November 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2140597] CVE-2022-37603 loader-utils:Regular expression denial of service
by bugzilla＠redhat.com 07 Nov '22

07 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2140597 Borja Tarraso <btarraso(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2140658, 2140660, 2140659, | |2140657 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2140597

1 0

[Bug 2140597] CVE-2022-37603 loader-utils:Regular expression denial of service
by bugzilla＠redhat.com 07 Nov '22

07 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2140597 --- Comment #2 from Vipul Nair <vinair(a)redhat.com> --- Created cockatrice tracking bugs for this issue: Affects: fedora-all [bug 2140606] Created couchdb tracking bugs for this issue: Affects: fedora-all [bug 2140607] Created golang-entgo-ent tracking bugs for this issue: Affects: fedora-all [bug 2140608] Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2140609] Created mozjs68 tracking bugs for this issue: Affects: fedora-all [bug 2140610] Created mozjs78 tracking bugs for this issue: Affects: fedora-all [bug 2140611] Created seamonkey tracking bugs for this issue: Affects: epel-all [bug 2140605] Affects: fedora-all [bug 2140612] Created yarnpkg tracking bugs for this issue: Affects: fedora-all [bug 2140613] Created zuul tracking bugs for this issue: Affects: fedora-all [bug 2140614] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2140597

1 0

[Bug 2140597] CVE-2022-37603 loader-utils:Regular expression denial of service
by bugzilla＠redhat.com 07 Nov '22

07 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2140597 Vipul Nair <vinair(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2140612, 2140605, 2140608, | |2140613, 2140609, 2140610, | |2140614, 2140611, 2140606, | |2140607 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2140605 [Bug 2140605] CVE-2022-37603 seamonkey: loader-utils:Regular expression denial of service [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140606 [Bug 2140606] CVE-2022-37603 cockatrice: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140607 [Bug 2140607] CVE-2022-37603 couchdb: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140608 [Bug 2140608] CVE-2022-37603 golang-entgo-ent: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140609 [Bug 2140609] CVE-2022-37603 grafana: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140610 [Bug 2140610] CVE-2022-37603 mozjs68: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140611 [Bug 2140611] CVE-2022-37603 mozjs78: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140612 [Bug 2140612] CVE-2022-37603 seamonkey: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140613 [Bug 2140613] CVE-2022-37603 yarnpkg: loader-utils:Regular expression denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2140614 [Bug 2140614] CVE-2022-37603 zuul: loader-utils:Regular expression denial of service [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2140597

1 0

[Bug 2140597] CVE-2022-37603 loader-utils:Regular expression denial of service
by bugzilla＠redhat.com 07 Nov '22

07 Nov '22

1 0

[Bug 2138022] Unable to start Scribus after running dnf upgrade
by bugzilla＠redhat.com 04 Nov '22

04 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2138022 --- Comment #14 from Adam Williamson <awilliam(a)redhat.com> --- See the other bug for details, there's no point duplicating the discussion. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2138022

1 0

[Bug 2138022] Unable to start Scribus after running dnf upgrade
by bugzilla＠redhat.com 04 Nov '22

04 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2138022 --- Comment #13 from Michael J Gruber <mjg(a)fedoraproject.org> --- (In reply to Adam Williamson from comment #12) > Well, really, the problem is that libxml2 changed ABI without changing > soname. That is not supposed to happen. We're covering that in We certainly agree on that. There are two options to react: - adjust to the new libxml build (which should not have been pushed) by rebuilding depending packages - revert libxml to the old ABI Mixing these won't work, obviously. > https://bugzilla.redhat.com/show_bug.cgi?id=2139546 . I'm sending a build of > libxml2 which should restore all the important lost symbols and hopefully > make the existing builds of dependent packages work (thanks mtasaka for > figuring out the options). What determines "important"? Does that restore the old ABI completely? Have you confirmed that existing builds for depending packages will indeed work with your libxml rebuild? Why not revert to the previous libxml2 build (with epoch bump)? I have a bad feeling that packages like GraphicsMagick will need yet another rebuild against your libxml build. In that case we'd better adjust to the reduced symbol set since upstream deprecated parts of the ABI. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2138022

1 0

[Bug 2139903] New: bear: FTBFS in Fedora Rawhide
by bugzilla＠redhat.com 03 Nov '22

03 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2139903 Bug ID: 2139903 Summary: bear: FTBFS in Fedora Rawhide Product: Fedora Version: rawhide URL: https://koschei.fedoraproject.org/package/bear Status: NEW Component: bear Assignee: dan.cermak(a)cgc-instruments.com Reporter: vitaly(a)easycoding.org QA Contact: extras-qa(a)fedoraproject.org CC: code(a)musicinmybrain.net, dan.cermak(a)cgc-instruments.com, epel-packagers-sig(a)lists.fedoraproject.org, mgansser(a)netcom-mail.de, thofmann(a)fedoraproject.org Target Milestone: --- Classification: Fedora Description of problem: Package bear fails to build from source in Fedora Rawhide. Version-Release number of selected component (if applicable): bear-3.0.20-3.fc38 Steps to Reproduce: koji build --scratch f38 bear-3.0.20-3.fc38.src.rpm Additional info: n/a -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2139903

1 1

[Bug 2138022] Unable to start Scribus after running dnf upgrade
by bugzilla＠redhat.com 03 Nov '22

03 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2138022 Adam Williamson <awilliam(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |DUPLICATE CC| |awilliam(a)redhat.com Status|ON_QA |CLOSED Last Closed| |2022-11-03 17:50:48 --- Comment #12 from Adam Williamson <awilliam(a)redhat.com> --- Well, really, the problem is that libxml2 changed ABI without changing soname. That is not supposed to happen. We're covering that in https://bugzilla.redhat.com/show_bug.cgi?id=2139546 . I'm sending a build of libxml2 which should restore all the important lost symbols and hopefully make the existing builds of dependent packages work (thanks mtasaka for figuring out the options). *** This bug has been marked as a duplicate of bug 2139546 *** -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2138022

1 0

[Bug 2104427] CVE-2022-33099 lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling
by bugzilla＠redhat.com 02 Nov '22

02 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2104427 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:7329 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2104427

1 0

[Bug 2104427] CVE-2022-33099 lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling
by bugzilla＠redhat.com 02 Nov '22

02 Nov '22

https://bugzilla.redhat.com/show_bug.cgi?id=2104427 --- Comment #14 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:7329 https://access.redhat.com/errata/RHSA-2022:7329 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2104427

1 0

2025

2024

2023

2022

2021

Epel-packagers-sig November 2022