openSUSE has issued an advisory on December 17: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/X3V7QAWJ6AWA3YEKX4DEGJFLTQ6ASRC3/ For Cauldron, mozjs78 should be dropped.
CVE: (none) => CVE-2024-50602Status comment: (none) => Patch available from openSUSESource RPM: (none) => mozjs78-78.15.0-7.1.mga9.src.rpmWhiteboard: (none) => MGA9TOO
Puzzled. Following links leads to [lib]expat. https://www.suse.com/security/cve/CVE-2024-50602.html Upstream information CVE-2024-50602 at MITRE Description An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. but I cannot see the patch in question. Suse have pushed updates. https://nvd.nist.gov/vuln/detail/CVE-2024-50602 similar https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50602 similar https://github.com/libexpat/libexpat/pull/915 looks close to a fix Assigning globally.
Assignee: bugsquad => pkg-bugs
mozjs78 dropped from Cauldron. Suggested advisory: ======================== The updated packages fix a security vulnerability: An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. (CVE-2024-50602) References: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/X3V7QAWJ6AWA3YEKX4DEGJFLTQ6ASRC3/ ======================== Updated packages in core/updates_testing: ======================== lib(64)mozjs78-78.15.0-7.2.mga9 lib(64)mozjs78-devel-78.15.0-7.2.mga9 from SRPM: mozjs78-78.15.0-7.2.mga9.src.rpm
Status: NEW => ASSIGNEDAssignee: pkg-bugs => qa-bugsStatus comment: Patch available from openSUSE => (none)Whiteboard: MGA9TOO => (none)Version: Cauldron => 9
(In reply to Nicolas Salguero from comment #2) > mozjs78 dropped from Cauldron. Or not!! You should remove explicitly all sub-pkgs from mozjs78-78.15.0-8.mga10.src.rpm libmozjs78 < 78.15.0-9 lib64mozjs78 < 78.15.0-9 libmozjs78-devel < 78.15.0-9 lib64mozjs78-devel < 78.15.0-9
CC: (none) => geiger.david68210
(In reply to David GEIGER from comment #3) > (In reply to Nicolas Salguero from comment #2) > > mozjs78 dropped from Cauldron. > > > Or not!! > > You should remove explicitly all sub-pkgs from > mozjs78-78.15.0-8.mga10.src.rpm > > libmozjs78 < 78.15.0-9 > lib64mozjs78 < 78.15.0-9 > libmozjs78-devel < 78.15.0-9 > lib64mozjs78-devel < 78.15.0-9 Indeed, sorry! task-obsolete-10-73.mga10 fixes that issue.
Keywords: (none) => advisory
This fix also https://bugs.mageia.org/show_bug.cgi?id=33691?
(In reply to katnatek from comment #5) > This fix also https://bugs.mageia.org/show_bug.cgi?id=33691? No, it does not. I am unsure we can fix it. Firefox, Thunderbird and mozjs are using embedded expat since many versions.
MGA9-64 Plasma in VirtualBox. This is not an easy one. From bug 33630: $ urpmq --whatrequires lib64mozjs78 couchdb lib64cjs0 lib64mozjs78 lib64mozjs78-devel In its last two updates, bug 30342 and bug 29548, QA attempted to test couchdb, but eventually validated based on a clean update over the existing version. Not particularly satisfactory, so I looked further: $ urpmq --whatrequires-recursive lib64mozjs78 cinnamon cinnamon-devel-doc cjs couchdb lib64cjs-devel lib64cjs-gir1.0 lib64cjs0 lib64mozjs78 lib64mozjs78-devel nemo-preview task-cinnamon task-cinnamon-devel task-cinnamon-minimal This might be more promising. I installed task-cinnamon-minimal, which did indeed draw in lib64cjs-gir1.0, lib64cjs0, and lib64mozjs78 - among many others. I rebooted, and there were two new choices for login, cinnamon and cinnamon(software rendering). I tried cinnamon first. I've never used cinnamon before, but I played around for a bit, and nothing bad happened, so I guess it's OK. So then I tried the same with the software rendering login, and nothing bad happened there, either. I'm calling that good enough to validate for MGA9. On another note, just to be sure it wasn't forgotten, you did address the potential dependencies when you dropped mozjs78 in Cauldron, right? In that MGA9 guest, attempting to remove lib64mozjs78 would have forced the removal of cinnamon, as well.
CC: (none) => andrewsfarm, sysadmin-bugsWhiteboard: (none) => MGA9-64-OKKeywords: (none) => validated_update
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0396.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED