August 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2093320] New: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations
by bugzilla＠redhat.com 13 Jan '26

13 Jan '26

https://bugzilla.redhat.com/show_bug.cgi?id=2093320 Bug ID: 2093320 Summary: CVE-2022-30785 ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093320

1 14

[Bug 2093323] New: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all]
by bugzilla＠redhat.com 13 Jan '26

13 Jan '26

https://bugzilla.redhat.com/show_bug.cgi?id=2093323 Bug ID: 2093323 Summary: CVE-2022-30785 ntfs-3g-system-compression: ntfs-3g: a file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093323

1 7

[Bug 2093314] New: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value
by bugzilla＠redhat.com 13 Jan '26

13 Jan '26

https://bugzilla.redhat.com/show_bug.cgi?id=2093314 Bug ID: 2093314 Summary: CVE-2022-30784 ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093314

1 17

[Bug 2093315] New: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all]
by bugzilla＠redhat.com 13 Jan '26

13 Jan '26

https://bugzilla.redhat.com/show_bug.cgi?id=2093315 Bug ID: 2093315 Summary: CVE-2022-30784 ntfs-3g-system-compression: ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093315

1 5

[Bug 2093305] New: CVE-2022-30783 ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic
by bugzilla＠redhat.com 13 Jan '26

13 Jan '26

https://bugzilla.redhat.com/show_bug.cgi?id=2093305 Bug ID: 2093305 Summary: CVE-2022-30783 ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: ddepaula(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, jferlan(a)redhat.com, kparal(a)redhat.com, ngompa13(a)gmail.com, rjones(a)redhat.com, spotrh(a)gmail.com, virt-maint(a)redhat.com Target Milestone: --- Classification: Other An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. References: https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58 https://github.com/tuxera/ntfs-3g/releases -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093305

1 14

[Bug 2093308] New: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [epel-all]
by bugzilla＠redhat.com 13 Jan '26

13 Jan '26

https://bugzilla.redhat.com/show_bug.cgi?id=2093308 Bug ID: 2093308 Summary: CVE-2022-30783 ntfs-3g-system-compression: ntfs-3g: invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: ntfs-3g-system-compression Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: kparal(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kparal(a)redhat.com, ngompa13(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora EPEL. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093308

1 7

[Bug 2093731] New: zbarimg does not read a Code 128 barcode
by bugzilla＠redhat.com 04 Jun '25

04 Jun '25

https://bugzilla.redhat.com/show_bug.cgi?id=2093731 Bug ID: 2093731 Summary: zbarimg does not read a Code 128 barcode Product: Fedora Version: 36 Status: NEW Component: zbar Severity: high Assignee: gwync(a)protonmail.com Reporter: cristian.ciupitu(a)yahoo.com QA Contact: extras-qa(a)fedoraproject.org CC: dougsland(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, gwync(a)protonmail.com, mchehab(a)infradead.org, mr.marcelo.barbosa(a)gmail.com, negativo17(a)gmail.com Target Milestone: --- Classification: Fedora Created attachment 1886898 --> https://bugzilla.redhat.com/attachment.cgi?id=1886898&action=edit Code 128 barcode Description of problem: zbarimg does not read a Code 128 barcode Version-Release number of selected component (if applicable): zbar-0.23.90-1.fc36.x86_64 How reproducible: Every time Steps to Reproduce: 1. zbarimg barcode.png Actual results: scanned 0 barcode symbols from 1 images in 0 seconds WARNING: barcode data was not detected in some image(s) Things to check: - is the barcode type supported? Currently supported symbologies are: . EAN/UPC (EAN-13, EAN-8, EAN-2, EAN-5, UPC-A, UPC-E, ISBN-10, ISBN-13) . DataBar, DataBar Expanded . Code 128 . Code 93 . Code 39 . Codabar . Interleaved 2 of 5 . QR code . SQ code . PDF 417 - is the barcode large enough in the image? - is the barcode mostly in focus? - is there sufficient contrast/illumination? - If the symbol is split in several barcodes, are they combined in one image? - Did you enable the barcode type? some EAN/UPC codes are disabled by default. To enable all, use: $ zbarimg -S*.enable <files> Please also notice that some variants take precedence over others. Due to that, if you want, for example, ISBN-10, you should do: $ zbarimg -Sisbn10.enable <files> Expected results: (Code 128) 755897201062022179.73 Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2093731

1 10

[Bug 2097004] New: stalonetray-0.8.4 is available
by bugzilla＠redhat.com 13 Feb '25

13 Feb '25

https://bugzilla.redhat.com/show_bug.cgi?id=2097004 Bug ID: 2097004 Summary: stalonetray-0.8.4 is available Product: Fedora Version: rawhide Status: NEW Component: stalonetray Keywords: FutureFeature, Triaged Assignee: fedora(a)me.benboeckel.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, fedora(a)me.benboeckel.net Target Milestone: --- Classification: Fedora Releases retrieved: 0.8.4 Upstream release that is considered latest: 0.8.4 Current version/release in rawhide: 0.8.3-16.fc36 URL: https://github.com/kolbusa/stalonetray Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/5713/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/stalonetray -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2097004

1 4

[Bug 2069364] New: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function
by bugzilla＠redhat.com 09 Jan '25

09 Jan '25

https://bugzilla.redhat.com/show_bug.cgi?id=2069364 Bug ID: 2069364 Summary: CVE-2021-43085 openssl: Insecure permissions vulnerability due to an error in the implementation of the CMAC_Final() function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aos-bugs(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, berrange(a)redhat.com, bmaxwell(a)redhat.com, bootloader-eng-team(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, cfergeau(a)redhat.com, chazlett(a)redhat.com, crobinso(a)redhat.com, crypto-team(a)lists.fedoraproject.org, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbelyavs(a)redhat.com, dhalasz(a)redhat.com, dkreling(a)redhat.com, dkuc(a)redhat.com, dosoudil(a)redhat.com, dueno(a)redhat.com, elima(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, erik-fedora(a)vanpienbroek.nl, f4bug(a)amsat.org, fjansen(a)redhat.com, fjuma(a)redhat.com, fmartine(a)redhat.com, gparvin(a)redhat.com, gzaronik(a)redhat.com, iweiss(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jkoehler(a)redhat.com, jochrist(a)redhat.com, jramanat(a)redhat.com, jwong(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kraxel(a)redhat.com, ktietz(a)redhat.com, lgao(a)redhat.com, marcandre.lureau(a)redhat.com, michal.skrivanek(a)redhat.com, michel(a)michel-slm.name, micjohns(a)redhat.com, mjg59(a)srcf.ucam.org, mosmerov(a)redhat.com, mperina(a)redhat.com, msochure(a)redhat.com, mspacek(a)redhat.com, msvehla(a)redhat.com, mturk(a)redhat.com, njean(a)redhat.com, nobody(a)redhat.com, nwallace(a)redhat.com, pahickey(a)redhat.com, pbonzini(a)redhat.com, pjindal(a)redhat.com, pjones(a)redhat.com, pmackay(a)redhat.com, redhat-bugzilla(a)linuxnetz.de, rfreiman(a)redhat.com, rharwood(a)redhat.com, rh-spice-bugs(a)redhat.com, rjones(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sahana(a)redhat.com, sbonazzo(a)redhat.com, smaestri(a)redhat.com, stcannon(a)redhat.com, sthirugn(a)redhat.com, szappis(a)redhat.com, tmeszaro(a)redhat.com, tm(a)t8m.info, tom.jenkinson(a)redhat.com, virt-maint(a)lists.fedoraproject.org, virt-maint(a)redhat.com, vkrizan(a)redhat.com, vkumar(a)redhat.com, vmugicag(a)redhat.com Target Milestone: --- Classification: Other An Insecure Permissions vulnerability exists in the OpenSSL Project 3.0 due to an error in the implementation of the CMAC_Final() function. Upstream issue: https://github.com/openssl/openssl/issues/16873 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2069364

1 4

[Bug 2121894] New: builtins.h requires mpc.h from libmpc-devel
by bugzilla＠redhat.com 13 Aug '24

13 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2121894 Bug ID: 2121894 Summary: builtins.h requires mpc.h from libmpc-devel Product: Fedora Version: 36 Hardware: x86_64 OS: Linux Status: NEW Component: cross-gcc Severity: medium Assignee: dhowells(a)redhat.com Reporter: elliott(a)hpe.com QA Contact: extras-qa(a)fedoraproject.org CC: dan(a)danny.cz, dhowells(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, lkundrak(a)v3.sk Target Milestone: --- Classification: Fedora Description of problem: Cross compiles of the linux kernel 6.0-rc1 allmodconfig fail for arm, arm64, mips, powerpc, and s390. This originates in scripts/gcc-plugins/Kconfig, which has this entry: menuconfig GCC_PLUGINS bool "GCC plugins" depends on HAVE_GCC_PLUGINS depends on CC_IS_GCC depends on $(success,test -e $(shell,$(CC) -print-file-name=plugin)/include/plugin-version.h) default y depends on $(success,test -e $(shell,$(CC) -print-file-name=plugin)/include/plugin-version.h) arch/sparc/Kconfig does not include select HAVE_GCC_PLUGINS but all the others do. The -print-file-name tests passes for all the cross-compilers, but does not for native x86: $ gcc -print-file-name=plugin plugin $ powerpc64-linux-gnu-gcc -print-file-name=plugin /usr/lib/gcc/powerpc64-linux-gnu/12/plugin $ aarch64-linux-gnu-gcc -print-file-name=plugin /usr/lib/gcc/aarch64-linux-gnu/12/plugin $ find /usr/lib/gcc -name plugin-version.h /usr/lib/gcc/s390x-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/aarch64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/powerpc64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/sparc64-linux-gnu/12/plugin/include/plugin-version.h /usr/lib/gcc/arm-linux-gnueabi/12/plugin/include/plugin-version.h /usr/lib/gcc/mips64-linux-gnu/12/plugin/include/plugin-version.h so the .x86 .config file only gets: CONFIG_HAVE_GCC_PLUGINS=y while the others get that, CONFIG_GCC_PLUGINS, and a several specific plugins: build-arm64/.config:CONFIG_HAVE_GCC_PLUGINS=y build-arm64/.config:CONFIG_GCC_PLUGINS=y build-arm64/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-arm64/.config:CONFIG_GCC_PLUGIN_STACKLEAK=y build-arm64/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-arm/.config:CONFIG_HAVE_GCC_PLUGINS=y build-arm/.config:CONFIG_GCC_PLUGINS=y build-arm/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-arm/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-mips/.config:CONFIG_HAVE_GCC_PLUGINS=y build-mips/.config:CONFIG_GCC_PLUGINS=y build-mips/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-mips/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-powerpc/.config:CONFIG_HAVE_GCC_PLUGINS=y build-powerpc/.config:CONFIG_GCC_PLUGINS=y build-powerpc/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-powerpc/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-s390/.config:CONFIG_HAVE_GCC_PLUGINS=y build-s390/.config:CONFIG_GCC_PLUGINS=y build-s390/.config:CONFIG_GCC_PLUGIN_LATENT_ENTROPY=y build-s390/.config:CONFIG_GCC_PLUGIN_RANDSTRUCT=y build-x86/.config:CONFIG_HAVE_GCC_PLUGINS=y A header included by each of the plugins, scripts/gcc-plugins/gcc-common.h, includes a GCC header file called builtins.h that includes <mpc.h>, which does not exist anywhere on my system. That causes errors early in the build on all of those architectures. Version-Release number of selected component (if applicable): gcc-[each architecture]-linux-gnu 12.1.1 How reproducible: 100% Steps to Reproduce: Example for arm 32-bit: 1. make ARCH=arm O=build-arm CROSS_COMPILE=arm-linux-gnu- allmodconfig 2. make ARCH=arm O=build-arm CROSS_COMPILE=arm-linux-gnu- -j 55 Actual results: For each "GCC plugin", an error like this terminates the make: In file included from ../scripts/gcc-plugins/gcc-common.h:95, from ../scripts/gcc-plugins/latent_entropy_plugin.c:78: /usr/lib/gcc/aarch64-linux-gnu/12/plugin/include/builtins.h:23:10: fatal error: mpc.h: No such file or directory 23 | #include <mpc.h> | ^~~~~~~ compilation terminated. Expected results: no errors Additional info: That mpc.h file is provided by the libmpc-devel package. 1. Please add a dependency for the libmpc-devel package from each gcc cross-compiler package that includes a builtins.h file 2. Please investigate whether the native gcc package not having plugins is correct, despite the kernel x86 allmodconfig expecting them by specifying CONFIG_HAVE_GCC_PLUGINS=y -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2121894

1 6

2026

2025

2024

2023

2022

2021

Epel-packagers-sig August 2022