body:
--16958508601.9BFF9c0D.30951
Date: Wed, 27 Sep 2023 21:41:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215776

            Bug ID: 1215776
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 117.0.5938.132
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org, m.szczepaniak.000-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-des=
ktop_27.html

* CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx
* CVE-2023-5186: Use after free in Passwords
* CVE-2023-5187: Use after free in Extensions

Google is aware that an exploit for CVE-2023-5217 exists in the wild
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16958508601.9BFF9c0D.30951
Date: Wed, 27 Sep 2023 21:41:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1215776

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 117.0.5938.132

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Critical

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org, m.szczepaniak.000@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2023/09/stable-channel-update-for-desktop_27.html

* CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx
* CVE-2023-5186: Use after free in Passwords
* CVE-2023-5187: Use after free in Extensions

Google is aware that an exploit for CVE-2023-5217 exists in the wild

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16958508601.9BFF9c0D.30951--

pkgs: chromium ungoogled-chromium


--16958580911.CDe6A5.31008
Date: Wed, 27 Sep 2023 23:41:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215778

            Bug ID: 1215778
           Summary: VUL-0: CVE-2023-5217: libvpx: Heap buffer overflow in vp8 encoding in libvpx
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: adrian.schroeter-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A Heap buffer overflow was reported in vp8 encoding in libvpx

Chromium rolled
https://chromium.googlesource.com/chromium/src/+/fa569fb226df361d676b604046=
23b17b16dddc8a

Roll src/third_party/libvpx/source/libvpx/ e1c124f89..51057f4ba (2 commits)

https://chromium.googlesource.com/webm/libvpx.git/+log/e1c124f8965f..51057f=
4ba894

$ git log e1c124f89..51057f4ba --date=3Dshort --no-merges --format=3D'%ad %=
ae %s'
2023-09-25 jzern VP8: disallow thread count changes
2023-09-25 jzern encode_api_test: add ConfigResizeChangeThreadCount
[...]

The corresponding chromium bug is bug 1215776.

References:
https://crbug.com/1486441
https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-des=
ktop_27.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16958580911.CDe6A5.31008
Date: Wed, 27 Sep 2023 23:41:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1215778

          Summary
          VUL-0: CVE-2023-5217: libvpx: Heap buffer overflow in vp8 enc=
oding in libvpx

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          adrian.schroeter@suse.com

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A Heap buffer overflow was reported in vp8 encoding in libvpx

Chromium rolled
https://chromium.googlesource.com/chromium/src/+=
/fa569fb226df361d676b60404623b17b16dddc8a

Roll src/third_party/libvpx/source/libvpx/ e1c124f89..51057f4ba (2 commits)

https://chromium.googlesource.com/webm/libvpx.git/+log/e=
1c124f8965f..51057f4ba894

$ git log e1c124f89..51057f4ba --date=3Dshort --no-merges --format=3D'%ad %=
ae %s'
2023-09-25 jzern VP8: disallow thread count changes
2023-09-25 jzern encode_api_test: add ConfigResizeChangeThreadCount
[...]

The corresponding chromium bug is bug 1215776.

References:
https://crbug.com/1486441
https://chromereleases.googleblog.com/2023/09/stab=
le-channel-update-for-desktop_27.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16958580911.CDe6A5.31008--


--16958830510.0A2EEDF14.31296
Date: Thu, 28 Sep 2023 06:37:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215784

            Bug ID: 1215784
           Summary: VUL-0: CVE-2023-42114: exim: NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/380213/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: wullinger-at-rz.uni-kiel.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: abergmann-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

This vulnerability allows remote attackers to disclose sensitive informatio=
n on
affected installations of Exim. Authentication is not required to exploit t=
his
vulnerability.

The specific flaw exists within the handling of NTLM challenge requests. The
issue results from the lack of proper validation of user-supplied data, whi=
ch
can result in a read past the end of an allocated data structure. An attack=
er
can leverage this vulnerability to disclose information in the context of t=
he
service account.

06/06/22 =E2=80=93 ZDI requested a PSIRT contact.

06/14/22 =E2=80=93 ZDI reported the vulnerability to the vendor.

04/25/23 =E2=80=93 ZDI asked for an update.

04/25/23 =E2=80=93 The vendor asked us to re-send the reports.

05/10/23 =E2=80=93 ZDI sent the vulnerability to the vendor.

09/25/23 =E2=80=93 ZDI asked for an update and informed the vendor that we =
intend to
publish the case as a zero-day advisory on 09/27/23.


--16958830610.81F4a.31299
Date: Thu, 28 Sep 2023 06:37:41 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215785

            Bug ID: 1215785
           Summary: VUL-0: CVE-2023-42115: exim: AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/380212/
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Sound
          Assignee: wullinger-at-rz.uni-kiel.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: abergmann-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

This vulnerability allows remote attackers to execute arbitrary code on
affected
installations of Exim. Authentication is not required to exploit this
vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port=
 25
by default. The issue results from the lack of proper validation of
user-supplied data, which can result in a write past the end of a buffer. An
attacker can leverage this vulnerability to execute code in the context of =
the
service account.

06/06/22 =E2=80=93 ZDI requested a PSIRT contact.

06/14/22 =E2=80=93 ZDI reported the vulnerability to the vendor.

04/25/23 =E2=80=93 ZDI asked for an update.

04/25/23 =E2=80=93 The vendor asked us to re-send the reports.

05/10/23 =E2=80=93 ZDI sent the vulnerability to the vendor.

09/25/23 =E2=80=93 ZDI asked for an update and informed the vendor that we =
intend to
publish the case as a zero-day advisory on 09/27/23.


--16958830723.6D5Bf92.31302
Date: Thu, 28 Sep 2023 06:37:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215786

            Bug ID: 1215786
           Summary: VUL-0: CVE-2023-42116: exim: SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/380211/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: wullinger-at-rz.uni-kiel.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: abergmann-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

This vulnerability allows remote attackers to execute arbitrary code on
affected
installations of Exim. Authentication is not required to exploit this
vulnerability.

The specific flaw exists within the handling of NTLM challenge requests. The
issue results from the lack of proper validation of the length of user-supp=
lied
data prior to copying it to a fixed-length stack-based buffer. An attacker =
can
leverage this vulnerability to execute code in the context of the service
account.

06/06/22 =E2=80=93 ZDI requested a PSIRT contact.

06/14/22 =E2=80=93 ZDI reported the vulnerability to the vendor.

04/25/23 =E2=80=93 ZDI asked for an update.

04/25/23 =E2=80=93 The vendor asked us to re-send the reports.

05/10/23 =E2=80=93 ZDI sent the vulnerability to the vendor.

09/25/23 =E2=80=93 ZDI asked for an update and informed the vendor that we =
intend to
publish the case as a zero-day advisory on 09/27/23.


--16958830770.9eDc462.31305
Date: Thu, 28 Sep 2023 06:37:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215787

            Bug ID: 1215787
           Summary: VUL-0: CVE-2023-42117: exim: Improper Neutralization of Special Elements Remote Code Execution Vulnerability
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/380210/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: wullinger-at-rz.uni-kiel.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: abergmann-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

This vulnerability allows remote attackers to execute arbitrary code on
affected
installations of Exim. Authentication is not required to exploit this
vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port=
 25
by default. The issue results from the lack of proper validation of
user-supplied data, which can result in a memory corruption condition. An
attacker can leverage this vulnerability to execute code in the context of =
the
current process.

06/06/22 =E2=80=93 ZDI requested a PSIRT contact.

06/14/22 =E2=80=93 ZDI reported the vulnerability to the vendor.

04/25/23 =E2=80=93 ZDI asked for an update.

04/25/23 =E2=80=93 The vendor asked us to re-send the reports.

05/10/23 =E2=80=93 ZDI sent the vulnerability to the vendor.

09/25/23 =E2=80=93 ZDI asked for an update and informed the vendor that we =
intend to
publish the case as a zero-day advisory on 09/27/23.


--16958830890.1340ffAed.31311
Date: Thu, 28 Sep 2023 06:38:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215789

            Bug ID: 1215789
           Summary: VUL-0: CVE-2023-42119: exim: dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/380208/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: wullinger-at-rz.uni-kiel.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: abergmann-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

This vulnerability allows network-adjacent attackers to disclose sensitive
information on affected installations of Exim. Authentication is not requir=
ed
to
exploit this vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port=
 25
by default. The issue results from the lack of proper validation of
user-supplied data, which can result in a read past the end of an allocated
buffer. An attacker can leverage this in conjunction with other vulnerabili=
ties
to execute arbitrary code in the context of the service account.

06/22/22 =E2=80=93 ZDI reported the vulnerability to the vendor.

04/25/23 =E2=80=93 ZDI asked for an update.

04/25/23 =E2=80=93 The vendor asked us to re-send the reports.

05/10/23 =E2=80=93 ZDI sent the vulnerability to the vendor.

09/25/23 =E2=80=93 ZDI asked for an update and informed the vendor that we =
intend to
publish the case as a zero-day advisory on 09/27/23.


body:
--16959186191.eBEa.32681
Date: Thu, 28 Sep 2023 16:30:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215817

            Bug ID: 1215817
           Summary: tcsh completion for 'ln' is incorrect
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: hendersj-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

When entering 'ln -s' and hitting tab to get a list of directories, I'm
prompted for a <link_name> instead of getting completion from the filesyste=
m. A
comparison with the upstream project shows that their pattern in
/etc/profile.d/complete.tcsh works, whereas what we have doesn't.

I originally reported this issue upstream as I missed the differences betwe=
en
upstream's version of the file and ours.  Using their file didn't work as-is
(not sure why), but replacing our entry for 'ln' with theirs did.

The upstream reported bug confirmed that it's an issue in our setup.  That =
bug
is at https://github.com/tcsh-org/tcsh/issues/80

This has been a longstanding issue, and I know it also exists in Leap (all
versions, including 15.6 alpha).
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16959186191.eBEa.32681
Date: Thu, 28 Sep 2023 16:30:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1215817

          Summary
          tcsh completion for 'ln' is incorrect

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          hendersj@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

When entering 'ln -s' and hitting tab to get a list of direc=
tories, I'm
prompted for a <link_name> instead of getting completion from the fil=
esystem. A
comparison with the upstream project shows that their pattern in
/etc/profile.d/complete.tcsh works, whereas what we have doesn't.

I originally reported this issue upstream as I missed the differences betwe=
en
upstream's version of the file and ours.  Using their file didn't work as-is
(not sure why), but replacing our entry for 'ln' with theirs did.

The upstream reported bug confirmed that it's an issue in our setup.  That =
bug
is at https://github=
.com/tcsh-org/tcsh/issues/80

This has been a longstanding issue, and I know it also exists in Leap (all
versions, including 15.6 alpha).

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16959186191.eBEa.32681--

summary: tcsh completion for 'ln' is incorrect


body:
--16964005622.3a8AC1f.320
Date: Wed, 4 Oct 2023 06:22:42 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215924

            Bug ID: 1215924
           Summary: VUL-0: CVE-2023-5346: chromium,ungoogled-chromium:
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Fixed in 117.0.5938.149:

* CVE-2023-5346: Type Confusion in V8

References:
https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-des=
ktop.html
https://crbug.com/1485829
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16964005622.3a8AC1f.320
Date: Wed, 4 Oct 2023 06:22:42 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1215924

          Summary
          VUL-0: CVE-2023-5346: chromium,ungoogled-chromium:

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Fixed in 117.0.5938.149:

* CVE-2023-5346: Type Confusion in V8

References:
https://chromereleases.googleblog.com/2023/10/stable-=
channel-update-for-desktop.html
https://crbug.com/1485829

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16964005622.3a8AC1f.320--


--16964109143.80106.791
Date: Wed, 4 Oct 2023 09:15:14 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215937

            Bug ID: 1215937
           Summary: VUL-0: CVE-2023-43907: optipng: global buffer overflow via the 'buffer' variable at gifread.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/380479/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: pgajdos-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: gabriele.sonnu-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the
'buffer' variable at gifread.c.

References:
https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffe=
r-overflow1/optipng-global-buffer-overflow1.md
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-43907
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16964109143.80106.791
Date: Wed, 4 Oct 2023 09:15:14 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1215937

          Summary
          VUL-0: CVE-2023-43907: optipng: global buffer overflow via th=
e 'buffer' variable at gifread.c

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/380479/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          pgajdos@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          gabriele.sonnu@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

OptiPNG v0.7.7 was discovered to contain a global buffer ove=
rflow via the
'buffer' variable at gifread.c.

References:
https://github.c=
om/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/opti=
png-global-buffer-overflow1.md
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-43907

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16964109143.80106.791--


--16964223321.adac7.1259
Date: Wed, 4 Oct 2023 12:25:32 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215943

            Bug ID: 1215943
           Summary: [Build 20231003] openQA test fails in podman_pods
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/3620135/modules/podm
                    an_pods/steps/201
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Created attachment 869906
  --> https://bugzilla.suse.com/attachment.cgi?id=3D869906&action=3Dedit
k3s check-config output

## Observation

openQA test in scenario
microos-Tumbleweed-DVD-aarch64-container-host@aarch64-4G-HD40G fails in
[podman_pods](https://openqa.opensuse.org/tests/3620135/modules/podman_pods=
/steps/201)

k3s check-config has been introduced with
https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/17699
but this fails on microos, likely because grep from busybox does not support
'--label=3DXYZ' option.

## Test suite description

## Reproducible

Fails since (at least) Build
[20231003](https://openqa.opensuse.org/tests/3619949)

## Expected result

Last good: [20231002](https://openqa.opensuse.org/tests/3615977) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Daarch64&distri=3Dm=
icroos&flavor=3DDVD&machine=3Daarch64-4G-HD40G&test=3Dcontainer-host&versio=
n=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16964223321.adac7.1259
Date: Wed, 4 Oct 2023 12:25:32 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1215943

          Summary
          [Build 20231003] openQA test fails in podman_pods

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/3620135/modules/podman_pods=
/steps/201

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Containers

          Assignee
          containers-bugowner@suse.de

          Reporter
          guillaume.gardet@arm.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Created attachment 869=
906 [details]
k3s check-config output

## Observation

openQA test in scenario
microos-Tumbleweed-DVD-aarch64-container-host@aarch64-4G-HD40G fails in
[podman_pods](https://openqa.opensuse.org/tests/3620135/modules/po=
dman_pods/steps/201)

k3s check-config has been introduced with
https://github.com/os-autoinst/os-autoinst-distri-opensuse/pull/1769=
9
but this fails on microos, likely because grep from busybox does not support
'--label=3DXYZ' option.

## Test suite description

## Reproducible

Fails since (at least) Build
[20231003](https://op=
enqa.opensuse.org/tests/3619949)

## Expected result

Last good: [20231002](https://openqa.opensuse.org/tests/3615977) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/=
tests/latest?arch=3Daarch64&distri=3Dmicroos&flavor=3DDVD&machi=
ne=3Daarch64-4G-HD40G&test=3Dcontainer-host&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16964223321.adac7.1259--


--16964260532.39a466B8.1394
Date: Wed, 4 Oct 2023 13:27:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1215945

            Bug ID: 1215945
           Summary: ffmpeg-4: Build fails with current Binutils; requires 'asm' fix (15.4, 15.5, Tumbleweed)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Keywords: build
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: burnus-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: jengelh-at-inai.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

GNU Binutils 2.41 now reveals a bug in the 'asm' code used in ffmpeg-4:

 ./libavcodec/x86/mathops.h:125: Error: operand type mismatch for `shr'

While Binutils is pending for opensuse:factory, the new version has already
landed in 15.4 and 15.5 such that ffmpeg-4 fails there:

https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4

ffmpeg-5/6 seemingly got the fix as I do see no fails for 15.4/15.5 for the
build of the 4h old package.

Upstream FIX:  "Fixes assembling with binutil as >=3D 2.41" at
https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/effadce6c756247ea8bae32=
dc13bb3e6f464f0eb?hp=3Dccc684993276248d64c328a810fb7714af2f4c70

See also
https://trac.ffmpeg.org/ticket/10405 or (where I found it):

The pending Binutils update for openSUSE:factory update is:
https://build.opensuse.org/request/show/1113885
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16964260532.39a466B8.1394
Date: Wed, 4 Oct 2023 13:27:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1215945

          Summary
          ffmpeg-4: Build fails with current Binutils; requires 'asm' f=
ix (15.4, 15.5, Tumbleweed)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Keywords
          build

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          burnus@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          jengelh@inai.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

GNU Binutils 2.41 now reveals a bug in the 'asm' code used i=
n ffmpeg-4:

 ./libavcodec/x86/mathops.h:125: Error: operand type mismatch for `shr'

While Binutils is pending for opensuse:factory, the new version has already
landed in 15.4 and 15.5 such that ffmpeg-4 fails there:

https://build.opensuse.org/package/show/multimedia:libs/ffmpeg-4

ffmpeg-5/6 seemingly got the fix as I do see no fails for 15.4/15.5 for the
build of the 4h old package.

Upstream FIX:  "Fixes assembling with binutil as >=3D 2.41" at
https://git.ffmpeg.org/gitweb/ffmpeg.git/commitdiff/effadce6c756247ea8bae3=
2dc13bb3e6f464f0eb?hp=3Dccc684993276248d64c328a810fb7714af2f4c70

See also
https://trac.ffmpeg.org/ti=
cket/10405 or (where I found it):

The pending Binutils update for openSUSE:factory update is:
https://build.o=
pensuse.org/request/show/1113885

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16964260532.39a466B8.1394--


--16966815351.cbd19Ded8.19160
Date: Sat, 7 Oct 2023 12:25:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216022

            Bug ID: 1216022
           Summary: missing /usr/bin/ecpg from postgresql15-devel
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: x86-64
                OS: openSUSE Leap 15.5
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: quirin.blaeser-at-freenet.de
        QA Contact: jsrain-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

output of rpm -ql postgresql15-devel:
/usr/bin/ecpg
/usr/include/pgsql
/usr/include/pgsql/ecpg_config.h
=E2=80=A6

output of ls /usr/bin/ec*:
/usr/bin/echo
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16966815351.cbd19Ded8.19160
Date: Sat, 7 Oct 2023 12:25:35 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216022

          Summary
          missing /usr/bin/ecpg from postgresql15-devel

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          x86-64

          OS
          openSUSE Leap 15.5

          Status
          NEW

          Severity
          Minor

          Priority
          P5 - None

          Component
          Installation

          Assignee
          yast2-maintainers@suse.de

          Reporter
          quirin.blaeser@freenet.de

          QA Contact
          jsrain@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

output of rpm -ql postgresql15-devel:
/usr/bin/ecpg
/usr/include/pgsql
/usr/include/pgsql/ecpg_config.h
=E2=80=A6

output of ls /usr/bin/ec*:
/usr/bin/echo

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16966815351.cbd19Ded8.19160--


body:
--16968357241.Df55f0A8.24204
Date: Mon, 9 Oct 2023 07:15:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216035

            Bug ID: 1216035
           Summary: /var/mail missed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werner-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Currently mutt build breaks with

[   22s] checking whether your system's regexp library is completely broken=
...
no
[   22s] checking where new mail is stored... no
[   22s] configure: error: "Could not determine where new mail is stored."

last change in package filesystem :

 Mon Sep 25 08:45:52 UTC 2023 - Ludwig Nussel <lnussel-at-suse.com>
 - Add /run/lock (boo#1212926)
 - Remove /var/spool/mail (boo#1179574)
 - Remove obsolete home dir check. The filesystem package is not
   meant to contain home directories of random system users anymore
 - Create ghost symlinks also in pretrans, needed to get /var/run as
   link right away

... and now with /var/spool/mail also /var/mail disapears?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16968357241.Df55f0A8.24204
Date: Mon, 9 Oct 2023 07:15:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216035

          Summary
          /var/mail missed

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          All

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          werner@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Currently mutt build breaks with

[   22s] checking whether your system's regexp library is completely broken=
...
no
[   22s] checking where new mail is stored... no
[   22s] configure: error: "Could not determine where new mail is stor=
ed."

last change in package filesystem :

 Mon Sep 25 08:45:52 UTC 2023 - Ludwig Nussel <lnussel@suse.com>
 - Add /run/lock (boo#1212926)
 - Remove /var/spool/mail (boo#1179574)
 - Remove obsolete home dir check. The filesystem package is not
   meant to contain home directories of random system users anymore
 - Create ghost symlinks also in pretrans, needed to get /var/run as
   link right away

... and now with /var/spool/mail also /var/mail disapears?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16968357241.Df55f0A8.24204--

summary: /var/mail missed


--16968358651.9a8C.24249
Date: Mon, 9 Oct 2023 07:17:45 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216036

            Bug ID: 1216036
           Summary: [RPi4] RPi4 fails to boot with U-Boot 2023.10
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: aarch64
               URL: https://openqa.opensuse.org/tests/3630664/modules/prep
                    are_firstboot/steps/1
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Bootloader
          Assignee: screening-team-bugs-at-suse.de
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
                CC: ivan.ivanov-at-suse.com
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

Created attachment 869994
  --> https://bugzilla.suse.com/attachment.cgi?id=3D869994&action=3Dedit
u-boot log

Since u-boot 2023.10, RPi4 fails to boot from uSD with:
  Card did not respond to voltage select! : -110
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16968358651.9a8C.24249
Date: Mon, 9 Oct 2023 07:17:45 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216036

          Summary
          [RPi4] RPi4 fails to boot with U-Boot 2023.10

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          aarch64

          URL
          https://openqa.opensuse.org/tests/3630664/modules/prepare_fir=
stboot/steps/1

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Bootloader

          Assignee
          screening-team-bugs@suse.de

          Reporter
          guillaume.gardet@arm.com

          QA Contact
          qa-bugs@suse.de

          CC
          ivan.ivanov@suse.com

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

Created attachment 869994 [d=
etails]
u-boot log

Since u-boot 2023.10, RPi4 fails to boot from uSD with:
  Card did not respond to voltage select! : -110

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16968358651.9a8C.24249--


body:
--16968666363.eeEe90b.30497
Date: Mon, 9 Oct 2023 15:50:36 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216061

            Bug ID: 1216061
           Summary: Syntax error in update_postmaps script
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: noreply.section+dev-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

If POSTFIX_UPDATE_MAPS=3D"no" in /etc/sysconfig/postfix, starting postfix
generates the error:

/usr/lib/postfix/systemd/update_postmaps: line 14: return: can only `return'
from a function or sourced script
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16968666363.eeEe90b.30497
Date: Mon, 9 Oct 2023 15:50:36 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216061

          Summary
          Syntax error in update_postmaps script

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          noreply.section+dev@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

If POSTFIX_UPDATE_MAPS=3D"no" in /etc/sysconfig/po=
stfix, starting postfix
generates the error:

/usr/lib/postfix/systemd/update_postmaps: line 14: return: can only `return'
from a function or sourced script

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16968666363.eeEe90b.30497--

summary: Syntax error in update_postmaps script


--16968924482.FD2Ff.32303
Date: Mon, 9 Oct 2023 23:00:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216070

            Bug ID: 1216070
           Summary: Assignment of /dev/sd* has altered dramatically
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: michael-at-actrix.gen.nz
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

After recent updates several users have reported that the assignment of
/dev/sd* has changed.   Whatever has perturbed the allocation of /dev/sd* is
recent.

It's well documented that the order of assignment of /dev/sd* cannot be rel=
ied
upon.  But it has been 100% stable for years.  It turns out that some confi=
gs,
scripts, and examples based on utilities such as hdparm and smartd, may have
been depending on the ordering being stable.

Additionally where admins had hard coded /dev/sd, such as /etc/fstab and
grub.conf, these changes had also been successful for years.

It would be desirable to provide some breathing space to allow systems to b=
oot
and run while purged of persistent references to /dev/sd*.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16968924482.FD2Ff.32303
Date: Mon, 9 Oct 2023 23:00:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216070

          Summary
          Assignment of /dev/sd* has altered dramatically

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          michael@actrix.gen.nz

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

After recent updates several users have reported that the as=
signment of
/dev/sd* has changed.   Whatever has perturbed the allocation of /dev/sd* is
recent.

It's well documented that the order of assignment of /dev/sd* cannot be rel=
ied
upon.  But it has been 100% stable for years.  It turns out that some confi=
gs,
scripts, and examples based on utilities such as hdparm and smartd, may have
been depending on the ordering being stable.

Additionally where admins had hard coded /dev/sd, such as /etc/fstab and
grub.conf, these changes had also been successful for years.

It would be desirable to provide some breathing space to allow systems to b=
oot
and run while purged of persistent references to /dev/sd*.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16968924482.FD2Ff.32303--


--16969206670.CA6DD.1560
Date: Tue, 10 Oct 2023 06:51:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216078

            Bug ID: 1216078
           Summary: VUL-0: CVE-2023-45199: mbedtls: buffer overflow in TLS handshake parsing with ECDH
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/381070/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: otto.hollmann-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: abergmann-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Title: Buffer overflow in TLS handshake parsing with ECDH
CVE: CVE-2023-45199
Date: 05 October 2023
Affects: Mbed TLS 3.2.0 and above
Impact: A remote attacker may cause arbitrary code execution.
Severity: HIGH
Credit: OSS-Fuzz

Vulnerability:
A TLS 1.3 client or server configured with support for signature-based
authentication (i.e. any non-PSK key exchange) is vulnerable to a heap buff=
er
overflow. The server copies up to 65535 bytes in a buffer that is shorter. =
An
unauthenticated malicious peer can overflow the TLS handshake structure by
sending an overly long ECDH or FFDH public key.

A TLS 1.2 server configured with MBEDTLS_USE_PSA_CRYPTO and with support fo=
r a
cipher suite using ECDH and a signature is vulnerable to a heap buffer
overflow. An unauthenticated malicious peer can overflow the TLS handshake
structure by sending an overly long ECDH public key. The server copies up to
255 bytes into a heap buffer that is sized for a valid public key, and thus
shorter unless RSA or FFDH is enabled in addition to ECDH. TLS 1.2 clients,=
 and
builds without MBEDTLS_USE_PSA_CRYPTO are not affected.

References:
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-secur=
ity-advisory-2023-10-2/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-45199
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16969206670.CA6DD.1560
Date: Tue, 10 Oct 2023 06:51:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216078

          Summary
          VUL-0: CVE-2023-45199: mbedtls: buffer overflow in TLS handsh=
ake parsing with ECDH

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/381070/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          otto.hollmann@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          abergmann@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Title: Buffer overflow in TLS handshake parsing with ECDH
CVE: CVE-2023-45199
Date: 05 October 2023
Affects: Mbed TLS 3.2.0 and above
Impact: A remote attacker may cause arbitrary code execution.
Severity: HIGH
Credit: OSS-Fuzz

Vulnerability:
A TLS 1.3 client or server configured with support for signature-based
authentication (i.e. any non-PSK key exchange) is vulnerable to a heap buff=
er
overflow. The server copies up to 65535 bytes in a buffer that is shorter. =
An
unauthenticated malicious peer can overflow the TLS handshake structure by
sending an overly long ECDH or FFDH public key.

A TLS 1.2 server configured with MBEDTLS_USE_PSA_CRYPTO and with support fo=
r a
cipher suite using ECDH and a signature is vulnerable to a heap buffer
overflow. An unauthenticated malicious peer can overflow the TLS handshake
structure by sending an overly long ECDH public key. The server copies up to
255 bytes into a heap buffer that is sized for a valid public key, and thus
shorter unless RSA or FFDH is enabled in addition to ECDH. TLS 1.2 clients,=
 and
builds without MBEDTLS_USE_PSA_CRYPTO are not affected.

References:
https://mbed-tls.readthedocs.io/en/late=
st/security-advisories/mbedtls-security-advisory-2023-10-2/
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-45199

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16969206670.CA6DD.1560--


--16969252939.f9069557D.2421
Date: Tue, 10 Oct 2023 08:08:13 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216080

            Bug ID: 1216080
           Summary: cockpit-ws: /etc/cockpit/disallowed-users is ignored
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: Cockpit-bugs-at-suse.de
          Reporter: amajer-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

This affects all cockpit versions, not just TW.

The default configuration we show in /etc/cockpit/disallowed-users,

# List of users which are not allowed to login to Cockpit
root

but this list is ignored and root can login. What is missing this in
/etc/pam.d/cockpit

auth       required     pam_listfile.so item=3Duser sense=3Ddeny
file=3D/etc/cockpit/disallowed-users onerr=3Dsucceed

followed by rest of the file.

So we should either not ship this file, or setup pam accordingly.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16969252939.f9069557D.2421
Date: Tue, 10 Oct 2023 08:08:13 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216080

          Summary
          cockpit-ws: /etc/cockpit/disallowed-users is ignored

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          Cockpit-bugs@suse.de

          Reporter
          amajer@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

This affects all cockpit versions, not just TW.

The default configuration we show in /etc/cockpit/disallowed-users,

# List of users which are not allowed to login to Cockpit
root

but this list is ignored and root can login. What is missing this in
/etc/pam.d/cockpit

auth       required     pam_listfile.so item=3Duser sense=3Ddeny
file=3D/etc/cockpit/disallowed-users onerr=3Dsucceed

followed by rest of the file.

So we should either not ship this file, or setup pam accordingly.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16969252939.f9069557D.2421--


--16969690273.3a33.10874
Date: Tue, 10 Oct 2023 20:17:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216111

            Bug ID: 1216111
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 118.0.5993.70
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: gmbr3-at-opensuse.org, m.szczepaniak.000-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2023/10/stable-channel-update-for-des=
ktop_10.html

CVE-2023-5218: Use after free in Site Isolation
CVE-2023-5487: Inappropriate implementation in Fullscreen
CVE-2023-5484: Inappropriate implementation in Navigation
CVE-2023-5475: Inappropriate implementation in DevTools
CVE-2023-5483: Inappropriate implementation in Intents
CVE-2023-5481: Inappropriate implementation in Downloads
CVE-2023-5476: Use after free in Blink History
CVE-2023-5474: Heap buffer overflow in PDF
CVE-2023-5479: Inappropriate implementation in Extensions API
CVE-2023-5485: Inappropriate implementation in Autofill
CVE-2023-5478: Inappropriate implementation in Autofill
CVE-2023-5477: Inappropriate implementation in Installer
CVE-2023-5486: Inappropriate implementation in Input
CVE-2023-5473: Use after free in Cast
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16969690273.3a33.10874
Date: Tue, 10 Oct 2023 20:17:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216111

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 118.0.5993.70

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          gmbr3@opensuse.org, m.szczepaniak.000@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2023/10/stable-channel-update-for-desktop_10.html

CVE-2023-5218: Use after free in Site Isolation
CVE-2023-5487: Inappropriate implementation in Fullscreen
CVE-2023-5484: Inappropriate implementation in Navigation
CVE-2023-5475: Inappropriate implementation in DevTools
CVE-2023-5483: Inappropriate implementation in Intents
CVE-2023-5481: Inappropriate implementation in Downloads
CVE-2023-5476: Use after free in Blink History
CVE-2023-5474: Heap buffer overflow in PDF
CVE-2023-5479: Inappropriate implementation in Extensions API
CVE-2023-5485: Inappropriate implementation in Autofill
CVE-2023-5478: Inappropriate implementation in Autofill
CVE-2023-5477: Inappropriate implementation in Installer
CVE-2023-5486: Inappropriate implementation in Input
CVE-2023-5473: Use after free in Cast

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16969690273.3a33.10874--


--16970134710.b9AE336FD.14195
Date: Wed, 11 Oct 2023 08:37:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216121

            Bug ID: 1216121
           Summary: rust1.7{1,2,3} fail to build with newest binutils
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Keywords: build
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: burnus-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: william.brown-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I have no idea why rust1.7{1,2,3} fails, I just note that with the new binu=
tils
  https://build.opensuse.org/request/show/1113885
as shown below.

The current error message does not point to anything obvious with regards to
binutils - but looks more like a generic Rust build issue.

But it as it does compile on opensuse:Factory, it must have something to
do with binutils. The fails is:

[  191s]     Finished release [optimized] target(s) in 1m 54s
[  192s] Building LLD for x86_64-unknown-linux-gnu
...
[  192s] CMake Deprecation Warning at
/home/abuild/rpmbuild/BUILD/rustc-1.73.0-src/src/llvm-project/cmake/Modules=
/CMakePolicy.cmake:6
(cmake_policy):
[  192s]   The OLD behavior for policy CMP0114 will be removed from a future
version
[  192s]   of CMake.
[  192s]=20
[  192s]   The cmake-policies(7) manual explains that the OLD behaviors of =
all
[  192s]   policies are deprecated and that a policy should be set to OLD o=
nly
under
[  192s]   specific short-term circumstances.  Projects should be ported to=
 the
NEW
[  192s]   behavior and not rely on setting a policy to OLD.
[  192s] Call Stack (most recent call first):
[  192s]   CMakeLists.txt:6 (include)
[  192s]=20
[  192s]=20
[  192s]


--16970183603.9E8645.14462
Date: Wed, 11 Oct 2023 09:59:20 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216126

            Bug ID: 1216126
           Summary: VUL-0: CVE-2023-45129: matrix-synapse: malicious ACL event can cause denial of service
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/381499/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: okurz-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: rfrohl-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Synapse is an open-source Matrix homeserver written and maintained by the
Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event
can
impact performance temporarily or permanently leading to a persistent denia=
l of
service. Homeservers running on a closed federation (which presumably do not
need to use server ACLs) are not affected. Server administrators are advise=
d to
upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious
server
ACL events can be purged and blocked using the admin API.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-45129
https://github.com/matrix-org/synapse/pull/16360
https://github.com/matrix-org/synapse/security/advisories/GHSA-5chr-wjw5-3g=
q4
https://matrix-org.github.io/synapse/latest/admin_api/rooms.html#version-2-=
new-version
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16970183603.9E8645.14462
Date: Wed, 11 Oct 2023 09:59:20 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216126

          Summary
          VUL-0: CVE-2023-45129: matrix-synapse: malicious ACL event ca=
n cause denial of service

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/381499/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          okurz@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          rfrohl@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Synapse is an open-source Matrix homeserver written and main=
tained by the
Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event
can
impact performance temporarily or permanently leading to a persistent denia=
l of
service. Homeservers running on a closed federation (which presumably do not
need to use server ACLs) are not affected. Server administrators are advise=
d to
upgrade to Synapse 1.94.0 or later. As a workaround, rooms with malicious
server
ACL events can be purged and blocked using the admin API.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-45129
https://github=
.com/matrix-org/synapse/pull/16360
https://github.com/matrix-org/synapse/security/advisories/GH=
SA-5chr-wjw5-3gq4
https://matrix-org.github.io/synapse/latest/admin_a=
pi/rooms.html#version-2-new-version

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16970183603.9E8645.14462--


--16974485463.62bd5FCd5.21358
Date: Mon, 16 Oct 2023 09:29:06 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216269

            Bug ID: 1216269
           Summary: telegram-desktop segfaults after upgrading to QT6
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: strzol-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hello,

After latest tumbleweed update that introduced QT6, telegram-desktop segfau=
lts.
Executing from console gives this:

** (telegram-desktop:10539): WARNING **: 11:53:50.643: Unable to load patch=
ed
fonts with Qt workarounds, expect font issues.
QPainter::begin: Paint device returned engine =3D=3D 0, type: 2
QWidget::render: Cannot render with an inactive painter
qt.svg: Error while inflating gzip file: SVG format check failed
Segmentation fault (core dumped)

And in dmesg there is this:

telegram-deskto[5052]: segfault at 0 ip 00007f72f0962d22 sp 00007f72d0bfc6c0
error 4 in libQt6Svg.so.6.6.0[7f72f094a000+3a000] likely on CPU 3 (core 4,
socket 0)

I can provide any additional information needed. Tumbleweed version is:
VERSION_ID=3D"20231013"

Regards.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16974485463.62bd5FCd5.21358
Date: Mon, 16 Oct 2023 09:29:06 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216269

          Summary
          telegram-desktop segfaults after upgrading to QT6

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          strzol@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hello,

After latest tumbleweed update that introduced QT6, telegram-desktop segfau=
lts.
Executing from console gives this:

** (telegram-desktop:10539): WARNING **: 11:53:50.643: Unable to load patch=
ed
fonts with Qt workarounds, expect font issues.
QPainter::begin: Paint device returned engine =3D=3D 0, type: 2
QWidget::render: Cannot render with an inactive painter
qt.svg: Error while inflating gzip file: SVG format check failed
Segmentation fault (core dumped)

And in dmesg there is this:

telegram-deskto[5052]: segfault at 0 ip 00007f72f0962d22 sp 00007f72d0bfc6c0
error 4 in libQt6Svg.so.6.6.0[7f72f094a000+3a000] likely on CPU 3 (core 4,
socket 0)

I can provide any additional information needed. Tumbleweed version is:
VERSION_ID=3D"20231013"

Regards.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16974485463.62bd5FCd5.21358--


--16976153602.Df83c.24797
Date: Wed, 18 Oct 2023 07:49:20 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216359

            Bug ID: 1216359
           Summary: Migration from 15.5 to 15.6 Problem: nothing provides '/usr/bin/python3.10' needed by the to be installed wsdd-0.7.1-bp156.1.2.noarch
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: lubos.kocman-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

This one popped up in zypper dup from 15.5 to 15.6=20

Reading installed packages...
Warning: You are about to do a distribution upgrade with all enabled
repositories. Make sure these repositories are compatible before you contin=
ue.
See 'man zypper' for more information about this command.
Computing distribution upgrade...
2 Problems:
Problem: nothing provides '/usr/bin/python3.10' needed by the to be install=
ed
wsdd-0.7.1-bp156.1.2.noarch
Problem: nothing provides 'kernel-default-devel =3D 5.14.21-150500.55.22' n=
eeded
by the to be installed
nvidia-driver-G06-kmp-default-535.113.01_k5.14.21_150500.55.22-lp156.14.1.x=
86_64

Problem: nothing provides '/usr/bin/python3.10' needed by the to be install=
ed
wsdd-0.7.1-bp156.1.2.noarch
 Solution 1: deinstallation of wsdd-0.7.0-bp155.1.8.noarch
 Solution 2: keep obsolete wsdd-0.7.0-bp155.1.8.noarch
 Solution 3: break wsdd-0.7.1-bp156.1.2.noarch by ignoring some of its
dependencies

Let's make sure that we have smooth upgrade from 15.6 to 15.5 by Beta (Febr=
uary
2024)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16976153602.Df83c.24797
Date: Wed, 18 Oct 2023 07:49:20 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216359

          Summary
          Migration from 15.5 to 15.6 Problem: nothing provides '/usr/b=
in/python3.10' needed by the to be installed wsdd-0.7.1-bp156.1.2.noarch

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          lubos.kocman@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

This one popped up in zypper dup from 15.5 to 15.6=20

Reading installed packages...
Warning: You are about to do a distribution upgrade with all enabled
repositories. Make sure these repositories are compatible before you contin=
ue.
See 'man zypper' for more information about this command.
Computing distribution upgrade...
2 Problems:
Problem: nothing provides '/usr/bin/python3.10' needed by the to be install=
ed
wsdd-0.7.1-bp156.1.2.noarch
Problem: nothing provides 'kernel-default-devel =3D 5.14.21-150500.55.22' n=
eeded
by the to be installed
nvidia-driver-G06-kmp-default-535.113.01_k5.14.21_150500.55.22-lp156.14.1.x=
86_64

Problem: nothing provides '/usr/bin/python3.10' needed by the to be install=
ed
wsdd-0.7.1-bp156.1.2.noarch
 Solution 1: deinstallation of wsdd-0.7.0-bp155.1.8.noarch
 Solution 2: keep obsolete wsdd-0.7.0-bp155.1.8.noarch
 Solution 3: break wsdd-0.7.1-bp156.1.2.noarch by ignoring some of its
dependencies

Let's make sure that we have smooth upgrade from 15.6 to 15.5 by Beta (Febr=
uary
2024)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16976153602.Df83c.24797--


body:
--16981495321.D926E24c3.1091
Date: Tue, 24 Oct 2023 12:12:12 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216537

            Bug ID: 1216537
           Summary: xdg-utils perl requirement
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: simonf.lees-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: jslaby-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

xdg-utils requires perl via /usr/bin/xdg-screensaver. On minimal systems we=
'd
like to avoid any extra script interpreters. Any chance to avoid using perl
there?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16981495321.D926E24c3.1091
Date: Tue, 24 Oct 2023 12:12:12 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216537

          Summary
          xdg-utils perl requirement

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 Applications

          Assignee
          simonf.lees@suse.com

          Reporter
          lnussel@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          jslaby@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

xdg-utils requires perl via /usr/bin/xdg-screensaver. On min=
imal systems we'd
like to avoid any extra script interpreters. Any chance to avoid using perl
there?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16981495321.D926E24c3.1091--

summary: xdg-utils perl requirement


--16984001150.E55C.5750
Date: Fri, 27 Oct 2023 09:48:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216650

            Bug ID: 1216650
           Summary: libz upgrade breaks texlive-latex-bin-bin / lualatex (library version does not match)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: registrations-at-wuthoehle.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

I did a 'zypper dup' yesterday and noticed that I couldn't compile any LaTeX
documents using LuaLaTeX any longer:

% lualatex beamer5.tex
PANIC: unprotected error in call to Lua API (zlib library version does not
match - header: 1.2.13, library: 1.3)
[1]    7239 IOT instruction (core dumped)  lualatex beamer5.tex

And indeed zlib was updated recently:
% LC_ALL=3DC rpm -qi libz1
Name        : libz1
Version     : 1.3
Release     : 1.1
Architecture: x86_64
Install Date: Thu Oct 26 22:00:15 2023
Group       : Unspecified
Size        : 118944
License     : Zlib
Signature   : RSA/SHA512, Wed Oct 25 18:06:26 2023, Key ID 35a2f86e29b700a4
Source RPM  : zlib-1.3-1.1.src.rpm
Build Date  : Wed Oct 25 18:06:09 2023
Build Host  : i03-ch2c
Packager    : https://bugs.opensuse.org
Vendor      : openSUSE
URL         : https://www.zlib.net/
Summary     : Library implementing the DEFLATE compression algorithm
Description :
zlib is a general-purpose lossless data-compression library,
implementing an API for the DEFLATE algorithm, the latter of
which is being used by, for example, gzip and the ZIP archive
format.
Distribution: openSUSE Tumbleweed

However, the corresponding texlive package was not:

% LC_ALL=3DC rpm -qi texlive-latex-bin-bin
Name        : texlive-latex-bin-bin
Version     : 2023.20230311.svn54358
Release     : 93.4
Architecture: x86_64
Install Date: Wed Oct 11 19:42:52 2023
Group       : Productivity/Publishing/TeX/Utilities
Size        : 26
License     : LPPL-1.0
Signature   : RSA/SHA512, Mon Oct  9 12:04:33 2023, Key ID 35a2f86e29b700a4
Source RPM  : texlive-2023.20230311-93.4.src.rpm
Build Date  : Mon Oct  9 11:45:00 2023
Build Host  : i03-ch1b
Relocations : /usr/bin=20
Packager    : https://bugs.opensuse.org
Vendor      : openSUSE
URL         : https://www.tug.org/texlive/
Summary     : Binary files of latex-bin
Description :
Binary files of latex-bin
Distribution: openSUSE Tumbleweed

It seems like the texlive package is in need of a rebuild.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16984001150.E55C.5750
Date: Fri, 27 Oct 2023 09:48:35 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216650

          Summary
          libz upgrade breaks texlive-latex-bin-bin / lualatex (library=
 version does not match)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          registrations@wuthoehle.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

I did a 'zypper dup' yesterday and noticed that I couldn't c=
ompile any LaTeX
documents using LuaLaTeX any longer:

% lualatex beamer5.tex
PANIC: unprotected error in call to Lua API (zlib library version does not
match - header: 1.2.13, library: 1.3)
[1]    7239 IOT instruction (core dumped)  lualatex beamer5.tex

And indeed zlib was updated recently:
% LC_ALL=3DC rpm -qi libz1
Name        : libz1
Version     : 1.3
Release     : 1.1
Architecture: x86_64
Install Date: Thu Oct 26 22:00:15 2023
Group       : Unspecified
Size        : 118944
License     : Zlib
Signature   : RSA/SHA512, Wed Oct 25 18:06:26 2023, Key ID 35a2f86e29b700a4
Source RPM  : zlib-1.3-1.1.src.rpm
Build Date  : Wed Oct 25 18:06:09 2023
Build Host  : i03-ch2c
Packager    : https://bugs.opensuse.o=
rg
Vendor      : openSUSE
URL         : https://www.zlib.net/
Summary     : Library implementing the DEFLATE compression algorithm
Description :
zlib is a general-purpose lossless data-compression library,
implementing an API for the DEFLATE algorithm, the latter of
which is being used by, for example, gzip and the ZIP archive
format.
Distribution: openSUSE Tumbleweed

However, the corresponding texlive package was not:

% LC_ALL=3DC rpm -qi texlive-latex-bin-bin
Name        : texlive-latex-bin-bin
Version     : 2023.20230311.svn54358
Release     : 93.4
Architecture: x86_64
Install Date: Wed Oct 11 19:42:52 2023
Group       : Productivity/Publishing/TeX/Utilities
Size        : 26
License     : LPPL-1.0
Signature   : RSA/SHA512, Mon Oct  9 12:04:33 2023, Key ID 35a2f86e29b700a4
Source RPM  : texlive-2023.20230311-93.4.src.rpm
Build Date  : Mon Oct  9 11:45:00 2023
Build Host  : i03-ch1b
Relocations : /usr/bin=20
Packager    : https://bugs.opensuse.o=
rg
Vendor      : openSUSE
URL         : https://www.tug.org/=
texlive/
Summary     : Binary files of latex-bin
Description :
Binary files of latex-bin
Distribution: openSUSE Tumbleweed

It seems like the texlive package is in need of a rebuild.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16984001150.E55C.5750--


--16986838380.fDDabe.8905
Date: Mon, 30 Oct 2023 16:37:18 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216717

            Bug ID: 1216717
           Summary: suse-module-tools: 60-io-scheduler.rules:37 Failed to write ATTR{/sys/devices/virtual/block/dm-0/queue/scheduler}, ignoring: No such file or directory
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: martin.wilck-at-suse.com
          Reporter: antonio.feijoo-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Just in case this wasn't reported yet, this error is logged in the journal =
of a
Tumbleweed system with crypto_LUKS devices:

Oct 30 15:46:46 localhost (udev-worker)[724]: dm-0:
/usr/lib/udev/rules.d/60-io-scheduler.rules:37 Failed to write
ATTR{/sys/devices/virtual/block/dm-0/queue/scheduler}, ignoring: No such fi=
le
or directory
Oct 30 15:46:48 localhost (udev-worker)[723]: dm-1:
/usr/lib/udev/rules.d/60-io-scheduler.rules:37 Failed to write
ATTR{/sys/devices/virtual/block/dm-1/queue/scheduler}, ignoring: No such fi=
le
or directory

# uname -r
6.5.9-1-default
# find /sys/devices -name "queue"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue
/sys/devices/virtual/block/dm-1/queue
/sys/devices/virtual/block/dm-0/queue
# find /sys/devices -name "scheduler"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue/scheduler
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/s=
cheduler

Not happening in systems with a similar setup using previous kernel version=
s:

- ALP Dolomite Build6.8

localhost:~ # uname -r
6.4.11-1-default
localhost:~ # find /sys/devices -name "queue"
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue
/sys/devices/virtual/block/dm-0/queue
localhost:~ # find /sys/devices -name "scheduler"
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/s=
cheduler
/sys/devices/virtual/block/dm-0/queue/scheduler

- Leap 15.5

# uname -r
5.14.21-150500.53-default
# find /sys/devices -name "queue"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue
/sys/devices/virtual/block/dm-0/queue
# find /sys/devices -name "scheduler"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue/scheduler
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/s=
cheduler
/sys/devices/virtual/block/dm-0/queue/scheduler

I don't know if it's a kernel bug or if the udev rule needs to be adjusted.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16986838380.fDDabe.8905
Date: Mon, 30 Oct 2023 16:37:18 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216717

          Summary
          suse-module-tools: 60-io-scheduler.rules:37 Failed to write A=
TTR{/sys/devices/virtual/block/dm-0/queue/scheduler}, ignoring: No such fil=
e or directory

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          martin.wilck@suse.com

          Reporter
          antonio.feijoo@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Just in case this wasn't reported yet, this error is logged =
in the journal of a
Tumbleweed system with crypto_LUKS devices:

Oct 30 15:46:46 localhost (udev-worker)[724]: dm-0:
/usr/lib/udev/rules.d/60-io-scheduler.rules:37 Failed to write
ATTR{/sys/devices/virtual/block/dm-0/queue/scheduler}, ignoring: No such fi=
le
or directory
Oct 30 15:46:48 localhost (udev-worker)[723]: dm-1:
/usr/lib/udev/rules.d/60-io-scheduler.rules:37 Failed to write
ATTR{/sys/devices/virtual/block/dm-1/queue/scheduler}, ignoring: No such fi=
le
or directory

# uname -r
6.5.9-1-default
# find /sys/devices -name "queue"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue
/sys/devices/virtual/block/dm-1/queue
/sys/devices/virtual/block/dm-0/queue
# find /sys/devices -name "scheduler"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue/scheduler
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/s=
cheduler

Not happening in systems with a similar setup using previous kernel version=
s:

- ALP Dolomite Build6.8

localhost:~ # uname -r
6.4.11-1-default
localhost:~ # find /sys/devices -name "queue"
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue
/sys/devices/virtual/block/dm-0/queue
localhost:~ # find /sys/devices -name "scheduler"
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/s=
cheduler
/sys/devices/virtual/block/dm-0/queue/scheduler

- Leap 15.5

# uname -r
5.14.21-150500.53-default
# find /sys/devices -name "queue"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue
/sys/devices/virtual/block/dm-0/queue
# find /sys/devices -name "scheduler"
/sys/devices/pci0000:00/0000:00:1f.2/ata1/host0/target0:0:0/0:0:0:0/block/s=
r0/queue/scheduler
/sys/devices/pci0000:00/0000:00:02.3/0000:04:00.0/virtio3/block/vda/queue/s=
cheduler
/sys/devices/virtual/block/dm-0/queue/scheduler

I don't know if it's a kernel bug or if the udev rule needs to be adjusted.=

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16986838380.fDDabe.8905--


body:
--16986986130.Cd50DE67.9118
Date: Mon, 30 Oct 2023 20:43:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216719

            Bug ID: 1216719
           Summary: Running 'w -s' crashes
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: ptesarik-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

With procps-3.3.17-14.2, attempts to run 'w -s' lead to a segmentation faul=
t.
This upstream commit must be applied:

https://gitlab.com/procps-ng/procps/-/commit/79042e07fab9956135a21b1df7a69d=
1fbde7ef79
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16986986130.Cd50DE67.9118
Date: Mon, 30 Oct 2023 20:43:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216719

          Summary
          Running 'w -s' crashes

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          ptesarik@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

With procps-3.3.17-14.2, attempts to run 'w -s' lead to a se=
gmentation fault.
This upstream commit must be applied:

https://gitlab.com/procps-ng/procps/-/commit/79042e0=
7fab9956135a21b1df7a69d1fbde7ef79

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16986986130.Cd50DE67.9118--

summary: Running 'w -s' crashes


--16987405593.FFA45e2A4.9478
Date: Tue, 31 Oct 2023 08:22:39 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216728

            Bug ID: 1216728
           Summary: VUL-0: CVE-2023-31794: mudf: infinite recursion in pdf_mark_list_push
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/383607/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: thomas.leroy-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

MuPDF v1.21.1 was discovered to contain an infinite recursion in the compon=
ent
pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of
Service (DoS) via a crafted PDF file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-31794
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16987405593.FFA45e2A4.9478
Date: Tue, 31 Oct 2023 08:22:39 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216728

          Summary
          VUL-0: CVE-2023-31794: mudf: infinite recursion in pdf_mark_l=
ist_push

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/383607/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          dmueller@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          thomas.leroy@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

MuPDF v1.21.1 was discovered to contain an infinite recursio=
n in the component
pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of
Service (DoS) via a crafted PDF file.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-31794

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16987405593.FFA45e2A4.9478--


--16987490940.66dF98C5.9934
Date: Tue, 31 Oct 2023 10:44:54 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1216739

            Bug ID: 1216739
           Summary: sssd: support configs and drop-ins in /usr
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: scabrero-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: ckowalczyk-at-suse.com, jengelh-at-inai.de,
                    scabrero-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

sssd ships configs in /etc. In order to be able to ship configs as packages,
support for having configs in /usr is desireable as well. Any chance to
simplement /usr/etc support?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--16987490940.66dF98C5.9934
Date: Tue, 31 Oct 2023 10:44:54 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1216739

          Summary
          sssd: support configs and drop-ins in /usr

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          scabrero@suse.com

          Reporter
          lnussel@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          ckowalczyk@suse.com, jengelh@inai.de, scabrero@su=
se.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

sssd ships configs in /etc. In order to be able to ship conf=
igs as packages,
support for having configs in /usr is desireable as well. Any chance to
simplement /usr/etc support?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--16987490940.66dF98C5.9934--