--17026360282.8Cd81.14404
Date: Fri, 15 Dec 2023 10:27:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218099

            Bug ID: 1218099
           Summary: VUL-0: CVE-2023-50471: cjson: segmentation violation in function cJSON_InsertItemInArray
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/388143/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: mardnh-at-gmx.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

cJSON v1.7.16 was discovered to contain a segmentation violation via the
function cJSON_InsertItemInArray at cJSON.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50471
https://github.com/DaveGamble/cJSON/issues/802
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17026360282.8Cd81.14404
Date: Fri, 15 Dec 2023 10:27:08 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218099

          Summary
          VUL-0: CVE-2023-50471: cjson: segmentation violation in funct=
ion cJSON_InsertItemInArray

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/388143/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          mardnh@gmx.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

cJSON v1.7.16 was discovered to contain a segmentation viola=
tion via the
function cJSON_InsertItemInArray at cJSON.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50471
https://github.c=
om/DaveGamble/cJSON/issues/802

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17026360282.8Cd81.14404--


--17027610482.aA9a08Fe0.16109
Date: Sat, 16 Dec 2023 21:10:48 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218131

            Bug ID: 1218131
           Summary: [Build 20231215] trup_smoke: sdboot asks for recovery key
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/3817847/modules/trup
                    _smoke/steps/25
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-sdboot-x86_64-microos-combustion@uefi fail=
s in
[trup_smoke](https://openqa.opensuse.org/tests/3817847/modules/trup_smoke/s=
teps/25)

## Test suite description
Like MicroOS, but use only combustion for the initial configuration.
jlausuch: it was `EXTRA=3DFEATURES`.

## Reproducible

Fails since (at least) Build
[20231215](https://openqa.opensuse.org/tests/3817711)

## Expected result

Last good: [20231214](https://openqa.opensuse.org/tests/3815394) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dmi=
croos&flavor=3DMicroOS-Image-sdboot&machine=3Duefi&test=3Dmicroos-combustio=
n&version=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17027610482.aA9a08Fe0.16109
Date: Sat, 16 Dec 2023 21:10:48 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218131

          Summary
          [Build 20231215] trup_smoke: sdboot asks for recovery key

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/3817847/modules/trup_smoke/=
steps/25

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-sdboot-x86_64-microos-combustion@uefi =
fails in
[trup_smoke](https://openqa.opensuse.org/tests/3817847/modules/trup_=
smoke/steps/25)

## Test suite description
Like MicroOS, but use only combustion for the initial configuration.
jlausuch: it was `EXTRA=3DFEATURES`.

## Reproducible

Fails since (at least) Build
[20231215](https://op=
enqa.opensuse.org/tests/3817711)

## Expected result

Last good: [20231214](https://openqa.opensuse.org/tests/3815394) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opens=
use.org/tests/latest?arch=3Dx86_64&distri=3Dmicroos&flavor=3DMicroO=
S-Image-sdboot&machine=3Duefi&test=3Dmicroos-combustion&version=
=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17027610482.aA9a08Fe0.16109--


--17028248800.9D2CF8f1B.16238
Date: Sun, 17 Dec 2023 14:54:40 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218135

            Bug ID: 1218135
           Summary: Dead keys in application after ibus update
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: Michael.Zapf-at-mizapf.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

After an update of the ibus component from 1.5.28-3.1 to 1.5.29-1.1, the
German-specific keys (=C3=A4, =C3=B6, =C3=BC, =C3=9F) on the German keyboar=
d stop working in the
MAME emulation framework.

The keys in other applications are not affected, but in MAME, they are
frequently used, and thus this update makes MAME unusable in large parts.

To my understanding, the keys are scanned for raw keycodes in MAME and then
mapped to the respective emulated system, so the =C3=B6 key should actually=
 deliver
"COLON", but as stated, does not do that anymore after the update but is
completely dead.

I was able to retain the key function by blocking the ibus component update=
 in
yast/zypper. Everything else could be updated, as checked right now (kernel
6.6.6).

I am involved in the MAME development, but I'm not familiar with those core
functionalities. I may be able to pass information to the suitable devs.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17028248800.9D2CF8f1B.16238
Date: Sun, 17 Dec 2023 14:54:40 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218135

          Summary
          Dead keys in application after ibus update

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          Michael.Zapf@mizapf.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

After an update of the ibus component from 1.5.28-3.1 to 1.5=
.29-1.1, the
German-specific keys (=C3=A4, =C3=B6, =C3=BC, =C3=9F) on the German keyboar=
d stop working in the
MAME emulation framework.

The keys in other applications are not affected, but in MAME, they are
frequently used, and thus this update makes MAME unusable in large parts.

To my understanding, the keys are scanned for raw keycodes in MAME and then
mapped to the respective emulated system, so the =C3=B6 key should actually=
 deliver
"COLON", but as stated, does not do that anymore after the update=
 but is
completely dead.

I was able to retain the key function by blocking the ibus component update=
 in
yast/zypper. Everything else could be updated, as checked right now (kernel
6.6.6).

I am involved in the MAME development, but I'm not familiar with those core
functionalities. I may be able to pass information to the suitable devs.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17028248800.9D2CF8f1B.16238--


--17029200950.0083ADF.17896
Date: Mon, 18 Dec 2023 17:21:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218170

            Bug ID: 1218170
           Summary: osc buildhistory error if in a git directory
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: marco.strigl-at-suse.com
          Reporter: suse-beta-at-cboltz.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

"osc buildhistory" fails with an error / python backtrace (see below for the
full error message) if you run it in a directory that contains a git repo. =
In
my case this git repo was the AppArmor source code.

I did not test what happens if you run "osc buildhistory" in a directory th=
at
contains the git repo of an OBS package - please test this yourself.

osc buildhistory (at least with the 4 parameters syntax) should work without
even looking at the current directory.

cb@tux:~/apparmor/git master> osc buildhistory -l 5 home:cboltz apparmor
openSUSE_Factory x86_64
Traceback (most recent call last):
  File "/usr/bin/osc", line 33, in <module>
    sys.exit(load_entry_point('osc=3D=3D1.5.1', 'console_scripts', 'osc')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/babysitter.py", line 226, in =
main
    sys.exit(run(commandline.OscMainCommand()))
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/babysitter.py", line 69, in r=
un
    prg.main(argv)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", line 556, in
main
    cmd.run(args)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", line 245, in=
 run
    cmd.run(args)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", line 500, in=
 run
    self.func(args.command, args, *args.positional_args)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", line 7519, in
do_buildhistory
    project, package, repository, arch =3D
pop_project_package_repository_arch_from_args(args)
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", line 817, in
pop_project_package_repository_arch_from_args
    project, package =3D pop_project_package_from_args(
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", line 705, in
pop_project_package_from_args
    project =3D project_store.project
              ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/git_scm/store.py", line 79, in
project
    raise RuntimeError(f"Couldn't map git branch '{branch}' to a project")
RuntimeError: Couldn't map git branch 'master' to a project

It works if I cd into a non-git directory:

cb@tux:~/apparmor/git master> cd ~
cb@tux:~> osc buildhistory -l 5 home:cboltz apparmor openSUSE_Factory x86_64
TIME                SRCMD5                           VER-REL.BUILD# REV
DURATION
2023-10-24 06:58:20 d18117ce59c416e52ba4454396c6e707 3.1.6-966.4    469 447
2023-10-30 03:48:35 d18117ce59c416e52ba4454396c6e707 3.1.6-966.5    469 2041
2023-11-05 22:02:11 d18117ce59c416e52ba4454396c6e707 3.1.6-966.6    469 450
2023-11-07 02:04:55 d18117ce59c416e52ba4454396c6e707 3.1.6-966.7    469 390
2023-11-08 18:28:44 f8aa056a23a410850e7f046bdedbfeee 3.1.6-970.1    471 378
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17029200950.0083ADF.17896
Date: Mon, 18 Dec 2023 17:21:35 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218170

          Summary
          osc buildhistory error if in a git directory

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          marco.strigl@suse.com

          Reporter
          suse-beta@cboltz.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

"osc buildhistory" fails with an error / python ba=
cktrace (see below for the
full error message) if you run it in a directory that contains a git repo. =
In
my case this git repo was the AppArmor source code.

I did not test what happens if you run "osc buildhistory" in a di=
rectory that
contains the git repo of an OBS package - please test this yourself.

osc buildhistory (at least with the 4 parameters syntax) should work without
even looking at the current directory.

cb@tux:~/apparmor/git master> osc buildhistory -l 5 home:cboltz appa=
rmor
openSUSE_Factory x86_64
Traceback (most recent call last):
  File "/usr/bin/osc", line 33, in <module>
    sys.exit(load_entry_point('osc=3D=3D1.5.1', 'console_scripts', 'osc')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/babysitter.py", lin=
e 226, in main
    sys.exit(run(commandline.OscMainCommand()))
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/babysitter.py", lin=
e 69, in run
    prg.main(argv)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", li=
ne 556, in
main
    cmd.run(args)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", li=
ne 245, in run
    cmd.run(args)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", li=
ne 500, in run
    self.func(args.command, args, *args.positional_args)
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", li=
ne 7519, in
do_buildhistory
    project, package, repository, arch =3D
pop_project_package_repository_arch_from_args(args)
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", li=
ne 817, in
pop_project_package_repository_arch_from_args
    project, package =3D pop_project_package_from_args(
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/commandline.py", li=
ne 705, in
pop_project_package_from_args
    project =3D project_store.project
              ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/osc/git_scm/store.py", =
line 79, in
project
    raise RuntimeError(f"Couldn't map git branch '{branch}' to a proje=
ct")
RuntimeError: Couldn't map git branch 'master' to a project

It works if I cd into a non-git directory:

cb@tux:~/apparmor/git master> cd ~
cb@tux:~> osc buildhistory -l 5 home:cboltz apparmor openSUSE_Factor=
y x86_64
TIME                SRCMD5                           VER-REL.BUILD# REV
DURATION
2023-10-24 06:58:20 d18117ce59c416e52ba4454396c6e707 3.1.6-966.4    469 447
2023-10-30 03:48:35 d18117ce59c416e52ba4454396c6e707 3.1.6-966.5    469 2041
2023-11-05 22:02:11 d18117ce59c416e52ba4454396c6e707 3.1.6-966.6    469 450
2023-11-07 02:04:55 d18117ce59c416e52ba4454396c6e707 3.1.6-966.7    469 390
2023-11-08 18:28:44 f8aa056a23a410850e7f046bdedbfeee 3.1.6-970.1    471 378=

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17029200950.0083ADF.17896--


body:
--17029985243.fA3cd6.19672
Date: Tue, 19 Dec 2023 15:08:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218223

            Bug ID: 1218223
           Summary: minetest server gameid
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: werwolf131313-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

now minetestserver want start with systemd servise from package
Previously, the selection of a game for minetest took place in the config u=
sing
the default_game directive. Now there is no such option, but there is an op=
tion
to launch the binary --gameid.
temporarily I solved this problem through systemd edit by adding the gameid=
 I
needed. but this is unlikely to be a good permanent solution. I ask the pac=
kage
maintainers to pay attention to this.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17029985243.fA3cd6.19672
Date: Tue, 19 Dec 2023 15:08:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218223

          Summary
          minetest server gameid

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          werwolf131313@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

now minetestserver want start with systemd servise from pack=
age
Previously, the selection of a game for minetest took place in the config u=
sing
the default_game directive. Now there is no such option, but there is an op=
tion
to launch the binary --gameid.
temporarily I solved this problem through systemd edit by adding the gameid=
 I
needed. but this is unlikely to be a good permanent solution. I ask the pac=
kage
maintainers to pay attention to this.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17029985243.fA3cd6.19672--

summary: minetest server gameid


--17030390471.d5c30a.20289
Date: Wed, 20 Dec 2023 02:24:07 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218240

            Bug ID: 1218240
           Summary: Bugs in downstream X server patches cause server crash when starting with Xinerama enabled
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: All
                OS: openSUSE Leap 15.5
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: gfx-bugs-at-suse.de
          Reporter: ddadap-at-nvidia.com
        QA Contact: gfx-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 871465
  --> https://bugzilla.suse.com/attachment.cgi?id=3D871465&action=3Dedit
A patch for the downstream patches in the xorg-x11-server

A number of downstream patches in the xorg-x11-server package call
rrGetScrPriv() without first ensuring that rrPrivKey is registered. This ca=
uses
the server to crash when Xinerama is enabled, as enabling Xinerama disables=
 the
RANDR extension.

#0  0x00007ffff6e53d2b in raise () from /lib64/libc.so.6
#1  0x00007ffff6e553e5 in abort () from /lib64/libc.so.6
#2  0x00007ffff6e4bc6a in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007ffff6e4bcf2 in __assert_fail () from /lib64/libc.so.6
#4  0x00005555555982b9 in dixGetPrivateAddr (key=3D<optimized out>,
key=3D<optimized out>, privates=3D0x5555558a2310) at
../../../include/privates.h:122
#5  0x00005555555f4578 in dixGetPrivateAddr (key=3D<optimized out>,
key=3D<optimized out>, privates=3D<optimized out>) at xf86Init.c:380
#6  dixLookupPrivate (key=3D<optimized out>, privates=3D<optimized out>) at
../../../include/privates.h:165
#7  xf86AutoConfigureProviderOutputsForMaster (pMasterScreen=3D0x5555558a1f=
40) at
xf86Init.c:293
#8  xf86AutoConfigProviderOutputs (pcbl=3D<optimized out>, data=3D<optimize=
d out>,
call_data=3D<optimized out>) at xf86Init.c:442
#9  0x00005555555b92c4 in _CallCallbacks (pcbl=3Dpcbl@entry=3D0x5555557b1790
<RootWindowInitialized>, call_data=3Dcall_data@entry=3D0x0) at dixutils.c:7=
43
#10 0x00005555555b7eca in CallCallbacks (call_data=3D0x0, pcbl=3D0x5555557b=
1790
<RootWindowInitialized>) at ../include/callback.h:83
#11 dix_main (argc=3D1, argv=3D0x7fffffffeca8, envp=3D<optimized out>) at m=
ain.c:247
#12 0x00007ffff6e3e24d in __libc_start_main () from /lib64/libc.so.6
#13 0x00005555555a17ca in _start () at ../sysdeps/x86_64/start.S:120

The following assert fires immediately before the crash:

Xorg: ../../../include/privates.h:122: dixGetPrivateAddr: Assertion
`key->initialized' failed.

Editing the patches to check dixPrivateKeyRegistered(rrPrivKey) before call=
ing
rrGetScrPriv() avoids the crash. Note that older X.org server versions (for
example, 1.20.3 in Leap 15.4) contain a similar upstream bug that was fixed
with the following commit:

https://gitlab.freedesktop.org/xorg/xserver/-/commit/cfc5e5040
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17030390471.d5c30a.20289
Date: Wed, 20 Dec 2023 02:24:07 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218240

          Summary
          Bugs in downstream X server patches cause server crash when s=
tarting with Xinerama enabled

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          All

          OS
          openSUSE Leap 15.5

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X.Org

          Assignee
          gfx-bugs@suse.de

          Reporter
          ddadap@nvidia.com

          QA Contact
          gfx-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 871465 [details]
A patch for the downstream patches in the xorg-x11-server

A number of downstream patches in the xorg-x11-server package call
rrGetScrPriv() without first ensuring that rrPrivKey is registered. This ca=
uses
the server to crash when Xinerama is enabled, as enabling Xinerama disables=
 the
RANDR extension.

#0  0x00007ffff6e53d2b in raise () from /lib64/libc.so.6
#1  0x00007ffff6e553e5 in abort () from /lib64/libc.so.6
#2  0x00007ffff6e4bc6a in __assert_fail_base () from /lib64/libc.so.6
#3  0x00007ffff6e4bcf2 in __assert_fail () from /lib64/libc.so.6
#4  0x00005555555982b9 in dixGetPrivateAddr (key=3D<optimized out>,
key=3D<optimized out>, privates=3D0x5555558a2310) at
../../../include/privates.h:122
#5  0x00005555555f4578 in dixGetPrivateAddr (key=3D<optimized out>,
key=3D<optimized out>, privates=3D<optimized out>) at xf86Init.=
c:380
#6  dixLookupPrivate (key=3D<optimized out>, privates=3D<optimized=
 out>) at
../../../include/privates.h:165
#7  xf86AutoConfigureProviderOutputsForMaster (pMasterScreen=3D0x5555558a1f=
40) at
xf86Init.c:293
#8  xf86AutoConfigProviderOutputs (pcbl=3D<optimized out>, data=3D&lt=
;optimized out>,
call_data=3D<optimized out>) at xf86Init.c:442
#9  0x00005555555b92c4 in _CallCallbacks (pcbl=3Dpcbl@entry=3D0x5555557=
b1790
<RootWindowInitialized>, call_data=3Dcall_data@entry=3D0x0) at di=
xutils.c:743
#10 0x00005555555b7eca in CallCallbacks (call_data=3D0x0, pcbl=3D0x5555557b=
1790
<RootWindowInitialized>) at ../include/callback.h:83
#11 dix_main (argc=3D1, argv=3D0x7fffffffeca8, envp=3D<optimized out>=
) at main.c:247
#12 0x00007ffff6e3e24d in __libc_start_main () from /lib64/libc.so.6
#13 0x00005555555a17ca in _start () at ../sysdeps/x86_64/start.S:120

The following assert fires immediately before the crash:

Xorg: ../../../include/privates.h:122: dixGetPrivateAddr: Assertion
`key->initialized' failed.

Editing the patches to check dixPrivateKeyRegistered(rrPrivKey) before call=
ing
rrGetScrPriv() avoids the crash. Note that older X.org server versions (for
example, 1.20.3 in Leap 15.4) contain a similar upstream bug that was fixed
with the following commit:

=
https://gitlab.freedesktop.org/xorg/xserver/-/commit/cfc5e5040

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17030390471.d5c30a.20289--


--17030621842.caCCD4.20670
Date: Wed, 20 Dec 2023 08:49:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218254

            Bug ID: 1218254
           Summary: [Build 20231219] qca: pkcs12 wrongly moved to 'legacy' provider
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/3826520/modules/libq
                    ca2/steps/16
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

Initially filed as QA bug, but in fact this seems to be a product bug:
https://progress.opensuse.org/issues/133529

With https://progress.opensuse.org/issues/133529, the 'pkcs12' provider has
been marked as 'only available when legacy is available' - which in our def=
ault
openssl configuration is not the case (the legacy.so is instal;led, but the
config does not enable it)

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[libqca2](https://openqa.opensuse.org/tests/3826520/modules/libqca2/steps/1=
6)

## Test suite description
Maintainer: slindomansilla-at-suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20231213](https://openqa.opensuse.org/tests/3811161)

## Expected result

Last good: [20231212](https://openqa.opensuse.org/tests/3809161) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3D64bit&test=3Dextra_tests_textmode&version=3DT=
umbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17030621842.caCCD4.20670
Date: Wed, 20 Dec 2023 08:49:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218254

          Summary
          [Build 20231219] qca: pkcs12 wrongly moved to 'legacy' provid=
er

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/3826520/modules/libqca2/ste=
ps/16

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          KDE Workspace (Plasma)

          Assignee
          opensuse-kde-bugs@opensuse.org

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

Initially filed as QA bug, but in fact this seems to be a product bug:
https://progress.op=
ensuse.org/issues/133529

With https://progre=
ss.opensuse.org/issues/133529, the 'pkcs12' provider has
been marked as 'only available when legacy is available' - which in our def=
ault
openssl configuration is not the case (the legacy.so is instal;led, but the
config does not enable it)

openQA test in scenario
opensuse-Tumbleweed-DVD-x86_64-extra_tests_textmode@64bit fails in
[libqca2](https://openqa.opensuse.org/tests/3826520/modules/libqca2/ste=
ps/16)

## Test suite description
Maintainer: slindomansilla&#6=
4;suse.de.
Mainly post-installation console extra tests.

## Reproducible

Fails since (at least) Build
[20231213](https://op=
enqa.opensuse.org/tests/3811161)

## Expected result

Last good: [20231212](https://openqa.opensuse.org/tests/3809161) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests=
/latest?arch=3Dx86_64&distri=3Dopensuse&flavor=3DDVD&machine=3D=
64bit&test=3Dextra_tests_textmode&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17030621842.caCCD4.20670--


body:
--17031335570.Cc01fc.22415
Date: Thu, 21 Dec 2023 04:39:17 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218288

            Bug ID: 1218288
           Summary: liblxqt needed for brightness control, not installed by default
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: LXQt
          Assignee: mvetter-at-suse.com
          Reporter: bog-at-khumba.net
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hi there,

I have a basic Tumbleweed install and selected LXQt in the installer.  Ther=
e is
a display brightness control that can be added to the LXQt panel, however
attempting to drag its slider results in the whole panel crashing (and
restarting) with an error in .xsession-errors:

> Cannot run program lxqt-backlight_backend: No such file or directory

This program is part of the liblxqt binary package, great, so it should be
installed by default, but I can't see why it's not.

Information for package liblxqt1: (installed)
---------------------------------
Repository     : openSUSE-Tumbleweed-Oss
Name           : liblxqt1
Version        : 1.4.0-1.1
Recommends     : [2]
    liblxqt-lang
    liblxqt >=3D 1.4.0
Provides       : [4]
    liblxqt.so.1()(64bit)
    liblxqt
    liblxqt1 =3D 1.4.0-1.1
    liblxqt1(x86-64) =3D 1.4.0-1.1

Information for package liblxqt: (not installed)
--------------------------------
Repository     : openSUSE-Tumbleweed-Oss
Name           : liblxqt
Version        : 1.4.0-1.1
Provides       : [3]
    liblxqt =3D 1.4.0-1.1
    liblxqt(x86-64) =3D 1.4.0-1.1
    liblxqt-qt5 =3D 1.4.0

I would expect the 'liblxqt >=3D 1.4.0' Recommends from liblxqt1 not to mat=
ch the
package's own unversioned 'liblxqt' Provides and instead pull in the proper
liblxqt package, but that's not what's happening.  What am I not understand=
ing
here?

'zypper inr' doesn't try to install liblxqt either.

The workaround is to install liblxqt manually of course :).
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17031335570.Cc01fc.22415
Date: Thu, 21 Dec 2023 04:39:17 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218288

          Summary
          liblxqt needed for brightness control, not installed by defau=
lt

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          LXQt

          Assignee
          mvetter@suse.com

          Reporter
          bog@khumba.net

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hi there,

I have a basic Tumbleweed install and selected LXQt in the installer.  Ther=
e is
a display brightness control that can be added to the LXQt panel, however
attempting to drag its slider results in the whole panel crashing (and
restarting) with an error in .xsession-errors:

> Cannot run program lxqt-backlight_backend: No su=
ch file or directory

This program is part of the liblxqt binary package, great, so it should be
installed by default, but I can't see why it's not.

Information for package liblxqt1: (installed)
---------------------------------
Repository     : openSUSE-Tumbleweed-Oss
Name           : liblxqt1
Version        : 1.4.0-1.1
Recommends     : [2]
    liblxqt-lang
    liblxqt >=3D 1.4.0
Provides       : [4]
    liblxqt.so.1()(64bit)
    liblxqt
    liblxqt1 =3D 1.4.0-1.1
    liblxqt1(x86-64) =3D 1.4.0-1.1

Information for package liblxqt: (not installed)
--------------------------------
Repository     : openSUSE-Tumbleweed-Oss
Name           : liblxqt
Version        : 1.4.0-1.1
Provides       : [3]
    liblxqt =3D 1.4.0-1.1
    liblxqt(x86-64) =3D 1.4.0-1.1
    liblxqt-qt5 =3D 1.4.0

I would expect the 'liblxqt >=3D 1.4.0' Recommends from liblxqt1 not to =
match the
package's own unversioned 'liblxqt' Provides and instead pull in the proper
liblxqt package, but that's not what's happening.  What am I not understand=
ing
here?

'zypper inr' doesn't try to install liblxqt either.

The workaround is to install liblxqt manually of course :).

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17031335570.Cc01fc.22415--

pkgs: liblxqt lxqt-panel patterns-lxqt


--17031485730.E8B52.22667
Date: Thu, 21 Dec 2023 08:49:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218299

            Bug ID: 1218299
           Summary: VUL-0: CVE-2023-44452: xreader: command injection during CBT file parsing
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/388935/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: andythe_great-at-pm.me
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: carlos.lopez-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

This vulnerability allows remote attackers to execute arbitrary code on
affected installations of Linux Mint Xreader. User interaction is required =
to
exploit this vulnerability in that the target must visit a malicious page or
open a malicious file.

The specific flaw exists within the parsing of CBT files. The issue results
from the lack of proper validation of a user-supplied string before using i=
t to
execute a system call. An attacker can leverage this vulnerability to execu=
te
code in the context of the current user.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-44452
https://www.zerodayinitiative.com/advisories/ZDI-23-1836/
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17031485730.E8B52.22667
Date: Thu, 21 Dec 2023 08:49:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218299

          Summary
          VUL-0: CVE-2023-44452: xreader: command injection during CBT =
file parsing

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/388935/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          andythe_great@pm.me

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          carlos.lopez@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

This vulnerability allows remote attackers to execute arbitr=
ary code on
affected installations of Linux Mint Xreader. User interaction is required =
to
exploit this vulnerability in that the target must visit a malicious page or
open a malicious file.

The specific flaw exists within the parsing of CBT files. The issue results
from the lack of proper validation of a user-supplied string before using i=
t to
execute a system call. An attacker can leverage this vulnerability to execu=
te
code in the context of the current user.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-44452
https=
://www.zerodayinitiative.com/advisories/ZDI-23-1836/

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17031485730.E8B52.22667--


body:
--17031501164.E6cA8.22706
Date: Thu, 21 Dec 2023 09:15:16 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218302

            Bug ID: 1218302
           Summary: VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities fixed in 120.0.6099.129/130
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: gmbr3-at-opensuse.org
          Reporter: gabriele.sonnu-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: Andreas.Stieger-at-gmx.de, m.szczepaniak.000-at-gmail.com,
                    security-team-at-suse.de
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

https://chromereleases.googleblog.com/2023/12/stable-channel-update-for-des=
ktop_20.html

The Stable channel has been updated to 120.0.6099.129 for Mac,Linux and
120.0.6099.129/130 to Windows which will roll out over the coming days/week=
s. A
full list of changes in this build is available in the nulllog.=20

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 1 security fix. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

- CVE-2023-7024: Heap buffer overflow in WebRTC.=20

Google is aware that an exploit for CVE-2023-7024 exists in the wild.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17031501164.E6cA8.22706
Date: Thu, 21 Dec 2023 09:15:16 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218302

          Summary
          VUL-0: chromium,ungoogled-chromium: multiple vulnerabilities =
fixed in 120.0.6099.129/130

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          gmbr3@opensuse.org

          Reporter
          gabriele.sonnu@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          Andreas.Stieger@gmx.de, m.szczepaniak.000@gmail.com, =
security-team@suse.de

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2023/12/stable-channel-update-for-desktop_20.html

The Stable channel has been updated to 120.0.6099.129 for Mac,Linux and
120.0.6099.129/130 to Windows which will roll out over the coming days/week=
s. A
full list of changes in this build is available in the nulllog.=20

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 1 security fix. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

- CVE-2023-7024: Heap buffer overflow in WebRTC.=20

Google is aware that an exploit for CVE-2023-7024 exists in the wild.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17031501164.E6cA8.22706--

pkgs: chromium ungoogled-chromium


body:
--17031508235.5D329A7.22733
Date: Thu, 21 Dec 2023 09:27:03 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218303

            Bug ID: 1218303
           Summary: VUL-0: CVE-2023-6704: libavif,chromium,ungoogled-chromium: use after free in libavif
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.5
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: aaronpuchert@alice-dsl.net, andrea.mattiazzo-at-suse.com,
                    Andreas.Stieger-at-gmx.de, gmbr3-at-opensuse.org,
                    security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

It was reported that libavif before 1.0.3, and as bundled in Chromium,
contained a use-after-free bug. colorProperties could be pointing to a dang=
ling
pointer if
findAlphaItem() resizes the meta.items array.

Also bundled in chromium, see bug 1218048

References:
https://github.com/AOMediaCodec/libavif/pull/1808
https://github.com/AOMediaCodec/libavif/commit/b984f48be99b41405cb4a7d44380=
6e01b46936fb
https://github.com/AOMediaCodec/libavif/releases/tag/v1.0.3
https://bugs.chromium.org/p/chromium/issues/detail?id=3D1504792
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17031508235.5D329A7.22733
Date: Thu, 21 Dec 2023 09:27:03 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218303

          Summary
          VUL-0: CVE-2023-6704: libavif,chromium,ungoogled-chromium: us=
e after free in libavif

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.5

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          Andreas.Stieger@gmx.de

          QA Contact
          qa-bugs@suse.de

          CC
          aaronpuchert@alice-dsl.net, andrea.mattiazzo@suse.com=
, Andreas.Stieger@gmx.de, gmbr3@opensuse.org, security-team@sus=
e.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

It was reported that libavif before 1.0.3, and as bundled in=
 Chromium,
contained a use-after-free bug. colorProperties could be pointing to a dang=
ling
pointer if
findAlphaItem() resizes the meta.items array.

Also bundled in chromium, see bug 1218048

References:
https://githu=
b.com/AOMediaCodec/libavif/pull/1808
https://github.com/AOMediaCodec/libavif/commit/b98=
4f48be99b41405cb4a7d443806e01b46936fb
htt=
ps://github.com/AOMediaCodec/libavif/releases/tag/v1.0.3
https://bugs.chromium.org/p/chromium/issues/detail?id=3D1504792

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17031508235.5D329A7.22733--


--17031554852.22E657c.22925
Date: Thu, 21 Dec 2023 10:44:45 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218306

            Bug ID: 1218306
           Summary: [Build 20231220] Unexpected situation found (using NVME disks)
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/3829554/modules/disa
                    ble_online_repos/steps/1
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: jsrain-at-suse.com
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

Snapshot 1220 has received new libnvme:
-Version:        1.6+5.g68c6ffb
+Version:        1.7.1+0.g13ba383

and nvme-cli:
 5-Version:        2.6
 6+Version:        2.7

YaST / installer seems not able to interpret their outputs

Will try to reproduce locally in order to get better logs - openQA only has=
 the
yui-log.txt, which is not a lot of info

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-nvme@uefi fails in
[disable_online_repos](https://openqa.opensuse.org/tests/3829554/modules/di=
sable_online_repos/steps/1)

## Test suite description
Maintainer: rbrown-at-suse.de; Basic installation test to confirm that install=
ing
and booting to an nvme as your root disk works

## Reproducible

Fails since (at least) Build
[20231220](https://openqa.opensuse.org/tests/3828924)

## Expected result

Last good: [20231219](https://openqa.opensuse.org/tests/3825818) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dop=
ensuse&flavor=3DDVD&machine=3Duefi&test=3Dnvme&version=3DTumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17031554852.22E657c.22925
Date: Thu, 21 Dec 2023 10:44:45 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218306

          Summary
          [Build 20231220] Unexpected situation found (using NVME disks)

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/3829554/modules/disable_onl=
ine_repos/steps/1

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Installation

          Assignee
          yast2-maintainers@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          jsrain@suse.com

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

Snapshot 1220 has received new libnvme:
-Version:        1.6+5.g68c6ffb
+Version:        1.7.1+0.g13ba383

and nvme-cli:
 5-Version:        2.6
 6+Version:        2.7

YaST / installer seems not able to interpret their outputs

Will try to reproduce locally in order to get better logs - openQA only has=
 the
yui-log.txt, which is not a lot of info

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-nvme@uefi fails =
in
[disable_online_repos](https://openqa.opensuse.org/tests/38=
29554/modules/disable_online_repos/steps/1)

## Test suite description
Maintainer: rbrown@suse.de; B=
asic installation test to confirm that installing
and booting to an nvme as your root disk works

## Reproducible

Fails since (at least) Build
[20231220](https://op=
enqa.opensuse.org/tests/3828924)

## Expected result

Last good: [20231219](https://openqa.opensuse.org/tests/3825818) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx8=
6_64&distri=3Dopensuse&flavor=3DDVD&machine=3Duefi&test=3Dn=
vme&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17031554852.22E657c.22925--


--17031970702.F6a207Bad.23908
Date: Thu, 21 Dec 2023 22:17:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218327

            Bug ID: 1218327
           Summary: AUDIT-0: dnf5: Audit dnf5daemon D-Bus files for whitelist
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: ngompa13-at-gmail.com
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

For my package found in OBS in system:packagemanager:dnf/dnf5 I would like a
whitelisting for the following rpmlint errors:

[  520s] dnf5daemon-server.x86_64: E: dbus-file-unauthorized (Badness: 1000=
0)
/etc/dbus-1/system.d/org.rpm.dnf.v0.conf (sha256 file digest default
filter:4dd26c049d6240e6640106bb8805ec958e03d9ad79eb2823152b9a92156554a9 she=
ll
filter:4dd26c049d6240e6640106bb8805ec958e03d9ad79eb2823152b9a92156554a9 xml
filter:bd2c589d0cb083d7b8a7696b98e0a344b2501ecd2d91a7fe447028cb47f75210)
[  520s] dnf5daemon-server.x86_64: E: dbus-file-unauthorized (Badness: 1000=
0)
/usr/share/dbus-1/system-services/org.rpm.dnf.v0.service (sha256 file digest
default filter:8dff187bd14e516fd976731fb4ab3996bb92b36dfa944733655641a6aec2=
15e1
shell filter:8dff187bd14e516fd976731fb4ab3996bb92b36dfa944733655641a6aec215=
e1
xml filter:<failed-to-calculate>)
[  520s] Packaging D-Bus services requires a review and whitelisting by the
SUSE
[  520s] security team. If the package is intended for inclusion in any SUSE
product
[  520s] please open a bug report to request review of the package by the
security
[  520s] team. Please refer to
[  520s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for
[  520s] more information.

This blocks my submit request: https://build.opensuse.org/request/show/1134=
536
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17031970702.F6a207Bad.23908
Date: Thu, 21 Dec 2023 22:17:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218327

          Summary
          AUDIT-0: dnf5: Audit dnf5daemon D-Bus files for whitelist

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          ngompa13@gmail.com

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

For my package found in OBS in system:packagemanager:dnf/dnf=
5 I would like a
whitelisting for the following rpmlint errors:

[  520s] dnf5daemon-server.x86_64: E: dbus-file-unauthorized (Badness: 1000=
0)
/etc/dbus-1/system.d/org.rpm.dnf.v0.conf (sha256 file digest default
filter:4dd26c049d6240e6640106bb8805ec958e03d9ad79eb2823152b9a92156554a9 she=
ll
filter:4dd26c049d6240e6640106bb8805ec958e03d9ad79eb2823152b9a92156554a9 xml
filter:bd2c589d0cb083d7b8a7696b98e0a344b2501ecd2d91a7fe447028cb47f75210)
[  520s] dnf5daemon-server.x86_64: E: dbus-file-unauthorized (Badness: 1000=
0)
/usr/share/dbus-1/system-services/org.rpm.dnf.v0.service (sha256 file digest
default filter:8dff187bd14e516fd976731fb4ab3996bb92b36dfa944733655641a6aec2=
15e1
shell filter:8dff187bd14e516fd976731fb4ab3996bb92b36dfa944733655641a6aec215=
e1
xml filter:<failed-to-calculate>)
[  520s] Packaging D-Bus services requires a review and whitelisting by the
SUSE
[  520s] security team. If the package is intended for inclusion in any SUSE
product
[  520s] please open a bug report to request review of the package by the
security
[  520s] team. Please refer to
[  520s]
https://en.opensuse.org/openSUSE:Package_security_guidelines#audit=
_bugs for
[  520s] more information.

This blocks my submit request: https://build.opensuse.org/request/show/1134536

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17031970702.F6a207Bad.23908--


--17032403631.7d96Cd2.24436
Date: Fri, 22 Dec 2023 10:19:23 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218344

            Bug ID: 1218344
           Summary: VUL-0: CVE-2023-51713: proftpd: make_ftp_cmd in main.c has a one-byte out-of-bounds read, and daemon crash
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389175/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: chris-at-computersalat.de
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds
read, and daemon crash, because of mishandling of quote/backslash semantics.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-51713
https://github.com/proftpd/proftpd/issues/1683

Patch:
https://github.com/proftpd/proftpd/commit/97bbe68363ccf2de0c07f67170ec64a8b=
4d62592
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17032403631.7d96Cd2.24436
Date: Fri, 22 Dec 2023 10:19:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218344

          Summary
          VUL-0: CVE-2023-51713: proftpd: make_ftp_cmd in main.c has a =
one-byte out-of-bounds read, and daemon crash

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389175/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Network

          Assignee
          chris@computersalat.de

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-by=
te out-of-bounds
read, and daemon crash, because of mishandling of quote/backslash semantics.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-51713
https://github.c=
om/proftpd/proftpd/issues/1683

Patch:
https://github.com/proftpd/proftpd/commit/97bbe68363ccf=
2de0c07f67170ec64a8b4d62592

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17032403631.7d96Cd2.24436--


--17032561153.a162E1.24901
Date: Fri, 22 Dec 2023 14:41:55 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218360

            Bug ID: 1218360
           Summary: VUL-0: CVE-2023-49084: cacti: multiple vulnerabilities in link.php file
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389152/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: nix-at-opensuse.org
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti is a robust performance and fault management framework and a frontend=
 to
RRDTool - a Time Series Database (TSDB). While using the detected SQL Injec=
tion
and insufficient processing of the include file path, it is possible to exe=
cute
arbitrary code on the server. Exploitation of the vulnerability is possible=
 for
an authorized user. The vulnerable component is the `link.php`. Impact of t=
he
vulnerability execution of arbitrary code on the server.=20

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49084
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-86vp

Patch:
https://github.com/Cacti/cacti/commit/c7c91bf4bdb87769351782b61cda6d89e8e82=
343
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17032561153.a162E1.24901
Date: Fri, 22 Dec 2023 14:41:55 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218360

          Summary
          VUL-0: CVE-2023-49084: cacti: multiple vulnerabilities in lin=
k.php file

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389152/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          nix@opensuse.org

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti is a robust performance and fault management framework=
 and a frontend to
RRDTool - a Time Series Database (TSDB). While using the detected SQL Injec=
tion
and insufficient processing of the include file path, it is possible to exe=
cute
arbitrary code on the server. Exploitation of the vulnerability is possible=
 for
an authorized user. The vulnerable component is the `link.php`. Impact of t=
he
vulnerability execution of arbitrary code on the server.=20

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49084
https://github.com/Cacti/cacti/security/advisories/GHSA-pfh9-gwm6-8=
6vp

Patch:
https://github.com/Cacti/cacti/commit/c7c91bf4bdb8776935178=
2b61cda6d89e8e82343

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17032561153.a162E1.24901--


--17032592733.7711A268.24993
Date: Fri, 22 Dec 2023 15:34:33 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218365

            Bug ID: 1218365
           Summary: [Build 20231221] cmake:full 3.28 fails to build on ppc64le
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC-64
               URL: https://openqa.opensuse.org/tests/3832324/modules/libq
                    t5_qtbase/steps/48
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

https://build.opensuse.org/package/live_build_log/openSUSE:Factory:PowerPC/=
cmake:full/standard/ppc64le

test suite fails on ppc64le - repeateldy

openQA test in scenario
opensuse-Tumbleweed-DVD-ppc64le-extra_tests_on_kde@ppc64le fails in
[libqt5_qtbase](https://openqa.opensuse.org/tests/3832324/modules/libqt5_qt=
base/steps/48)

## Test suite description

## Reproducible

Fails since (at least) Build
[20231221](https://openqa.opensuse.org/tests/3831092)

## Expected result

Last good: [20231219](https://openqa.opensuse.org/tests/3825238) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dppc64le&distri=3Do=
pensuse&flavor=3DDVD&machine=3Dppc64le&test=3Dextra_tests_on_kde&version=3D=
Tumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17032592733.7711A268.24993
Date: Fri, 22 Dec 2023 15:34:33 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218365

          Summary
          [Build 20231221] cmake:full 3.28 fails to build on ppc64le

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          PowerPC-64

          URL
          https://openqa.opensuse.org/tests/3832324/modules/libqt5_qtba=
se/steps/48

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          dimstar@opensuse.org

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

https://build.opensuse.org/package/=
live_build_log/openSUSE:Factory:PowerPC/cmake:full/standard/ppc64le

test suite fails on ppc64le - repeateldy

openQA test in scenario
opensuse-Tumbleweed-DVD-ppc64le-extra_tests_on_kde@ppc64le fails in
[libqt5_qtbase](https://openqa.opensuse.org/tests/3832324/modules=
/libqt5_qtbase/steps/48)

## Test suite description

## Reproducible

Fails since (at least) Build
[20231221](https://op=
enqa.opensuse.org/tests/3831092)

## Expected result

Last good: [20231219](https://openqa.opensuse.org/tests/3825238) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/test=
s/latest?arch=3Dppc64le&distri=3Dopensuse&flavor=3DDVD&machine=
=3Dppc64le&test=3Dextra_tests_on_kde&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17032592733.7711A268.24993--


--17032598231.D0CD8.25014
Date: Fri, 22 Dec 2023 15:43:43 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218366

            Bug ID: 1218366
           Summary: VUL-0: CVE-2023-49086: cacti: XSS when adding new devices
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389161/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: pstivanin-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: andrea.mattiazzo-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti is a robust performance and fault management framework and a frontend=
 to
RRDTool - a Time Series Database (TSDB). Bypassing an earlier fix
(CVE-2023-39360) that leads to a DOM XSS attack.
Exploitation of the vulnerability is possible for an authorized user. The
vulnerable component is the `graphs_new.php`. Impact of the vulnerability -
execution of arbitrary javascript code in the attacked user's browser. This
issue has been patched in version 1.2.26.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49086
https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-59pr
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17032598231.D0CD8.25014
Date: Fri, 22 Dec 2023 15:43:43 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218366

          Summary
          VUL-0: CVE-2023-49086: cacti: XSS when adding new devices

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389161/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          pstivanin@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          andrea.mattiazzo@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti is a robust performance and fault management framework=
 and a frontend to
RRDTool - a Time Series Database (TSDB). Bypassing an earlier fix
(CVE-2023-39360) that leads to a DOM XSS attack.
Exploitation of the vulnerability is possible for an authorized user. The
vulnerable component is the `graphs_new.php`. Impact of the vulnerability -
execution of arbitrary javascript code in the attacked user's browser. This
issue has been patched in version 1.2.26.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49086
https://github.com/Cacti/cacti/security/advisories/GHSA-wc73-r2vw-5=
9pr

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17032598231.D0CD8.25014--


--17034075440.fF1EA7F6.25445
Date: Sun, 24 Dec 2023 08:45:44 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218378

            Bug ID: 1218378
           Summary: VUL-0: CVE-2023-49085: cacti: Multiple vulnerabilities
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389219/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: pstivanin-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: meissner-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework. In
versions 1.2.25 and prior, it is possible to execute arbitrary SQL code thr=
ough
the `pollers.php` script. An authorized user may be able to execute arbitra=
ry
SQL code. The vulnerable component is the `pollers.php`. Impact of the
vulnerability - arbitrary SQL code execution. As of time of publication, a
patch does not appear to exist.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49085
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17034075440.fF1EA7F6.25445
Date: Sun, 24 Dec 2023 08:45:44 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218378

          Summary
          VUL-0: CVE-2023-49085: cacti: Multiple vulnerabilities

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389219/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          pstivanin@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          meissner@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework. In
versions 1.2.25 and prior, it is possible to execute arbitrary SQL code thr=
ough
the `pollers.php` script. An authorized user may be able to execute arbitra=
ry
SQL code. The vulnerable component is the `pollers.php`. Impact of the
vulnerability - arbitrary SQL code execution. As of time of publication, a
patch does not appear to exist.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49085

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17034075440.fF1EA7F6.25445--


--17034076502.7a35e052.25454
Date: Sun, 24 Dec 2023 08:47:30 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218379

            Bug ID: 1218379
           Summary: VUL-0: CVE-2023-49088: cacti: incomplete fix for CVE-2023-39515, XSS attack via data_debug.php
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389220/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: pstivanin-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: meissner-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti is an open source operational monitoring and fault management framewo=
rk.
The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it
enables an adversary to have a victim browser execute malicious code when a
victim user hovers their mouse over the malicious data source path in
`data_debug.php`. To perform the cross-site scripting attack, the adversary
needs to be an authorized cacti user with the following permissions: `Gener=
al
Administration>Sites/Devices/Data`. The victim of this attack could be any
account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of
time of publication, no complete fix has been included in Cacti.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49088
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17034076502.7a35e052.25454
Date: Sun, 24 Dec 2023 08:47:30 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218379

          Summary
          VUL-0: CVE-2023-49088: cacti: incomplete fix for CVE-2023-395=
15, XSS attack via data_debug.php

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389220/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          pstivanin@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          meissner@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti is an open source operational monitoring and fault man=
agement framework.
The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it
enables an adversary to have a victim browser execute malicious code when a
victim user hovers their mouse over the malicious data source path in
`data_debug.php`. To perform the cross-site scripting attack, the adversary
needs to be an authorized cacti user with the following permissions: `Gener=
al
Administration>Sites/Devices/Data`. The victim of this attack could be a=
ny
account with permissions to view `http://<HOST>/cacti/data_debug.php`=
. As of
time of publication, no complete fix has been included in Cacti.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-49088

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17034076502.7a35e052.25454--


--17034083590.11Fbd7ae.25472
Date: Sun, 24 Dec 2023 08:59:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218381

            Bug ID: 1218381
           Summary: VUL-0: CVE-2023-51448: cacti: blind SQL injection in SNMP notification receivers feature
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389228/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: pstivanin-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: meissner-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Cacti provides an operational monitoring and fault management framework.
Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SN=
MP
Notification Receivers feature in the file `=E2=80=98managers.php=E2=80=99`=
. An authenticated
attacker with the =E2=80=9CSettings/Utilities=E2=80=9D permission can send =
a crafted HTTP GET
request to the endpoint `=E2=80=98/cacti/managers.php=E2=80=99` with an SQL=
i payload in the
`=E2=80=98selected_graphs_array=E2=80=99` HTTP GET parameter. As of time of=
 publication, no
patched versions exist.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-51448
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17034083590.11Fbd7ae.25472
Date: Sun, 24 Dec 2023 08:59:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218381

          Summary
          VUL-0: CVE-2023-51448: cacti: blind SQL injection in SNMP not=
ification receivers feature

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389228/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          pstivanin@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          meissner@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Cacti provides an operational monitoring and fault managemen=
t framework.
Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SN=
MP
Notification Receivers feature in the file `=E2=80=98managers.php=E2=80=99`=
. An authenticated
attacker with the =E2=80=9CSettings/Utilities=E2=80=9D permission can send =
a crafted HTTP GET
request to the endpoint `=E2=80=98/cacti/managers.php=E2=80=99` with an SQL=
i payload in the
`=E2=80=98selected_graphs_array=E2=80=99` HTTP GET parameter. As of time of=
 publication, no
patched versions exist.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-51448

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17034083590.11Fbd7ae.25472--


--17034086911.ADC18.25475
Date: Sun, 24 Dec 2023 09:04:51 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218382

            Bug ID: 1218382
           Summary: VUL-0: CVE-2023-50254: deepin-reader: RCE via file overwrite via crafted docx document
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389225/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: hillwoodroc-at-gmail.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: meissner-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Deepin Linux's default document reader `deepin-reader` software suffers fro=
m a
serious vulnerability in versions prior to 6.0.7 due to a design flaw that
leads to remote command execution via crafted docx document. This is a file
overwrite vulnerability. Remote code execution (RCE) can be achieved by
overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered wh=
en
the user opens the terminal. Version 6.0.7 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50254
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17034086911.ADC18.25475
Date: Sun, 24 Dec 2023 09:04:51 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218382

          Summary
          VUL-0: CVE-2023-50254: deepin-reader: RCE via file overwrite =
via crafted docx document

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389225/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          hillwoodroc@gmail.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          meissner@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Deepin Linux's default document reader `deepin-reader` softw=
are suffers from a
serious vulnerability in versions prior to 6.0.7 due to a design flaw that
leads to remote command execution via crafted docx document. This is a file
overwrite vulnerability. Remote code execution (RCE) can be achieved by
overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered wh=
en
the user opens the terminal. Version 6.0.7 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-50254

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17034086911.ADC18.25475--


--17034105081.bb07226E.25505
Date: Sun, 24 Dec 2023 09:35:08 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218387

            Bug ID: 1218387
           Summary: VUL-0: CVE-2023-51766: exim: SMTP smuggling attack
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/389285/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: poeml-at-cmdline.net
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: meissner-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Exim through 4.97 allows SMTP smuggling in certain configurations. Remote
attackers can use a published exploitation technique to inject e-mail messa=
ges
that appear to originate from the Exim server, allowing bypass of an SPF
protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but s=
ome
other popular e-mail servers do not.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-51766
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17034105081.bb07226E.25505
Date: Sun, 24 Dec 2023 09:35:08 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218387

          Summary
          VUL-0: CVE-2023-51766: exim: SMTP smuggling attack

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/389285/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          poeml@cmdline.net

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          meissner@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Exim through 4.97 allows SMTP smuggling in certain configura=
tions. Remote
attackers can use a published exploitation technique to inject e-mail messa=
ges
that appear to originate from the Exim server, allowing bypass of an SPF
protection mechanism. This occurs because Exim supports <LF>.<CR&g=
t;<LF> but some
other popular e-mail servers do not.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2023-51766

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17034105081.bb07226E.25505--


--17036598351.0Aa1C8d93.26477
Date: Wed, 27 Dec 2023 06:50:35 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218410

            Bug ID: 1218410
           Summary: hardware/iwd: version 2.11 now available
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Network
          Assignee: screening-team-bugs-at-suse.de
          Reporter: johndoe1352460-at-outlook.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

IWD has a new version 2.11 available.

https://git.kernel.org/pub/scm/network/wireless/iwd.git/tag/?h=3D2.11
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17036598351.0Aa1C8d93.26477
Date: Wed, 27 Dec 2023 06:50:35 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218410

          Summary
          hardware/iwd: version 2.11 now available

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Network

          Assignee
          screening-team-bugs@suse.de

          Reporter
          johndoe1352460@outlook.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

IWD has a new version 2.11 available.

https://git.kernel.org/pub/scm/network/wireless/iwd.git/tag/?h=3D2=
.11

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17036598351.0Aa1C8d93.26477--


body:
--17037469652.AAFF2a.27361
Date: Thu, 28 Dec 2023 07:02:45 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1218424

            Bug ID: 1218424
           Summary: go1.22 release tracking
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jkowalczyk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

go1.22 (expected February 2024) is a major release of Go.
Minor releases of go1.22.x will be provided through February 2025.
This issue tracks go1.22.x releases packaged and submitted initially
to openSUSE:Factory and can be referenced in submissions to
additional repositories.

Go Release Cycle
https://github.com/golang/go/wiki/Go-Release-Cycle

Go Release history
https://golang.org/doc/devel/release.html
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17037469652.AAFF2a.27361
Date: Thu, 28 Dec 2023 07:02:45 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1218424

          Summary
          go1.22 release tracking

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          jkowalczyk@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

go1.22 (expected February 2024) is a major release of Go.
Minor releases of go1.22.x will be provided through February 2025.
This issue tracks go1.22.x releases packaged and submitted initially
to openSUSE:Factory and can be referenced in submissions to
additional repositories.

Go Release Cycle
https://gith=
ub.com/golang/go/wiki/Go-Release-Cycle

Go Release history
https://golang.org/do=
c/devel/release.html

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17037469652.AAFF2a.27361--

summary: go1.22 release tracking