SUSE-IU-2026:6327-1: Security update of suse/sle-micro/kvm-5.5

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Tue Aug 18 07:10:00 UTC 2026 

SUSE Image Update Advisory: suse/sle-micro/kvm-5.5
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:6327-1
Image Tags        : suse/sle-micro/kvm-5.5:2.0.4 , suse/sle-micro/kvm-5.5:2.0.4-3.5.593 , suse/sle-micro/kvm-5.5:latest
Image Release     : 3.5.593
Severity          : important
Type              : security
References        : 1264514 1269039 1269040 1269041 1269042 1269043 1269044 1269045
                        1269046 1269047 1269048 1269049 1269050 1269051 1269052 1269053
                        1269054 1269055 1269056 1269057 1269058 1269060 1273429 1273430
                        1273431 1273432 1273433 1273434 1273435 1273436 1273437 1273438
                        1273439 1273440 1273441 CVE-2026-41035 CVE-2026-53783 CVE-2026-53784
                        CVE-2026-53785 CVE-2026-53786 CVE-2026-53788 CVE-2026-53789 CVE-2026-53790
                        CVE-2026-53791 CVE-2026-53792 CVE-2026-53793 CVE-2026-53794 CVE-2026-53795
                        CVE-2026-53796 CVE-2026-53797 CVE-2026-53798 CVE-2026-53799 CVE-2026-53800
                        CVE-2026-53801 CVE-2026-53802 CVE-2026-53803 CVE-2026-70452 CVE-2026-70453
                        CVE-2026-70454 CVE-2026-70455 CVE-2026-70456 CVE-2026-70457 CVE-2026-70458
                        CVE-2026-70459 CVE-2026-70460 CVE-2026-70461 CVE-2026-70462 CVE-2026-70463
                        CVE-2026-70464 
-----------------------------------------------------------------

The container suse/sle-micro/kvm-5.5 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3634-1
Released:    Mon Aug 17 21:03:13 2026
Summary:     Security update for rsync
Type:        security
Severity:    important
References:  1264514,1269039,1269040,1269041,1269042,1269043,1269044,1269045,1269046,1269047,1269048,1269049,1269050,1269051,1269052,1269053,1269054,1269055,1269056,1269057,1269058,1269060,1273429,1273430,1273431,1273432,1273433,1273434,1273435,1273436,1273437,1273438,1273439,1273440,1273441,CVE-2026-41035,CVE-2026-53783,CVE-2026-53784,CVE-2026-53785,CVE-2026-53786,CVE-2026-53788,CVE-2026-53789,CVE-2026-53790,CVE-2026-53791,CVE-2026-53792,CVE-2026-53793,CVE-2026-53794,CVE-2026-53795,CVE-2026-53796,CVE-2026-53797,CVE-2026-53798,CVE-2026-53799,CVE-2026-53800,CVE-2026-53801,CVE-2026-53802,CVE-2026-53803,CVE-2026-70452,CVE-2026-70453,CVE-2026-70454,CVE-2026-70455,CVE-2026-70456,CVE-2026-70457,CVE-2026-70458,CVE-2026-70459,CVE-2026-70460,CVE-2026-70461,CVE-2026-70462,CVE-2026-70463,CVE-2026-70464
This update for rsync fixes the following issues:

- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
- CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
- CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement
  (bsc#1269053).
- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
- CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege
  escalation) (bsc#1269056).
- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion
  outside the source tree (bsc#1269057).
- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure
  (bsc#1269058).
- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths
  (bsc#1269040).
- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant
  to block (bsc#1273441).
- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs
  (bsc#1273437).
- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory
  transfer root (bsc#1273434).
- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-
  module symlink (bsc#1273433).
- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
- CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule
  (bsc#1273430).
- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).


The following package changes have been done:

- rsync-3.2.3-150400.3.34.1 updated
- container:suse-sle-micro-base-5.5-latest-2.0.4-5.8.308 updated
- openslp-2.0.0-150000.6.17.1 removed

More information about the sle-container-updates mailing list