body:
--17127621884.c7516EEc.8607
Date: Wed, 10 Apr 2024 15:16:28 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222637

            Bug ID: 1222637
           Summary: emacs package does not build with gcc14
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mjambor-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: werner-at-suse.com
            Blocks: 1220571
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Emacs package does not build with gcc 14, which treats as errors a
number of situations which were only warnings before (see bug 1220571
for more details).  The error is:

xsettings.c: In function 'apply_xft_settings':
xsettings.c:846:25: error: implicit declaration of function 'round'
[-Wimplicit-function-declaration]
  846 |       oldsettings.dpi =3D round(oldsettings.dpi);
      |                         ^~~~~
xsettings.c:67:1: note: include '<math.h>' or provide a declaration of 'rou=
nd'
   66 | #include <cairo/cairo-ft.h>
  +++ |+#include <math.h>
   67 | #endif

It seems that the problem comes from SUSE specific patch
emacs-25.1-custom-fonts.patch.  Adding #include <math.h> to it results in a
successfully finished build.

As of 10th April 2024, this can be conveniently tested locally with:
  osc build --alternative-project home:rguenther:nextgcc
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17127621884.c7516EEc.8607
Date: Wed, 10 Apr 2024 15:16:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222637

          Summary
          emacs package does not build with gcc14

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          mjambor@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          werner@suse.com

          Blocks
          1220571

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Emacs package does not build with gcc 14, which treats as er=
rors a
number of situations which were only warnings before (see bug 1220571
for more details).  The error is:

xsettings.c: In function 'apply_xft_settings':
xsettings.c:846:25: error: implicit declaration of function 'round'
[-Wimplicit-function-declaration]
  846 |       oldsettings.dpi =3D round(oldsettings.dpi);
      |                         ^~~~~
xsettings.c:67:1: note: include '<math.h>' or provide a declaration o=
f 'round'
   66 | #include <cairo/cairo-ft.h>
  +++ |+#include <math.h>
   67 | #endif

It seems that the problem comes from SUSE specific patch
emacs-25.1-custom-fonts.patch.  Adding #include <math.h> to it result=
s in a
successfully finished build.

As of 10th April 2024, this can be conveniently tested locally with:
  osc build --alternative-project home:rguenther:nextgcc

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17127621884.c7516EEc.8607--

summary: emacs package does not build with gcc14


--17128753134.eF1fdeC58.12204
Date: Thu, 11 Apr 2024 22:41:53 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222694

            Bug ID: 1222694
           Summary: Dolphin language package is not automatically installed as a dependency
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: opendreas-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The dolphin-part-lang package must be installed manually when installing Le=
ap
15.6 fresh.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17128753134.eF1fdeC58.12204
Date: Thu, 11 Apr 2024 22:41:53 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222694

          Summary
          Dolphin language package is not automatically installed as a =
dependency

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          x86-64

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KDE Applications

          Assignee
          opensuse-kde-bugs@opensuse.org

          Reporter
          opendreas@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The dolphin-part-lang package must be installed manually whe=
n installing Leap
15.6 fresh.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17128753134.eF1fdeC58.12204--


--17128839853.e2f1.12252
Date: Fri, 12 Apr 2024 01:06:25 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222696

            Bug ID: 1222696
           Summary: rke2 fails to start: "Failed to validate golang version: kubernetes golang build version not set"
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: botelho2305-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hi all,
I'm trying to install rke2 via the Tumbleweed repositories and get the
following error:

kube3:~ # rke2 server

WARN[0000] not running in CIS mode

INFO[0000] Applying Pod Security Admission Configuration

FATA[0000] Failed to validate golang version: kubernetes golang build versi=
on
not set - see 'golang: upstream version' in
https://github.com/kubernetes/kubernetes/blob/dev/build/dependencies.yaml

It appears as if upstream Kubernetes has changed something which is blocking
the running of Kubernetes unless the golang build version is set. The k3s
package from devel:kubic seems to have the same problem.

On a side note, would it be possible to include systemd service files with =
this
package? I would be willing to write some based on the upstream rke2 install
script if required.

Cheers
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17128839853.e2f1.12252
Date: Fri, 12 Apr 2024 01:06:25 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222696

          Summary
          rke2 fails to start: "Failed to validate golang version:=
 kubernetes golang build version not set"

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          botelho2305@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hi all,
I'm trying to install rke2 via the Tumbleweed repositories and get the
following error:

kube3:~ # rke2 server

WARN[0000] not running in CIS mode

INFO[0000] Applying Pod Security Admission Configuration

FATA[0000] Failed to validate golang version: kubernetes golang build versi=
on
not set - see 'golang: upstream version' in
https://github.com/kubernetes/kubernetes/blob/dev/build/dependen=
cies.yaml

It appears as if upstream Kubernetes has changed something which is blocking
the running of Kubernetes unless the golang build version is set. The k3s
package from devel:kubic seems to have the same problem.

On a side note, would it be possible to include systemd service files with =
this
package? I would be willing to write some based on the upstream rke2 install
script if required.

Cheers

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17128839853.e2f1.12252--


--17129064691.EB46.12567
Date: Fri, 12 Apr 2024 07:21:09 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222707

            Bug ID: 1222707
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 123.0.6312.122
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: Andreas.Stieger-at-gmx.de
          Reporter: thomas.leroy-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: m.szczepaniak.000-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The Stable channel has been updated to 123.0.6312.122/.123 for Windows
123.0.6312.122/.123/.124 for Mac and 123.0.6312.122 to Linux which will roll
out over the coming days/weeks. A full list of changes in this build is
available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 3 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

High CVE-2024-3157: Out of bounds write in Compositing. Reported by DarkNav=
y on
2024-03-26
High CVE-2024-3516: Heap buffer overflow in ANGLE. Reported by Bao (zx) Pham
and Toan (suto) Pham of Qrious Secure on 2024-03-09
High CVE-2024-3515: Use after free in Dawn. Reported by wgslfuzz on 2024-03=
-25

https://chromereleases.googleblog.com/2024/04/stable-channel-update-for-des=
ktop_10.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17129064691.EB46.12567
Date: Fri, 12 Apr 2024 07:21:09 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222707

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 123.0.6312.122

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          Andreas.Stieger@gmx.de

          Reporter
          thomas.leroy@suse.com

          QA Contact
          security-team@suse.de

          CC
          m.szczepaniak.000@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The Stable channel has been updated to 123.0.6312.122/.123 f=
or Windows
123.0.6312.122/.123/.124 for Mac and 123.0.6312.122 to Linux which will roll
out over the coming days/weeks. A full list of changes in this build is
available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 3 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

High CVE-2024-3157: Out of bounds write in Compositing. Reported by DarkNav=
y on
2024-03-26
High CVE-2024-3516: Heap buffer overflow in ANGLE. Reported by Bao (zx) Pham
and Toan (suto) Pham of Qrious Secure on 2024-03-09
High CVE-2024-3515: Use after free in Dawn. Reported by wgslfuzz on 2024-03=
-25

https://chromereleases.googleblog.com/2024/04/stab=
le-channel-update-for-desktop_10.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17129064691.EB46.12567--


--17129270812.b22E8.13419
Date: Fri, 12 Apr 2024 13:04:41 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222730

            Bug ID: 1222730
           Summary: VUL-0: CVE-2023-49528: ffmpeg-6: buffer overflow vulnerability in the dialogue enhance audio filter
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/401578/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a
local attacker to execute arbitrary code and cause a denial of service (DoS)
via the af_dialoguenhance.c:261:5 in the de_stereo component.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49528
https://www.cve.org/CVERecord?id=3DCVE-2023-49528
https://trac.ffmpeg.org/ticket/10691
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17129270812.b22E8.13419
Date: Fri, 12 Apr 2024 13:04:41 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222730

          Summary
          VUL-0: CVE-2023-49528: ffmpeg-6: buffer overflow vulnerabilit=
y in the dialogue enhance audio filter

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/401578/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          jengelh@inai.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Buffer Overflow vulnerability in FFmpeg version n6.1-3-g4667=
99d4f5, allows a
local attacker to execute arbitrary code and cause a denial of service (DoS)
via the af_dialoguenhance.c:261:5 in the de_stereo component.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49528
https://www.c=
ve.org/CVERecord?id=3DCVE-2023-49528
https://trac.ffmpeg.org/ti=
cket/10691

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17129270812.b22E8.13419--


--17132165920.5700Bcb.18396
Date: Mon, 15 Apr 2024 21:29:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222864

            Bug ID: 1222864
           Summary: VUL-0: CVE-2024-31497: putty: NIST P521 private keys are exposed by biased signature generation
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allow=
s an
attacker to recover a user's NIST P-521 secret key via a quick lattice-based
attack in approximately 60 signatures. This is especially important in a
scenario where an adversary is able to read messages signed by PuTTY or
Pageant. One scenario is that the adversary is an operator of an SSH server=
 to
which the victim authenticates (for remote login or file copy), even though
this server is not fully trusted by the victim, and the victim uses the same
private key for SSH connections to other services operated by other entitie=
s.
Here, the rogue server operator (who would otherwise have no way to determi=
ne
the victim's private key) can derive the victim's private key, and then use=
 it
for unauthorized access to those other services. Because SSH is sometimes u=
sed
to authenticate to Git services, it is possible that this vulnerability cou=
ld
be leveraged for supply-chain attacks on software maintained in Git. It is =
also
conceivable that signed messages from PuTTY or Pageant are readable by
adversaries more easily in other scenarios, but none have yet been disclose=
d.=20

https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.=
html
https://www.openwall.com/lists/oss-security/2024/04/15/6
https://git.tartarus.org/?p=3Dsimon/putty.git;a=3Dcommitdiff;h=3Dc193fe9848=
f50a88a4089aac647fecc31ae96d27
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17132165920.5700Bcb.18396
Date: Mon, 15 Apr 2024 21:29:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222864

          Summary
          VUL-0: CVE-2024-31497: putty: NIST P521 private keys are expo=
sed by biased signature generation

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          jengelh@inai.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce g=
eneration allows an
attacker to recover a user's NIST P-521 secret key via a quick lattice-based
attack in approximately 60 signatures. This is especially important in a
scenario where an adversary is able to read messages signed by PuTTY or
Pageant. One scenario is that the adversary is an operator of an SSH server=
 to
which the victim authenticates (for remote login or file copy), even though
this server is not fully trusted by the victim, and the victim uses the same
private key for SSH connections to other services operated by other entitie=
s.
Here, the rogue server operator (who would otherwise have no way to determi=
ne
the victim's private key) can derive the victim's private key, and then use=
 it
for unauthorized access to those other services. Because SSH is sometimes u=
sed
to authenticate to Git services, it is possible that this vulnerability cou=
ld
be leveraged for supply-chain attacks on software maintained in Git. It is =
also
conceivable that signed messages from PuTTY or Pageant are readable by
adversaries more easily in other scenarios, but none have yet been disclose=
d.=20

https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlis=
t/vuln-p521-bias.html
https:=
//www.openwall.com/lists/oss-security/2024/04/15/6
https://git.tartarus.org/?p=3D=
simon/putty.git;a=3Dcommitdiff;h=3Dc193fe9848f50a88a4089aac647fecc31ae96d27=

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17132165920.5700Bcb.18396--


--17133065311.2cE0FDebc.21533
Date: Tue, 16 Apr 2024 22:28:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222933

            Bug ID: 1222933
           Summary: python-gear fails to build on Leap 15.6 - ssl.SSLError: [SSL: EE_KEY_TOO_SMALL]
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Python
          Assignee: python-maintainers-at-suse.com
          Reporter: lubos.kocman-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hello

package python-gear fails to build on Leap 15.6

https://build.opensuse.org/package/live_build_log/openSUSE:Backports:SLE-15=
-SP6/python-gear/standard/x86_64
[  145s] 2024-04-15 10:21:37,509 gear.Connection.b'client'        DEBUG=20=
=20=20
Using SSL
[  145s] 2024-04-15 10:21:37,510 gear.Worker.b'worker'            ERROR=20=
=20=20
Exception while connecting to <gear.Connection 0x7fe38112fa20 host: 127.0.0=
.1
port: 35231>
[  145s] Traceback (most recent call last):
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__.py",
line 782, in _connectLoop
[  145s]     conn.reconnect()
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__.py",
line 252, in reconnect
[  145s]     self.connect()
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__.py",
line 211, in connect
[  145s]     context.load_cert_chain(self.ssl_cert, self.ssl_key)
[  145s] ssl.SSLError: [SSL: EE_KEY_TOO_SMALL] ee key too small (_ssl.c:350=
3)
[  145s] 2024-04-15 10:21:37,510 gear.Client.b'client'            ERROR=20=
=20=20
Exception while connecting to <gear.Connection 0x7fe38112f9e8 host: 127.0.0=
.1
port: 35231>
[  145s] Traceback (most recent call last):
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__.py",
line 782, in _connectLoop
[  145s]     conn.reconnect()
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__i

Could you please have a look?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17133065311.2cE0FDebc.21533
Date: Tue, 16 Apr 2024 22:28:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222933

          Summary
          python-gear fails to build on Leap 15.6 - ssl.SSLError: [SSL:=
 EE_KEY_TOO_SMALL]

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Python

          Assignee
          python-maintainers@suse.com

          Reporter
          lubos.kocman@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hello

package python-gear fails to build on Leap 15.6

https://build.opensuse.org/pac=
kage/live_build_log/openSUSE:Backports:SLE-15-SP6/python-gear/standard/x86_=
64
[  145s] 2024-04-15 10:21:37,509 gear.Connection.b'client'        DEBUG=20=
=20=20
Using SSL
[  145s] 2024-04-15 10:21:37,510 gear.Worker.b'worker'            ERROR=20=
=20=20
Exception while connecting to <gear.Connection 0x7fe38112fa20 host: 127.=
0.0.1
port: 35231>
[  145s] Traceback (most recent call last):
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__=
.py",
line 782, in _connectLoop
[  145s]     conn.reconnect()
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__=
.py",
line 252, in reconnect
[  145s]     self.connect()
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__=
.py",
line 211, in connect
[  145s]     context.load_cert_chain(self.ssl_cert, self.ssl_key)
[  145s] ssl.SSLError: [SSL: EE_KEY_TOO_SMALL] ee key too small (_ssl.c:350=
3)
[  145s] 2024-04-15 10:21:37,510 gear.Client.b'client'            ERROR=20=
=20=20
Exception while connecting to <gear.Connection 0x7fe38112f9e8 host: 127.=
0.0.1
port: 35231>
[  145s] Traceback (most recent call last):
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__init__=
.py",
line 782, in _connectLoop
[  145s]     conn.reconnect()
[  145s]   File "/home/abuild/rpmbuild/BUILD/gear-0.14.0/gear/__i

Could you please have a look?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17133065311.2cE0FDebc.21533--


body:
--17133652981.64b647CDA.23381
Date: Wed, 17 Apr 2024 14:48:18 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1222978

            Bug ID: 1222978
           Summary: [SELinux] gnome-control-center (users) unable to set AutoLogin
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: rbrown-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

GNOME Control Center has the ability to set autologin, as button in a users
account,  requiring Polkit escalation in order to be able to set it

Polkit is doing it's thing fine..but SELinux blocks it :)

Audit.log output below

type=3DUSER_ACCT msg=3Daudit(1713364967.267:211): pid=3D23024 uid=3D1000 au=
id=3D1000
ses=3D3 subj=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
msg=3D'op=3DPAM:accounting grantors=3Dpam_unix acct=3D"ilmehtar"
exe=3D"/usr/libexec/polkit-1/polkit-agent-helper-1" hostname=3D? addr=3D? t=
erminal=3D?
res=3Dsuccess'
type=3DAVC msg=3Daudit(1713364970.590:212): avc:  denied  { write } for  pi=
d=3D1269
comm=3D"accounts-daemon" name=3D"sysconfig" dev=3D"overlay" ino=3D283
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Ddir permissive=3D1
type=3DAVC msg=3Daudit(1713364970.590:213): avc:  denied  { add_name } for=
=20
pid=3D1269 comm=3D"accounts-daemon" name=3D"displaymanager.new.1025417169"
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Ddir permissive=3D1
type=3DAVC msg=3Daudit(1713364970.590:214): avc:  denied  { create } for  p=
id=3D1269
comm=3D"accounts-daemon" name=3D"displaymanager.new.1025417169"
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Dfile permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:215): avc:  denied  { write } for  pi=
d=3D1269
comm=3D"accounts-daemon" path=3D"/etc/sysconfig/displaymanager.new.10254171=
69"
dev=3D"overlay" ino=3D1179107 scontext=3Dsystem_u:system_r:accountsd_t:s0
tcontext=3Dsystem_u:object_r:etc_t:s0 tclass=3Dfile permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:216): avc:  denied  { remove_name } f=
or=20
pid=3D1269 comm=3D"accounts-daemon" name=3D"displaymanager.new.1025417169"
dev=3D"overlay" ino=3D1179107 scontext=3Dsystem_u:system_r:accountsd_t:s0
tcontext=3Dsystem_u:object_r:etc_t:s0 tclass=3Ddir permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:217): avc:  denied  { rename } for  p=
id=3D1269
comm=3D"accounts-daemon" name=3D"displaymanager.new.1025417169" dev=3D"over=
lay"
ino=3D1179107 scontext=3Dsystem_u:system_r:accountsd_t:s0
tcontext=3Dsystem_u:object_r:etc_t:s0 tclass=3Dfile permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:218): avc:  denied  { unlink } for  p=
id=3D1269
comm=3D"accounts-daemon" name=3D"displaymanager" dev=3D"overlay" ino=3D31627
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Dfile permissive=3D1

Not the most severe issue in the world (I personally dislike the feature)..=
but
I have users who are super passionate about it, so at least I can now say t=
he
issue is filed in the right place :)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17133652981.64b647CDA.23381
Date: Wed, 17 Apr 2024 14:48:18 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1222978

          Summary
          [SELinux] gnome-control-center (users) unable to set AutoLogin

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          rbrown@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

GNOME Control Center has the ability to set autologin, as bu=
tton in a users
account,  requiring Polkit escalation in order to be able to set it

Polkit is doing it's thing fine..but SELinux blocks it :)

Audit.log output below

type=3DUSER_ACCT msg=3Daudit(1713364967.267:211): pid=3D23024 uid=3D1000 au=
id=3D1000
ses=3D3 subj=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
msg=3D'op=3DPAM:accounting grantors=3Dpam_unix acct=3D"ilmehtar"
exe=3D"/usr/libexec/polkit-1/polkit-agent-helper-1" hostname=3D? =
addr=3D? terminal=3D?
res=3Dsuccess'
type=3DAVC msg=3Daudit(1713364970.590:212): avc:  denied  { write } for  pi=
d=3D1269
comm=3D"accounts-daemon" name=3D"sysconfig" dev=3D&quot=
;overlay" ino=3D283
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Ddir permissive=3D1
type=3DAVC msg=3Daudit(1713364970.590:213): avc:  denied  { add_name } for=
=20
pid=3D1269 comm=3D"accounts-daemon" name=3D"displaymanager.n=
ew.1025417169"
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Ddir permissive=3D1
type=3DAVC msg=3Daudit(1713364970.590:214): avc:  denied  { create } for  p=
id=3D1269
comm=3D"accounts-daemon" name=3D"displaymanager.new.10254171=
69"
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Dfile permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:215): avc:  denied  { write } for  pi=
d=3D1269
comm=3D"accounts-daemon" path=3D"/etc/sysconfig/displaymanag=
er.new.1025417169"
dev=3D"overlay" ino=3D1179107 scontext=3Dsystem_u:system_r:accoun=
tsd_t:s0
tcontext=3Dsystem_u:object_r:etc_t:s0 tclass=3Dfile permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:216): avc:  denied  { remove_name } f=
or=20
pid=3D1269 comm=3D"accounts-daemon" name=3D"displaymanager.n=
ew.1025417169"
dev=3D"overlay" ino=3D1179107 scontext=3Dsystem_u:system_r:accoun=
tsd_t:s0
tcontext=3Dsystem_u:object_r:etc_t:s0 tclass=3Ddir permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:217): avc:  denied  { rename } for  p=
id=3D1269
comm=3D"accounts-daemon" name=3D"displaymanager.new.10254171=
69" dev=3D"overlay"
ino=3D1179107 scontext=3Dsystem_u:system_r:accountsd_t:s0
tcontext=3Dsystem_u:object_r:etc_t:s0 tclass=3Dfile permissive=3D1
type=3DAVC msg=3Daudit(1713364970.593:218): avc:  denied  { unlink } for  p=
id=3D1269
comm=3D"accounts-daemon" name=3D"displaymanager" dev=3D=
"overlay" ino=3D31627
scontext=3Dsystem_u:system_r:accountsd_t:s0 tcontext=3Dsystem_u:object_r:et=
c_t:s0
tclass=3Dfile permissive=3D1

Not the most severe issue in the world (I personally dislike the feature)..=
but
I have users who are super passionate about it, so at least I can now say t=
he
issue is filed in the right place :)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17133652981.64b647CDA.23381--

pkgs: accountsservice gdm


--17135192714.BbF8eC.28653
Date: Fri, 19 Apr 2024 09:34:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223125

            Bug ID: 1223125
           Summary: [Build 665.1] wallpapaer is not a openSUSE default ones
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4092941/modules/open
                    suse_welcome/steps/5
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: mlin-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

After wallpapaer format has been changed to png from jpg, along with that
plasma5-openSUSE has adjusted also with
https://build.opensuse.org/request/show/1168418 , but the default wallpapaer
looks like has a upstream one appeared, not the default opensuse one.

note that, this is issue does not happen on xfce and gnome.

openQA test in scenario opensuse-15.6-DVD-x86_64-install_only@64bit-multipa=
th
fails in
[opensuse_welcome](https://openqa.opensuse.org/tests/4092941/modules/opensu=
se_welcome/steps/5)

## Test suite description
set HDDSIZE=3D40 as required for ppc64le (failed w/o it on
https://openqa.opensuse.org/tests/390330#step/install_and_reboot/21

## Reproducible

Fails since (at least) Build [665.1](https://openqa.opensuse.org/tests/4092=
941)
(current job)

## Expected result

Last good: [656.1](https://openqa.opensuse.org/tests/4067117) (or more rece=
nt)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit-multipath&test=3Dinstall_only&version=
=3D15.6)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17135192714.BbF8eC.28653
Date: Fri, 19 Apr 2024 09:34:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223125

          Summary
          [Build 665.1] wallpapaer is not a openSUSE default ones

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4092941/modules/opensuse_we=
lcome/steps/5

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KDE Workspace (Plasma)

          Assignee
          opensuse-kde-bugs@opensuse.org

          Reporter
          mlin@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

After wallpapaer format has been changed to png from jpg, along with that
plasma5-openSUSE has adjusted also with
https://build.o=
pensuse.org/request/show/1168418 , but the default wallpapaer
looks like has a upstream one appeared, not the default opensuse one.

note that, this is issue does not happen on xfce and gnome.

openQA test in scenario opensuse-15.6-DVD-x86_64-install_only@64bit-mul=
tipath
fails in
[opensuse_welcome](https://openqa.opensuse.org/tests/4092941/mo=
dules/opensuse_welcome/steps/5)

## Test suite description
set HDDSIZE=3D40 as required for ppc64le (failed w/o it on
https://openqa.opensuse.org/tests/390330#step/install_and_reboot/21

## Reproducible

Fails since (at least) Build [665.1](https://openqa.opensuse.org/tests/4092941)
(current job)

## Expected result

Last good: [656.1](ht=
tps://openqa.opensuse.org/tests/4067117) (or more recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/lat=
est?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D64bi=
t-multipath&test=3Dinstall_only&version=3D15.6)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17135192714.BbF8eC.28653--


body:
--17135201566.62c9c329f.28731
Date: Fri, 19 Apr 2024 09:49:16 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223128

            Bug ID: 1223128
           Summary: [TRACK] Update Python312 to to 3.12.3
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Python
          Assignee: python-maintainers-at-suse.com
          Reporter: ana.guerrero-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hi,

The update of python312 to 3.12.3 (SR#1168659 for now), it's stuck for a few
python modules failing to build: python-exceptiongroup:test, python-gevent =
and
python-Sphinx:test

* python-exceptiongroup:test

[    9s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D FAILURES
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[    9s] _______________ DeepRecursionInSplitAndSubgroup.test_deep_split
________________
[    9s] tests/test_exceptions.py:375: in test_deep_split
[    9s]     with self.assertRaises(RecursionError):
[    9s] E   AssertionError: RecursionError not raised
[    9s] ______________ DeepRecursionInSplitAndSubgroup.test_deep_subgroup
______________
[    9s] tests/test_exceptions.py:380: in test_deep_subgroup
[    9s]     with self.assertRaises(RecursionError):
[    9s] E   AssertionError: RecursionError not raised
[    9s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D short test summary info
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
[    9s] SKIPPED [1] tests/test_apport_monkeypatching.py:39: need Ubuntu wi=
th
python3-apport installed
[    9s] SKIPPED [2] tests/test_formatting.py:221: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [2] tests/test_formatting.py:341: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [2] tests/test_formatting.py:368: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:417: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:462: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:486: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:511: No patching is done on
Python >=3D 3.11
[    9s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 2 failed=
, 86 passed, 11 skipped in 0.20s
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[    9s] error: Bad exit status from /var/tmp/rpm-tmp.5kiGVX (%check)

* python-gevent

[  303s] 2/69 tests failed in 01:19
[  303s]=20
[  303s] 1/69 expected failures
[  303s]  - GEVENTTEST_USE_RESOURCES=3D-network /usr/bin/python3.12 -u -W i=
gnore
-m gevent.testing.monkey_test test_threading.py
[  303s]=20
[  303s] 1/69 unexpected failures
[  303s]  - GEVENTTEST_USE_RESOURCES=3D-network /usr/bin/python3.12 -u -W i=
gnore
-m gevent.testing.monkey_test test_subprocess.py
[  303s]=20
[  303s] Ran 4087 tests (skipped=3D918) in 69 files in 01:19
[  303s] error: Bad exit status from /var/tmp/rpm-tmp.XI82JU (%check)
[  303s]=20
[  303s] RPM build errors:
[  303s]     Bad exit status from /var/tmp/rpm-tmp.XI82JU (%check)

* python-Sphinx:test

[  415s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D short test summary info
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
[  415s] FAILED tests/test_ext_autodoc.py::test_enum_class - AssertionError:
assert ['...
[  415s] =3D 1 failed, 2005 passed, 11 skipped, 45 deselected, 6 warnings in
172.52s (0:02:52) =3D
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17135201566.62c9c329f.28731
Date: Fri, 19 Apr 2024 09:49:16 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223128

          Summary
          [TRACK] Update Python312 to to 3.12.3

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Python

          Assignee
          python-maintainers@suse.com

          Reporter
          ana.guerrero@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hi,

The update of python312 to 3.12.3 (SR#1168659 for now), it's stuck for a few
python modules failing to build: python-exceptiongroup:test, python-gevent =
and
python-Sphinx:test

* python-exceptiongroup:test

[    9s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D FAILURES
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[    9s] _______________ DeepRecursionInSplitAndSubgroup.test_deep_split
________________
[    9s] tests/test_exceptions.py:375: in test_deep_split
[    9s]     with self.assertRaises(RecursionError):
[    9s] E   AssertionError: RecursionError not raised
[    9s] ______________ DeepRecursionInSplitAndSubgroup.test_deep_subgroup
______________
[    9s] tests/test_exceptions.py:380: in test_deep_subgroup
[    9s]     with self.assertRaises(RecursionError):
[    9s] E   AssertionError: RecursionError not raised
[    9s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D short test summary info
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
[    9s] SKIPPED [1] tests/test_apport_monkeypatching.py:39: need Ubuntu wi=
th
python3-apport installed
[    9s] SKIPPED [2] tests/test_formatting.py:221: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [2] tests/test_formatting.py:341: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [2] tests/test_formatting.py:368: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:417: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:462: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:486: No patching is done on
Python >=3D 3.11
[    9s] SKIPPED [1] tests/test_formatting.py:511: No patching is done on
Python >=3D 3.11
[    9s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 2 failed=
, 86 passed, 11 skipped in 0.20s
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
[    9s] error: Bad exit status from /var/tmp/rpm-tmp.5kiGVX (%check)

* python-gevent

[  303s] 2/69 tests failed in 01:19
[  303s]=20
[  303s] 1/69 expected failures
[  303s]  - GEVENTTEST_USE_RESOURCES=3D-network /usr/bin/python3.12 -u -W i=
gnore
-m gevent.testing.monkey_test test_threading.py
[  303s]=20
[  303s] 1/69 unexpected failures
[  303s]  - GEVENTTEST_USE_RESOURCES=3D-network /usr/bin/python3.12 -u -W i=
gnore
-m gevent.testing.monkey_test test_subprocess.py
[  303s]=20
[  303s] Ran 4087 tests (skipped=3D918) in 69 files in 01:19
[  303s] error: Bad exit status from /var/tmp/rpm-tmp.XI82JU (%check)
[  303s]=20
[  303s] RPM build errors:
[  303s]     Bad exit status from /var/tmp/rpm-tmp.XI82JU (%check)

* python-Sphinx:test

[  415s] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D short test summary info
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
[  415s] FAILED tests/test_ext_autodoc.py::test_enum_class - AssertionError:
assert ['...
[  415s] =3D 1 failed, 2005 passed, 11 skipped, 45 deselected, 6 warnings in
172.52s (0:02:52) =3D

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17135201566.62c9c329f.28731--

summary: [TRACK] Update Python312 to to 3.12.3


body:
--17135338120.9f00C.29556
Date: Fri, 19 Apr 2024 13:36:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223149

            Bug ID: 1223149
           Summary: Plasma uses wrong window decoration
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/4094466/modules/open
                    suse_welcome/steps/3
                OS: Other
            Status: CONFIRMED
          Severity: Critical
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes
             Flags: SHIP_STOPPER+

For some reason, kwin uses the aurorae window deco instead of breeze, even
though that is the builtin default.

## Observation

openQA test in scenario opensuse-15.6-DVD-aarch64-create_hdd_kde@aarch64 fa=
ils
in
[opensuse_welcome](https://openqa.opensuse.org/tests/4094466/modules/opensu=
se_welcome/steps/3)

## Test suite description

## Reproducible

Fails since (at least) Build [665.1](https://openqa.opensuse.org/tests/4092=
929)

## Expected result

Last good: [656.1](https://openqa.opensuse.org/tests/4067063) (or more rece=
nt)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Daarch64&distri=3Do=
pensuse&flavor=3DDVD&machine=3Daarch64&test=3Dcreate_hdd_kde&version=3D15.6)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17135338120.9f00C.29556
Date: Fri, 19 Apr 2024 13:36:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223149

          Summary
          Plasma uses wrong window decoration

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/4094466/modules/opensuse_we=
lcome/steps/3

          OS
          Other

          Status
          CONFIRMED

          Severity
          Critical

          Priority
          P5 - None

          Component
          KDE Workspace (Plasma)

          Assignee
          opensuse-kde-bugs@opensuse.org

          Reporter
          fvogt@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

          Flags
          SHIP_STOPPER+

For some reason, kwin uses the aurorae window deco instead o=
f breeze, even
though that is the builtin default.

## Observation

openQA test in scenario opensuse-15.6-DVD-aarch64-create_hdd_kde@aarch6=
4 fails
in
[opensuse_welcome](https://openqa.opensuse.org/tests/4094466/mo=
dules/opensuse_welcome/steps/3)

## Test suite description

## Reproducible

Fails since (at least) Build [665.1](https://openqa.opensuse.org/tests/4092929)

## Expected result

Last good: [656.1](ht=
tps://openqa.opensuse.org/tests/4067063) (or more recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?a=
rch=3Daarch64&distri=3Dopensuse&flavor=3DDVD&machine=3Daarch64&=
amp;test=3Dcreate_hdd_kde&version=3D15.6)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17135338120.9f00C.29556--

summary: Plasma uses wrong window decoration


--17137666190.FF64.31696
Date: Mon, 22 Apr 2024 06:16:59 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223181

            Bug ID: 1223181
           Summary: python_socks does not require async_timeout, but it should
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Python
          Assignee: python-maintainers-at-suse.com
          Reporter: jslaby-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

If you try to import Proxy (as per python_socks docs):
>>> from python_socks.async_.asyncio.v2 import Proxy=20
Traceback (most recent call last):=20
 File "<stdin>", line 1, in <module>=20
 File
"/usr/lib/python3.11/site-packages/python_socks/async_/asyncio/__init__.py",
line 1, in <module>=20
   from ._proxy import AsyncioProxy as Proxy=20
 File
"/usr/lib/python3.11/site-packages/python_socks/async_/asyncio/_proxy.py", =
line
5, in <module>=20
   import async_timeout=20
ModuleNotFoundError: No module named 'async_timeout'

I.e. python_socks should Require async_timeout.

I do not speak snakes, so I am not sure what needs to be done (Require:-ed),
actually.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17137666190.FF64.31696
Date: Mon, 22 Apr 2024 06:16:59 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223181

          Summary
          python_socks does not require async_timeout, but it should

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Python

          Assignee
          python-maintainers@suse.com

          Reporter
          jslaby@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

If you try to import Proxy (as per python_socks docs):
>>> from python_socks.async_.asyncio.v2 impo=
rt Proxy
Traceback (most recent call last):=20
 File "<stdin>", line 1, in <module>=20
 File
"/usr/lib/python3.11/site-packages/python_socks/async_/asyncio/__init_=
_.py",
line 1, in <module>=20
   from ._proxy import AsyncioProxy as Proxy=20
 File
"/usr/lib/python3.11/site-packages/python_socks/async_/asyncio/_proxy.=
py", line
5, in <module>=20
   import async_timeout=20
ModuleNotFoundError: No module named 'async_timeout'

I.e. python_socks should Require async_timeout.

I do not speak snakes, so I am not sure what needs to be done (Require:-ed),
actually.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17137666190.FF64.31696--


--17137849987.6CfFddA.32395
Date: Mon, 22 Apr 2024 11:23:18 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223215

            Bug ID: 1223215
           Summary: VUL-0: CVE-2023-49501: ffmpeg: buffer overflow via the config_eq_output function in libavfilter/asrc_afirsrc.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/402757/
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Other
          Assignee: jengelh-at-inai.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local
attacker to execute arbitrary code via the config_eq_output function in the
libavfilter/asrc_afirsrc.c:495:30 component.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49501
https://www.cve.org/CVERecord?id=3DCVE-2023-49501
https://github.com/FFmpeg/FFmpeg
https://trac.ffmpeg.org/ticket/10686
https://trac.ffmpeg.org/ticket/10686#no1
https://bugzilla.redhat.com/show_bug.cgi?id=3D2276114
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17137849987.6CfFddA.32395
Date: Mon, 22 Apr 2024 11:23:18 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223215

          Summary
          VUL-0: CVE-2023-49501: ffmpeg: buffer overflow via the config=
_eq_output function in libavfilter/asrc_afirsrc.c

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/402757/

          OS
          Other

          Status
          NEW

          Severity
          Critical

          Priority
          P5 - None

          Component
          Other

          Assignee
          jengelh@inai.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5=
 allows a local
attacker to execute arbitrary code via the config_eq_output function in the
libavfilter/asrc_afirsrc.c:495:30 component.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49501
https://www.c=
ve.org/CVERecord?id=3DCVE-2023-49501
https://github.com/FFmpeg/FFmp=
eg
https://trac.ffmpeg.org/ti=
cket/10686
https://trac.ffmpeg.or=
g/ticket/10686#no1
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2276114

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17137849987.6CfFddA.32395--


--17138802740.b415.2458
Date: Tue, 23 Apr 2024 13:51:14 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223309

            Bug ID: 1223309
           Summary: VUL-0: hugo: XSS injection from Markdown content files (release 0.123.0)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: jkowalczyk-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

v0.125.3

This release fixes a security issue reported by @ejona86 (see #12411) that
could allow XSS injection from Markdown content files if one of the internal
link or image render hook templates added in Hugo 0.123.0 are enabled. You
typically control and trust the content files, but according to Hugo's secu=
rity
model, we state that "template and configuration authors (you) are trusted,=
 but
the data you send in is not."

 markup/goldmark: Fix data race in the hugocontext wrapper 509ab08 @bep
 tpl: Escape .Title in built-in image and link render hooks 15a4b9b @bep
 tpl/tplimpl: Improve embedded templates 10a8448 @jmooring #12396
 SECURITY.md: Update link to security model 722c486 @ejona86
 modules: Fix potential infinite loop in module collection f40f50e @bep #12=
407

References:
https://github.com/gohugoio/hugo/releases/tag/v0.125.3
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17138802740.b415.2458
Date: Tue, 23 Apr 2024 13:51:14 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223309

          Summary
          VUL-0: hugo: XSS injection from Markdown content files (relea=
se 0.123.0)

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          jkowalczyk@suse.com

          Reporter
          abergmann@suse.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

v0.125.3

This release fixes a security issue reported by @ejona86 (see #12411) t=
hat
could allow XSS injection from Markdown content files if one of the internal
link or image render hook templates added in Hugo 0.123.0 are enabled. You
typically control and trust the content files, but according to Hugo's secu=
rity
model, we state that "template and configuration authors (you) are tru=
sted, but
the data you send in is not."

 markup/goldmark: Fix data race in the hugocontext wrapper 509ab08 @bep
 tpl: Escape .Title in built-in image and link render hooks 15a4b9b @bep
 tpl/tplimpl: Improve embedded templates 10a8448 @jmooring #12396
 SECURITY.md: Update link to security model 722c486 @ejona86
 modules: Fix potential infinite loop in module collection f40f50e @bep=
 #12407

References:
https://=
github.com/gohugoio/hugo/releases/tag/v0.125.3

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17138802740.b415.2458--


--17138897411.bC8219d.2838
Date: Tue, 23 Apr 2024 16:29:01 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223319

            Bug ID: 1223319
           Summary: VUL-0: CVE-2024-31208: matrix-synapse: weakness in auth chain indexing allows DoS
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: mrueckert-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Weakness in auth chain indexing allows DoS from remote room members through
disk fill and high CPU usage

Description
Impact

A remote Matrix user with malicious intent, sharing a room with Synapse
instances before 1.105.1, can dispatch specially crafted events to exploit a
weakness in how the auth chain cover index is calculated. This can induce h=
igh
CPU consumption and accumulate excessive data in the database of such
instances, resulting in a denial of service.

Servers in private federations, or those that do not federate, are not
affected.
Patches

Server administrators should upgrade to 1.105.1 or later.
Workarounds

One can:

    ban the malicious users or ACL block servers from the rooms; and/or
    leave the room and purge the room using the admin API

For more information

If you have any questions or comments about this advisory, please email us =
at
security AT element.io.

References:
https://github.com/element-hq/synapse/security/advisories/GHSA-3h7q-rfh9-xm=
4v
https://github.com/element-hq/synapse/releases/tag/v1.105.1
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17138897411.bC8219d.2838
Date: Tue, 23 Apr 2024 16:29:01 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223319

          Summary
          VUL-0: CVE-2024-31208: matrix-synapse: weakness in auth chain=
 indexing allows DoS

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          mrueckert@suse.com

          Reporter
          abergmann@suse.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Weakness in auth chain indexing allows DoS from remote room =
members through
disk fill and high CPU usage

Description
Impact

A remote Matrix user with malicious intent, sharing a room with Synapse
instances before 1.105.1, can dispatch specially crafted events to exploit a
weakness in how the auth chain cover index is calculated. This can induce h=
igh
CPU consumption and accumulate excessive data in the database of such
instances, resulting in a denial of service.

Servers in private federations, or those that do not federate, are not
affected.
Patches

Server administrators should upgrade to 1.105.1 or later.
Workarounds

One can:

    ban the malicious users or ACL block servers from the rooms; and/or
    leave the room and purge the room using the admin API

For more information

If you have any questions or comments about this advisory, please email us =
at
security AT element.io.

References:
https://github.com/element-hq/synapse/security/advisories/GH=
SA-3h7q-rfh9-xm4v
htt=
ps://github.com/element-hq/synapse/releases/tag/v1.105.1

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17138897411.bC8219d.2838--


--17138970800.1C56C.2973
Date: Tue, 23 Apr 2024 18:31:20 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223324

            Bug ID: 1223324
           Summary: VUL-0: CVE-2024-28130: dcmtk: incorrect type conversion in the DVPSSoftcopyVOI_PList:createFromImage functionality of OFFIS DCMTK
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/402934/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: KDE Applications
          Assignee: christophe-at-krop.fr
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

An incorrect type conversion vulnerability exists in the
DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A
specially crafted malformed file can lead to arbitrary code execution. An
attacker can provide a malicious file to trigger this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-28130
https://www.cve.org/CVERecord?id=3DCVE-2024-28130
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1957
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17138970800.1C56C.2973
Date: Tue, 23 Apr 2024 18:31:20 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223324

          Summary
          VUL-0: CVE-2024-28130: dcmtk: incorrect type conversion in th=
e DVPSSoftcopyVOI_PList:createFromImage functionality of OFFIS DCMTK

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/402934/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          KDE Applications

          Assignee
          christophe@krop.fr

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

An incorrect type conversion vulnerability exists in the
DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A
specially crafted malformed file can lead to arbitrary code execution. An
attacker can provide a malicious file to trigger this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-28130
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-28130
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1957

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17138970800.1C56C.2973--


--17139760220.fCB4F43.4595
Date: Wed, 24 Apr 2024 16:27:02 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223366

            Bug ID: 1223366
           Summary: network:im:signal/signal-desktop: Segmentation fault with 7.5.1-1.2 and 7.5.1-1.3
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: brunopitrus-at-hotmail.com
          Reporter: john-susecom-at-pelago.org.uk
        QA Contact: screening-team-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Signal Desktop is segmentation faulting for me, since version 7.5.1-1.2. Lo=
g:

Set Windows Application User Model ID (AUMID) { AUMID:
'org.whispersystems.signal-desktop' }
NODE_ENV production
NODE_CONFIG_DIR /usr/libexec/signal-desktop/config
NODE_CONFIG {}
ALLOW_CONFIG_MUTATIONS undefined
HOSTNAME hp450g4
NODE_APP_INSTANCE undefined
SUPPRESS_NO_CONFIG_WARNING undefined
SIGNAL_ENABLE_HTTP undefined
userData: /home/john/.config/Signal
config/get: Successfully read user config file
config/get: Successfully read ephemeral config file
getLogger: Logger not yet initialized!
crashReporter: enabled
making app single instance
{"level":30,"time":"2024-04-24T16:17:06.386Z","msg":"crashReporter: enabled=
"}
{"level":30,"time":"2024-04-24T16:17:06.395Z","msg":"got fast localeOverride
setting null"}
{"level":30,"time":"2024-04-24T16:17:06.395Z","msg":"app.ready: hour cycle
preference: UnknownPreference"}
{"level":30,"time":"2024-04-24T16:17:06.395Z","msg":"app.ready: preferred
system locales: en-GB, en"}
{"level":30,"time":"2024-04-24T16:17:06.396Z","msg":"locale: Supported loca=
les:
af-ZA, ar, az-AZ, bg-BG, bn-BD, bs-BA, ca, cs, da, de, el, en, es, et-EE, e=
u,
fa-IR, fi, fr, ga-IE, gl-ES, gu-IN, he, hi-IN, hr-HR, hu, id, it, ja, ka-GE,
kk-KZ, km-KH, kn-IN, ko, ky-KG, lt-LT, lv-LV, mk-MK, ml-IN, mr-IN, ms, my, =
nb,
nl, pa-IN, pl, pt-BR, pt-PT, ro-RO, ru, sk-SK, sl-SI, sq-AL, sr, sv, sw, ta=
-IN,
te-IN, th, tl-PH, tr, ug, uk-UA, ur, vi, yue, zh-CN, zh-HK, zh-Hant"}
{"level":30,"time":"2024-04-24T16:17:06.396Z","msg":"locale: Preferred loca=
les:
en-GB, en"}
{"level":30,"time":"2024-04-24T16:17:06.400Z","msg":"locale: Locale Overrid=
e:
null"}
{"level":30,"time":"2024-04-24T16:17:06.404Z","msg":"locale: Matched locale:
en"}
{"level":40,"time":"2024-04-24T16:17:06.485Z","msg":"intl.onWarn
[@formatjs/intl] \"defaultRichTextElements\" was specified but \"message\" =
was
not pre-compiled. \nPlease consider using \"@formatjs/cli\" to pre-compile =
your
messages for performance.\nFor more details see
https://formatjs.io/docs/getting-started/message-distribution"}
{"level":30,"time":"2024-04-24T16:17:06.486Z","msg":"locale: Text info
direction for en: ltr"}
{"level":30,"time":"2024-04-24T16:17:06.486Z","msg":"getSystemTraySetting g=
ot
value MinimizeToAndStartInSystemTray"}
{"level":30,"time":"2024-04-24T16:17:06.486Z","msg":"getSystemTraySetting
returning MinimizeToAndStartInSystemTray"}
{"level":30,"time":"2024-04-24T16:17:06.488Z","msg":"app ready"}
{"level":30,"time":"2024-04-24T16:17:06.488Z","msg":"starting version 7.5.1=
"}
{"level":30,"time":"2024-04-24T16:17:06.488Z","msg":"media access status
[object Undefined] [object Undefined]"}
{"level":30,"time":"2024-04-24T16:17:06.491Z","msg":"got fast theme-setting
value dark"}
{"level":30,"time":"2024-04-24T16:17:06.493Z","msg":"got fast theme-setting
value dark"}
{"level":30,"time":"2024-04-24T16:17:06.493Z","msg":"got fast spellcheck
setting true"}
{"level":30,"time":"2024-04-24T16:17:06.494Z","msg":"Initializing BrowserWi=
ndow
config:
{\"show\":false,\"width\":683,\"height\":696,\"minWidth\":300,\"minHeight\"=
:200,\"autoHideMenuBar\":false,\"titleBarStyle\":\"default\",\"backgroundCo=
lor\":\"#121212\",\"webPreferences\":{\"devTools\":false,\"spellcheck\":tru=
e,\"enableBlinkFeatures\":\"CSSPseudoDir,CSSLogical\",\"enablePreferredSize=
Mode\":true,\"nodeIntegration\":false,\"nodeIntegrationInWorker\":false,\"s=
andbox\":false,\"contextIsolation\":true,\"preload\":\"[REDACTED]/preload.b=
undle.js\",\"backgroundThrottling\":true,\"disableBlinkFeatures\":\"Acceler=
ated2dCanvas,AcceleratedSmallCanvases\"},\"icon\":\"[REDACTED]/images/signa=
l-logo-desktop-linux.png\",\"x\":3,\"y\":28}"}
{"level":30,"time":"2024-04-24T16:17:06.594Z","msg":"spellcheck: user local=
es:
[\"en-GB\",\"en\"]"}
{"level":30,"time":"2024-04-24T16:17:06.594Z","msg":"spellcheck: available
spellchecker languages:
[\"af\",\"bg\",\"ca\",\"cs\",\"cy\",\"da\",\"de\",\"de-DE\",\"el\",\"en\",\=
"en-AU\",\"en-CA\",\"en-GB\",\"en-GB-oxendict\",\"en-US\",\"es\",\"es-419\"=
,\"es-AR\",\"es-ES\",\"es-MX\",\"es-US\",\"et\",\"fa\",\"fo\",\"fr\",\"fr-F=
R\",\"he\",\"hi\",\"hr\",\"hu\",\"hy\",\"id\",\"it\",\"it-IT\",\"ko\",\"lt\=
",\"lv\",\"nb\",\"nl\",\"pl\",\"pt\",\"pt-BR\",\"pt-PT\",\"ro\",\"ru\",\"sh=
\",\"sk\",\"sl\",\"sq\",\"sr\",\"sv\",\"ta\",\"tg\",\"tr\",\"uk\",\"vi\"]"}
{"level":30,"time":"2024-04-24T16:17:06.594Z","msg":"spellcheck: setting
languages to: [\"en-GB\",\"en\"]"}
{"level":40,"time":"2024-04-24T16:17:06.595Z","msg":"MainSQL: Database log
code=3D283: recovered 580 frames from WAL file [REDACTED]/sql/db.sqlite-wal=
"}
{"level":30,"time":"2024-04-24T16:17:06.595Z","msg":"MainSQL: updateSchema:=
\n=20
Current user_version: 1010;\n  Most recent db schema: 1010;\n  SQLite versi=
on:
3.42.0;\n  SQLCipher version: 4.5.5 community;\n  (deprecated) schema_versi=
on:
409;\n"}
{"level":30,"time":"2024-04-24T16:17:07.167Z","msg":"got fast theme-setting
value dark"}
{"level":30,"time":"2024-04-24T16:17:08.023Z","msg":"got fast spellcheck
setting true"}
{"level":30,"time":"2024-04-24T16:17:08.033Z","msg":"System tray service:
created"}
{"level":30,"time":"2024-04-24T16:17:08.034Z","msg":"System tray service:
updating main window. Previously, there was not a window, and now there is"}
{"level":30,"time":"2024-04-24T16:17:08.034Z","msg":"System tray service:
rendering no tray"}
{"level":30,"time":"2024-04-24T16:17:08.034Z","msg":"System tray service:
enabling"}
{"level":30,"time":"2024-04-24T16:17:08.034Z","msg":"System tray service:
rendering the tray"}
{"level":30,"time":"2024-04-24T16:17:08.034Z","msg":"System tray service:
creating the tray"}
{"level":30,"time":"2024-04-24T16:17:08.036Z","msg":"Begin ensuring
permissions"}
{"level":30,"time":"2024-04-24T16:17:08.038Z","msg":"main window is
ready-to-show"}
{"level":30,"time":"2024-04-24T16:17:08.039Z","msg":"Ensuring file permissi=
ons
for 4 files"}
{"level":30,"time":"2024-04-24T16:17:08.041Z","msg":"Finish ensuring
permissions in 5ms"}
{"level":30,"time":"2024-04-24T16:17:08.699Z","msg":"MainSQL: slow query
getAllStories duration=3D561ms"}
{"level":30,"time":"2024-04-24T16:17:08.829Z","msg":"Prevent display sleep
service: allowing display sleep"}
{"level":30,"time":"2024-04-24T16:17:08.829Z","msg":"Background throttling
enabled because no call is active"}
{"level":30,"time":"2024-04-24T16:17:09.164Z","msg":"updater/start: Updates
disabled - not starting new version checks"}
{"level":30,"time":"2024-04-24T16:17:09.165Z","msg":"App loaded - time: 267=
8"}
{"level":30,"time":"2024-04-24T16:17:09.165Z","msg":"SQL init - time: 202"}
{"level":30,"time":"2024-04-24T16:17:09.165Z","msg":"Preload - time: 822"}
{"level":30,"time":"2024-04-24T16:17:09.165Z","msg":"WebSocket connect - ti=
me:
588"}
{"level":30,"time":"2024-04-24T16:17:09.165Z","msg":"Processed count: 12"}
{"level":30,"time":"2024-04-24T16:17:09.165Z","msg":"Messages per second:
9.46372239747634"}
{"level":40,"time":"2024-04-24T16:17:09.212Z","msg":"crashReports: 10 pendi=
ng
dumps found"}
{"level":30,"time":"2024-04-24T16:17:13.853Z","msg":"System tray service:
rendering the tray"}
Segmentation fault (core dumped)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17139760220.fCB4F43.4595
Date: Wed, 24 Apr 2024 16:27:02 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223366

          Summary
          network:im:signal/signal-desktop: Segmentation fault with 7.5=
.1-1.2 and 7.5.1-1.3

          Classification
          openSUSE

          Product
          openSUSE.org

          Version
          unspecified

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          3rd party software

          Assignee
          brunopitrus@hotmail.com

          Reporter
          john-susecom@pelago.org.uk

          QA Contact
          screening-team-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Signal Desktop is segmentation faulting for me, since versio=
n 7.5.1-1.2. Log:

Set Windows Application User Model ID (AUMID) { AUMID:
'org.whispersystems.signal-desktop' }
NODE_ENV production
NODE_CONFIG_DIR /usr/libexec/signal-desktop/config
NODE_CONFIG {}
ALLOW_CONFIG_MUTATIONS undefined
HOSTNAME hp450g4
NODE_APP_INSTANCE undefined
SUPPRESS_NO_CONFIG_WARNING undefined
SIGNAL_ENABLE_HTTP undefined
userData: /home/john/.config/Signal
config/get: Successfully read user config file
config/get: Successfully read ephemeral config file
getLogger: Logger not yet initialized!
crashReporter: enabled
making app single instance
{"level":30,"time":"2024-04-24T16:17:06.386Z"=
,"msg":"crashReporter: enabled"}
{"level":30,"time":"2024-04-24T16:17:06.395Z"=
,"msg":"got fast localeOverride
setting null"}
{"level":30,"time":"2024-04-24T16:17:06.395Z"=
,"msg":"app.ready: hour cycle
preference: UnknownPreference"}
{"level":30,"time":"2024-04-24T16:17:06.395Z"=
,"msg":"app.ready: preferred
system locales: en-GB, en"}
{"level":30,"time":"2024-04-24T16:17:06.396Z"=
,"msg":"locale: Supported locales:
af-ZA, ar, az-AZ, bg-BG, bn-BD, bs-BA, ca, cs, da, de, el, en, es, et-EE, e=
u,
fa-IR, fi, fr, ga-IE, gl-ES, gu-IN, he, hi-IN, hr-HR, hu, id, it, ja, ka-GE,
kk-KZ, km-KH, kn-IN, ko, ky-KG, lt-LT, lv-LV, mk-MK, ml-IN, mr-IN, ms, my, =
nb,
nl, pa-IN, pl, pt-BR, pt-PT, ro-RO, ru, sk-SK, sl-SI, sq-AL, sr, sv, sw, ta=
-IN,
te-IN, th, tl-PH, tr, ug, uk-UA, ur, vi, yue, zh-CN, zh-HK, zh-Hant"}
{"level":30,"time":"2024-04-24T16:17:06.396Z"=
,"msg":"locale: Preferred locales:
en-GB, en"}
{"level":30,"time":"2024-04-24T16:17:06.400Z"=
,"msg":"locale: Locale Override:
null"}
{"level":30,"time":"2024-04-24T16:17:06.404Z"=
,"msg":"locale: Matched locale:
en"}
{"level":40,"time":"2024-04-24T16:17:06.485Z"=
,"msg":"intl.onWarn
[@formatjs/intl] \"defaultRichTextElements\" was specified bu=
t \"message\" was
not pre-compiled. \nPlease consider using \"@formatjs/cli\" t=
o pre-compile your
messages for performance.\nFor more details see
h=
ttps://formatjs.io/docs/getting-started/message-distribution"}
{"level":30,"time":"2024-04-24T16:17:06.486Z"=
,"msg":"locale: Text info
direction for en: ltr"}
{"level":30,"time":"2024-04-24T16:17:06.486Z"=
,"msg":"getSystemTraySetting got
value MinimizeToAndStartInSystemTray"}
{"level":30,"time":"2024-04-24T16:17:06.486Z"=
,"msg":"getSystemTraySetting
returning MinimizeToAndStartInSystemTray"}
{"level":30,"time":"2024-04-24T16:17:06.488Z"=
,"msg":"app ready"}
{"level":30,"time":"2024-04-24T16:17:06.488Z"=
,"msg":"starting version 7.5.1"}
{"level":30,"time":"2024-04-24T16:17:06.488Z"=
,"msg":"media access status
[object Undefined] [object Undefined]"}
{"level":30,"time":"2024-04-24T16:17:06.491Z"=
,"msg":"got fast theme-setting
value dark"}
{"level":30,"time":"2024-04-24T16:17:06.493Z"=
,"msg":"got fast theme-setting
value dark"}
{"level":30,"time":"2024-04-24T16:17:06.493Z"=
,"msg":"got fast spellcheck
setting true"}
{"level":30,"time":"2024-04-24T16:17:06.494Z"=
,"msg":"Initializing BrowserWindow
config:
{\"show\":false,\"width\":683,\"height\":696,=
\"minWidth\":300,\"minHeight\":200,\"autoHideMenuB=
ar\":false,\"titleBarStyle\":\"default\",\"ba=
ckgroundColor\":\"#121212\",\"webPreferences\":{\&=
quot;devTools\":false,\"spellcheck\":true,\"enableBlink=
Features\":\"CSSPseudoDir,CSSLogical\",\"enablePreferre=
dSizeMode\":true,\"nodeIntegration\":false,\"nodeIntegr=
ationInWorker\":false,\"sandbox\":false,\"contextIsolat=
ion\":true,\"preload\":\"[REDACTED]/preload.bundle.js\&=
quot;,\"backgroundThrottling\":true,\"disableBlinkFeatures\&=
quot;:\"Accelerated2dCanvas,AcceleratedSmallCanvases\"},\"ic=
on\":\"[REDACTED]/images/signal-logo-desktop-linux.png\",\&q=
uot;x\":3,\"y\":28}"}
{"level":30,"time":"2024-04-24T16:17:06.594Z"=
,"msg":"spellcheck: user locales:
[\"en-GB\",\"en\"]"}
{"level":30,"time":"2024-04-24T16:17:06.594Z"=
,"msg":"spellcheck: available
spellchecker languages:
[\"af\",\"bg\",\"ca\",\"cs\",\&quot=
;cy\",\"da\",\"de\",\"de-DE\",\"el\=
",\"en\",\"en-AU\",\"en-CA\",\"en-G=
B\",\"en-GB-oxendict\",\"en-US\",\"es\",=
\"es-419\",\"es-AR\",\"es-ES\",\"es-MX\&=
quot;,\"es-US\",\"et\",\"fa\",\"fo\&quot=
;,\"fr\",\"fr-FR\",\"he\",\"hi\",\&=
quot;hr\",\"hu\",\"hy\",\"id\",\"it=
\",\"it-IT\",\"ko\",\"lt\",\"lv\&qu=
ot;,\"nb\",\"nl\",\"pl\",\"pt\",\&q=
uot;pt-BR\",\"pt-PT\",\"ro\",\"ru\",\&qu=
ot;sh\",\"sk\",\"sl\",\"sq\",\"sr\&=
quot;,\"sv\",\"ta\",\"tg\",\"tr\",\=
"uk\",\"vi\"]"}
{"level":30,"time":"2024-04-24T16:17:06.594Z"=
,"msg":"spellcheck: setting
languages to: [\"en-GB\",\"en\"]"}
{"level":40,"time":"2024-04-24T16:17:06.595Z"=
,"msg":"MainSQL: Database log
code=3D283: recovered 580 frames from WAL file [REDACTED]/sql/db.sqlite-wal=
"}
{"level":30,"time":"2024-04-24T16:17:06.595Z"=
,"msg":"MainSQL: updateSchema:\n=20
Current user_version: 1010;\n  Most recent db schema: 1010;\n  SQLite versi=
on:
3.42.0;\n  SQLCipher version: 4.5.5 community;\n  (deprecated) schema_versi=
on:
409;\n"}
{"level":30,"time":"2024-04-24T16:17:07.167Z"=
,"msg":"got fast theme-setting
value dark"}
{"level":30,"time":"2024-04-24T16:17:08.023Z"=
,"msg":"got fast spellcheck
setting true"}
{"level":30,"time":"2024-04-24T16:17:08.033Z"=
,"msg":"System tray service:
created"}
{"level":30,"time":"2024-04-24T16:17:08.034Z"=
,"msg":"System tray service:
updating main window. Previously, there was not a window, and now there is&=
quot;}
{"level":30,"time":"2024-04-24T16:17:08.034Z"=
,"msg":"System tray service:
rendering no tray"}
{"level":30,"time":"2024-04-24T16:17:08.034Z"=
,"msg":"System tray service:
enabling"}
{"level":30,"time":"2024-04-24T16:17:08.034Z"=
,"msg":"System tray service:
rendering the tray"}
{"level":30,"time":"2024-04-24T16:17:08.034Z"=
,"msg":"System tray service:
creating the tray"}
{"level":30,"time":"2024-04-24T16:17:08.036Z"=
,"msg":"Begin ensuring
permissions"}
{"level":30,"time":"2024-04-24T16:17:08.038Z"=
,"msg":"main window is
ready-to-show"}
{"level":30,"time":"2024-04-24T16:17:08.039Z"=
,"msg":"Ensuring file permissions
for 4 files"}
{"level":30,"time":"2024-04-24T16:17:08.041Z"=
,"msg":"Finish ensuring
permissions in 5ms"}
{"level":30,"time":"2024-04-24T16:17:08.699Z"=
,"msg":"MainSQL: slow query
getAllStories duration=3D561ms"}
{"level":30,"time":"2024-04-24T16:17:08.829Z"=
,"msg":"Prevent display sleep
service: allowing display sleep"}
{"level":30,"time":"2024-04-24T16:17:08.829Z"=
,"msg":"Background throttling
enabled because no call is active"}
{"level":30,"time":"2024-04-24T16:17:09.164Z"=
,"msg":"updater/start: Updates
disabled - not starting new version checks"}
{"level":30,"time":"2024-04-24T16:17:09.165Z"=
,"msg":"App loaded - time: 2678"}
{"level":30,"time":"2024-04-24T16:17:09.165Z"=
,"msg":"SQL init - time: 202"}
{"level":30,"time":"2024-04-24T16:17:09.165Z"=
,"msg":"Preload - time: 822"}
{"level":30,"time":"2024-04-24T16:17:09.165Z"=
,"msg":"WebSocket connect - time:
588"}
{"level":30,"time":"2024-04-24T16:17:09.165Z"=
,"msg":"Processed count: 12"}
{"level":30,"time":"2024-04-24T16:17:09.165Z"=
,"msg":"Messages per second:
9.46372239747634"}
{"level":40,"time":"2024-04-24T16:17:09.212Z"=
,"msg":"crashReports: 10 pending
dumps found"}
{"level":30,"time":"2024-04-24T16:17:13.853Z"=
,"msg":"System tray service:
rendering the tray"}
Segmentation fault (core dumped)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17139760220.fCB4F43.4595--


--17140625147.816Bd1e.6016
Date: Thu, 25 Apr 2024 16:28:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223398

            Bug ID: 1223398
           Summary: VUL-0: CVE-2024-22373: gdcm: out-of-bounds write in the JPEG2000Codec:DecodeByStreamsCommon functionality
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/403162/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Other
          Assignee: axel.braun-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

An out-of-bounds write vulnerability exists in the
JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre
Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap
buffer overflow. An attacker can provide a malicious file to trigger this
vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-22373
https://www.cve.org/CVERecord?id=3DCVE-2024-22373
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17140625147.816Bd1e.6016
Date: Thu, 25 Apr 2024 16:28:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223398

          Summary
          VUL-0: CVE-2024-22373: gdcm: out-of-bounds write in the JPEG2=
000Codec:DecodeByStreamsCommon functionality

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/403162/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Other

          Assignee
          axel.braun@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

An out-of-bounds write vulnerability exists in the
JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre
Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap
buffer overflow. An attacker can provide a malicious file to trigger this
vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-22373
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-22373
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024=
-1935

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17140625147.816Bd1e.6016--


--17141303888.6D509Ab4.6949
Date: Fri, 26 Apr 2024 11:19:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223420

            Bug ID: 1223420
           Summary: VUL-0: CVE-2024-31755: cJSON: NULL pointer dereference via cJSON_SetValuestring()
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/403222/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: mardnh-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: carlos.lopez-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

cJSON v1.7.17 was discovered to contain a segmentation violation, which can
trigger through the second parameter of function cJSON_SetValuestring at
cJSON.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31755
https://www.cve.org/CVERecord?id=3DCVE-2024-31755
https://github.com/DaveGamble/cJSON/issues/839
https://bugzilla.redhat.com/show_bug.cgi?id=3D2277268
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17141303888.6D509Ab4.6949
Date: Fri, 26 Apr 2024 11:19:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223420

          Summary
          VUL-0: CVE-2024-31755: cJSON: NULL pointer dereference via cJ=
SON_SetValuestring()

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/403222/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          mardnh@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          carlos.lopez@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

cJSON v1.7.17 was discovered to contain a segmentation viola=
tion, which can
trigger through the second parameter of function cJSON_SetValuestring at
cJSON.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2024-31755
https://www.c=
ve.org/CVERecord?id=3DCVE-2024-31755
https://github.c=
om/DaveGamble/cJSON/issues/839
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2277268

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17141303888.6D509Ab4.6949--


--17143849790.1eE2aB1Ec.9623
Date: Mon, 29 Apr 2024 10:02:59 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1223504

            Bug ID: 1223504
           Summary: transactional_update cannot deal with new table look of snapper
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: aschnell-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

See https://build.opensuse.org/request/show/1169010.

snapper uses unicode symbols for the table lines now. The code
in transactional_update cannot deal with that:

=20
https://github.com/openSUSE/transactional-update/blob/master/sbin/transacti=
onal-update.in#L1383

transactional_update should use the CSV or JSON output of snapper
instead. CSV is partly used already:

=20
https://github.com/openSUSE/transactional-update/blob/master/systemd/prepar=
e-nextroot-for-softreboot#L14
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17143849790.1eE2aB1Ec.9623
Date: Mon, 29 Apr 2024 10:02:59 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1223504

          Summary
          transactional_update cannot deal with new table look of snapp=
er

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          aschnell@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

See https://build.opensuse.org/request/show/1169010.

snapper uses unicode symbols for the table lines now. The code
in transactional_update cannot deal with that:

=20
https://github.com/openSUSE/transactional-=
update/blob/master/sbin/transactional-update.in#L1383

transactional_update should use the CSV or JSON output of snapper
instead. CSV is partly used already:

=20
https://github.com/openSUSE/trans=
actional-update/blob/master/systemd/prepare-nextroot-for-softreboot#L14=

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17143849790.1eE2aB1Ec.9623--