https://bugzilla.redhat.com/show_bug.cgi?id=2042511
Bug ID: 2042511
Summary: CVE-2022-22815 python-pillow: improperly initializes
ImagePath.Path in path_getbbox() in path.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: bdettelb(a)redhat.com, cstratak(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
infra-sig(a)lists.fedoraproject.org,
manisandro(a)gmail.com, miminar(a)redhat.com,
orion(a)nwra.com, python-maint(a)redhat.com,
python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com
Target Milestone: ---
Classification: Other
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes
ImagePath.Path.
References:
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da…https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2042511
https://bugzilla.redhat.com/show_bug.cgi?id=2176591
Bug ID: 2176591
Summary: msmtp package should provide /usr/bin/sendmail
Product: Fedora
Version: rawhide
Status: NEW
Component: msmtp
Assignee: lemenkov(a)gmail.com
Reporter: yann(a)droneaud.fr
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
gbcox(a)bzb.us, lemenkov(a)gmail.com, ndevos(a)redhat.com,
wart(a)kobold.org
Target Milestone: ---
Classification: Fedora
Description of problem:
msmtp package is not declared to provide /usr/sbin/sendmail. But installing
the package, makes msmtp the "mta" (see alternatives --display mta), and thus
provide /usr/bin/sendmail.
Some packages, see below, requires /usr/sbin/sendmail
BackupPC-0:4.4.0-9.fc38.x86_64
alpine-0:2.26-3.fc38.x86_64
arpwatch-14:3.3-14.fc39.x86_64
asterisk-voicemail-0:18.12.1-1.fc38.3.x86_64
certwatch-mod_ssl-0:1.2-12.fc38.x86_64
fail2ban-sendmail-0:1.0.2-2.fc38.noarch
fvwm-0:2.7.0-3.fc38.x86_64
hylafax+-client-0:7.0.7-1.fc39.i686
hylafax+-client-0:7.0.7-1.fc39.x86_64
mgetty-0:1.2.1-18.fc38.x86_64
quilt-0:0.67-4.fc39.noarch
redhat-lsb-core-0:4.1-60.fc38.i686
redhat-lsb-core-0:4.1-60.fc38.x86_64
spamass-milter-0:0.4.0-24.fc38.x86_64
uudeview-0:0.5.20-51.fc38.x86_64
websec-0:1.9.0-34.fc38.noarch
x509watch-0:0.6.1-14.fc38.noarch
Thus, when asking dnf to install one of the packages above, it will also
install another mta from the list below if none of them is already installed.
Likely esmtp in my experience (likely because it's the first alphabetically).
esmtp-0:1.2-21.fc38.x86_64
exim-0:4.96-8.fc38.x86_64
opensmtpd-0:6.8.0p2-11.fc38.x86_64
postfix-2:3.7.4-1.fc38.x86_64
sendmail-0:8.17.1-8.fc38.x86_64
ssmtp-0:2.64-32.fc38.x86_64
Having msmtp already installed should be enough to satisfy /usr/sbin/sendmail
requirement, and no other MTA should be installed as part of installing another
package.
Version-Release number of selected component (if applicable):
msmtp-1.8.23-1.fc38.x86_64
How reproducible:
When installing a package that requires /usr/bin/sendmail when no other MTA
is installed.
Steps to Reproduce:
1. dnf install msmtp
2. dnf install arpwatch
Actual results:
"dnf install arpwatch" installs arpwatch and esmtp
Expected results:
"dnf install arpwatch" would install only arpwatch
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176591
https://bugzilla.redhat.com/show_bug.cgi?id=2208403
Bug ID: 2208403
Summary: busybox-1.36.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: busybox
Keywords: FutureFeature, Triaged
Assignee: spotrh(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, davide(a)cavalca.name,
dvlasenk(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
spotrh(a)gmail.com
Target Milestone: ---
Classification: Fedora
Releases retrieved: 1.36.1
Upstream release that is considered latest: 1.36.1
Current version/release in rawhide: 1.36.0-2.fc38
URL: https://www.busybox.net/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M…
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from Anitya:
https://release-monitoring.org/project/230/
To change the monitoring settings for the project, please visit:
https://src.fedoraproject.org/rpms/busybox
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2208403
https://bugzilla.redhat.com/show_bug.cgi?id=2203386
Bug ID: 2203386
Summary: [abrt] nemo: __strcmp_avx2(): nemo killed by SIGSEGV
Product: Fedora
Version: 38
Hardware: x86_64
Status: NEW
Whiteboard: abrt_hash:99394516a0e196608b50270f5deb839d5c001b3b;VAR
IANT_ID=cinnamon;
Component: nemo
Assignee: leigh123linux(a)googlemail.com
Reporter: ingobeh(a)hotmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
leigh123linux(a)googlemail.com, riehecky(a)fnal.gov
Target Milestone: ---
Classification: Fedora
Version-Release number of selected component:
nemo-5.6.4-1.fc38
Additional info:
reporter: libreport-2.17.9
backtrace_rating: 4
cmdline: /usr/bin/nemo
reason: nemo killed by SIGSEGV
crash_function: __strcmp_avx2
package: nemo-5.6.4-1.fc38
cgroup: 0::/user.slice/user-1000.slice/session-4.scope
type: CCpp
runlevel: N 5
uid: 1000
journald_cursor:
s=73f5e300f4d44bf0b8d33a2571820641;i=56928;b=4322ac57adbe4f41a7add5b251b22443;m=1143608a;t=5fb7c09330779;x=582eb515dc046aec
kernel: 6.2.14-300.fc38.x86_64
rootdir: /
executable: /usr/bin/nemo
Truncated backtrace:
Thread no. 1 (15 frames)
#0 __strcmp_avx2 at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:994
#1 cache_alias_lookup at ../gio/xdgmime/xdgmimecache.c:333
#2 __gio_xdg_cache_unalias_mime_type at ../gio/xdgmime/xdgmimecache.c:988
#3 __gio_xdg_cache_mime_type_subclass at ../gio/xdgmime/xdgmimecache.c:911
#4 __gio_xdg_mime_type_subclass at ../gio/xdgmime/xdgmime.c:844
#5 _gio_xdg_mime_type_subclass at ../gio/xdgmime/xdgmime.c:884
#6 g_content_type_guess at ../gio/gcontenttype.c:857
#7 get_content_type at ../gio/glocalfileinfo.c:1413
#8 _g_local_file_info_get at ../gio/glocalfileinfo.c:2092
#9 g_local_file_enumerator_next_file at ../gio/glocalfileenumerator.c:409
#10 g_file_enumerator_next_file at ../gio/gfileenumerator.c:238
#11 visit_directory at ../libnemo-private/nemo-search-engine-advanced.c:912
#12 search_thread_func at
../libnemo-private/nemo-search-engine-advanced.c:1054
#13 g_thread_proxy at ../glib/gthread.c:831
#15 clone3 at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2203386