openSUSE has issued an advisory on July 5: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PKLBHCP4H6J6LCEJELBPDKGM2W4ZWDNC/
CVE: (none) => CVE-2025-6140Source RPM: (none) => spdlog-1.11.0-4.mga9.src.rpm
https://bugzilla.suse.com/show_bug.cgi?id=1244696 includes these github refs: https://github.com/gabime/spdlog/commit/10320184df1eb4638e253a34b1eb44ce78954094 is the patch. https://github.com/gabime/spdlog/issues/3360 https://github.com/gabime/spdlog/issues/3360#issuecomment-2729579422 are the same: a POC. Assigning directly to DavidG, who normally maintains this ppkg.
Assignee: bugsquad => geiger.david68210
Suggested advisory: ======================== The updated packages fix a security vulnerability: Spdlog pattern_formatter-inl.h scoped_padder resource consumption. (CVE-2025-6140) References: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PKLBHCP4H6J6LCEJELBPDKGM2W4ZWDNC/ ======================== Updated packages in core/updates_testing: ======================== lib(64)spdlog-devel-1.11.0-4.1.mga9 lib(64)spdlog1.11-1.11.0-4.1.mga9 from SRPM: spdlog-1.11.0-4.1.mga9.src.rpm
Assignee: geiger.david68210 => qa-bugsStatus: NEW => ASSIGNED
Keywords: (none) => advisory
MGA9-64 server Plasma Wayland on Compaq H000SB. No installation issues. No previous updates, so # urpmq --whatrequires lib64spdlog1.11 gave me a list, many of them I had no idea how to handle those. First picked kodi, run it under strace, and had it to add some files to its catalogue and play it. But the trace had no ref to spdlog. Second try with gerbera. Had some issues to get this to start, but succeeded. After opening port 49152 in the firewall, I was able to access files from my desktop PC. Remark: as stated in the feedback of starting gerbera, it apparently can only be connected via the explicit IP-address. Anyway, the trace now has a ref to openat(AT_FDCWD, "/lib64/libspdlog.so.1.11", O_RDONLY|O_CLOEXEC) = 3 So in the end all is well.
CC: (none) => herman.viaeneWhiteboard: (none) => MGA9-64-OK
Validating.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2025-0294.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED