--17037518211.d3e3.27412
Date: Thu, 28 Dec 2023 08:23:41 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218427

            Bug ID: 1218427
           Summary: plasma-discover - Unable to search for applications in the OpenSUSE repos after update 25122023
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: silviucc-at-outlook.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 871583
  --> https://bugzilla.suse.com/attachment.cgi?id=3D871583&action=3Dedit
part of the log showing which packages were installed and which were removed

Hello,

After updating to snapshot 25122023 Discover does not work properly anymore.

On the Home screen it show: "Unable to load applications. Please verify
internet connectivity"

It is only able to search through flathub and shows only flatpak apps.

zypper still works normally.

I saw a bunch of packagekit updates in the logs, maybe one of them borked i=
t?

Attaching a trimmed zypper log

This is what it shows when started from the terminal:
---
silviu@localhost:~> plasma-discover
fetch ratings! false
adding empty sources model QStandardItemModel(0x5585bc8e01e0)
no component found for "org.opensuse.opensuse-tumbleweed"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
qrc:/qml/Feedback.qml:44: ReferenceError: UserFeedbackSettings is not defin=
ed
PackageKit stopped running!
---
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17037518211.d3e3.27412
Date: Thu, 28 Dec 2023 08:23:41 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218427

          Summary
          plasma-discover - Unable to search for applications in the Op=
enSUSE repos after update 25122023

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KDE Applications

          Assignee
          opensuse-kde-bugs@opensuse.org

          Reporter
          silviucc@outlook.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 871583 [details]
part of the log showing which packages were installed and which were removed

Hello,

After updating to snapshot 25122023 Discover does not work properly anymore.

On the Home screen it show: "Unable to load applications. Please verify
internet connectivity"

It is only able to search through flathub and shows only flatpak apps.

zypper still works normally.

I saw a bunch of packagekit updates in the logs, maybe one of them borked i=
t?

Attaching a trimmed zypper log

This is what it shows when started from the terminal:
---
silviu@localhost:~> plasma-discover
fetch ratings! false
adding empty sources model QStandardItemModel(0x5585bc8e01e0)
no component found for "org.opensuse.opensuse-tumbleweed"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
file:///usr/lib64/qt5/qml/org/kde/kirigami.2/ScrollablePage.qml:200:9: QML
MouseArea: Binding loop detected for property "implicitHeight"
qrc:/qml/Feedback.qml:44: ReferenceError: UserFeedbackSettings is not defin=
ed
PackageKit stopped running!
---

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17037518211.d3e3.27412--


--17037529421.AE02cc98.27439
Date: Thu, 28 Dec 2023 08:42:22 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218428

            Bug ID: 1218428
           Summary: VUL-0: CVE-2023-50255: deepin-compressor: path traversal during file extraction
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389416/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: hillwoodroc-at-gmail.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: carlos.lopez-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior =
to
5.12.21, there's a path traversal vulnerability in deepin-compressor that c=
an
be exploited to achieve Remote Command Execution on the target system upon
opening crafted archives. Users are advised to update to version 5.12.21 wh=
ich
addresses the issue. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50255
https://github.com/linuxdeepin/deepin-compressor/commit/82f668c78c133873f50=
94cfab6e4eabc0b70e4b6
https://github.com/linuxdeepin/developer-center/security/advisories/GHSA-rw=
5r-8p9h-3gp2
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17037529421.AE02cc98.27439
Date: Thu, 28 Dec 2023 08:42:22 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218428

          Summary
          VUL-0: CVE-2023-50255: deepin-compressor: path traversal duri=
ng file extraction

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389416/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          hillwoodroc@gmail.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          carlos.lopez@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Deepin-Compressor is the default archive manager of Deepin L=
inux OS. Prior to
5.12.21, there's a path traversal vulnerability in deepin-compressor that c=
an
be exploited to achieve Remote Command Execution on the target system upon
opening crafted archives. Users are advised to update to version 5.12.21 wh=
ich
addresses the issue. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50255
https://github.com/linuxdeepin/deepin-com=
pressor/commit/82f668c78c133873f5094cfab6e4eabc0b70e4b6
https://github.com/linuxdeepin/developer-center/se=
curity/advisories/GHSA-rw5r-8p9h-3gp2

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17037529421.AE02cc98.27439--


body:
--17038144682.d40Fa0f28.28125
Date: Fri, 29 Dec 2023 01:47:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218439

            Bug ID: 1218439
           Summary: Aeon: TPM not detected in Gnome
    Classification: openSUSE
           Product: openSUSE Kalpa
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Patterns
          Assignee: sfalken@cloverleaf-linux.org
          Reporter: sfalken@cloverleaf-linux.org
        QA Contact: qa-bugs-at-suse.de
                CC: 0xdopice-at-protonmail.com, qa-bugs-at-suse.de,
                    rbrown-at-suse.com
        Depends on: 1211835
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1211835 +++

In a default install of Aeon, the TPM chip is not detected by Gnome due to
missing packages.

Gnome settings > Privacy > Device Security reports "Checks Failed - Hardware
does not pass checks. The report show "TPM v2.0:=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      ! Fail (Not Found)" under HSI-1 Tests. The required packages are,
tpm2-0-tss
tpm2.0-abrmd
tpm2.0-tools
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17038144682.d40Fa0f28.28125
Date: Fri, 29 Dec 2023 01:47:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218439

          Summary
          Aeon: TPM not detected in Gnome

          Classification
          openSUSE

          Product
          openSUSE Kalpa

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Patterns

          Assignee
          sfalken@cloverleaf-linux.org

          Reporter
          sfalken@cloverleaf-linux.org

          QA Contact
          qa-bugs@suse.de

          CC
          0xdopice@protonmail.com, qa-bugs@suse.de, rbrown@=
suse.com

          Depends on
          1211835

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1211835 +++

In a default install of Aeon, the TPM chip is not detected by Gnome due to
missing packages.

Gnome settings > Privacy > Device Security reports "Checks Faile=
d - Hardware
does not pass checks. The report show "TPM v2.0:=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
      ! Fail (Not Found)" under HSI-1 Tests. The required packages are,
tpm2-0-tss
tpm2.0-abrmd
tpm2.0-tools

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17038144682.d40Fa0f28.28125--

summary: Aeon: TPM not detected in Gnome


--17038410310.F9E3aE1.28272
Date: Fri, 29 Dec 2023 09:10:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218446

            Bug ID: 1218446
           Summary: VUL-0: CVE-2023-7158: micropython: heap-based buffer overflow in function slice_indices of the file objslice.c.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389587/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: steven.kowalik-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

A vulnerability was found in MicroPython up to 1.21.0. It has been classifi=
ed
as critical. Affected is the function slice_indices of the file objslice.c.=
 The
manipulation leads to heap-based buffer overflow. It is possible to launch =
the
attack remotely. The exploit has been disclosed to the public and may be us=
ed.
Upgrading to version 1.22.0 is able to address this issue. It is recommende=
d to
upgrade the affected component. The identifier of this vulnerability is
VDB-249180.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-7158
https://github.com/micropython/micropython/issues/13007

Patch:
https://github.com/micropython/micropython/pull/13039/commits/f397a3ec318f3=
ad05aa287764ae7cef32202380f
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17038410310.F9E3aE1.28272
Date: Fri, 29 Dec 2023 09:10:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218446

          Summary
          VUL-0: CVE-2023-7158: micropython: heap-based buffer overflow=
 in function slice_indices of the file objslice.c.

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389587/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          steven.kowalik@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

A vulnerability was found in MicroPython up to 1.21.0. It ha=
s been classified
as critical. Affected is the function slice_indices of the file objslice.c.=
 The
manipulation leads to heap-based buffer overflow. It is possible to launch =
the
attack remotely. The exploit has been disclosed to the public and may be us=
ed.
Upgrading to version 1.22.0 is able to address this issue. It is recommende=
d to
upgrade the affected component. The identifier of this vulnerability is
VDB-249180.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-7158
https:/=
/github.com/micropython/micropython/issues/13007

Patch:
https://github.com/micropython/micr=
opython/pull/13039/commits/f397a3ec318f3ad05aa287764ae7cef32202380f</pr=
e>

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17038410310.F9E3aE1.28272--


--17041846801.feF1E.29354
Date: Tue, 2 Jan 2024 08:38:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218473

            Bug ID: 1218473
           Summary: VUL-0: CVE-2023-26157: libredwg: out-of-bound read involving section->num_pages in decode_r2007.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389804/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: jengelh-at-inai.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denia=
l of
Service (DoS) due to an out-of-bounds read involving section->num_pages in
decode_r2007.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-26157
https://github.com/LibreDWG/libredwg/issues/850

Patch:
https://github.com/LibreDWG/libredwg/commit/c8cf03ce4c2315b146caf582ea061c0=
460193bcc
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17041846801.feF1E.29354
Date: Tue, 2 Jan 2024 08:38:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218473

          Summary
          VUL-0: CVE-2023-26157: libredwg: out-of-bound read involving =
section->num_pages in decode_r2007.c

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389804/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          jengelh@inai.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Versions of the package libredwg before 0.12.5.6384 are vuln=
erable to Denial of
Service (DoS) due to an out-of-bounds read involving section->num_pages =
in
decode_r2007.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-26157
https://github.=
com/LibreDWG/libredwg/issues/850

Patch:
https://github.com/LibreDWG/libredwg/commit/c8cf03ce4=
c2315b146caf582ea061c0460193bcc

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17041846801.feF1E.29354--


--17042705650.D0629498F.30638
Date: Wed, 3 Jan 2024 08:29:25 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218492

            Bug ID: 1218492
           Summary: [Build 20231228] FTBFS: tvm fails to build against not libSPIRV
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/3845146/modules/tvm/
                    steps/3
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

Problem: nothing provides 'libSPIRV-Tools-2023.5~rc1.so()(64bit)' needed by=
 the
to be installed python311-tvm-0.13.0-1.2.x86_64
 Solution 1: do not install tvmc-0.13.0-1.2.x86_64
 Solution 2: break python311-tvm-0.13.0-1.2.x86_64 by ignoring some of its
dependencies

Source of evil is the build fail of tvm:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory/tvm/stan=
dard/x86_64

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-extra_tests_ai_ml@64=
bit
fails in
[tvm](https://openqa.opensuse.org/tests/3845146/modules/tvm/steps/3)

## Test suite description
Test AI/ML software

## Reproducible

Fails since (at least) Build
[20231228](https://openqa.opensuse.org/tests/3842176)

## Expected result

Last good: [20231226](https://openqa.opensuse.org/tests/3840037) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dextra_tests_ai_ml&version=3DTumb=
leweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17042705650.D0629498F.30638
Date: Wed, 3 Jan 2024 08:29:25 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218492

          Summary
          [Build 20231228] FTBFS: tvm fails to build against not libSPI=
RV

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/3845146/modules/tvm/steps/3

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

Problem: nothing provides 'libSPIRV-Tools-2023.5~rc1.so()(64bit)' needed by=
 the
to be installed python311-tvm-0.13.0-1.2.x86_64
 Solution 1: do not install tvmc-0.13.0-1.2.x86_64
 Solution 2: break python311-tvm-0.13.0-1.2.x86_64 by ignoring some of its
dependencies

Source of evil is the build fail of tvm:
https://build.opensuse.org/package/live_build_log/o=
penSUSE:Factory/tvm/standard/x86_64

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-extra_tests_ai_ml&#6=
4;64bit
fails in
[tvm](https://openqa.opensuse.org/tests/3845146/modules/tvm/steps/3)

## Test suite description
Test AI/ML software

## Reproducible

Fails since (at least) Build
[20231228](https://op=
enqa.opensuse.org/tests/3842176)

## Expected result

Last good: [20231226](https://openqa.opensuse.org/tests/3840037) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/la=
test?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D64b=
it&test=3Dextra_tests_ai_ml&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17042705650.D0629498F.30638--


body:
--17043536160.2B09E4BaA.32413
Date: Thu, 4 Jan 2024 07:33:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218533

            Bug ID: 1218533
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 120.0.6099.199
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: abergmann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-des=
ktop.html

Stable Channel Update for Desktop
Wednesday, January 3, 2024

The Stable channel has been updated to 120.0.6099.199 for Mac,Linux and
120.0.6099.199/200 to Windows which will roll out over the coming days/week=
s. A
full list of changes in this build is available in the Log.

Security Fixes:
High: CVE-2024-0222: Use after free in ANGLE.
High: CVE-2024-0223: Heap buffer overflow in ANGLE.
High: CVE-2024-0224: Use after free in WebAudio.
High: CVE-2024-0225: Use after free in WebGPU.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17043536160.2B09E4BaA.32413
Date: Thu, 4 Jan 2024 07:33:36 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218533

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 120.0.6099.199

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          gmbr3@opensuse.org

          Reporter
          abergmann@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.com/=
2024/01/stable-channel-update-for-desktop.html

Stable Channel Update for Desktop
Wednesday, January 3, 2024

The Stable channel has been updated to 120.0.6099.199 for Mac,Linux and
120.0.6099.199/200 to Windows which will roll out over the coming days/week=
s. A
full list of changes in this build is available in the Log.

Security Fixes:
High: CVE-2024-0222: Use after free in ANGLE.
High: CVE-2024-0223: Heap buffer overflow in ANGLE.
High: CVE-2024-0224: Use after free in WebAudio.
High: CVE-2024-0225: Use after free in WebGPU.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17043536160.2B09E4BaA.32413--

pkgs: chromium ungoogled-chromium


body:
--17047247174.7D1DCBE.4463
Date: Mon, 8 Jan 2024 14:38:37 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218620

            Bug ID: 1218620
           Summary: cmake: -Wl,--no-undefined breaks canokey-qemu build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: stefan.bruens@rwth-aachen.de
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: dmueller-at-suse.com, simonf.lees-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The recent addition of  -Wl,--no-undefined to link flags for shared librari=
es
breaks build of the canokey-qemu package. I've tried to fix it but hit my
limits wrt cmake knowledge. Advice needed.

The issue here is that the package produces an actual shared library, not a
module. Qemu links against it. Nevertheless AFAICT it has symbols that come
from the qemu binary itself. Probably dirty but that's the way it is:

https://build.opensuse.org/package/show/openSUSE:Factory/canokey-qemu

Is there a way to either unset --no-undefined or adjust the cmake config th=
ere?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17047247174.7D1DCBE.4463
Date: Mon, 8 Jan 2024 14:38:37 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218620

          Summary
          cmake: -Wl,--no-undefined breaks canokey-qemu build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          stefan.bruens@rwth-aachen.de

          Reporter
          lnussel@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          dmueller@suse.com, simonf.lees@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The recent addition of  -Wl,--no-undefined to link flags for=
 shared libraries
breaks build of the canokey-qemu package. I've tried to fix it but hit my
limits wrt cmake knowledge. Advice needed.

The issue here is that the package produces an actual shared library, not a
module. Qemu links against it. Nevertheless AFAICT it has symbols that come
from the qemu binary itself. Probably dirty but that's the way it is:

https://build.opensuse.org/package/show/openSUSE:Factory/canokey-qem=
u

Is there a way to either unset --no-undefined or adjust the cmake config th=
ere?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17047247174.7D1DCBE.4463--

pkgs: canokey-qemu cmake


--17048131800.23eA.6561
Date: Tue, 9 Jan 2024 15:13:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218653

            Bug ID: 1218653
           Summary: Gimp 3 scheduled for May - Lets start the preparations
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

- https://www.phoronix.com/news/GIMP-3.0-May-2024-Schedule
- https://librearts.org/2023/11/gimp-3-0-roadmap/

current test packages are in:
https://build.opensuse.org/project/show/graphics:gimp:master

i dropped a mail to Jehan to find out if the master snapshots of gegl and b=
abl
are still needed or not.

if we want to have parallel buildable packages it would be easy to rename t=
he
master gimp package to gimp3 and apply this patch:

```
Index: gimp.spec
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
-


--17048342313.C0b3d94eC.7065
Date: Tue, 9 Jan 2024 21:03:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218666

            Bug ID: 1218666
           Summary: sg3_utils: udev rules: spurious warning about .SCSI_ID_SERIAL_SRC
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.wilck-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Lots of warnings during boot:

55-scsi-sg3_id.rules[15445]: WARNING: SCSI device loop0 has no device ID,
consider changing .SCSI_ID_SERIAL_SRC in 00-scsi-sg3_config.rules
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17048342313.C0b3d94eC.7065
Date: Tue, 9 Jan 2024 21:03:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218666

          Summary
          sg3_utils: udev rules: spurious warning about .SCSI_ID_SERIAL=
_SRC

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          martin.wilck@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Lots of warnings during boot:

55-scsi-sg3_id.rules[15445]: WARNING: SCSI device loop0 has no device ID,
consider changing .SCSI_ID_SERIAL_SRC in 00-scsi-sg3_config.rules

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17048342313.C0b3d94eC.7065--


--17048900130.B645B.8346
Date: Wed, 10 Jan 2024 12:33:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218701

            Bug ID: 1218701
           Summary: llvm17 on i586: fails to build with RPM 4.19
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ana.guerrero-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 871750
  --> https://bugzilla.suse.com/attachment.cgi?id=3D871750&action=3Dedit
llvm17 on i586 with RPM 4.19

The remaining blocker for RPM 4.19 to go is llvm17 failing to build on i586,
please see attached log.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17048900130.B645B.8346
Date: Wed, 10 Jan 2024 12:33:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218701

          Summary
          llvm17 on i586: fails to build with RPM 4.19

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          ana.guerrero@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachmen=
t 871750 [details]
llvm17 on i586 with RPM 4.19

The remaining blocker for RPM 4.19 to go is llvm17 failing to build on i586,
please see attached log.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17048900130.B645B.8346--


body:
--17049656832.b3aBA.929
Date: Thu, 11 Jan 2024 09:34:43 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218719

            Bug ID: 1218719
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 120.0.6099.216
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: m.szczepaniak.000-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The Stable channel has been updated to 120.0.6099.216 for Mac,Linux and
120.0.6099.216/217 to Windows which will roll out over the coming days/week=
s. A
full list of changes in this build is available in the Log.

- CVE-2024-0333: Insufficient data validation in Extensions. Reported by
Malcolm Stagg

References:
https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-des=
ktop_9.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17049656832.b3aBA.929
Date: Thu, 11 Jan 2024 09:34:43 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218719

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 120.0.6099.216

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          gmbr3@opensuse.org

          Reporter
          thomas.leroy@suse.com

          QA Contact
          security-team@suse.de

          CC
          m.szczepaniak.000@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The Stable channel has been updated to 120.0.6099.216 for Ma=
c,Linux and
120.0.6099.216/217 to Windows which will roll out over the coming days/week=
s. A
full list of changes in this build is available in the Log.

- CVE-2024-0333: Insufficient data validation in Extensions. Reported by
Malcolm Stagg

References:
https://chromereleases.googleblog.com/2024/01/stabl=
e-channel-update-for-desktop_9.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17049656832.b3aBA.929--


--17050410680.16cFB.2851
Date: Fri, 12 Jan 2024 06:31:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218749

            Bug ID: 1218749
           Summary: VUL-0: CVE-2022-48620: uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/390989/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mvetter-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: stoyan.manolov-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxeve=
nts
is a large number.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2022-48620
https://www.cve.org/CVERecord?id=3DCVE-2022-48620
https://github.com/troglobit/libuev/commit/2d9f1c9ce655cc38511aeeb6e95ac309=
14f7aec9
https://github.com/troglobit/libuev/compare/v2.4.0...v2.4.1
https://github.com/troglobit/libuev/issues/27
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17050410680.16cFB.2851
Date: Fri, 12 Jan 2024 06:31:08 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218749

          Summary
          VUL-0: CVE-2022-48620: uev (aka libuev) before 2.4.1 has a bu=
ffer overflow in epoll_wait if maxevents is a large number.

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/390989/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          mvetter@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          stoyan.manolov@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

uev (aka libuev) before 2.4.1 has a buffer overflow in epoll=
_wait if maxevents
is a large number.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2022-48620
https://www.c=
ve.org/CVERecord?id=3DCVE-2022-48620
https://github.com/troglobit/libuev/commit/2d9f1c9ce65=
5cc38511aeeb6e95ac30914f7aec9
htt=
ps://github.com/troglobit/libuev/compare/v2.4.0...v2.4.1
https://github.co=
m/troglobit/libuev/issues/27

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17050410680.16cFB.2851--


--17053193750.B0aAE.6646
Date: Mon, 15 Jan 2024 11:49:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218808

            Bug ID: 1218808
           Summary: bcachefs-tools: some systemd services use non-existing exec paths
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Other
          Assignee: jengelh-at-inai.de
          Reporter: matthias.gerstner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

While looking into the newly added systemd services for bcachefs-tools I
noticed that some of the services use non-existing paths in /usr/local:

/usr/lib/systemd/system/bcachefsck_all_fail.service:ExecStart=3D/usr/local/=
libexec/bcachefsck_fail
"${EMAIL_ADDR}" bcachefsck_all
/usr/lib/systemd/system/bcachefsck_fail@.service:ExecStart=3D/usr/local/lib=
exec/bcachefsck_fail
"${EMAIL_ADDR}" bcachefs %f

This script exists in /usr/libexec instead.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17053193750.B0aAE.6646
Date: Mon, 15 Jan 2024 11:49:35 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218808

          Summary
          bcachefs-tools: some systemd services use non-existing exec p=
aths

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Minor

          Priority
          P5 - None

          Component
          Other

          Assignee
          jengelh@inai.de

          Reporter
          matthias.gerstner@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

While looking into the newly added systemd services for bcac=
hefs-tools I
noticed that some of the services use non-existing paths in /usr/local:

/usr/lib/systemd/system/bcachefsck_all_fail.service:ExecStart=3D/usr/local/=
libexec/bcachefsck_fail
"${EMAIL_ADDR}" bcachefsck_all
/usr/lib/systemd/system/bcachefsck_fail@.service:ExecStart=3D/usr/local=
/libexec/bcachefsck_fail
"${EMAIL_ADDR}" bcachefs %f

This script exists in /usr/libexec instead.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17053193750.B0aAE.6646--


body:
--17054801688.8F2dD4.10685
Date: Wed, 17 Jan 2024 08:29:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218892

            Bug ID: 1218892
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 120.0.6099.224
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The Stable channel has been updated to 120.0.6099.224 for Linux which will =
roll
out over the coming days/weeks. A full list of changes in this build is
available in the Log.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 4 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

CVE-2024-0517: Out of bounds write in V8.
CVE-2024-0518: Type Confusion in V8.
CVE-2024-0519: Out of bounds memory access in V8.

Google is aware of reports that an exploit for CVE-2024-0519 exists in the
wild.

As usual, our ongoing internal security work was responsible for a wide ran=
ge
of fixes:
[1518006] Various fixes from internal audits, fuzzing and other initiatives
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17054801688.8F2dD4.10685
Date: Wed, 17 Jan 2024 08:29:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218892

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 120.0.6099.224

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The Stable channel has been updated to 120.0.6099.224 for Li=
nux which will roll
out over the coming days/weeks. A full list of changes in this build is
available in the Log.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 4 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

CVE-2024-0517: Out of bounds write in V8.
CVE-2024-0518: Type Confusion in V8.
CVE-2024-0519: Out of bounds memory access in V8.

Google is aware of reports that an exploit for CVE-2024-0519 exists in the
wild.

As usual, our ongoing internal security work was responsible for a wide ran=
ge
of fixes:
[1518006] Various fixes from internal audits, fuzzing and other initiatives=

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17054801688.8F2dD4.10685--


body:
--17055876371.461B1.16303
Date: Thu, 18 Jan 2024 14:20:37 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218951

            Bug ID: 1218951
           Summary: vagrant: needs update for ruby3.3
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ana.guerrero-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Vagrant is blocking the update to ruby3.3 because it's failing to build with
this version.=20
Relevant lines from the log:

[   17s] + cd /home/abuild/rpmbuild/BUILD
[   17s] + cd vagrant-2.3.7
[   17s] + sed -i 's|gem '\''vagrant-spec'\'', git.*$|gem
'\''vagrant-spec'\''|' Gemfile
[   17s] ++ ruby.ruby3.3 -e 'print Gem.path.reject{|path| path.include?
'\''home'\''}.join('\'':'\'')'
[   17s] + export
GEM_PATH=3D/home/abuild/rpmbuild/BUILDROOT/vagrant-2.3.7-4.1.x86_64/usr/sha=
re/vagrant/gems:/usr/lib64/ruby/gems/3.3.0
[   17s] +
GEM_PATH=3D/home/abuild/rpmbuild/BUILDROOT/vagrant-2.3.7-4.1.x86_64/usr/sha=
re/vagrant/gems:/usr/lib64/ruby/gems/3.3.0
[   17s] + bundle exec rake test:unit
[   18s] bundler: failed to load command: rake (/usr/bin/rake)
[   18s] /usr/lib64/ruby/3.3.0/bundler/resolver.rb:116:in `rescue in
solve_versions': Could not find compatible versions (Bundler::SolveFailure)
[   18s]=20
[   18s] Because every version of vagrant depends on Ruby >=3D 3.0, < 3.3
[   18s]   and Gemfile depends on vagrant >=3D 0,
[   18s]   Ruby >=3D 3.0, < 3.3 is required.
[   18s] So, because current Ruby version is =3D 3.3.0,
[   18s]   version solving has failed.
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:79:in
`solve_versions'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:32:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:600:in
`start_resolution'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:311:in
`resolve'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:553:in
`materialize'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:203:in `sp=
ecs'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:270:in
`specs_for'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/runtime.rb:18:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler.rb:162:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `block in
<top (required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:159:in
`with_level'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:111:in `sile=
nce'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `<top
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`require_relative'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`kernel_load'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:23:in `run'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:451:in `exec'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/command.rb:28:in `run'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/invocation.rb:127:in
`invoke_command'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor.rb:527:in `dispatch'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:34:in `dispatch'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/base.rb:584:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:28:in `start'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:28:in `block in <t=
op
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/friendly_errors.rb:117:in
`with_friendly_errors'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:20:in `<top
(required)>'
[   18s]        from /usr/bin/bundle:25:in `load'
[   18s]        from /usr/bin/bundle:25:in `'
[   18s]
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:237:in
`resolve_conflict': Could not find compatible versions
(Bundler::PubGrub::SolveFailure)
[   18s]=20
[   18s] Because every version of vagrant depends on Ruby >=3D 3.0, < 3.3
[   18s]   and Gemfile depends on vagrant >=3D 0,
[   18s]   Ruby >=3D 3.0, < 3.3 is required.
[   18s] So, because current Ruby version is =3D 3.3.0,
[   18s]   version solving has failed.
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:73:in
`block in propagate'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:70:in
`reverse_each'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:70:in
`propagate'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:42:in
`work'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:58:in
`solve'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:81:in
`solve_versions'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:32:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:600:in
`start_resolution'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:311:in
`resolve'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:553:in
`materialize'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:203:in `sp=
ecs'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:270:in
`specs_for'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/runtime.rb:18:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler.rb:162:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `block in
<top (required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:159:in
`with_level'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:111:in `sile=
nce'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `<top
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`require_relative'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`kernel_load'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:23:in `run'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:451:in `exec'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/command.rb:28:in `run'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/invocation.rb:127:in
`invoke_command'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor.rb:527:in `dispatch'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:34:in `dispatch'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/base.rb:584:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:28:in `start'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:28:in `block in <t=
op
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/friendly_errors.rb:117:in
`with_friendly_errors'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:20:in `<top
(required)>'
[   18s]        from /usr/bin/bundle:25:in `load'
[   18s]        from /usr/bin/bundle:25:in `'
[   18s] error: Bad exit status from /var/tmp/rpm-tmp.L6GsJN (%check)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17055876371.461B1.16303
Date: Thu, 18 Jan 2024 14:20:37 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218951

          Summary
          vagrant: needs update for ruby3.3

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          ana.guerrero@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Vagrant is blocking the update to ruby3.3 because it's faili=
ng to build with
this version.=20
Relevant lines from the log:

[   17s] + cd /home/abuild/rpmbuild/BUILD
[   17s] + cd vagrant-2.3.7
[   17s] + sed -i 's|gem '\''vagrant-spec'\'', git.*$|gem
'\''vagrant-spec'\''|' Gemfile
[   17s] ++ ruby.ruby3.3 -e 'print Gem.path.reject{|path| path.include?
'\''home'\''}.join('\'':'\'')'
[   17s] + export
GEM_PATH=3D/home/abuild/rpmbuild/BUILDROOT/vagrant-2.3.7-4.1.x86_64/usr/sha=
re/vagrant/gems:/usr/lib64/ruby/gems/3.3.0
[   17s] +
GEM_PATH=3D/home/abuild/rpmbuild/BUILDROOT/vagrant-2.3.7-4.1.x86_64/usr/sha=
re/vagrant/gems:/usr/lib64/ruby/gems/3.3.0
[   17s] + bundle exec rake test:unit
[   18s] bundler: failed to load command: rake (/usr/bin/rake)
[   18s] /usr/lib64/ruby/3.3.0/bundler/resolver.rb:116:in `rescue in
solve_versions': Could not find compatible versions (Bundler::SolveFailure)
[   18s]=20
[   18s] Because every version of vagrant depends on Ruby >=3D 3.0, <=
 3.3
[   18s]   and Gemfile depends on vagrant >=3D 0,
[   18s]   Ruby >=3D 3.0, < 3.3 is required.
[   18s] So, because current Ruby version is =3D 3.3.0,
[   18s]   version solving has failed.
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:79:in
`solve_versions'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:32:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:600:in
`start_resolution'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:311:in
`resolve'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:553:in
`materialize'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:203:in `sp=
ecs'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:270:in
`specs_for'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/runtime.rb:18:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler.rb:162:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `block in
<top (required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:159:in
`with_level'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:111:in `sile=
nce'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `<top
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`require_relative'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`kernel_load'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:23:in `run'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:451:in `exec'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/command.rb:28:in `run'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/invocation.rb:127:in
`invoke_command'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor.rb:527:in `dispatch'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:34:in `dispatch'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/base.rb:584:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:28:in `start'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:28:in `block in &l=
t;top
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/friendly_errors.rb:117:in
`with_friendly_errors'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:20:in `<top
(required)>'
[   18s]        from /usr/bin/bundle:25:in `load'
[   18s]        from /usr/bin/bundle:25:in `<main>'
[   18s]
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:237:in
`resolve_conflict': Could not find compatible versions
(Bundler::PubGrub::SolveFailure)
[   18s]=20
[   18s] Because every version of vagrant depends on Ruby >=3D 3.0, <=
 3.3
[   18s]   and Gemfile depends on vagrant >=3D 0,
[   18s]   Ruby >=3D 3.0, < 3.3 is required.
[   18s] So, because current Ruby version is =3D 3.3.0,
[   18s]   version solving has failed.
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:73:in
`block in propagate'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:70:in
`reverse_each'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:70:in
`propagate'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:42:in
`work'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/pub_grub/lib/pub_grub/version_solver.r=
b:58:in
`solve'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:81:in
`solve_versions'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/resolver.rb:32:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:600:in
`start_resolution'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:311:in
`resolve'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:553:in
`materialize'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:203:in `sp=
ecs'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/definition.rb:270:in
`specs_for'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/runtime.rb:18:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler.rb:162:in `setup'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `block in
<top (required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:159:in
`with_level'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/ui/shell.rb:111:in `sile=
nce'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/setup.rb:26:in `<top
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`require_relative'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:56:in
`kernel_load'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli/exec.rb:23:in `run'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:451:in `exec'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/command.rb:28:in `run'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/invocation.rb:127:in
`invoke_command'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor.rb:527:in `dispatch'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:34:in `dispatch'
[   18s]        from
/usr/lib64/ruby/3.3.0/bundler/vendor/thor/lib/thor/base.rb:584:in `start'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/cli.rb:28:in `start'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:28:in `block in &l=
t;top
(required)>'
[   18s]        from /usr/lib64/ruby/3.3.0/bundler/friendly_errors.rb:117:in
`with_friendly_errors'
[   18s]        from
/usr/lib64/ruby/gems/3.3.0/gems/bundler-2.5.3/exe/bundle:20:in `<top
(required)>'
[   18s]        from /usr/bin/bundle:25:in `load'
[   18s]        from /usr/bin/bundle:25:in `<main>'
[   18s] error: Bad exit status from /var/tmp/rpm-tmp.L6GsJN (%check)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17055876371.461B1.16303--

summary: vagrant: needs update for ruby3.3


--17056386280.FAaaf9.17337
Date: Fri, 19 Jan 2024 04:30:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218976

            Bug ID: 1218976
           Summary: VUL-0: CVE-2024-22415: jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Language Server Protocol. Installations of jupyter-lsp running in environments without confi ...
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/391707/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: code-at-bnavigator.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: stoyan.manolov-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + h=
over
suggestions + linters + autocompletion + rename) using Language Server
Protocol. Installations of jupyter-lsp running in environments without
configured file system access control (on the operating system level), and =
with
jupyter-server instances exposed to non-trusted network are vulnerable to
unauthorised access and modification of file system beyond the jupyter root
directory. This issue has been patched in version 2.2.2 and all users are
advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-22415
https://github.com/jupyter-lsp/jupyterlab-lsp/security/advisories/GHSA-4qhp=
-652w-c22x
https://www.cve.org/CVERecord?id=3DCVE-2024-22415
https://github.com/jupyter-lsp/jupyterlab-lsp/commit/4ad12f204ad0b85580fc32=
137c647baaff044e95
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17056386280.FAaaf9.17337
Date: Fri, 19 Jan 2024 04:30:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218976

          Summary
          VUL-0: CVE-2024-22415: jupyter-lsp is a coding assistance too=
l for JupyterLab (code navigation + hover suggestions + linters + autocompl=
etion + rename) using Language Server Protocol. Installations of jupyter-ls=
p running in environments without confi ...

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/391707/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          code@bnavigator.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          stoyan.manolov@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

jupyter-lsp is a coding assistance tool for JupyterLab (code=
 navigation + hover
suggestions + linters + autocompletion + rename) using Language Server
Protocol. Installations of jupyter-lsp running in environments without
configured file system access control (on the operating system level), and =
with
jupyter-server instances exposed to non-trusted network are vulnerable to
unauthorised access and modification of file system beyond the jupyter root
directory. This issue has been patched in version 2.2.2 and all users are
advised to upgrade. Users unable to upgrade should uninstall jupyter-lsp.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-22415
https://github.com/jupyter-lsp/jupyterlab-lsp/securi=
ty/advisories/GHSA-4qhp-652w-c22x
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-22415
https://github.com/jupyter-lsp/jupyterlab-ls=
p/commit/4ad12f204ad0b85580fc32137c647baaff044e95

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17056386280.FAaaf9.17337--


body:
--17057658512.CdCDEF.19369
Date: Sat, 20 Jan 2024 15:50:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1219031

            Bug ID: 1219031
           Summary: Multiple cross-arm-none-gcc13 bugs
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: rguenther-at-suse.com
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

1. the package does not require libisl23 libmpc3 so the binary does not run.
2. package not required to provide required headers:

```
Compiling: keyboards/moonlander/matrix.c=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                   In file included from
./lib/chibios/os/hal/osal/rt-nil/osal.h:29,
                 from ./lib/chibios/os/hal/include/hal.h:30,
                 from platforms/chibios/platform_deps.h:18,
                 from quantum/quantum.h:18,
                 from keyboards/moonlander/moonlander.h:21,
                 from keyboards/moonlander/matrix.c:19:
/usr/lib64/gcc/arm-none-eabi/13/include/stdint.h:9:16: fatal error: stdint.=
h:
No such file or directory
    9 | # include_next <stdint.h>
      |                ^~~~~~~~~~
compilation terminated.
 [ERRORS]
 |=20
 |=20
 |=20
gmake[1]: *** [builddefs/common_rules.mk:361:
.build/obj_moonlander_darix-v3/matrix.o] Error 1
Make finished with errors
gmake: *** [Makefile:392: moonlander:darix-v3] Error 1
```
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17057658512.CdCDEF.19369
Date: Sat, 20 Jan 2024 15:50:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1219031

          Summary
          Multiple cross-arm-none-gcc13 bugs

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          rguenther@suse.com

          Reporter
          mrueckert@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

1. the package does not require libisl23 libmpc3 so the bina=
ry does not run.
2. package not required to provide required headers:

```
Compiling: keyboards/moonlander/matrix.c=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20
                   In file included from
./lib/chibios/os/hal/osal/rt-nil/osal.h:29,
                 from ./lib/chibios/os/hal/include/hal.h:30,
                 from platforms/chibios/platform_deps.h:18,
                 from quantum/quantum.h:18,
                 from keyboards/moonlander/moonlander.h:21,
                 from keyboards/moonlander/matrix.c:19:
/usr/lib64/gcc/arm-none-eabi/13/include/stdint.h:9:16: fatal error: stdint.=
h:
No such file or directory
    9 | # include_next <stdint.h>
      |                ^~~~~~~~~~
compilation terminated.
 [ERRORS]
 |=20
 |=20
 |=20
gmake[1]: *** [builddefs/common_rules.mk:361:
.build/obj_moonlander_darix-v3/matrix.o] Error 1
Make finished with errors
gmake: *** [Makefile:392: moonlander:darix-v3] Error 1
```

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17057658512.CdCDEF.19369--

summary: Multiple cross-arm-none-gcc13 bugs


body:
--17059561770.AdD83F547.21444
Date: Mon, 22 Jan 2024 20:42:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1219070

            Bug ID: 1219070
           Summary: Chromium won't play youtube videos
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: screening-team-bugs-at-suse.de
          Reporter: aloisio-at-gmx.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Since the last two updates, using plasma/wayland, playing won't start and a
generic error is shown.

The console prints:
  ERROR:gl_surface_presentation_helper.cc(260)] GetVSyncParametersIfAvailab=
le()
failed for 1 times!

Last functioning version is 119.0.6045.199-bp155.2.61.1
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17059561770.AdD83F547.21444
Date: Mon, 22 Jan 2024 20:42:57 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1219070

          Summary
          Chromium won't play youtube videos

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 Applications

          Assignee
          screening-team-bugs@suse.de

          Reporter
          aloisio@gmx.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Since the last two updates, using plasma/wayland, playing wo=
n't start and a
generic error is shown.

The console prints:
  ERROR:gl_surface_presentation_helper.cc(260)] GetVSyncParametersIfAvailab=
le()
failed for 1 times!

Last functioning version is 119.0.6045.199-bp155.2.61.1

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17059561770.AdD83F547.21444--

summary: Chromium won't play youtube videos


--17059975391.2aA4Acfb5.21897
Date: Tue, 23 Jan 2024 08:12:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1219074

            Bug ID: 1219074
           Summary: [Build 20240122] live images: grub2 falls back to text mode
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/3886589/modules/boot
                    loader/steps/1
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Bootloader
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

This seems to be a regression of
https://build.opensuse.org/package/rdiff/openSUSE:Factory/grub2?linkrev=3Db=
ase&rev=3D314

On all live images, grub2 does not show up in the nice, 'graphical' view, b=
ut
falls back to the pure text mode.=20

openQA test in scenario
opensuse-Tumbleweed-GNOME-Live-x86_64-gnome-live@64bit-4G fails in
[bootloader](https://openqa.opensuse.org/tests/3886589/modules/bootloader/s=
teps/1)

## Test suite description
Maintainer: dimstar-at-opensuse.org

Test for openSUSE GNOME Next Live-Media

EXCLUDE_MODULES is a workaround for
https://bugzilla.opensuse.org/show_bug.cgi?id=3D1138401#c10 (except for
opensuse_welcome, which is blacklisted on the GNOME live for space reasons)

## Reproducible

Fails since (at least) Build
[20240122](https://openqa.opensuse.org/tests/3886589) (current job)

## Expected result

Last good: [20240121](https://openqa.opensuse.org/tests/3883367) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DGNOME-Live&machine=3D64bit-4G&test=3Dgnome-live&version=3DT=
umbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17059975391.2aA4Acfb5.21897
Date: Tue, 23 Jan 2024 08:12:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1219074

          Summary
          [Build 20240122] live images: grub2 falls back to text mode

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/3886589/modules/bootloader/=
steps/1

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Bootloader

          Assignee
          screening-team-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

This seems to be a regression of
https://build.opensuse.org/package/rdiff/open=
SUSE:Factory/grub2?linkrev=3Dbase&rev=3D314

On all live images, grub2 does not show up in the nice, 'graphical' view, b=
ut
falls back to the pure text mode.=20

openQA test in scenario
opensuse-Tumbleweed-GNOME-Live-x86_64-gnome-live@64bit-4G fails in
[bootloader](https://openqa.opensuse.org/tests/3886589/modules/bootlo=
ader/steps/1)

## Test suite description
Maintainer: dimstar@opensus=
e.org

Test for openSUSE GNOME Next Live-Media

EXCLUDE_MODULES is a workaround for
htt=
ps://bugzilla.opensuse.org/show_bug.cgi?id=3D1138401#c10 (except for
opensuse_welcome, which is blacklisted on the GNOME live for space reasons)

## Reproducible

Fails since (at least) Build
[20240122](https://op=
enqa.opensuse.org/tests/3886589) (current job)

## Expected result

Last good: [20240121](https://openqa.opensuse.org/tests/3883367) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests=
/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DGNOME-Live&mac=
hine=3D64bit-4G&test=3Dgnome-live&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17059975391.2aA4Acfb5.21897--


body:
--17060846310.db2fa9b2.23969
Date: Wed, 24 Jan 2024 08:23:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1219118

            Bug ID: 1219118
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 121.0.6167.85
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The Stable channel has been updated to 121.0.6167.85 for Mac and Linux and
121.0.6167.85/.86 to Windows which will roll out over the coming days/weeks=
. A
full list of changes in this build is available in the log.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 17 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

High CVE-2024-0807: Use after free in WebAudio. Reported by Huang Xilin of =
Ant
Group Light-Year Security Lab on 2023-11-25

High CVE-2024-0812: Inappropriate implementation in Accessibility. Reported=
 by
Anonymous on 2023-09-19

High CVE-2024-0808: Integer underflow in WebUI. Reported by Lyra Rebane
(rebane2001) on 2023-11-24

Medium CVE-2024-0810: Insufficient policy enforcement in DevTools. Reported=
 by
Shaheen Fazim on 2023-10-26

Medium CVE-2024-0814: Incorrect security UI in Payments. Reported by Muneaki
Nishimura (nishimunea) on 2023-07-11

Medium CVE-2024-0813: Use after free in Reading Mode. Reported by @retsew0x=
01
on 2023-08-30

Medium CVE-2024-0806: Use after free in Passwords. Reported by 18=E6=A5=BC=
=E6=A2=A6=E6=83=B3=E6=94=B9=E9=80=A0=E5=AE=B6 on
2023-11-25

Medium CVE-2024-0805: Inappropriate implementation in Downloads. Reported b=
y Om
Apip on 2024-01-01

Medium CVE-2024-0804: Insufficient policy enforcement in iOS Security UI.
Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India)  on 2024-01-=
03

Low CVE-2024-0811: Inappropriate implementation in Extensions API. Reported=
 by
Jann Horn of Google Project Zero on 2023-10-21

[TBD][1497985] Low CVE-2024-0809: Inappropriate implementation in Autofill.
Reported by Ahmed ElMasry on 2023-10-31
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17060846310.db2fa9b2.23969
Date: Wed, 24 Jan 2024 08:23:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1219118

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 121.0.6167.85

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          gmbr3@opensuse.org

          Reporter
          thomas.leroy@suse.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The Stable channel has been updated to 121.0.6167.85 for Mac=
 and Linux and
121.0.6167.85/.86 to Windows which will roll out over the coming days/weeks=
. A
full list of changes in this build is available in the log.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 17 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

High CVE-2024-0807: Use after free in WebAudio. Reported by Huang Xilin of =
Ant
Group Light-Year Security Lab on 2023-11-25

High CVE-2024-0812: Inappropriate implementation in Accessibility. Reported=
 by
Anonymous on 2023-09-19

High CVE-2024-0808: Integer underflow in WebUI. Reported by Lyra Rebane
(rebane2001) on 2023-11-24

Medium CVE-2024-0810: Insufficient policy enforcement in DevTools. Reported=
 by
Shaheen Fazim on 2023-10-26

Medium CVE-2024-0814: Incorrect security UI in Payments. Reported by Muneaki
Nishimura (nishimunea) on 2023-07-11

Medium CVE-2024-0813: Use after free in Reading Mode. Reported by @rets=
ew0x01
on 2023-08-30

Medium CVE-2024-0806: Use after free in Passwords. Reported by 18=E6=A5=BC=
=E6=A2=A6=E6=83=B3=E6=94=B9=E9=80=A0=E5=AE=B6 on
2023-11-25

Medium CVE-2024-0805: Inappropriate implementation in Downloads. Reported b=
y Om
Apip on 2024-01-01

Medium CVE-2024-0804: Insufficient policy enforcement in iOS Security UI.
Reported by Narendra Bhati of Suma Soft Pvt. Ltd. Pune (India)  on 2024-01-=
03

Low CVE-2024-0811: Inappropriate implementation in Extensions API. Reported=
 by
Jann Horn of Google Project Zero on 2023-10-21

[TBD][1497985] Low CVE-2024-0809: Inappropriate implementation in Autofill.
Reported by Ahmed ElMasry on 2023-10-31

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17060846310.db2fa9b2.23969--


body:
--17060991080.1ff5ef05.24716
Date: Wed, 24 Jan 2024 12:25:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1219139

            Bug ID: 1219139
           Summary: [Build 20240123] pam 1.6 vs apparmor
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/3889394/modules/mutt
                    /steps/24
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: AppArmor
          Assignee: suse-beta-at-cboltz.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

the test sets up a postfix/dovecot mail server and then tries to connect us=
ing
mutt to it.

Since the upgrade to PAM 1.6, this no longer works

On a local debug I could identify AppArmor blocking access to two objects w=
hile
authenticating:

type=3DAVC msg=3Daudit(1706098433.326:138): apparmor=3D"DENIED" operation=
=3D"exec"
class=3D"file" profile=3D"dovecot-auth" name=3D"/usr/sbin/unix_chkpwd" pid=
=3D1479
comm=3D"auth" requested_mask=3D"x" denied_mask=3D"x" fsuid=3D0 ouid=3D0
type=3DAVC msg=3Daudit(1706098433.326:139): apparmor=3D"DENIED" operation=
=3D"open"
class=3D"file" profile=3D"dovecot-auth" name=3D"/proc/1478/loginuid" pid=3D=
1478
comm=3D"auth" requested_mask=3D"r" denied_mask=3D"r" fsuid=3D0 ouid=3D0

If I tear down AppArmor (aa-teardown) I can successfully login to my test
dovecot setup.
openQA test in scenario
opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-extra@64bit_virtio-2G
fails in
[mutt](https://openqa.opensuse.org/tests/3889394/modules/mutt/steps/24)

## Test suite description
Same as jeos, plus some more tests.

## Reproducible

Fails since (at least) Build
[20240123](https://openqa.opensuse.org/tests/3888714)

## Expected result

Last good: [20240122](https://openqa.opensuse.org/tests/3886456) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DJeOS-for-kvm-and-xen&machine=3D64bit_virtio-2G&test=3Djeos-=
extra&version=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17060991080.1ff5ef05.24716
Date: Wed, 24 Jan 2024 12:25:08 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1219139

          Summary
          [Build 20240123] pam 1.6 vs apparmor

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/3889394/modules/mutt/steps/=
24

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          AppArmor

          Assignee
          suse-beta@cboltz.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

the test sets up a postfix/dovecot mail server and then tries to connect us=
ing
mutt to it.

Since the upgrade to PAM 1.6, this no longer works

On a local debug I could identify AppArmor blocking access to two objects w=
hile
authenticating:

type=3DAVC msg=3Daudit(1706098433.326:138): apparmor=3D"DENIED" o=
peration=3D"exec"
class=3D"file" profile=3D"dovecot-auth" name=3D"/u=
sr/sbin/unix_chkpwd" pid=3D1479
comm=3D"auth" requested_mask=3D"x" denied_mask=3D"=
x" fsuid=3D0 ouid=3D0
type=3DAVC msg=3Daudit(1706098433.326:139): apparmor=3D"DENIED" o=
peration=3D"open"
class=3D"file" profile=3D"dovecot-auth" name=3D"/p=
roc/1478/loginuid" pid=3D1478
comm=3D"auth" requested_mask=3D"r" denied_mask=3D"=
r" fsuid=3D0 ouid=3D0

If I tear down AppArmor (aa-teardown) I can successfully login to my test
dovecot setup.
openQA test in scenario
opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-extra@64bit_virtio=
-2G
fails in
[mutt](https://openqa.opensuse.org/tests/3889394/modules/mutt/steps/24)

## Test suite description
Same as jeos, plus some more tests.

## Reproducible

Fails since (at least) Build
[20240123](https://op=
enqa.opensuse.org/tests/3888714)

## Expected result

Last good: [20240122](https://openqa.opensuse.org/tests/3886456) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.o=
pensuse.org/tests/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DJ=
eOS-for-kvm-and-xen&machine=3D64bit_virtio-2G&test=3Djeos-extra&amp=
;version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17060991080.1ff5ef05.24716--

summary: [Build 20240123] pam 1.6 vs apparmor


--17061320843.A7cfBb61B.25936
Date: Wed, 24 Jan 2024 21:34:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1219158

            Bug ID: 1219158
           Summary: bcachefs-tools: fails to mount device due building without Rust (NO_RUST=3D1)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel:Filesystems
          Assignee: kernel-fs-at-suse.de
          Reporter: petr.vorel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I reported bcachefs-tools failure to mount loop device [1]. Upstream notes =
that
building with Rust is mandatory [2] and indeed we have NO_RUST=3D1 in our s=
pec
file  [3]. Could you please build with Rust?

[1] https://lore.kernel.org/ltp/20240124200032.GA343522@pevik/
[2]
https://lore.kernel.org/ltp/5ykyohhnlc7nkbz7usc5sqmluyl7wgyhc6frqmbo5kk4vhu=
u3c@kgzze4c35gsv/
[3]
https://build.opensuse.org/package/view_file/filesystems/bcachefs-tools/bca=
chefs-tools.spec?expand=3D1
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17061320843.A7cfBb61B.25936
Date: Wed, 24 Jan 2024 21:34:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1219158

          Summary
          bcachefs-tools: fails to mount device due building without Ru=
st (NO_RUST=3D1)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel:Filesystems

          Assignee
          kernel-fs@suse.de

          Reporter
          petr.vorel@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I reported bcachefs-tools failure to mount loop device [1]. =
Upstream notes that
building with Rust is mandatory [2] and indeed we have NO_RUST=3D1 in our s=
pec
file  [3]. Could you please build with Rust?

[1] https://lore.kernel.org/ltp/20240124200032.GA343522@pevik/
[2]
https://lore.kernel.org/ltp/5ykyohhnlc7nk=
bz7usc5sqmluyl7wgyhc6frqmbo5kk4vhuu3c@kgzze4c35gsv/
[3]
https://build.opensuse.org/package/=
view_file/filesystems/bcachefs-tools/bcachefs-tools.spec?expand=3D1</pr=
e>

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17061320843.A7cfBb61B.25936--