--17455803291.377BfE28.1525
Date: Fri, 25 Apr 2025 11:25:29 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241888

            Bug ID: 1241888
           Summary: [SELinux] Denials logged when using coreutils-single
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

When using coreutils-single, there is only a single /usr/bin/coreutils bina=
ry
invoked by shebangs, e.g.:

localhost:~ # cat /usr/bin/mkdir=20
#!/usr/bin/coreutils --coreutils-prog-shebang=3Dmkdir

To make the invocation of this more consistent with the multi-binary coreut=
ils,
it tries to set the program name:
https://github.com/coreutils/coreutils/blob/3a5c9c5537227eafc38c5657024584c=
dad63112a/src/coreutils.c#L123

This needs the CAP_SYS_RESOURCE capability. While this is available to
processes running as root, various contexts don't allow this and this resul=
ts
in denials being printed:

type=3DAVC msg=3Daudit(04/25/25 13:20:12.838:42) : avc:  denied  { sys_reso=
urce }
for  pid=3D1024 comm=3Dmkdir capability=3Dsys_resource=20
scontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tcontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tclass=3Dcapability permissive=3D0=20
----
type=3DAVC msg=3Daudit(04/25/25 13:20:12.839:43) : avc:  denied  { sys_reso=
urce }
for  pid=3D1025 comm=3Drm capability=3Dsys_resource=20
scontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tcontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tclass=3Dcapability permissive=3D0

This should either be allowed or dontaudited IMO.

To reproduce, run "zypper in coreutils-single -coreutils" and reboot.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17455803291.377BfE28.1525
Date: Fri, 25 Apr 2025 11:25:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241888

          Summary
          [SELinux] Denials logged when using coreutils-single

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          fvogt@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

When using coreutils-single, there is only a single /usr/bin=
/coreutils binary
invoked by shebangs, e.g.:

localhost:~ # cat /usr/bin/mkdir=20
#!/usr/bin/coreutils --coreutils-prog-shebang=3Dmkdir

To make the invocation of this more consistent with the multi-binary coreut=
ils,
it tries to set the program name:
https://github.com/coreutils/cor=
eutils/blob/3a5c9c5537227eafc38c5657024584cdad63112a/src/coreutils.c#L123</=
a>

This needs the CAP_SYS_RESOURCE capability. While this is available to
processes running as root, various contexts don't allow this and this resul=
ts
in denials being printed:

type=3DAVC msg=3Daudit(04/25/25 13:20:12.838:42) : avc:  denied  { sys_reso=
urce }
for  pid=3D1024 comm=3Dmkdir capability=3Dsys_resource=20
scontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tcontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tclass=3Dcapability permissive=3D0=20
----
type=3DAVC msg=3Daudit(04/25/25 13:20:12.839:43) : avc:  denied  { sys_reso=
urce }
for  pid=3D1025 comm=3Drm capability=3Dsys_resource=20
scontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tcontext=3Dsystem_u:system_r:NetworkManager_dispatcher_chronyc_t:s0
tclass=3Dcapability permissive=3D0

This should either be allowed or dontaudited IMO.

To reproduce, run "zypper in coreutils-single -coreutils" and reb=
oot.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17455803291.377BfE28.1525--


body:
--17456474270.3ACD.2634
Date: Sat, 26 Apr 2025 06:03:46 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241902

            Bug ID: 1241902
           Summary: core modules: fix build with cmake4
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: ada.lovelace-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1239788
  Target Milestone: ---
          Found By: ---
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1239788 +++

The following qore modules seem to fail to build with cmake 4.
Context:
https://lists.opensuse.org/archives/list/factory-at-lists.opensuse.org/thread/=
FHM4V3PGI3GX65LG6ZIAGJ6QQD5O57WN/

qore-json-module
qore-linenoise-module
qore-openldap-module
qore-pgsql-module
qore-sqlite3-module
qore-ssh2-module
qore-uuid-module
qore-xml-module
qore-yaml-module

Representative message:

[   17s] CMake Error at CMakeLists.txt:1 (cmake_minimum_required):
[   17s]   Compatibility with CMake < 3.5 has been removed from CMake.
[   17s]=20
[   17s]   Update the VERSION argument <min> value.  Or, use the <min>...<m=
ax>
syntax
[   17s]   to tell CMake that the project requires at least <min> but has b=
een
updated
[   17s]   to work with policies introduced by <max> or earlier.
[   17s]=20
[   17s]   Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3D3.5 to try configuring
anyway.

I see that upstream has already made the change, e.g.:
https://github.com/qorelanguage/module-yaml/commit/598f847afe9523902e8d6aa0=
fddf706281fd179e

Please pull the appropriate change into the distribution package to build w=
ith
both cmake 3 and 4.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17456474270.3ACD.2634
Date: Sat, 26 Apr 2025 06:03:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241902

          Summary
          core modules: fix build with cmake4

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          ada.lovelace@gmx.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          Blocks
          1239788

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1239788 +++

The following qore modules seem to fail to build with cmake 4.
Context:
https://lists.opensuse.or=
g/archives/list/factory@lists.opensuse.org/thread/FHM4V3PGI3GX65LG6ZIAG=
J6QQD5O57WN/

qore-json-module
qore-linenoise-module
qore-openldap-module
qore-pgsql-module
qore-sqlite3-module
qore-ssh2-module
qore-uuid-module
qore-xml-module
qore-yaml-module

Representative message:

[   17s] CMake Error at CMakeLists.txt:1 (cmake_minimum_required):
[   17s]   Compatibility with CMake < 3.5 has been removed from CMake.
[   17s]=20
[   17s]   Update the VERSION argument <min> value.  Or, use the <=
min>...<max>
syntax
[   17s]   to tell CMake that the project requires at least <min> but=
 has been
updated
[   17s]   to work with policies introduced by <max> or earlier.
[   17s]=20
[   17s]   Or, add -DCMAKE_POLICY_VERSION_MINIMUM=3D3.5 to try configuring
anyway.

I see that upstream has already made the change, e.g.:
https://github.com/qorelanguage/module-yaml/co=
mmit/598f847afe9523902e8d6aa0fddf706281fd179e

Please pull the appropriate change into the distribution package to build w=
ith
both cmake 3 and 4.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17456474270.3ACD.2634--

summary: core modules: fix build with cmake4


body:
--17457477320.9B9EDF.2918
Date: Sun, 27 Apr 2025 09:55:32 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241916

            Bug ID: 1241916
           Summary: GCC 15 - binutils package doesn't build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: matz-at-suse.com
          Reporter: filip.kastl-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1239850
  Target Milestone: ---
          Found By: ---
           Blocker: ---

binutils doesn't build with -std=3Dgnu23.

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:=
Gcc7/binutils/standard/x86_64

Looks like the problem is the different behavior of c23 regarding function
declarations without parameters.  Seems like this upstream patch should take
care of that:

https://sourceware.org/pipermail/binutils/2024-November/137696.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17457477320.9B9EDF.2918
Date: Sun, 27 Apr 2025 09:55:32 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241916

          Summary
          GCC 15 - binutils package doesn't build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          matz@suse.com

          Reporter
          filip.kastl@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1239850

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

binutils doesn't build with -std=3Dgnu23.

https://build.opensuse.org/packag=
e/live_build_log/openSUSE:Factory:Staging:Gcc7/binutils/standard/x86_64

Looks like the problem is the different behavior of c23 regarding function
declarations without parameters.  Seems like this upstream patch should take
care of that:

https://sourceware.org/pipermail/binutils/2024-November/137696.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17457477320.9B9EDF.2918--

summary: GCC 15 - binutils package doesn't build


--17458231006.06Ef4dcf1.3344
Date: Mon, 28 Apr 2025 06:51:40 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241952

            Bug ID: 1241952
           Summary: qemu crash in qemuBlockThrottleFiltersDetach()
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KVM
          Assignee: kvm-bugs-at-suse.de
          Reporter: luna.dragon-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 882180
  --> https://bugzilla.suse.com/attachment.cgi?id=3D882180&action=3Dedit
Full back trace of several threads captured by upstream tests

Upstream testing of cockpit-machines seems to have triggered a crash inside
qemuBlockThrottleFiltersDetach(). The test in question can be found here
https://github.com/cockpit-project/cockpit-machines/blob/799a8dc53620dee838=
9abbf428f084ed03b864f5/test/check-machines-disks#L1187.
The back trace of the crash seems to be

> #0  0x00007f1ff827eda4 qemuBlockThrottleFiltersDetach (libvirt_driver_qem=
u.so + 0x7eda4)
> #1  0x00007f1ff82f4dbc qemuDomainAttachDiskGeneric (libvirt_driver_qemu.s=
o + 0xf4dbc)
> #2  0x00007f1ff82fa808 qemuDomainAttachDeviceLive (libvirt_driver_qemu.so=
 + 0xfa808)
> #3  0x00007f1ff82d4ef8 n/a (libvirt_driver_qemu.so + 0xd4ef8)
> #4  0x00007f1ffe1284d0 virDomainAttachDeviceFlags (libvirt.so.0 + 0x3284d=
0)
> #5  0x00005561f19f8db1 n/a (/usr/sbin/virtqemud + 0x55db1)
> #6  0x00007f1ffe01b1ba virNetServerProgramDispatch (libvirt.so.0 + 0x21b1=
ba)
> #7  0x00007f1ffe01b6c2 n/a (libvirt.so.0 + 0x21b6c2)
> #8  0x00007f1ffe01b7cd n/a (libvirt.so.0 + 0x21b7cd)
> #9  0x00007f1ffdf557bd n/a (libvirt.so.0 + 0x1557bd)
> #10 0x00007f1ffdf54324 n/a (libvirt.so.0 + 0x154324)
> #11 0x00007f1ffd899546 start_thread (libc.so.6 + 0x99546)
> #12 0x00007f1ffd91d94c __clone3 (libc.so.6 + 0x11d94c)

Attached is the full crash log from upstream.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17458231006.06Ef4dcf1.3344
Date: Mon, 28 Apr 2025 06:51:40 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241952

          Summary
          qemu crash in qemuBlockThrottleFiltersDetach()

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KVM

          Assignee
          kvm-bugs@suse.de

          Reporter
          luna.dragon@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 882180 [details]
Full back trace of several threads captured by upstream tests

Upstream testing of cockpit-machines seems to have triggered a crash inside
qemuBlockThrottleFiltersDetach(). The test in question can be found here
https://=
github.com/cockpit-project/cockpit-machines/blob/799a8dc53620dee8389abbf428=
f084ed03b864f5/test/check-machines-disks#L1187.
The back trace of the crash seems to be

> #0  0x00007f1ff827eda4 qemuBlockThrottleFiltersD=
etach (libvirt_driver_qemu.so + 0x7eda4)
> #1  0x00007f1ff82f4dbc qemuDomainAttachDiskGeneric (libvirt_driver_qem=
u.so + 0xf4dbc)
> #2  0x00007f1ff82fa808 qemuDomainAttachDeviceLive (libvirt_driver_qemu=
.so + 0xfa808)
> #3  0x00007f1ff82d4ef8 n/a (libvirt_driver_qemu.so + 0xd4ef8)
> #4  0x00007f1ffe1284d0 virDomainAttachDeviceFlags (libvirt.so.0 + 0x32=
84d0)
> #5  0x00005561f19f8db1 n/a (/usr/sbin/virtqemud + 0x55db1)
> #6  0x00007f1ffe01b1ba virNetServerProgramDispatch (libvirt.so.0 + 0x2=
1b1ba)
> #7  0x00007f1ffe01b6c2 n/a (libvirt.so.0 + 0x21b6c2)
> #8  0x00007f1ffe01b7cd n/a (libvirt.so.0 + 0x21b7cd)
> #9  0x00007f1ffdf557bd n/a (libvirt.so.0 + 0x1557bd)
> #10 0x00007f1ffdf54324 n/a (libvirt.so.0 + 0x154324)
> #11 0x00007f1ffd899546 start_thread (libc.so.6 + 0x99546)
> #12 0x00007f1ffd91d94c __clone3 (libc.so.6 + 0x11d94c)

Attached is the full crash log from upstream.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17458231006.06Ef4dcf1.3344--


body:
--17458328141.2DAb6DDB.4082
Date: Mon, 28 Apr 2025 09:33:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1241966

            Bug ID: 1241966
           Summary: Missing script in initrd for dracut-ssh
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: eroca-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hi all,

Since yesterday, I noticed I cannot unlock my system via dracut-ssh, it's
missing a script in the initrd:

Apr 28 10:52:26 mini sshd[231]: /usr/libexec/ssh/sshd-auth does not exist o=
r is
not executable
Apr 28 10:53:08 mini systemd[1]: sshd.service: Scheduled restart job, resta=
rt
counter is at 1.
Apr 28 10:53:08 mini systemd[1]: Starting OpenSSH server daemon...
Apr 28 10:53:08 mini (sshd)[1714]: sshd.service: Referenced but unset
environment variable evaluates to an empty string: CRYPTO_POLICY, OPTIONS
Apr 28 10:53:08 mini sshd[1714]: /usr/libexec/ssh/sshd-auth does not exist =
or
is not executable
Apr 28 10:53:08 mini systemd[1]: sshd.service: Main process exited,
code=3Dexited, status=3D255/EXCEPTION
Apr 28 10:53:08 mini systemd[1]: sshd.service: Failed with result 'exit-cod=
e'.
Apr 28 10:53:08 mini systemd[1]: Failed to start OpenSSH server daemon.

If I manually add it, it works again:

cat /etc/dracut.conf.d/91-sshd.conf
install_items+=3D" /usr/libexec/ssh/sshd-auth "
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17458328141.2DAb6DDB.4082
Date: Mon, 28 Apr 2025 09:33:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1241966

          Summary
          Missing script in initrd for dracut-ssh

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          eroca@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hi all,

Since yesterday, I noticed I cannot unlock my system via dracut-ssh, it's
missing a script in the initrd:

Apr 28 10:52:26 mini sshd[231]: /usr/libexec/ssh/sshd-auth does not exist o=
r is
not executable
Apr 28 10:53:08 mini systemd[1]: sshd.service: Scheduled restart job, resta=
rt
counter is at 1.
Apr 28 10:53:08 mini systemd[1]: Starting OpenSSH server daemon...
Apr 28 10:53:08 mini (sshd)[1714]: sshd.service: Referenced but unset
environment variable evaluates to an empty string: CRYPTO_POLICY, OPTIONS
Apr 28 10:53:08 mini sshd[1714]: /usr/libexec/ssh/sshd-auth does not exist =
or
is not executable
Apr 28 10:53:08 mini systemd[1]: sshd.service: Main process exited,
code=3Dexited, status=3D255/EXCEPTION
Apr 28 10:53:08 mini systemd[1]: sshd.service: Failed with result 'exit-cod=
e'.
Apr 28 10:53:08 mini systemd[1]: Failed to start OpenSSH server daemon.

If I manually add it, it works again:

cat /etc/dracut.conf.d/91-sshd.conf
install_items+=3D" /usr/libexec/ssh/sshd-auth "

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17458328141.2DAb6DDB.4082--

summary: Missing script in initrd for dracut-ssh


--17459922521.51Dc9F083.7455
Date: Wed, 30 Apr 2025 05:50:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242044

            Bug ID: 1242044
           Summary: Fix potential OOB access in MIDI2 UMP conversion code
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: tiwai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

There is an upstream fix that addresses the potential buffer overflow found=
 in
the MIDI 2.0 UMP conversion code in the recent kernel, commit
56f1f30e6795b890463d9b20b11e576adf5a2f77
   ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
in sound.git tree.  This needs to be backported to our kernels.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17459922521.51Dc9F083.7455
Date: Wed, 30 Apr 2025 05:50:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242044

          Summary
          Fix potential OOB access in MIDI2 UMP conversion code

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          tiwai@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

There is an upstream fix that addresses the potential buffer=
 overflow found in
the MIDI 2.0 UMP conversion code in the recent kernel, commit
56f1f30e6795b890463d9b20b11e576adf5a2f77
   ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
in sound.git tree.  This needs to be backported to our kernels.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17459922521.51Dc9F083.7455--


--17460016063.EBD7.7887
Date: Wed, 30 Apr 2025 08:26:46 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242056

            Bug ID: 1242056
           Summary: Please adjust the whitelisting of the polkit actions to cope with the on going renaming of systemd-network sub-package
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fbui-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hi,

systemd-network, which contains systemd-resolved and systemd-networkd, is g=
oing
to be split so each service gains its dedicated sub-package (systemd-resolv=
ed
and systemd-networkd respectively).

Could you please adjust the whitelisting accordingly to fix the following b=
uild
errors:

> [  336s] systemd-networkd.x86_64: E: polkit-file-unauthorized (Badness: 1=
0000) /usr/share/polkit-1/rules.d/60-systemd-networkd.rules (sha256 file di=
gest default filter:f199e386a9297858331b00df07ed0b0ee5fcf4bea67f6c0bccc8a92=
b7e310bbd shell filter:5231b429eae9aefeba189a38938c217ae617860c0196f394e7a9=
64fc2e8075ce xml filter:<failed-to-calculate>)
> [  336s] Packaging polkit rules requires a review and whitelisting by the=
 SUSE security
> [  336s] team. If the package is intended for inclusion in any SUSE produ=
ct please open
> [  336s] a bug report to request review of the package by the security te=
am. Please
> [  336s] refer to
> [  336s] https://en.opensuse.org/openSUSE:Package_security_guidelines#aud=
it_bugs for
> [  336s] more information.
>=20
> [  336s] systemd-networkd.x86_64: E: dbus-file-unauthorized (Badness: 100=
00) /usr/share/dbus-1/system.d/org.freedesktop.network1.conf (sha256 file d=
igest default filter:3517cb15b466c8e6826c4f4261477ab61ea11c23cbd10c69bfb2f5=
4ef97357cc shell filter:938555f0bd46f46cb8ad40ad9219c55350c4231dc92e01b5dd7=
00c3bbec1875e xml filter:0dc908d25974ae44a6526a5eb51e0f6e5d5fff7e8fc91c01be=
c1c51042e3d69f)
> [  336s] systemd-networkd.x86_64: E: dbus-file-unauthorized (Badness: 100=
00) /usr/share/dbus-1/system-services/org.freedesktop.network1.service (sha=
256 file digest default filter:2b6ff324305f9a9d650a48cc94c91764601e3ff4bc67=
1d0e2596a54d039b7150 shell filter:c5050801bc59bbfed19b913fdcfed0ae84f843de6=
c8fec5801265c11438d7b04 xml filter:<failed-to-calculate>)
> [  336s] systemd-resolved.x86_64: E: dbus-file-unauthorized (Badness: 100=
00) /usr/share/dbus-1/system.d/org.freedesktop.resolve1.conf (sha256 file d=
igest default filter:1586cbabf4977b1e43d858373f2128b641e920fd6b995b0b231986=
cab53b3a7f shell filter:e8e6a4b60e377b0a83f0cd19144b6b2495bfe6b53ba3f046d74=
25eac99d7589b xml filter:c47254830a002ad52889a0b19c9410c02c96cbd6931bc7bab5=
10d56c58e7fc7c)
> [  336s] systemd-resolved.x86_64: E: dbus-file-unauthorized (Badness: 100=
00) /usr/share/dbus-1/system-services/org.freedesktop.resolve1.service (sha=
256 file digest default filter:5fc8808faa8da6c61553f11985eb8eb828b34e628421=
f3aedbb421e0d61426d1 shell filter:9bd3adcbd2c5466b58de3dc0c68f10fc0e1d115d1=
c3dbd379ad6ee502db6bde8 xml filter:<failed-to-calculate>)
> [  336s] Packaging D-Bus services requires a review and whitelisting by t=
he SUSE
> [  336s] security team. If the package is intended for inclusion in any S=
USE product
> [  336s] please open a bug report to request review of the package by the=
 security
> [  336s] team. Please refer to
> [  336s] https://en.opensuse.org/openSUSE:Package_security_guidelines#aud=
it_bugs for
> [  336s] more information.
> [  336s]=20

Thanks.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17460016063.EBD7.7887
Date: Wed, 30 Apr 2025 08:26:46 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242056

          Summary
          Please adjust the whitelisting of the polkit actions to cope =
with the on going renaming of systemd-network sub-package

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          fbui@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hi,

systemd-network, which contains systemd-resolved and systemd-networkd, is g=
oing
to be split so each service gains its dedicated sub-package (systemd-resolv=
ed
and systemd-networkd respectively).

Could you please adjust the whitelisting accordingly to fix the following b=
uild
errors:

> [  336s] systemd-networkd.x86_64: E: polkit-file=
-unauthorized (Badness: 10000) /usr/share/polkit-1/rules.d/60-systemd-netwo=
rkd.rules (sha256 file digest default filter:f199e386a9297858331b00df07ed0b=
0ee5fcf4bea67f6c0bccc8a92b7e310bbd shell filter:5231b429eae9aefeba189a38938=
c217ae617860c0196f394e7a964fc2e8075ce xml filter:<failed-to-calculate&gt=
;)
> [  336s] Packaging polkit rules requires a review and whitelisting by =
the SUSE security
> [  336s] team. If the package is intended for inclusion in any SUSE pr=
oduct please open
> [  336s] a bug report to request review of the package by the security=
 team. Please
> [  336s] refer to
> [  336s] https://en.opensuse.org/openSUSE:Package_security_gu=
idelines#audit_bugs for
> [  336s] more information.
>=20
> [  336s] systemd-networkd.x86_64: E: dbus-file-unauthorized (Badness: =
10000) /usr/share/dbus-1/system.d/org.freedesktop.network1.conf (sha256 fil=
e digest default filter:3517cb15b466c8e6826c4f4261477ab61ea11c23cbd10c69bfb=
2f54ef97357cc shell filter:938555f0bd46f46cb8ad40ad9219c55350c4231dc92e01b5=
dd700c3bbec1875e xml filter:0dc908d25974ae44a6526a5eb51e0f6e5d5fff7e8fc91c0=
1bec1c51042e3d69f)
> [  336s] systemd-networkd.x86_64: E: dbus-file-unauthorized (Badness: =
10000) /usr/share/dbus-1/system-services/org.freedesktop.network1.service (=
sha256 file digest default filter:2b6ff324305f9a9d650a48cc94c91764601e3ff4b=
c671d0e2596a54d039b7150 shell filter:c5050801bc59bbfed19b913fdcfed0ae84f843=
de6c8fec5801265c11438d7b04 xml filter:<failed-to-calculate>)
> [  336s] systemd-resolved.x86_64: E: dbus-file-unauthorized (Badness: =
10000) /usr/share/dbus-1/system.d/org.freedesktop.resolve1.conf (sha256 fil=
e digest default filter:1586cbabf4977b1e43d858373f2128b641e920fd6b995b0b231=
986cab53b3a7f shell filter:e8e6a4b60e377b0a83f0cd19144b6b2495bfe6b53ba3f046=
d7425eac99d7589b xml filter:c47254830a002ad52889a0b19c9410c02c96cbd6931bc7b=
ab510d56c58e7fc7c)
> [  336s] systemd-resolved.x86_64: E: dbus-file-unauthorized (Badness: =
10000) /usr/share/dbus-1/system-services/org.freedesktop.resolve1.service (=
sha256 file digest default filter:5fc8808faa8da6c61553f11985eb8eb828b34e628=
421f3aedbb421e0d61426d1 shell filter:9bd3adcbd2c5466b58de3dc0c68f10fc0e1d11=
5d1c3dbd379ad6ee502db6bde8 xml filter:<failed-to-calculate>)
> [  336s] Packaging D-Bus services requires a review and whitelisting b=
y the SUSE
> [  336s] security team. If the package is intended for inclusion in an=
y SUSE product
> [  336s] please open a bug report to request review of the package by =
the security
> [  336s] team. Please refer to
> [  336s] https://en.opensuse.org/openSUSE:Package_security_gu=
idelines#audit_bugs for
> [  336s] more information.
> [  336s]

Thanks.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17460016063.EBD7.7887--


body:
--17460405002.47cEc.9557
Date: Wed, 30 Apr 2025 19:15:00 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242079

            Bug ID: 1242079
           Summary: TRACKERBUG: migration to fuse 3 and deprecation of fuse (1)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

This bug tracks the work needed to migrate to fuse 3 to allow the deprecati=
on
of fuse (1).

Rationale: fuse 3 appeared upstream 2016, and in openSUSE 2018. fuse 2.9.9 =
was
released 2019-01-04 and should be considered deprecated.

Similar efforts:
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Starting counts:

build requires fuse (transitive)      : 136
build requires fuse fuse3 (transitive): 64

requires libfuse.so.2 : 70
requires libfuse3.so.4: 30

requires: "fuse" : 30
requires: "fuse3": 10

Maintainer text follows.

---

Dear maintainer, please update your package to use fuse 3 instead of fuse.=
=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specified. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17460405002.47cEc.9557
Date: Wed, 30 Apr 2025 19:15:00 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242079

          Summary
          TRACKERBUG: migration to fuse 3 and deprecation of fuse (1)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

This bug tracks the work needed to migrate to fuse 3 to allo=
w the deprecation
of fuse (1).

Rationale: fuse 3 appeared upstream 2016, and in openSUSE 2018. fuse 2.9.9 =
was
released 2019-01-04 and should be considered deprecated.

Similar efforts:
=
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Starting counts:

build requires fuse (transitive)      : 136
build requires fuse fuse3 (transitive): 64

requires libfuse.so.2 : 70
requires libfuse3.so.4: 30

requires: "fuse" : 30
requires: "fuse3": 10

Maintainer text follows.

---

Dear maintainer, please update your package to use fuse 3 instead of fuse.=
=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specifi=
ed. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
=
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17460405002.47cEc.9557--

pkgs: libbfoverlay libewf libfsapfs libfshfs libfsntfs libmodi libphdi libregf libsmraw libvmdk libvshadow


--17460423221.980d7fb.9590
Date: Wed, 30 Apr 2025 19:45:22 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242081

            Bug ID: 1242081
           Summary: libvirt: migration to fuse 3 and deprecation of fuse (1)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: jfehlig-at-suse.com
            Blocks: 1242079
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Dear maintainer, please update your package to use fuse 3 instead of fuse.=
=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specified. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas

libvirt.spec:
> BuildRequires:  fuse-devel >=3D 2.8.6
> [...]
>            -Dfuse=3Denabled \

>From https://libvirt.org/news.html#v8-2-0-2022-04-01

> Implement support for FUSE3
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17460423221.980d7fb.9590
Date: Wed, 30 Apr 2025 19:45:22 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242081

          Summary
          libvirt: migration to fuse 3 and deprecation of fuse (1)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Other

          Assignee
          virt-bugs@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          jfehlig@suse.com

          Blocks
          1242079

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Dear maintainer, please update your package to use fuse 3 in=
stead of fuse.=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specifi=
ed. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
=
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas

libvirt.spec:
> BuildRequires:  fuse-devel >=3D 2.8.6
> [...]
>            -Dfuse=3Denabled \

>From https://li=
bvirt.org/news.html#v8-2-0-2022-04-01

> Implement support for FUSE3

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17460423221.980d7fb.9590--


--17460441470.f4e82.9614
Date: Wed, 30 Apr 2025 20:15:47 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242085

            Bug ID: 1242085
           Summary: GCC 15 - package virtualbox does not build with GCC 15
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Virtualization:Other
          Assignee: virt-bugs-at-suse.de
          Reporter: mjambor-at-suse.com
        QA Contact: qa-bugs-at-suse.de
            Blocks: 1239850
  Target Milestone: ---
          Found By: Development
           Blocker: ---

The package virtualbox does not build with GCC 15, most probably
because it has switched by default to C23 standard for the C language.
The failure can be seen here:

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:=
Gcc7/virtualbox/standard/x86_64

The failure stopping the build is:

[   45s] @gcc -c -O2 -g -pipe -pedantic -Wshadow -Wall -Wextra
-Wno-missing-field-initializers -Wno-unused -Wno-trigraphs
-fdiagnostics-show-option -Wno-unused-parameter     -Wlogical-op=20=20
-Wno-variadic-macros  -Wno-long-long -Wunused-variable -Wunused-function
-Wunused-label -Wunused-parameter -Wmissing-prototypes -Wstrict-prototypes
-Wmissing-declarations -Werror-implicit-function-declaration
-Wno-variadic-macros  -O2 -fno-omit-frame-pointer -fno-strict-aliasing -m64
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/V=
Box/Runtime/include
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/l=
ibs/liblzf-3.6
-I/usr/include/libxml2
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/inclu=
de
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/out/l=
inux.amd64/release
-DVBOX -DVBOX_OSE -DVBOX_WITH_64_BITS_GUESTS -DRT_OS_LINUX
-D_FILE_OFFSET_BITS=3D64 -DRT_ARCH_AMD64 -D__AMD64__ -DVBOX_WITH_DEBUGGER
-DVBOX_WITH_HARDENING "-DRTPATH_APP_PRIVATE=3D\"/usr/share/virtualbox\""
"-DRTPATH_APP_PRIVATE_ARCH=3D\"/usr/lib/virtualbox\""
"-DRTPATH_SHARED_LIBS=3D\"/usr/lib/virtualbox\""
"-DRTPATH_APP_DOCS=3D\"/usr/share/doc/packages/virtualbox\"" -D_REENTRANT
-DIN_RING3 -DLOG_DISABLED -DIN_BLD_PROG -DIN_RT_R3 -DIN_ADV_BLD_PROG -DIN_R=
T_R3
-DLDR_WITH_NATIVE -DLDR_WITH_ELF32 -DLDR_WITH_LX -DLDR_WITH_MACHO -DLDR_WIT=
H_PE
-DRT_WITH_VBOX -DRT_NO_GIP -DRT_WITHOUT_NOCRT_WRAPPERS -DNOFILEID
-DIPRT_WITH_LZMA -DRT_WITH_ICONV_CACHE -DIPRT_WITHOUT_LDR_VERIFY -DRT_NO_GIP
-Wp,-MD,/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8=
/out/linux.amd64/release/obj/RuntimeBldProg/common/misc/sanity-c.o.dep
-Wp,-MT,/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8=
/out/linux.amd64/release/obj/RuntimeBldProg/common/misc/sanity-c.o
-Wp,-MP -o
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/out/lin=
ux.amd64/release/obj/RuntimeBldProg/common/misc/sanity-c.o
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity-c.c
[   45s] kBuild: Compiling RuntimeBldProg -
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity-c.c
[   45s] In file included from
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity.h:38,
[   45s]                  from
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity-c.c:37:
[   45s]
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/include=
/iprt/types.h:285:15:
error: =E2=80=98bool=E2=80=99 cannot be defined via =E2=80=98typedef=E2=80=
=99
[   45s]   285 | typedef _Bool bool;
[   45s]       |               ^~~~
[   45s]
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/include=
/iprt/types.h:285:15:
note: =E2=80=98bool=E2=80=99 is a keyword with =E2=80=98-std=3Dc23=E2=80=99=
 onwards
[   45s]
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/include=
/iprt/types.h:285:1:
warning: useless type name in empty declaration
[   45s]   285 | typedef _Bool bool;
[   45s]       | ^~~~~~~

Unless there are patches upstream to make the source compliant with
C23, it may be easiest to simply compile with -std=3Dgnu17.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17460441470.f4e82.9614
Date: Wed, 30 Apr 2025 20:15:47 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242085

          Summary
          GCC 15 - package virtualbox does not build with GCC 15

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Virtualization:Other

          Assignee
          virt-bugs@suse.de

          Reporter
          mjambor@suse.com

          QA Contact
          qa-bugs@suse.de

          Blocks
          1239850

          Target Milestone
          ---

          Found By
          Development

          Blocker
          ---

The package virtualbox does not build with GCC 15, most prob=
ably
because it has switched by default to C23 standard for the C language.
The failure can be seen here:

https://build.opensuse.org/pack=
age/live_build_log/openSUSE:Factory:Staging:Gcc7/virtualbox/standard/x86_64=

The failure stopping the build is:

[   45s] @gcc -c -O2 -g -pipe -pedantic -Wshadow -Wall -Wextra
-Wno-missing-field-initializers -Wno-unused -Wno-trigraphs
-fdiagnostics-show-option -Wno-unused-parameter     -Wlogical-op=20=20
-Wno-variadic-macros  -Wno-long-long -Wunused-variable -Wunused-function
-Wunused-label -Wunused-parameter -Wmissing-prototypes -Wstrict-prototypes
-Wmissing-declarations -Werror-implicit-function-declaration
-Wno-variadic-macros  -O2 -fno-omit-frame-pointer -fno-strict-aliasing -m64
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/V=
Box/Runtime/include
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/l=
ibs/liblzf-3.6
-I/usr/include/libxml2
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/inclu=
de
-I/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/out/l=
inux.amd64/release
-DVBOX -DVBOX_OSE -DVBOX_WITH_64_BITS_GUESTS -DRT_OS_LINUX
-D_FILE_OFFSET_BITS=3D64 -DRT_ARCH_AMD64 -D__AMD64__ -DVBOX_WITH_DEBUGGER
-DVBOX_WITH_HARDENING "-DRTPATH_APP_PRIVATE=3D\"/usr/share/virtua=
lbox\""
"-DRTPATH_APP_PRIVATE_ARCH=3D\"/usr/lib/virtualbox\""
"-DRTPATH_SHARED_LIBS=3D\"/usr/lib/virtualbox\""
"-DRTPATH_APP_DOCS=3D\"/usr/share/doc/packages/virtualbox\"&=
quot; -D_REENTRANT
-DIN_RING3 -DLOG_DISABLED -DIN_BLD_PROG -DIN_RT_R3 -DIN_ADV_BLD_PROG -DIN_R=
T_R3
-DLDR_WITH_NATIVE -DLDR_WITH_ELF32 -DLDR_WITH_LX -DLDR_WITH_MACHO -DLDR_WIT=
H_PE
-DRT_WITH_VBOX -DRT_NO_GIP -DRT_WITHOUT_NOCRT_WRAPPERS -DNOFILEID
-DIPRT_WITH_LZMA -DRT_WITH_ICONV_CACHE -DIPRT_WITHOUT_LDR_VERIFY -DRT_NO_GIP
-Wp,-MD,/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8=
/out/linux.amd64/release/obj/RuntimeBldProg/common/misc/sanity-c.o.dep
-Wp,-MT,/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8=
/out/linux.amd64/release/obj/RuntimeBldProg/common/misc/sanity-c.o
-Wp,-MP -o
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/out/lin=
ux.amd64/release/obj/RuntimeBldProg/common/misc/sanity-c.o
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity-c.c
[   45s] kBuild: Compiling RuntimeBldProg -
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity-c.c
[   45s] In file included from
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity.h:38,
[   45s]                  from
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/src/VBo=
x/Runtime/common/misc/sanity-c.c:37:
[   45s]
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/include=
/iprt/types.h:285:15:
error: =E2=80=98bool=E2=80=99 cannot be defined via =E2=80=98typedef=E2=80=
=99
[   45s]   285 | typedef _Bool bool;
[   45s]       |               ^~~~
[   45s]
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/include=
/iprt/types.h:285:15:
note: =E2=80=98bool=E2=80=99 is a keyword with =E2=80=98-std=3Dc23=E2=80=99=
 onwards
[   45s]
/home/abuild/rpmbuild/BUILD/virtualbox-7.1.8-build/VirtualBox-7.1.8/include=
/iprt/types.h:285:1:
warning: useless type name in empty declaration
[   45s]   285 | typedef _Bool bool;
[   45s]       | ^~~~~~~

Unless there are patches upstream to make the source compliant with
C23, it may be easiest to simply compile with -std=3Dgnu17.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17460441470.f4e82.9614--


--17460450381.5AcbE.9647
Date: Wed, 30 Apr 2025 20:30:38 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242088

            Bug ID: 1242088
           Summary: xwmfs: migration to fuse 3 and deprecation of fuse (1)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: matthias.gerstner-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: qa-bugs-at-suse.de
            Blocks: 1242079
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Dear maintainer, please update your package to use fuse 3 instead of fuse.=
=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specified. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas

from xwmfs.spec:
> BuildRequires:  fuse-devel
> [...]
> Requires:       fuse

No upstream support:
https://github.com/gerstner-hub/xwmfs/blob/master/configure.ac#L39-L41
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17460450381.5AcbE.9647
Date: Wed, 30 Apr 2025 20:30:38 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242088

          Summary
          xwmfs: migration to fuse 3 and deprecation of fuse (1)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 Applications

          Assignee
          matthias.gerstner@suse.com

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          qa-bugs@suse.de

          Blocks
          1242079

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Dear maintainer, please update your package to use fuse 3 in=
stead of fuse.=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specifi=
ed. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
=
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas

from xwmfs.spec:
> BuildRequires:  fuse-devel
> [...]
> Requires:       fuse

No upstream support:
https://github.com/gerstner-hub/xwmfs/blob/master/configure.ac#L39-=
L41

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17460450381.5AcbE.9647--


--17460499540.d2f4F.9722
Date: Wed, 30 Apr 2025 21:52:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242092

            Bug ID: 1242092
           Summary: fuseiso: migration to fuse 3 and deprecation of fuse (1)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: dsterba-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: qa-bugs-at-suse.de
            Blocks: 1242079
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Dear maintainer, please update your package to use fuse 3 instead of fuse.=
=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specified. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas

>From fuseiso.spec:

> BuildRequires:  fuse-devel
> Requires:       fuse

Debian patch:
https://salsa.debian.org/debian/fuseiso/-/blob/debian/unstable/debian/patch=
es/fuse3.patch
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17460499540.d2f4F.9722
Date: Wed, 30 Apr 2025 21:52:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242092

          Summary
          fuseiso: migration to fuse 3 and deprecation of fuse (1)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          dsterba@suse.com

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          qa-bugs@suse.de

          Blocks
          1242079

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Dear maintainer, please update your package to use fuse 3 in=
stead of fuse.=20

That would be pkgconfig(fuse3) as provided by fuse3-devel, and libfuse3.so.=
* -
instead of pkgconfig(fuse) from fuse-devel, and libfuse.so.2. Do not forget=
 to
change "Requires: fuse" to "Requires: fuse3" if specifi=
ed. As usual please
perform any testing you need to be comfortable with this change.

As with other such changes, please do one of the following:

1. If upstream already supports it, build your package to fuse 3
2. If needed, bump to an upstream version that supports fuse 3 and use it.
3. Pull a change from upstream git if unreleased, or a WIP pull request
4. Raise an upstream bug to request a change to support fuse 3.
5. copy a patch from another distribution, see links
6. write a downstream patch
7. (not desired) check if the package is still actively maintained, or if t=
here
are forks

If you submitted to openSUSE:Factory please just comment the request into t=
he
bug and resolve it. For general discussion see parent bug.

Similar efforts:
=
https://release.debian.org/transitions/html/fuse-to-fuse3.html

Many thanks,
Andreas

>From fuseiso.spec:

> BuildRequires:  fuse-devel
> Requires:       fuse

Debian patch:
https://salsa.debian.org/debian/fuseiso/-/blob/d=
ebian/unstable/debian/patches/fuse3.patch

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17460499540.d2f4F.9722--


--17460517751.FFBFeC.9725
Date: Wed, 30 Apr 2025 22:22:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242093

            Bug ID: 1242093
           Summary: fuser fails to detect TCP listeners in Tumbleweed (regression after psmisc >23.7)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: elias.erke-at-proton.me
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

On Tumbleweed, fuser fails to detect processes listening on TCP ports.
Example:

ss -tulpn | grep :5432   # shows PostgreSQL listening
fuser 5432/tcp           # returns nothing

After testing, I confirmed the issue does not exist in the latest official
release of psmisc (23.7).
The bug appears to have been introduced in post-23.7 commits in upstream
psmisc, likely related to changes in fuser.c (specifically the new get_fdin=
fo()
function).

This suggests Tumbleweed is shipping a non-release snapshot of psmisc that
includes this regression.

Upstream issue for reference:
https://gitlab.com/psmisc/psmisc/-/issues/57

How to Reproduce?

1. Start any process listening on a TCP port.

2. Confirm it's listening:

ss -tulpn | grep :5432

3. Run fuser:

fuser 5432/tcp

4. fuser returns nothing, even though the port is active.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17460517751.FFBFeC.9725
Date: Wed, 30 Apr 2025 22:22:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242093

          Summary
          fuser fails to detect TCP listeners in Tumbleweed (regression=
 after psmisc >23.7)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          elias.erke@proton.me

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

On Tumbleweed, fuser fails to detect processes listening on =
TCP ports.
Example:

ss -tulpn | grep :5432   # shows PostgreSQL listening
fuser 5432/tcp           # returns nothing

After testing, I confirmed the issue does not exist in the latest official
release of psmisc (23.7).
The bug appears to have been introduced in post-23.7 commits in upstream
psmisc, likely related to changes in fuser.c (specifically the new get_fdin=
fo()
function).

This suggests Tumbleweed is shipping a non-release snapshot of psmisc that
includes this regression.

Upstream issue for reference:
https://gitlab.com=
/psmisc/psmisc/-/issues/57

How to Reproduce?

1. Start any process listening on a TCP port.

2. Confirm it's listening:

ss -tulpn | grep :5432

3. Run fuser:

fuser 5432/tcp

4. fuser returns nothing, even though the port is active.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17460517751.FFBFeC.9725--


body:
--17461969772.77ca1.11254
Date: Fri, 2 May 2025 14:42:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242153

            Bug ID: 1242153
           Summary: chromium 136.0.7103.59 release
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: ro-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

High CVE-2025-4096: Heap buffer overflow in HTML. Reported by Anonymous on
2025-04-11
Medium CVE-2025-4050: Out of bounds memory access in DevTools. Reported by
Anonymous on 2025-04-09
Medium CVE-2025-4051: Insufficient data validation in DevTools. Reported by
Daniel Fr=C3=B6jdendahl on 2025-03-1
Low CVE-2025-4052: Inappropriate implementation in DevTools. Reported by
vanillawebdev on 2025-03-10
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17461969772.77ca1.11254
Date: Fri, 2 May 2025 14:42:57 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242153

          Summary
          chromium 136.0.7103.59 release

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          ro@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

High CVE-2025-4096: Heap buffer overflow in HTML. Reported b=
y Anonymous on
2025-04-11
Medium CVE-2025-4050: Out of bounds memory access in DevTools. Reported by
Anonymous on 2025-04-09
Medium CVE-2025-4051: Insufficient data validation in DevTools. Reported by
Daniel Fr=C3=B6jdendahl on 2025-03-1
Low CVE-2025-4052: Inappropriate implementation in DevTools. Reported by
vanillawebdev on 2025-03-10

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17461969772.77ca1.11254--

summary: chromium 136.0.7103.59 release


body:
--17463291513.b0c7B.12138
Date: Sun, 4 May 2025 03:25:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242186

            Bug ID: 1242186
           Summary: yt-dlp is outdated
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: arnaudmez-at-vivaldi.net
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hello=20

I've started to receive error when trying to use yt-dlp, then I checked it =
and
got this output

---
yt-dlp -U
Current version: stable@2025.03.31 from yt-dlp/yt-dlp
Latest version: stable@2025.04.30 from yt-dlp/yt-dlp
ERROR: You installed yt-dlp from a manual build or with a package manager; =
Use
that to update
---

It's clear that the package is outdated and need some work to be done for i=
t to
be refreshed.

Thanks for your support
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17463291513.b0c7B.12138
Date: Sun, 4 May 2025 03:25:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242186

          Summary
          yt-dlp is outdated

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          arnaudmez@vivaldi.net

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hello=20

I've started to receive error when trying to use yt-dlp, then I checked it =
and
got this output

---
yt-dlp -U
Current version: stable@2025.0=
3.31 from yt-dlp/yt-dlp
Latest version: stable@2025.04=
.30 from yt-dlp/yt-dlp
ERROR: You installed yt-dlp from a manual build or with a package manager; =
Use
that to update
---

It's clear that the package is outdated and need some work to be done for i=
t to
be refreshed.

Thanks for your support

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17463291513.b0c7B.12138--

summary: yt-dlp is outdated


--17464416860.FeCBbe8CD.13437
Date: Mon, 5 May 2025 10:41:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242266

            Bug ID: 1242266
           Summary: 0ad fails to build for the ppc64le architecture
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: hector.oron-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

0ad fails to build in Factory, with following error:

[...]
[   78s] In file included from src/host/term_textColor.c:7:
[   78s] src/host/premake.h:70:2: error: #error Unknown architecture detect=
ed
[   78s]    70 | #error Unknown architecture detected
[   78s]       |  ^~~~~
[   78s] In file included from src/host/zip_extract.c:7:
[   78s] src/host/premake.h:70:2: error: #error Unknown architecture detect=
ed
[   78s]    70 | #error Unknown architecture detected
[   78s]       |  ^~~~~
[   80s] make: *** [Bootstrap.mak:110: linux] Error 1
[...]

Please check the OpenSUSE Factory project package status at:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:PowerPC/=
0ad/standard/ppc64le

Package should probably need to be disabled for ppc64le architecture.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17464416860.FeCBbe8CD.13437
Date: Mon, 5 May 2025 10:41:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242266

          Summary
          0ad fails to build for the ppc64le architecture

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          hector.oron@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

0ad fails to build in Factory, with following error:

[...]
[   78s] In file included from src/host/term_textColor.c:7:
[   78s] src/host/premake.h:70:2: error: #error Unknown architecture detect=
ed
[   78s]    70 | #error Unknown architecture detected
[   78s]       |  ^~~~~
[   78s] In file included from src/host/zip_extract.c:7:
[   78s] src/host/premake.h:70:2: error: #error Unknown architecture detect=
ed
[   78s]    70 | #error Unknown architecture detected
[   78s]       |  ^~~~~
[   80s] make: *** [Bootstrap.mak:110: linux] Error 1
[...]

Please check the OpenSUSE Factory project package status at:
https://build.opensuse.org/package/live_bu=
ild_log/openSUSE:Factory:PowerPC/0ad/standard/ppc64le

Package should probably need to be disabled for ppc64le architecture.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17464416860.FeCBbe8CD.13437--


body:
--17464515920.66eE4.14025
Date: Mon, 5 May 2025 13:26:32 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242310

            Bug ID: 1242310
           Summary: ffmpeg-7 changes file out of order
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: jengelh-at-inai.de
          Reporter: mrueckert-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

`osc pdiff graphics:blender-backports/ffmpeg-7`
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17464515920.66eE4.14025
Date: Mon, 5 May 2025 13:26:32 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242310

          Summary
          ffmpeg-7 changes file out of order

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          jengelh@inai.de

          Reporter
          mrueckert@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

`osc pdiff graphics:blender-backports/ffmpeg-7`

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17464515920.66eE4.14025--

summary: ffmpeg-7 changes file out of order


--17465388652.EbEc7ce.17012
Date: Tue, 6 May 2025 13:41:05 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242632

            Bug ID: 1242632
           Summary: VUL-0: CVE-2025-3416: newsflash: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/449197/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S
                    :U/C:N/I:N/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1242599
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A flaw was found in OpenSSL's handling of the properties argument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://bugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cve.org/CVERecord?id=3DCVE-2025-3416
https://access.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfackler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/87085bd67896b7f92e6de35d081=
f607a334beae4
https://github.com/sfackler/rust-openssl/pull/2390
https://rustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/3xxx/CVE-2025-=
3416.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17465388652.EbEc7ce.17012
Date: Tue, 6 May 2025 13:41:05 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242632

          Summary
          VUL-0: CVE-2025-3416: newsflash: openssl: Use-After-Free in M=
d::fetch and Cipher::fetch in rust-openssl crate

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/449197/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S:U/C:N/=
I:N/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1242599

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A flaw was found in OpenSSL's handling of the properties arg=
ument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-3416
https://ac=
cess.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfa=
ckler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/8=
7085bd67896b7f92e6de35d081f607a334beae4
https://gith=
ub.com/sfackler/rust-openssl/pull/2390
https://r=
ustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cv=
es/2025/3xxx/CVE-2025-3416.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17465388652.EbEc7ce.17012--


--17465388655.87f9.17012
Date: Tue, 6 May 2025 13:41:05 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242633

            Bug ID: 1242633
           Summary: VUL-0: CVE-2025-3416: oo7: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/449197/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S
                    :U/C:N/I:N/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1242599
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A flaw was found in OpenSSL's handling of the properties argument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://bugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cve.org/CVERecord?id=3DCVE-2025-3416
https://access.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfackler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/87085bd67896b7f92e6de35d081=
f607a334beae4
https://github.com/sfackler/rust-openssl/pull/2390
https://rustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/3xxx/CVE-2025-=
3416.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17465388655.87f9.17012
Date: Tue, 6 May 2025 13:41:05 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242633

          Summary
          VUL-0: CVE-2025-3416: oo7: openssl: Use-After-Free in Md::fet=
ch and Cipher::fetch in rust-openssl crate

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/449197/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S:U/C:N/=
I:N/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1242599

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A flaw was found in OpenSSL's handling of the properties arg=
ument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-3416
https://ac=
cess.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfa=
ckler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/8=
7085bd67896b7f92e6de35d081f607a334beae4
https://gith=
ub.com/sfackler/rust-openssl/pull/2390
https://r=
ustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cv=
es/2025/3xxx/CVE-2025-3416.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17465388655.87f9.17012--


--17465388720.0fE14D5.17012
Date: Tue, 6 May 2025 13:41:12 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242642

            Bug ID: 1242642
           Summary: VUL-0: CVE-2025-3416: kanidm: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/449197/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S
                    :U/C:N/I:N/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: william.brown-at-suse.com
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1242599
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A flaw was found in OpenSSL's handling of the properties argument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://bugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cve.org/CVERecord?id=3DCVE-2025-3416
https://access.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfackler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/87085bd67896b7f92e6de35d081=
f607a334beae4
https://github.com/sfackler/rust-openssl/pull/2390
https://rustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/3xxx/CVE-2025-=
3416.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17465388720.0fE14D5.17012
Date: Tue, 6 May 2025 13:41:12 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242642

          Summary
          VUL-0: CVE-2025-3416: kanidm: openssl: Use-After-Free in Md::=
fetch and Cipher::fetch in rust-openssl crate

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/449197/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S:U/C:N/=
I:N/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          william.brown@suse.com

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1242599

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A flaw was found in OpenSSL's handling of the properties arg=
ument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-3416
https://ac=
cess.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfa=
ckler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/8=
7085bd67896b7f92e6de35d081f607a334beae4
https://gith=
ub.com/sfackler/rust-openssl/pull/2390
https://r=
ustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cv=
es/2025/3xxx/CVE-2025-3416.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17465388720.0fE14D5.17012--


--17465389446.1E4F92.17030
Date: Tue, 6 May 2025 13:42:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242678

            Bug ID: 1242678
           Summary: VUL-0: CVE-2025-3416: cosmic-store: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/449197/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S
                    :U/C:N/I:N/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1242599
  Target Milestone: ---
          Found By: ---
           Blocker: ---

A flaw was found in OpenSSL's handling of the properties argument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://bugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cve.org/CVERecord?id=3DCVE-2025-3416
https://access.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfackler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/87085bd67896b7f92e6de35d081=
f607a334beae4
https://github.com/sfackler/rust-openssl/pull/2390
https://rustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/3xxx/CVE-2025-=
3416.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17465389446.1E4F92.17030
Date: Tue, 6 May 2025 13:42:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242678

          Summary
          VUL-0: CVE-2025-3416: cosmic-store: openssl: Use-After-Free i=
n Md::fetch and Cipher::fetch in rust-openssl crate

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://smash.suse.de/issue/449197/

          OS
          Other

          Status
          NEW

          Whiteboard
          CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S:U/C:N/=
I:N/A:L)=20

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          rrahl0@opensuse.org

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          security-team@suse.de

          Blocks
          1242599

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

A flaw was found in OpenSSL's handling of the properties arg=
ument in certain
functions. This vulnerability can allow use-after-free exploitation, which =
may
result in undefined behavior or incorrect property parsing, leading to Open=
SSL
treating the input as an empty string.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-3416
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2357560
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-3416
https://ac=
cess.redhat.com/security/cve/CVE-2025-3416
https://github.com/sfa=
ckler/rust-openssl
https://github.com/sfackler/rust-openssl/commit/8=
7085bd67896b7f92e6de35d081f607a334beae4
https://gith=
ub.com/sfackler/rust-openssl/pull/2390
https://r=
ustsec.org/advisories/RUSTSEC-2025-0022.html
https://github.com/CVEProject/cvelistV5/blob/main//cv=
es/2025/3xxx/CVE-2025-3416.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17465389446.1E4F92.17030--


--17465390100.b4de1E.17048
Date: Tue, 6 May 2025 13:43:30 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242683
https://bugzilla.suse.com/show_bug.cgi?id=3D1242683#c1

            Bug ID: 1242683
           Summary: VUL-0: CVE-2025-3416: forgejo-cli: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://smash.suse.de/issue/449197/
                OS: Other
            Status: NEW
        Whiteboard: CVSSv3.1:SUSE:CVE-2025-3416:3.7:(AV:N/AC:H/PR:N/UI:N/S
                    :U/C:N/I:N/A:L)
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: rrahl0-at-opensuse.org
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: security-team-at-suse.de
            Blocks: 1242599
  Target Milestone: ---
          Found By: ---
           Blocker: ---

-


--17465474191.C644D9aD2.17650
Date: Tue, 6 May 2025 16:03:39 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1242701

            Bug ID: 1242701
           Summary: Linphone starts with "undefined symbol: OQS_KEM_hqc_192_encaps" error
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: bjoernv-at-arcor.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Linphone currently does not start. It shows the following error:

# linphone
linphone: symbol lookup error: /lib64/libpostquantumcryptoengine.so.1:
undefined symbol: OQS_KEM_hqc_192_encaps

Tumbleweed 20250503

The current package version:
# rpm -q libbzrtp0 liblinphone++10 liblinphone10 libmediastreamer2-11
libpostquantumcryptoengine1 linphone-cli linphone-desktop=20
libbzrtp0-5.3.105-1.2.x86_64
liblinphone++10-5.3.105-1.2.x86_64
liblinphone10-5.3.105-1.2.x86_64
libmediastreamer2-11-5.3.105-1.3.x86_64
libpostquantumcryptoengine1-5.3.101-1.1.x86_64
linphone-cli-5.3.105-1.2.x86_64
linphone-desktop-5.2.6-1.4.x86_64
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17465474191.C644D9aD2.17650
Date: Tue, 6 May 2025 16:03:39 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1242701

          Summary
          Linphone starts with "undefined symbol: OQS_KEM_hqc_192_=
encaps" error

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          bjoernv@arcor.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Linphone currently does not start. It shows the following er=
ror:

# linphone
linphone: symbol lookup error: /lib64/libpostquantumcryptoengine.so.1:
undefined symbol: OQS_KEM_hqc_192_encaps

Tumbleweed 20250503

The current package version:
# rpm -q libbzrtp0 liblinphone++10 liblinphone10 libmediastreamer2-11
libpostquantumcryptoengine1 linphone-cli linphone-desktop=20
libbzrtp0-5.3.105-1.2.x86_64
liblinphone++10-5.3.105-1.2.x86_64
liblinphone10-5.3.105-1.2.x86_64
libmediastreamer2-11-5.3.105-1.3.x86_64
libpostquantumcryptoengine1-5.3.101-1.1.x86_64
linphone-cli-5.3.105-1.2.x86_64
linphone-desktop-5.2.6-1.4.x86_64

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17465474191.C644D9aD2.17650--