August 2023 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2042522] New: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042522 Bug ID: 2042522 Summary: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

1 22

[Bug 2042511] New: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2042511 Bug ID: 2042511 Summary: CVE-2022-22815 python-pillow: improperly initializes ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bdettelb(a)redhat.com, cstratak(a)redhat.com, epel-packagers-sig(a)lists.fedoraproject.org, infra-sig(a)lists.fedoraproject.org, manisandro(a)gmail.com, miminar(a)redhat.com, orion(a)nwra.com, python-maint(a)redhat.com, python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com Target Milestone: --- Classification: Other path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path. References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da… https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image… -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042511

1 19

[Bug 2215458] New: golang-x-tools-0.10.0 is available
by bugzilla＠redhat.com 23 Jun '24

23 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2215458 Bug ID: 2215458 Summary: golang-x-tools-0.10.0 is available Product: Fedora Version: rawhide Status: NEW Component: golang-x-tools Keywords: FutureFeature, Triaged Assignee: mark.e.fuller(a)gmx.de Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, go-sig(a)lists.fedoraproject.org, mark.e.fuller(a)gmx.de Target Milestone: --- Classification: Fedora Releases retrieved: 0.10.0 Upstream release that is considered latest: 0.10.0 Current version/release in rawhide: 0.9.3-1.fc39 URL: https://github.com/golang/tools Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/9382/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/golang-x-tools -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2215458 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 93

[Bug 2219100] New: squashfuse-0.2.0 is available
by bugzilla＠redhat.com 13 Jun '24

13 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2219100 Bug ID: 2219100 Summary: squashfuse-0.2.0 is available Product: Fedora Version: rawhide Status: NEW Component: squashfuse Keywords: FutureFeature, Triaged Assignee: kyrofa(a)ubuntu.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, kyrofa(a)ubuntu.com, michel(a)michel-slm.name Target Milestone: --- Classification: Fedora Releases retrieved: 0.2.0 Upstream release that is considered latest: 0.2.0 Current version/release in rawhide: 0.1.105-3.fc38 URL: https://github.com/vasi/squashfuse Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/16661/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/squashfuse -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2219100 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 23

[Bug 2225757] New: diskimage-builder: FTBFS in Fedora rawhide/f39
by bugzilla＠redhat.com 06 Jun '24

06 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2225757 Bug ID: 2225757 Summary: diskimage-builder: FTBFS in Fedora rawhide/f39 Product: Fedora Version: rawhide Status: NEW Component: diskimage-builder Assignee: amoralej(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: amoralej(a)redhat.com, apevec(a)redhat.com, bnemec(a)redhat.com, davide(a)cavalca.name, epel-packagers-sig(a)lists.fedoraproject.org, jslagle(a)redhat.com, mburns(a)redhat.com, openstack-sig(a)lists.fedoraproject.org Blocks: 2168842 (F39FTBFS,RAWHIDEFTBFS) Target Milestone: --- Classification: Fedora diskimage-builder failed to build from source in Fedora rawhide/f39 https://koji.fedoraproject.org/koji/taskinfo?taskID=103568042 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Please fix diskimage-builder at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, diskimage-builder will be orphaned. Before branching of Fedora 40, diskimage-builder will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2168842 [Bug 2168842] Fedora 39 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2225757 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 12

[Bug 2176591] New: msmtp package should provide /usr/bin/sendmail
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2176591 Bug ID: 2176591 Summary: msmtp package should provide /usr/bin/sendmail Product: Fedora Version: rawhide Status: NEW Component: msmtp Assignee: lemenkov(a)gmail.com Reporter: yann(a)droneaud.fr QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, gbcox(a)bzb.us, lemenkov(a)gmail.com, ndevos(a)redhat.com, wart(a)kobold.org Target Milestone: --- Classification: Fedora Description of problem: msmtp package is not declared to provide /usr/sbin/sendmail. But installing the package, makes msmtp the "mta" (see alternatives --display mta), and thus provide /usr/bin/sendmail. Some packages, see below, requires /usr/sbin/sendmail BackupPC-0:4.4.0-9.fc38.x86_64 alpine-0:2.26-3.fc38.x86_64 arpwatch-14:3.3-14.fc39.x86_64 asterisk-voicemail-0:18.12.1-1.fc38.3.x86_64 certwatch-mod_ssl-0:1.2-12.fc38.x86_64 fail2ban-sendmail-0:1.0.2-2.fc38.noarch fvwm-0:2.7.0-3.fc38.x86_64 hylafax+-client-0:7.0.7-1.fc39.i686 hylafax+-client-0:7.0.7-1.fc39.x86_64 mgetty-0:1.2.1-18.fc38.x86_64 quilt-0:0.67-4.fc39.noarch redhat-lsb-core-0:4.1-60.fc38.i686 redhat-lsb-core-0:4.1-60.fc38.x86_64 spamass-milter-0:0.4.0-24.fc38.x86_64 uudeview-0:0.5.20-51.fc38.x86_64 websec-0:1.9.0-34.fc38.noarch x509watch-0:0.6.1-14.fc38.noarch Thus, when asking dnf to install one of the packages above, it will also install another mta from the list below if none of them is already installed. Likely esmtp in my experience (likely because it's the first alphabetically). esmtp-0:1.2-21.fc38.x86_64 exim-0:4.96-8.fc38.x86_64 opensmtpd-0:6.8.0p2-11.fc38.x86_64 postfix-2:3.7.4-1.fc38.x86_64 sendmail-0:8.17.1-8.fc38.x86_64 ssmtp-0:2.64-32.fc38.x86_64 Having msmtp already installed should be enough to satisfy /usr/sbin/sendmail requirement, and no other MTA should be installed as part of installing another package. Version-Release number of selected component (if applicable): msmtp-1.8.23-1.fc38.x86_64 How reproducible: When installing a package that requires /usr/bin/sendmail when no other MTA is installed. Steps to Reproduce: 1. dnf install msmtp 2. dnf install arpwatch Actual results: "dnf install arpwatch" installs arpwatch and esmtp Expected results: "dnf install arpwatch" would install only arpwatch -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2176591

1 16

[Bug 2236563] New: [abrt] gnome-calendar: g_date_time_add_days(): gnome-calendar killed by SIGSEGV
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2236563 Bug ID: 2236563 Summary: [abrt] gnome-calendar: g_date_time_add_days(): gnome-calendar killed by SIGSEGV Product: Fedora Version: 38 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:abb5d0ab9e6ff7f5ceede07a2d765f2b2c849ee5;VAR IANT_ID=workstation; Component: gnome-calendar Assignee: gnome-sig(a)lists.fedoraproject.org Reporter: fabian(a)knogle.industries QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, gnome-sig(a)lists.fedoraproject.org, igor.raits(a)gmail.com, klember(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: Trying to access an event, stretched accross a few days. Version-Release number of selected component: gnome-calendar-44.1-1.fc38 Additional info: reporter: libreport-2.17.11 type: CCpp reason: gnome-calendar killed by SIGSEGV journald_cursor: s=a4f44cce694f4b1b8a4bdf494f4c6e4b;i=6496e;b=9b7d0edf7d2e4a27bbd42315ab195e81;m=46b1be211;t=6043c28d1545d;x=ed95a7eda7ddbd07 executable: /usr/bin/gnome-calendar cmdline: /usr/bin/gnome-calendar --gapplication-service cgroup: 0::/user.slice/user-1000.slice/user@1000.service/app.slice/dbus-:1.2-org.gnome.Calendar@0.service rootdir: / uid: 1000 kernel: 6.4.12-200.fc38.x86_64 package: gnome-calendar-44.1-1.fc38 runlevel: N 5 backtrace_rating: 4 crash_function: g_date_time_add_days comment: Trying to access an event, stretched accross a few days. Truncated backtrace: Thread no. 1 (6 frames) #0 g_date_time_add_days at ../glib/gdatetime.c:1868 #2 update_event_indicators at ../src/gui/event-editor/gcal-date-chooser.c:407 #3 update_event_indicators_in_idle_cb at ../src/gui/event-editor/gcal-date-chooser.c:447 #7 g_main_context_iterate.isra.0 at ../glib/gmain.c:4276 #8 g_main_context_iteration at ../glib/gmain.c:4343 #9 g_application_run at ../gio/gapplication.c:2573 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2236563 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 1

[Bug 2236508] New: [abrt] cinnamon: get_settings(): JsonSettingsWidgets.py:151:get_settings:FileNotFoundError: [Errno 2] Нет такого файла или каталога: '/home/andrewc/.config/cinnamon/spices/timelet@linuxedo.com/5.json'
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2236508 Bug ID: 2236508 Summary: [abrt] cinnamon: get_settings(): JsonSettingsWidgets.py:151:get_settings:FileNotFoundEr ror: [Errno 2] Нет такого файла или каталога: '/home/andrewc/.config/cinnamon/spices/timelet@linuxed o.com/5.json' Product: Fedora Version: 38 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:1f06524953908c4cbf98655051e0d778a7d2e951;VAR IANT_ID=workstation; Component: cinnamon Assignee: leigh123linux(a)googlemail.com Reporter: cherdantsefff(a)ya.ru QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, leigh123linux(a)googlemail.com, miketwebster(a)gmail.com, riehecky(a)fnal.gov Target Milestone: --- Classification: Fedora Version-Release number of selected component: cinnamon-5.8.4-3.fc38 Additional info: reporter: libreport-2.17.11 kernel: 6.4.12-200.fc38.x86_64 cmdline: xlet-settings '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' cgroup: 0::/user.slice/user-1000.slice/session-7.scope uid: 1000 reason: JsonSettingsWidgets.py:151:get_settings:FileNotFoundError: [Errno 2] Нет такого файла или каталога: '/home/andrewc/.config/cinnamon/spices/timelet(a)linuxedo.com/5.json' executable: /usr/share/cinnamon/cinnamon-settings/xlet-settings.py type: Python3 package: cinnamon-5.8.4-3.fc38 runlevel: N 5 exception_type: FileNotFoundError crash_function: get_settings interpreter: cinnamon-5.8.4-3.fc38.x86_64 Truncated backtrace: JsonSettingsWidgets.py:151:get_settings:FileNotFoundError: [Errno 2] Нет такого файла или каталога: '/home/andrewc/.config/cinnamon/spices/timelet(a)linuxedo.com/5.json' Traceback (most recent call last): File "/usr/share/cinnamon/cinnamon-settings/bin/JsonSettingsWidgets.py", line 136, in check_settings self.settings = self.get_settings() ^^^^^^^^^^^^^^^^^^^ File "/usr/share/cinnamon/cinnamon-settings/bin/JsonSettingsWidgets.py", line 151, in get_settings file = open(self.filepath) ^^^^^^^^^^^^^^^^^^^ FileNotFoundError: [Errno 2] Нет такого файла или каталога: '/home/andrewc/.config/cinnamon/spices/timelet(a)linuxedo.com/5.json' Local variables in innermost frame: self: <JsonSettingsWidgets.JSONSettingsHandler object at 0x7ff84d893ad0> -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2236508 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 1

[Bug 2236499] New: [abrt] nemo: g_type_check_instance_is_fundamentally_a(): nemo-desktop killed by SIGSEGV
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2236499 Bug ID: 2236499 Summary: [abrt] nemo: g_type_check_instance_is_fundamentally_a(): nemo-desktop killed by SIGSEGV Product: Fedora Version: 38 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:023bee837b7d608b59e7f13df23e7c83d5f5125b;VAR IANT_ID=cinnamon; Component: nemo Assignee: leigh123linux(a)googlemail.com Reporter: yhl3051(a)rit.edu QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, leigh123linux(a)googlemail.com, riehecky(a)fnal.gov Target Milestone: --- Classification: Fedora Version-Release number of selected component: nemo-5.8.4-3.fc38 Additional info: reporter: libreport-2.17.11 type: CCpp reason: nemo-desktop killed by SIGSEGV journald_cursor: s=7f4c96f9356f46df80c72226a993329b;i=63b59;b=bf60b0ee876f42e599fe80484aade5a7;m=2a3ac29c4;t=6042ba62328f1;x=e3090afc42d9c2fc executable: /usr/bin/nemo-desktop cmdline: nemo-desktop cgroup: 0::/user.slice/user-1000.slice/session-2.scope rootdir: / uid: 1000 kernel: 6.4.12-200.fc38.x86_64 package: nemo-5.8.4-3.fc38 runlevel: N 5 backtrace_rating: 4 crash_function: g_type_check_instance_is_fundamentally_a Truncated backtrace: Thread no. 1 (10 frames) #0 g_type_check_instance_is_fundamentally_a at ../gobject/gtype.c:4167 #2 open_with_dialog_response_cb.part.0.lto_priv.0 at ../src/nemo-mime-actions.c:1151 #3 g_cclosure_marshal_VOID__INTv at ../gobject/gmarshal.c:596 #4 _g_closure_invoke_va at ../gobject/gclosure.c:895 #10 gtk_button_clicked at ../gtk/gtkbutton.c:1541 #11 gtk_button_finish_activate at ../gtk/gtkbutton.c:2042 #12 button_activate_timeout at ../gtk/gtkbutton.c:1984 #17 g_main_context_iterate.isra.0 at ../glib/gmain.c:4276 #18 g_main_context_iteration at ../glib/gmain.c:4343 #19 g_application_run at ../gio/gapplication.c:2573 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2236499 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 1

[Bug 2236392] New: CVE-2023-39615 mingw-libxml2: libxml2: crafted xml can cause global buffer overflow [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2236392 Bug ID: 2236392 Summary: CVE-2023-39615 mingw-libxml2: libxml2: crafted xml can cause global buffer overflow [fedora-all] Product: Fedora Version: 38 Status: NEW Component: mingw-libxml2 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: rjones(a)redhat.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, rjones(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2235864 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2236392 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

2024

2023

2022

2021

Epel-packagers-sig August 2023