invoking emacsclient.

Similar problems were reported in Bug 1174534 and Bug 1222172; in both those
cases emacsclient refused to start, but in this bug the error message and
workarounds are different.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17447452962.baBb77b1.17515
Date: Tue, 15 Apr 2025 19:28:16 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241254

          Summary
          emacsclient -c fails with "Authorization required, but n=
o authorization protocol specified"

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          psychonaut@nothingisreal.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

My user account has emacs running as a daemon with systemd. =
 (My emacs.service
file is identical to the one provided by Tumbleweed in
/usr/lib/systemd/users/emacs.service except that it sets an additional PATH
environment variable.)

Following an upgrade from emacs-29.4 to emacs-30.1, invoking emacsclient no
longer works.  Trying to do so results in the program immediately exiting, =
with
the following logged to the user systemd journal:

emacs[2366]: Invalid MIT-MAGIC-COOKIE-1 key
emacs[2366]: Authorization required, but no authorization protocol specified

Restarting the emacs service has no effect.  However, the problem can be wo=
rked
around by running `xhost +local:` before invoking emacsclient.

Similar problems were reported in Bug 1174534 and Bug 1222172; in both those
cases emacsclient refused to start, but in this bug the error message and
workarounds are different.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17447452962.baBb77b1.17515--


body:
--17448139751.6FCD.19345
Date: Wed, 16 Apr 2025 14:32:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241288

            Bug ID: 1241288
           Summary: chromium release 135.0.7049.95
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: ro-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/

[TBD][409619251] Critical CVE-2025-3619: Heap buffer overflow in Codecs.
Reported by Elias Hohl on 2025-04-09

[TBD][405292639] High CVE-2025-3620: Use after free in USB. Reported by
@retsew0x01 on 2025-03-21
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17448139751.6FCD.19345
Date: Wed, 16 Apr 2025 14:32:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241288

          Summary
          chromium release 135.0.7049.95

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          ro@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://c=
hromereleases.googleblog.com/

[TBD][409619251] Critical CVE-2025-3619: Heap buffer overflow in Codecs.
Reported by Elias Hohl on 2025-04-09

[TBD][405292639] High CVE-2025-3620: Use after free in USB. Reported by
@retsew0x01 on 2025-03-21

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17448139751.6FCD.19345--

summary: chromium release 135.0.7049.95


--17448958442.7Af4FAc.21762
Date: Thu, 17 Apr 2025 13:17:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241353

            Bug ID: 1241353
           Summary: [Build 20250416] openQA test fails in tdup: ordering of package in transaction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/5000969/modules/tdup
                    /steps/12
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

Fabian has debugged this and found the issue being 'update-bootloader' not
being picked up in time to be updated prior to the kernel

The issue boiling down to:

OrderWithRequires(post): perl-Bootloader

There is no package called perl-Bootloader in the transaction, and as such,=
 the
hint that this should be done before the kernel is invalid. the old style w=
ith
Requires(post) perl-Bootloader 'worked', as in this case the provides by
update-bootloader was used to select the package at all

The correct thing would be to also add
OrderWithRequires(post): update-bootloader

(leaving perl-Bootloader in place - in case the kernel is installed on any
distro where the rename did not yet happen)

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-x86_64-microos-old2microosnext@64bit fails=
 in
[tdup](https://openqa.opensuse.org/tests/5000969/modules/tdup/steps/12)

## Test suite description
Boot from existing, static MicroOS image and transactional-update dup to
snapshot under test

## Reproducible

Fails since (at least) Build
[20250415](https://openqa.opensuse.org/tests/4996879)

## Expected result

Last good: [20250414](https://openqa.opensuse.org/tests/4994158) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dmi=
croos&flavor=3DMicroOS-Image&machine=3D64bit&test=3Dmicroos-old2microosnext=
&version=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17448958442.7Af4FAc.21762
Date: Thu, 17 Apr 2025 13:17:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241353

          Summary
          [Build 20250416] openQA test fails in tdup: ordering of packa=
ge in transaction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/5000969/modules/tdup/steps/=
12

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

Fabian has debugged this and found the issue being 'update-bootloader' not
being picked up in time to be updated prior to the kernel

The issue boiling down to:

OrderWithRequires(post): perl-Bootloader

There is no package called perl-Bootloader in the transaction, and as such,=
 the
hint that this should be done before the kernel is invalid. the old style w=
ith
Requires(post) perl-Bootloader 'worked', as in this case the provides by
update-bootloader was used to select the package at all

The correct thing would be to also add
OrderWithRequires(post): update-bootloader

(leaving perl-Bootloader in place - in case the kernel is installed on any
distro where the rename did not yet happen)

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-x86_64-microos-old2microosnext@64bit f=
ails in
[tdup](https://openqa.opensuse.org/tests/5000969/modules/tdup/steps/12)

## Test suite description
Boot from existing, static MicroOS image and transactional-update dup to
snapshot under test

## Reproducible

Fails since (at least) Build
[20250415](https://op=
enqa.opensuse.org/tests/4996879)

## Expected result

Last good: [20250414](https://openqa.opensuse.org/tests/4994158) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensu=
se.org/tests/latest?arch=3Dx86_64&distri=3Dmicroos&flavor=3DMicroOS=
-Image&machine=3D64bit&test=3Dmicroos-old2microosnext&version=
=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17448958442.7Af4FAc.21762--


body:
--17451410262.a6Efb.24106
Date: Sun, 20 Apr 2025 09:23:46 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241472

            Bug ID: 1241472
           Summary: GCC 15 - dhcp package doesn't build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: filip.kastl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1239850
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Package dhcp doesn't build with GCC 15.  Here is a sample of the build erro=
rs:

[  194s] dhcpv6.c:6063:25: error: too many arguments to function =E2=80=98i=
a_na_match=E2=80=99;
expected 0, have 3
[  194s]  6063 |                         ia_na_match(client_id, &iaaddr,
lease);
[  194s]       |                         ^~~~~~~~~~~ ~~~~~~~~~
[  194s] dhcpv6.c:6065:25: error: too many arguments to function
=E2=80=98ia_na_nomatch=E2=80=99; expected 0, have 7
[  194s]  6065 |                         ia_na_nomatch(client_id, &iaaddr,
[  194s]       |                         ^~~~~~~~~~~~~ ~~~~~~~~~
[  194s] dhcpv6.c: In function =E2=80=98dhcpv6_decline=E2=80=99:
[  194s] dhcpv6.c:6153:47: error: passing argument 6 of =E2=80=98iterate_ov=
er_ia_na=E2=80=99
from incompatible pointer type [-Wincompatible-pointer-types]
[  194s]  6153 |                                    "Decline",
ia_na_match_decline,
[  194s]       |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
^~~~~~~~~~~~~~~~~~~
[  194s]       |                                               |
[  194s]       |                                               void (*)(con=
st
struct data_string *, const struct data_string *, struct iasubopt *)
[  194s] dhcpv6.c:5852:27: note: expected =E2=80=98void (*)(void)=E2=80=99 =
but argument is of
type =E2=80=98void (*)(const struct data_string *, const struct data_string=
 *, struct
iasubopt *)=E2=80=99

This looks like it is caused by the c23 change regarding function declarati=
ons
without parameters.  See
https://gcc.gnu.org/gcc-15/porting_to.html#c23-fn-decls-without-parameters.

Possible solutions:
- Just compile with -std=3Dgnu17
- Find an upstream patch that makes this package c23-compliant
- If such patch doesn't exist, contribute it to the upstream

You can see the build failure here:
https://build.opensuse.org/package/show/openSUSE:Factory:Staging:Gcc7/dhcp
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17451410262.a6Efb.24106
Date: Sun, 20 Apr 2025 09:23:46 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241472

          Summary
          GCC 15 - dhcp package doesn't build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Network

          Assignee
          screening-team-bugs@suse.de

          Reporter
          filip.kastl@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1239850

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Package dhcp doesn't build with GCC 15.  Here is a sample of=
 the build errors:

[  194s] dhcpv6.c:6063:25: error: too many arguments to function =E2=80=98i=
a_na_match=E2=80=99;
expected 0, have 3
[  194s]  6063 |                         ia_na_match(client_id, &iaaddr,
lease);
[  194s]       |                         ^~~~~~~~~~~ ~~~~~~~~~
[  194s] dhcpv6.c:6065:25: error: too many arguments to function
=E2=80=98ia_na_nomatch=E2=80=99; expected 0, have 7
[  194s]  6065 |                         ia_na_nomatch(client_id, &iaad=
dr,
[  194s]       |                         ^~~~~~~~~~~~~ ~~~~~~~~~
[  194s] dhcpv6.c: In function =E2=80=98dhcpv6_decline=E2=80=99:
[  194s] dhcpv6.c:6153:47: error: passing argument 6 of =E2=80=98iterate_ov=
er_ia_na=E2=80=99
from incompatible pointer type [-Wincompatible-pointer-types]
[  194s]  6153 |                                    "Decline",
ia_na_match_decline,
[  194s]       |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20
^~~~~~~~~~~~~~~~~~~
[  194s]       |                                               |
[  194s]       |                                               void (*)(con=
st
struct data_string *, const struct data_string *, struct iasubopt *)
[  194s] dhcpv6.c:5852:27: note: expected =E2=80=98void (*)(void)=E2=80=99 =
but argument is of
type =E2=80=98void (*)(const struct data_string *, const struct data_string=
 *, struct
iasubopt *)=E2=80=99

This looks like it is caused by the c23 change regarding function declarati=
ons
without parameters.  See
https://gcc.gnu.org/gcc-15/porting_to.html#c23-fn-decls-without=
-parameters.

Possible solutions:
- Just compile with -std=3Dgnu17
- Find an upstream patch that makes this package c23-compliant
- If such patch doesn't exist, contribute it to the upstream

You can see the build failure here:
https://build.opensuse.org/package/show/openSUSE:Factory:Stagin=
g:Gcc7/dhcp

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17451410262.a6Efb.24106--

summary: GCC 15 - dhcp package doesn't build


body:
--17451413473.7eE98.24112
Date: Sun, 20 Apr 2025 09:29:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241473

            Bug ID: 1241473
           Summary: GCC 15 - qemu package doesn't build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: filip.kastl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1239850
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The package qemu doesn't build with GCC 15.  These are the build errors:

[ 2604s] In file included from usb-core.h:17,
[ 2604s]                  from usb-core.c:14:
[ 2604s] ../libc/include/stdbool.h:17:16: error: cannot use keyword 'false'=
 as
enumeration constant
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                ^~~~~
[ 2604s] ../libc/include/stdbool.h:17:16: note: 'false' is a keyword with
'-std=3Dc23' onwards
[ 2604s] ../libc/include/stdbool.h:17:34: error: expected ';', identifier or
'(' before 'bool'
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                                  ^~~~
[ 2604s] ../libc/include/stdbool.h:17:34: warning: useless type name in emp=
ty
declaration
[ 2604s] make[4]: *** [<builtin>: usb-core.o] Error 1
[ 2604s] make[3]: *** [Makefile:24: libusb] Error 2
[ 2604s] make[3]: *** Waiting for unfinished jobs....
[ 2604s]        [CC]    isdigit.o
[ 2604s]        [CC]    virtio-blk.o
[ 2604s] In file included from virtio-blk.c:14:
[ 2604s] ../libc/include/stdbool.h:17:16: error: cannot use keyword 'false'=
 as
enumeration constant
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                ^~~~~
[ 2604s] ../libc/include/stdbool.h:17:16: note: 'false' is a keyword with
'-std=3Dc23' onwards
[ 2604s] ../libc/include/stdbool.h:17:34: error: expected ';', identifier or
'(' before 'bool'
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                                  ^~~~

This is caused by c23 adding 'false', 'true' and 'bool' as new keywords.  S=
ee
https://gcc.gnu.org/gcc-15/porting_to.html#c23-new-keywords.

Possible solutions:
- Just compile with -std=3Dgnu17
- Find an upstream patch that makes this package c23-compliant
- If such patch doesn't exist, contribute it to the upstream

You can see the build failure here:
https://build.opensuse.org/package/show/openSUSE:Factory:Staging:Gcc7/qemu
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17451413473.7eE98.24112
Date: Sun, 20 Apr 2025 09:29:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241473

          Summary
          GCC 15 - qemu package doesn't build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Other

          Assignee
          virt-bugs@suse.de

          Reporter
          filip.kastl@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1239850

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The package qemu doesn't build with GCC 15.  These are the b=
uild errors:

[ 2604s] In file included from usb-core.h:17,
[ 2604s]                  from usb-core.c:14:
[ 2604s] ../libc/include/stdbool.h:17:16: error: cannot use keyword 'false'=
 as
enumeration constant
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                ^~~~~
[ 2604s] ../libc/include/stdbool.h:17:16: note: 'false' is a keyword with
'-std=3Dc23' onwards
[ 2604s] ../libc/include/stdbool.h:17:34: error: expected ';', identifier or
'(' before 'bool'
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                                  ^~~~
[ 2604s] ../libc/include/stdbool.h:17:34: warning: useless type name in emp=
ty
declaration
[ 2604s] make[4]: *** [<builtin>: usb-core.o] Error 1
[ 2604s] make[3]: *** [Makefile:24: libusb] Error 2
[ 2604s] make[3]: *** Waiting for unfinished jobs....
[ 2604s]        [CC]    isdigit.o
[ 2604s]        [CC]    virtio-blk.o
[ 2604s] In file included from virtio-blk.c:14:
[ 2604s] ../libc/include/stdbool.h:17:16: error: cannot use keyword 'false'=
 as
enumeration constant
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                ^~~~~
[ 2604s] ../libc/include/stdbool.h:17:16: note: 'false' is a keyword with
'-std=3Dc23' onwards
[ 2604s] ../libc/include/stdbool.h:17:34: error: expected ';', identifier or
'(' before 'bool'
[ 2604s]    17 | typedef enum { false =3D 0, true } bool;
[ 2604s]       |                                  ^~~~

This is caused by c23 adding 'false', 'true' and 'bool' as new keywords.  S=
ee
htt=
ps://gcc.gnu.org/gcc-15/porting_to.html#c23-new-keywords.

Possible solutions:
- Just compile with -std=3Dgnu17
- Find an upstream patch that makes this package c23-compliant
- If such patch doesn't exist, contribute it to the upstream

You can see the build failure here:
https://build.opensuse.org/package/show/openSUSE:Factory:Stagin=
g:Gcc7/qemu

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17451413473.7eE98.24112--

summary: GCC 15 - qemu package doesn't build


body:
--17451581612.a9ceCF5eD.24133
Date: Sun, 20 Apr 2025 14:09:21 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241475

            Bug ID: 1241475
           Summary: GCC 15 - texlive package doesn't build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: filip.kastl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1239850
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Package texlive fails to build with GCC 15.  This is the first compilation
error:

[  817s] [ 53%] Building CXX object
CMakeFiles/lspcpp.dir/src/jsonrpc/serializer.cpp.o
[  818s] In file included from
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/utils/asymp=
tote/LspCpp/src/jsonrpc/serializer.cpp:1:
[  818s]
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/utils/asymp=
tote/LspCpp/include/LibLsp/JsonRpc/serializer.h:51:13:
error: =E2=80=98uint32_t=E2=80=99 does not name a type
[  818s]    51 |     virtual uint32_t GetUint32() =3D 0;
[  818s]       |             ^~~~~~~~
[  818s]
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/utils/asymp=
tote/LspCpp/include/LibLsp/JsonRpc/serializer.h:15:1:
note: =E2=80=98uint32_t=E2=80=99 is defined in header =E2=80=98<cstdint>=E2=
=80=99; this is probably fixable by
adding =E2=80=98#include <cstdint>=E2=80=99
[  818s]    14 | #include "optionalVersion.h"
[  818s]   +++ |+#include <cstdint>
[  818s]    15 |=20

This is a result of the C++ standard library changing some dependencies bet=
ween
headers (https://gcc.gnu.org/gcc-15/porting_to.html#header-dep-changes).  I
expect including the header as the error message suggests will be enough to=
 fix
the failing build.

Btw, here you can see the build failure:

https://build.opensuse.org/package/show/openSUSE:Factory:Staging:Gcc7/texli=
ve
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17451581612.a9ceCF5eD.24133
Date: Sun, 20 Apr 2025 14:09:21 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241475

          Summary
          GCC 15 - texlive package doesn't build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          filip.kastl@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1239850

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Package texlive fails to build with GCC 15.  This is the fir=
st compilation
error:

[  817s] [ 53%] Building CXX object
CMakeFiles/lspcpp.dir/src/jsonrpc/serializer.cpp.o
[  818s] In file included from
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/utils/asymp=
tote/LspCpp/src/jsonrpc/serializer.cpp:1:
[  818s]
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/utils/asymp=
tote/LspCpp/include/LibLsp/JsonRpc/serializer.h:51:13:
error: =E2=80=98uint32_t=E2=80=99 does not name a type
[  818s]    51 |     virtual uint32_t GetUint32() =3D 0;
[  818s]       |             ^~~~~~~~
[  818s]
/home/abuild/rpmbuild/BUILD/texlive-2025.20250308-build/texlive/utils/asymp=
tote/LspCpp/include/LibLsp/JsonRpc/serializer.h:15:1:
note: =E2=80=98uint32_t=E2=80=99 is defined in header =E2=80=98<cstdint&=
gt;=E2=80=99; this is probably fixable by
adding =E2=80=98#include <cstdint>=E2=80=99
[  818s]    14 | #include "optionalVersion.h"
[  818s]   +++ |+#include <cstdint>
[  818s]    15 |=20

This is a result of the C++ standard library changing some dependencies bet=
ween
headers (https://gcc.gnu.org/gcc-15/porting_to.html#header-dep-changes).=
  I
expect including the header as the error message suggests will be enough to=
 fix
the failing build.

Btw, here you can see the build failure:

https://build.opensuse.org/package/show/openSUSE:Factory:Sta=
ging:Gcc7/texlive

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17451581612.a9ceCF5eD.24133--

summary: GCC 15 - texlive package doesn't build


body:
--17453355073.9FBF6D.27485
Date: Tue, 22 Apr 2025 15:25:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241568

            Bug ID: 1241568
           Summary: Hanging desktop with 9070XT
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

This sounds a lot like:

https://gitlab.freedesktop.org/drm/amd/-/issues/4126

can we pull those patches into our 6.14?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17453355073.9FBF6D.27485
Date: Tue, 22 Apr 2025 15:25:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241568

          Summary
          Hanging desktop with 9070XT

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          mrueckert@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

This sounds a lot like:

https://gi=
tlab.freedesktop.org/drm/amd/-/issues/4126

can we pull those patches into our 6.14?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17453355073.9FBF6D.27485--

summary: Hanging desktop with 9070XT


body:
--17453982314.d8acebB9.28631
Date: Wed, 23 Apr 2025 08:50:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241611

            Bug ID: 1241611
           Summary: [SELinux] pmlogger fails to start
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 16.0
          Hardware: aarch64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: felix.niederwanger-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

On Leap 16.0, starting the pmlogger via cockpit fails with the error message
"Error: systemd job StartUnit ["pmlogger.service","replace"] failed with re=
sult
failed". The journal logs a permission denied error:

> Apr 23 10:40:01 wombat systemd[1]: Starting Performance Metrics Archive L=
ogger...
> Apr 23 10:40:01 wombat rc[16168]: /etc/pcp/pmlogger/rc: line 153: /var/li=
b/pcp/tmp/pmlogger_rc.GvjnQPrz0/tmp: Permission denied
> Apr 23 10:40:01 wombat rc[16168]: /etc/pcp/pmlogger/rc: Warning: Performa=
nce Co-Pilot archive logger(s) not permanently enabled.
> Apr 23 10:40:01 wombat rc[16168]:     To enable pmlogger, run the followi=
ng as root:
> Apr 23 10:40:01 wombat rc[16168]:     # /usr/bin/systemctl enable pmlogge=
r.service
> Apr 23 10:40:01 wombat rc[16213]: /etc/pcp/pmlogger/rc: line 92: /var/lib=
/pcp/tmp/pmlogger_rc_start.00H6WNACh/pmcheck.out: Permission denied
> Apr 23 10:40:01 wombat systemd[1]: pmlogger.service: Main process exited,=
 code=3Dexited, status=3D1/FAILURE
> Apr 23 10:40:01 wombat systemd[1]: pmlogger.service: Failed with result '=
exit-code'.

I register the following AVC denials:

> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.452:326): avc:  denied  { add_name } fo=
r  pid=3D15386 comm=3D"rc" name=3D"tmp" scontext=3Dsystem_u:system_r:init_t=
:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir permissive=
=3D0
> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.500:327): avc:  denied  { add_name } fo=
r  pid=3D15461 comm=3D"rc" name=3D"pmcheck.out" scontext=3Dsystem_u:system_=
r:init_t:s0 > tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir pe=
rmissive=3D0
> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.856:336): avc:  denied  { add_name } fo=
r  pid=3D15620 comm=3D"rc" name=3D"tmp" scontext=3Dsystem_u:system_r:init_t=
:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir permissive=
=3D0
> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.924:337): avc:  denied  { add_name } fo=
r  pid=3D15760 comm=3D"rc" name=3D"pmcheck.out" scontext=3Dsystem_u:system_=
r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir perm=
issive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.124:343): avc:  denied  { add_name } fo=
r  pid=3D15823 comm=3D"rc" name=3D"tmp" scontext=3Dsystem_u:system_r:init_t=
:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir permissive=
=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.168:344): avc:  denied  { add_name } fo=
r  pid=3D15914 comm=3D"rc" name=3D"pmcheck.out" scontext=3Dsystem_u:system_=
r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir perm=
issive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.404:350): avc:  denied  { add_name } fo=
r  pid=3D15994 comm=3D"rc" name=3D"tmp" scontext=3Dsystem_u:system_r:init_t=
:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir permissive=
=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.464:351): avc:  denied  { add_name } fo=
r  pid=3D16084 comm=3D"rc" name=3D"pmcheck.out" scontext=3Dsystem_u:system_=
r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir perm=
issive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.676:358): avc:  denied  { add_name } fo=
r  pid=3D16168 comm=3D"rc" name=3D"tmp" scontext=3Dsystem_u:system_r:init_t=
:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir permissive=
=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.716:359): avc:  denied  { add_name } fo=
r  pid=3D16213 comm=3D"rc" name=3D"pmcheck.out" scontext=3Dsystem_u:system_=
r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tclass=3Ddir perm=
issive=3D0

## System information

openSUSE Leap 16.0

> wombat:~ # sestatus
> SELinux status:                 enabled
> SELinuxfs mount:                /sys/fs/selinux
> SELinux root directory:         /etc/selinux
> Loaded policy name:             targeted
> Current mode:                   enforcing
> Mode from config file:          enforcing
> Policy MLS status:              enabled
> Policy deny_unknown status:     allowed
> Memory protection checking:     actual (secure)
> Max kernel policy version:      33

Policy:

> wombat:~ # zypper info selinux-policy
> ...
> Information for package selinux-policy:
> ---------------------------------------
> Repository     : https://download.opensuse.org/distribution/leap/16.0/rep=
o/oss/aarch64
> Name           : selinux-policy
> Version        : 20241031+git516.1a75276b-160000.1.11
> Arch           : noarch
> Vendor         : SUSE LLC <https://www.suse.com/>
> Installed Size : 25.0 KiB
> Installed      : Yes (automatically)
> Status         : up-to-date
> Source package : selinux-policy-20241031+git516.1a75276b-160000.1.11.src
> Upstream URL   : https://github.com/fedora-selinux/selinux-policy.git
> Summary        : SELinux policy configuration
> Description    :=20
>     A complete SELinux policy that can be used as the system policy for a=
 variety
>     of systems and used as the basis for creating other policies.

## Additional information

Setting the system to permissive mode, fixes the permission denied errors a=
nd
makes pmlogger start normally
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17453982314.d8acebB9.28631
Date: Wed, 23 Apr 2025 08:50:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241611

          Summary
          [SELinux] pmlogger fails to start

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 16.0

          Hardware
          aarch64

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          felix.niederwanger@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

On Leap 16.0, starting the pmlogger via cockpit fails with t=
he error message
"Error: systemd job StartUnit ["pmlogger.service","repl=
ace"] failed with result
failed". The journal logs a permission denied error:

> Apr 23 10:40:01 wombat systemd[1]: Starting Perf=
ormance Metrics Archive Logger...
> Apr 23 10:40:01 wombat rc[16168]: /etc/pcp/pmlogger/rc: line 153: /var=
/lib/pcp/tmp/pmlogger_rc.GvjnQPrz0/tmp: Permission denied
> Apr 23 10:40:01 wombat rc[16168]: /etc/pcp/pmlogger/rc: Warning: Perfo=
rmance Co-Pilot archive logger(s) not permanently enabled.
> Apr 23 10:40:01 wombat rc[16168]:     To enable pmlogger, run the foll=
owing as root:
> Apr 23 10:40:01 wombat rc[16168]:     # /usr/bin/systemctl enable pmlo=
gger.service
> Apr 23 10:40:01 wombat rc[16213]: /etc/pcp/pmlogger/rc: line 92: /var/=
lib/pcp/tmp/pmlogger_rc_start.00H6WNACh/pmcheck.out: Permission denied
> Apr 23 10:40:01 wombat systemd[1]: pmlogger.service: Main process exit=
ed, code=3Dexited, status=3D1/FAILURE
> Apr 23 10:40:01 wombat systemd[1]: pmlogger.service: Failed with resul=
t 'exit-code'.

I register the following AVC denials:

> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.452:326): avc:  denied  { add_name }=
 for  pid=3D15386 comm=3D"rc" name=3D"tmp" scontext=3Ds=
ystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tc=
lass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.500:327): avc:  denied  { add_name }=
 for  pid=3D15461 comm=3D"rc" name=3D"pmcheck.out" scon=
text=3Dsystem_u:system_r:init_t:s0 > tcontext=3Dsystem_u:object_r:pcp_va=
r_lib_t:s0 tclass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.856:336): avc:  denied  { add_name }=
 for  pid=3D15620 comm=3D"rc" name=3D"tmp" scontext=3Ds=
ystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tc=
lass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:00 2025
> type=3DAVC msg=3Daudit(1745397600.924:337): avc:  denied  { add_name }=
 for  pid=3D15760 comm=3D"rc" name=3D"pmcheck.out" scon=
text=3Dsystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib=
_t:s0 tclass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.124:343): avc:  denied  { add_name }=
 for  pid=3D15823 comm=3D"rc" name=3D"tmp" scontext=3Ds=
ystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tc=
lass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.168:344): avc:  denied  { add_name }=
 for  pid=3D15914 comm=3D"rc" name=3D"pmcheck.out" scon=
text=3Dsystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib=
_t:s0 tclass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.404:350): avc:  denied  { add_name }=
 for  pid=3D15994 comm=3D"rc" name=3D"tmp" scontext=3Ds=
ystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tc=
lass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.464:351): avc:  denied  { add_name }=
 for  pid=3D16084 comm=3D"rc" name=3D"pmcheck.out" scon=
text=3Dsystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib=
_t:s0 tclass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.676:358): avc:  denied  { add_name }=
 for  pid=3D16168 comm=3D"rc" name=3D"tmp" scontext=3Ds=
ystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib_t:s0 tc=
lass=3Ddir permissive=3D0
> ----
> time->Wed Apr 23 10:40:01 2025
> type=3DAVC msg=3Daudit(1745397601.716:359): avc:  denied  { add_name }=
 for  pid=3D16213 comm=3D"rc" name=3D"pmcheck.out" scon=
text=3Dsystem_u:system_r:init_t:s0 tcontext=3Dsystem_u:object_r:pcp_var_lib=
_t:s0 tclass=3Ddir permissive=3D0

## System information

openSUSE Leap 16.0

> wombat:~ # sestatus
> SELinux status:                 enabled
> SELinuxfs mount:                /sys/fs/selinux
> SELinux root directory:         /etc/selinux
> Loaded policy name:             targeted
> Current mode:                   enforcing
> Mode from config file:          enforcing
> Policy MLS status:              enabled
> Policy deny_unknown status:     allowed
> Memory protection checking:     actual (secure)
> Max kernel policy version:      33

Policy:

> wombat:~ # zypper info selinux-policy
> ...
> Information for package selinux-policy:
> ---------------------------------------
> Repository     : https://download.opensuse.org/distribution/lea=
p/16.0/repo/oss/aarch64
> Name           : selinux-policy
> Version        : 20241031+git516.1a75276b-160000.1.11
> Arch           : noarch
> Vendor         : SUSE LLC <https:=
//www.suse.com/>
> Installed Size : 25.0 KiB
> Installed      : Yes (automatically)
> Status         : up-to-date
> Source package : selinux-policy-20241031+git516.1a75276b-160000.1.11.s=
rc
> Upstream URL   : https://github.com/fedora-selinux/selinux-policy.git
> Summary        : SELinux policy configuration
> Description    :=20
>     A complete SELinux policy that can be used as the system policy fo=
r a variety
>     of systems and used as the basis for creating other policies.</spa=
n >

## Additional information

Setting the system to permissive mode, fixes the permission denied errors a=
nd
makes pmlogger start normally

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17453982314.d8acebB9.28631--

summary: [SELinux] pmlogger fails to start


--17454834453.d4c8Cfe10.31084
Date: Thu, 24 Apr 2025 08:30:45 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241680

            Bug ID: 1241680
           Summary: dracut: bug in kernel module name normalization
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: dracut-maintainers-at-suse.de
          Reporter: antonio.feijoo-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: sndirsch-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

dracut works internally with kernel module names having "_" only. So, it
normalizes these module names passed via
drivers/add_drivers/force_drivers/omit_drivers, replacing "-" with "_". The=
 bug
is it's only replacing the first module with "-", and not all of them.

In the following example, if we want to omit multiple kernel modules that h=
ave
"-" in their names, only the first one is ommitted:

> # lsinitrd | grep -w -e "ohci-hcd\.ko" -e "uhci-hcd\.ko" -e "xhci-hcd\.ko"
> -rw-r--r


--17455057426.B3e874a.32437
Date: Thu, 24 Apr 2025 14:42:22 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241812

            Bug ID: 1241812
           Summary: VUL-0: CVE-2025-22872: glow: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: munix9-at-googlemail.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17455057426.B3e874a.32437
Date: Thu, 24 Apr 2025 14:42:22 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241812

          Summary
          VUL-0: CVE-2025-22872: glow: golang.org/x/net/html: incorrect=
ly interpreted tags can cause content to be placed wrong scope during DOM c=
onstruction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          munix9@googlemail.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17455057426.B3e874a.32437--


--17455057318.26B02.32431
Date: Thu, 24 Apr 2025 14:42:11 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241801

            Bug ID: 1241801
           Summary: VUL-0: CVE-2025-22872: headscale: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17455057318.26B02.32431
Date: Thu, 24 Apr 2025 14:42:11 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241801

          Summary
          VUL-0: CVE-2025-22872: headscale: golang.org/x/net/html: inco=
rrectly interpreted tags can cause content to be placed wrong scope during =
DOM construction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17455057318.26B02.32431--


--17455057436.38aD3b.32437
Date: Thu, 24 Apr 2025 14:42:23 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241814

            Bug ID: 1241814
           Summary: VUL-0: CVE-2025-22872: go-sendxmpp: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17455057436.38aD3b.32437
Date: Thu, 24 Apr 2025 14:42:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241814

          Summary
          VUL-0: CVE-2025-22872: go-sendxmpp: golang.org/x/net/html: in=
correctly interpreted tags can cause content to be placed wrong scope durin=
g DOM construction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          mvetter@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17455057436.38aD3b.32437--


--174550574611.dCCfA4ba.32437
Date: Thu, 24 Apr 2025 14:42:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241819

            Bug ID: 1241819
           Summary: VUL-0: CVE-2025-22872: gitea-tea: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--174550574611.dCCfA4ba.32437
Date: Thu, 24 Apr 2025 14:42:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241819

          Summary
          VUL-0: CVE-2025-22872: gitea-tea: golang.org/x/net/html: inco=
rrectly interpreted tags can cause content to be placed wrong scope during =
DOM construction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--174550574611.dCCfA4ba.32437--


--17455057731.BC122f.32452
Date: Thu, 24 Apr 2025 14:42:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241834

            Bug ID: 1241834
           Summary: VUL-0: CVE-2025-22872: distrobuilder: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17455057731.BC122f.32452
Date: Thu, 24 Apr 2025 14:42:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241834

          Summary
          VUL-0: CVE-2025-22872: distrobuilder: golang.org/x/net/html: =
incorrectly interpreted tags can cause content to be placed wrong scope dur=
ing DOM construction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17455057731.BC122f.32452--


--17455056664.4EBB6b.32413
Date: Thu, 24 Apr 2025 14:41:06 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241750

            Bug ID: 1241750
           Summary: VUL-0: CVE-2025-22872: subfinder: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jkowalczyk-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17455056664.4EBB6b.32413
Date: Thu, 24 Apr 2025 14:41:06 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241750

          Summary
          VUL-0: CVE-2025-22872: subfinder: golang.org/x/net/html: inco=
rrectly interpreted tags can cause content to be placed wrong scope during =
DOM construction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          jkowalczyk@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17455056664.4EBB6b.32413--


--174550566310.B318aD1.32413
Date: Thu, 24 Apr 2025 14:41:03 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241744

            Bug ID: 1241744
           Summary: VUL-0: CVE-2025-22872: rpm2docserv: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: kukuk-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--174550566310.B318aD1.32413
Date: Thu, 24 Apr 2025 14:41:03 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241744

          Summary
          VUL-0: CVE-2025-22872: rpm2docserv: golang.org/x/net/html: in=
correctly interpreted tags can cause content to be placed wrong scope durin=
g DOM construction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          kukuk@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--174550566310.B318aD1.32413--


--174550569712.28AC33.32419
Date: Thu, 24 Apr 2025 14:41:37 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241776

            Bug ID: 1241776
           Summary: VUL-0: CVE-2025-22872: kubo: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: bwiedemann-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--174550569712.28AC33.32419
Date: Thu, 24 Apr 2025 14:41:37 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241776

          Summary
          VUL-0: CVE-2025-22872: kubo: golang.org/x/net/html: incorrect=
ly interpreted tags can cause content to be placed wrong scope during DOM c=
onstruction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          bwiedemann@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--174550569712.28AC33.32419--


--17455057313.5AdeA1c.32431
Date: Thu, 24 Apr 2025 14:42:11 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241804

            Bug ID: 1241804
           Summary: VUL-0: CVE-2025-22872: hauler: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/450972/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/
                    S:C/C:L/I:L/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1241710
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The tokenizer incorrectly interprets tags with unquoted attribute values th=
at
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts=
).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.cve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/22xxx/CVE-2025=
-22872.json
https://bugzilla.redhat.com/show_bug.cgi?id=3D2360404
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17455057313.5AdeA1c.32431
Date: Thu, 24 Apr 2025 14:42:11 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241804

          Summary
          VUL-0: CVE-2025-22872: hauler: golang.org/x/net/html: incorre=
ctly interpreted tags can cause content to be placed wrong scope during DOM=
 construction

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/450972/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-22872:6.5:(AV:N/AC:H/PR:N/UI:N/S:C/C:L=
/I:L/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1241710

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The tokenizer incorrectly interprets tags with unquoted attr=
ibute values that
end with a solidus character (/) as self-closing. When directly using
Tokenizer, this can result in such tags incorrectly being marked as
self-closing, and when using the Parse functions, this can result in content
following such tags as being placed in the wrong scope during DOM construct=
ion,
but only when tags are in foreign content (e.g. <math>, <svg>, =
etc contexts).

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-22872
https://www.c=
ve.org/CVERecord?id=3DCVE-2025-22872
https://go.dev/cl/662715
https://go.dev/issue/73070
https=
://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO=
-2025-3595
https://github.com/CVEProject/cvelistV5/blob/main//=
cves/2025/22xxx/CVE-2025-22872.json
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2360404

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17455057313.5AdeA1c.32431--