CVE-2024-0217

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.

This update for libzypp, zypper, PackageKit fixes the following issues:

• Fixup New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014)
• CVE-2024-0217: Check that Finished signal is emitted at most once (bsc#1218544)
• Add resolver option 'removeOrphaned' for distupgrade (bsc#1221525)
• New VendorSupportOption flag VendorSupportSuperseded (jsc#OBS-301, jsc#PED-8014)
• Add default stripe minimum
• Don't expose std::optional where YAST/PK explicitly use c++11.
• Digest: Avoid using the deprecated OPENSSL_config
• version 17.32.0
• ProblemSolution::skipsPatchesOnly overload to handout the patches
• Show active dry-run/download-only at the commit propmpt
• Add --skip-not-applicable-patches option
• Fix printing detailed solver problem description
• Fix bash-completion to work with right adjusted numbers in the 1st column too
• Set libzypp shutdown request signal on Ctrl+C
• In the detailed view show all baseurls not just the first one (bsc#1218171)

This update for PackageKit fixes the following issues:

• CVE-2024-0217: Check that Finished signal is emitted at most once (bsc#1218544).

This update for PackageKit fixes the following issues:

• CVE-2024-0217: Check that Finished signal is emitted at most once (bsc#1218544).
• Dropped unnecessary executable permission (bsc#1209138).