SUSE-CU-2026:9140-1: Security update of suse/multi-linux-manager/5.1/x86_64/server-saline
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Mon Aug 24 07:23:12 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.1/x86_64/server-saline
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:9140-1
Container Tags : suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.5 , suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.5.9.25.2 , suse/multi-linux-manager/5.1/x86_64/server-saline:latest
Container Release : 9.25.2
Severity : important
Type : security
References : 1243168 1244141 1245944 1247004 1252306 1253043 1253505 1254201
1257102 1257295 1257463 1258500 1258567 1259225 1259254 1259594
1259720 1260342 1260396 1261195 1261400 1261606 1261969 1261982
1261983 1262012 1262098 1262168 1262305 1262319 1262631 1262654
1262664 1262684 1263083 1263366 1263367 1263656 1263658 1263822
1263823 1264962 1265268 1265334 1266304 1266481 1267581 1267619
1267644 1267647 1267821 1267871 1268006 1268131 1268151 1268229
1268290 1268309 1268325 1268349 1268375 1268402 1268407 1268409
1268413 1268415 1268416 1268417 1268420 1268422 1268427 1268567
1268570 1268673 1268886 1268977 1269012 1269066 1269192 1269267
1269279 1269408 1269583 1269788 1269790 1269959 1270008 1270009
1270010 1270016 1270018 1270021 1270040 1270393 1271192 1271372
1271712 1271712 1272164 1272165 1272166 1272167 1272168 1272169
1272171 1274571 1274984 1275217 CVE-2026-0864 CVE-2026-10536
CVE-2026-11850 CVE-2026-11940 CVE-2026-11972 CVE-2026-11979 CVE-2026-12064
CVE-2026-12087 CVE-2026-13595 CVE-2026-1502 CVE-2026-15308 CVE-2026-27456
CVE-2026-3276 CVE-2026-3276 CVE-2026-39821 CVE-2026-40226 CVE-2026-40355
CVE-2026-40356 CVE-2026-41989 CVE-2026-4360 CVE-2026-4786 CVE-2026-4873
CVE-2026-53612 CVE-2026-53613 CVE-2026-53614 CVE-2026-5435 CVE-2026-54411
CVE-2026-57062 CVE-2026-57432 CVE-2026-58010 CVE-2026-58011 CVE-2026-58012
CVE-2026-58013 CVE-2026-58014 CVE-2026-58016 CVE-2026-59843 CVE-2026-59844
CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848 CVE-2026-59850
CVE-2026-6019 CVE-2026-6019 CVE-2026-6100 CVE-2026-6238 CVE-2026-7210
CVE-2026-7774 CVE-2026-8286 CVE-2026-8328 CVE-2026-8376 CVE-2026-8458
CVE-2026-8924 CVE-2026-8927 CVE-2026-9079 CVE-2026-9080 CVE-2026-9545
CVE-2026-9547
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.1/x86_64/server-saline was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2848-1
Released: Fri Jul 10 13:38:57 2026
Summary: Security update for krb5, krb5-mini
Type: security
Severity: important
References: 1263366,1263367,1268131,CVE-2026-11850,CVE-2026-40355,CVE-2026-40356
This update for krb5, krb5-mini fixes the following issues
- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).
- CVE-2026-40355: Denial of Service via NULL pointer dereference in NegoEx mechanism (bsc#1263366).
- CVE-2026-40356: Denial of Service via integer underflow and out-of-bounds read (bsc#1263367).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2925-1
Released: Mon Jul 13 19:53:23 2026
Summary: Security update for curl
Type: security
Severity: important
References: 1262631,1268402,1268407,1268409,1268413,1268415,1268416,1268417,1268420,1268422,1268427,CVE-2026-10536,CVE-2026-12064,CVE-2026-4873,CVE-2026-8286,CVE-2026-8458,CVE-2026-8924,CVE-2026-8927,CVE-2026-9079,CVE-2026-9080,CVE-2026-9545,CVE-2026-9547
This update for curl fixes the following issues
- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
- CVE-2026-8458: wrong reuse for different services (bsc#1268407).
- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
- CVE-2026-9079: stale proxy password leak (bsc#1268415).
- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
- CVE-2026-9547: SSH improper host validation (bsc#1268420).
- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3030-1
Released: Wed Jul 15 11:53:06 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3097-1
Released: Fri Jul 17 13:39:27 2026
Summary: Security update for libxml2
Type: security
Severity: important
References: 1269790,CVE-2026-11979
This update for libxml2 fixes the following issue
- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3104-1
Released: Fri Jul 17 15:31:14 2026
Summary: Security update for python311
Type: security
Severity: important
References: 1261969,1262098,1262319,1262654,CVE-2026-1502,CVE-2026-4786,CVE-2026-6019,CVE-2026-6100
This update for python311 fixes the following issues
- CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers or host (bsc#1261969).
- CVE-2026-4786: URLs containing `%action` can bypass mitigation that allows command injection via the
`webbrowser.open()` API (bsc#1262319).
- CVE-2026-6019: HTML parser-sensitive sequence not neutralized by `http.cookies.Morsel.js_output()` (bsc#1262654).
- CVE-2026-6100: use-after-free in decompression modules when a memory allocation fails with a `MemoryError` and the
decompression instance is re-used (bsc#1262098).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3118-1
Released: Fri Jul 17 22:18:41 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions to/from uint32_t. Filter out -Wtime_t-conversion
from flags to build D target library files. [jsc#PED-15601]
- Remove loongarch64 from quadmath_arch. On LoongArch long double
is IEEE quad, so libquadmath is not needed and no longer built.
- includes fix for bogus expression simplification [bsc#1257463]
even when not available at build time. [bsc#1253043]
- Backport fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3141-1
Released: Tue Jul 21 09:04:39 2026
Summary: Recommended update for shadow
Type: recommended
Severity: important
References: 1270393
This update for shadow fixes the following issues:
- Fix regression about default GID by setting USERGROUPS_ENAB to no Update (bsc#1270393)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3155-1
Released: Tue Jul 21 14:58:48 2026
Summary: Security update for python-tornado6
Type: security
Severity: moderate
References: 1269012
This update for python-tornado6 fixes the following issue
- GHSA-pw6j-qg29-8w7f: `CurlAsyncHTTPClient` leaks per-request credentials on handle reuse (bsc#1269012).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3163-1
Released: Tue Jul 21 16:50:54 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3182-1
Released: Wed Jul 22 09:25:44 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service
(bsc#1262684).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3243-1
Released: Fri Jul 24 15:09:32 2026
Summary: Security update for gpg2
Type: security
Severity: low
References: 1269279,CVE-2026-57062
This update for gpg2 fixes the following issue:
- CVE-2026-57062: CMS parsing in gpgsm mishandles the CMS format for AES-GCM (bsc#1269279).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3244-1
Released: Fri Jul 24 15:11:25 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1261400,1261982,1261983,1262305,1267644,1267647,CVE-2026-40226
This update for systemd fixes the following issues
Security issues fixed:
- CVE-2026-40226: nspawn: escape-to-host via malformed optional config file (bsc#1261400).
Other updates and bugfixes:
- Fix soft reboot not restarting user services with default.target (bsc#1262305).
- Import commit e46e1952d5 (bsc#1267647 bsc#1262305 bsc#1267644).
- Import commit 429043ca9a (bsc#1261982 bsc#1261983).
- Import commit 58e5d2e21e (bsc#1261982).
- Import commit 4bd91117cc (bsc#1261983).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3330-1
Released: Tue Jul 28 11:35:51 2026
Summary: Security update for libssh
Type: security
Severity: moderate
References: 1272164,1272165,1272166,1272167,1272168,1272169,1272171,CVE-2026-59843,CVE-2026-59844,CVE-2026-59845,CVE-2026-59846,CVE-2026-59847,CVE-2026-59848,CVE-2026-59850
This update for libssh fixes the following issues:
- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).
- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).
- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).
- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).
- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).
- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).
- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3341-1
Released: Tue Jul 28 12:09:19 2026
Summary: Security update for glib2
Type: security
Severity: important
References: 1270008,1270009,1270010,1270016,1270018,1270021,CVE-2026-58010,CVE-2026-58011,CVE-2026-58012,CVE-2026-58013,CVE-2026-58014,CVE-2026-58016
This update for glib2 fixes the following issues:
- CVE-2026-58010: error during gvs_tuple_is_normal alignment validation could cause a 1-byte out-of-bounds read
(bsc#1270009).
- CVE-2026-58011: invalid GDateTime in g_date_time_get_ymd could trigger a 2-byte out-of-bounds read (bsc#1270010).
- CVE-2026-58012: raw byte regex matches with UTF-8 functions during case-change replacements could cause an out-of-
bounds read (bsc#1270016).
- CVE-2026-58013: multi-byte custom line terminator in g_io_channel_read_line_backend could trigger an out-of-bounds
read (bsc#1270018).
- CVE-2026-58014: processing empty key file values in g_key_file_get_locale_string_list could cause a 1-byte out-of-
bounds access (bsc#1270021).
- CVE-2026-58016: malformed D-Bus introspection XML could trigger an unsigned integer overflow (bsc#1270008).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3444-1
Released: Fri Jul 31 22:04:31 2026
Summary: Security update for openssl-3
Type: security
Severity: moderate
References: 1271712
This update for openssl-3 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3558-1
Released: Mon Aug 10 20:01:21 2026
Summary: Security update for perl
Type: security
Severity: important
References: 1266304,1268349,1271372,CVE-2026-12087,CVE-2026-57432,CVE-2026-8376
This update for perl fixes the following issues:
- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
(bsc#1266304).
- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure
(bsc#1268349).
- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`
(bsc#1271372).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3560-1
Released: Mon Aug 10 20:09:08 2026
Summary: Security update for python311
Type: security
Severity: important
References: 1264962,1265268,1267581,1267821,1268375,1268977,1269066,1269788,1269959,1271192,CVE-2026-0864,CVE-2026-11940,CVE-2026-11972,CVE-2026-15308,CVE-2026-3276,CVE-2026-4360,CVE-2026-7210,CVE-2026-7774,CVE-2026-8328
This update for python311 fixes the following issues:
Security issues fixed:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
- CVE-2026-4360: in the Tarfile.extract() function, the filter parameter is not passed properly when extracting
hardlinks (bsc#1269959).
- CVE-2026-7210: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding
protection (bsc#1264962).
- CVE-2026-7774: `tarfile.data_filter` path traversal bypass allows writing outside the extraction directory
(bsc#1267821).
- CVE-2026-8328: `ftpcp()` does not use actual peer address and trusts server-supplied PASV host address (bsc#1265268).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).
- CVE-2026-11972: infinite loop due to improper EOF handling in the tarfile module streaming mode can lead to DoS
(bsc#1269788).
- CVE-2026-15308: Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations
(bsc#1271192).
Non security issue fixed:
- [kernel 7.1] udplite was removed -> python fails in tests (bsc#1268375).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3578-1
Released: Tue Aug 11 15:58:41 2026
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1271712
This update for openssl-1_1 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3648-1
Released: Wed Aug 19 11:54:08 2026
Summary: Security update for python311
Type: security
Severity: important
References: 1263083,CVE-2026-3276,CVE-2026-6019
This update for python311 fixes the following issues:
- Regression in `http.cookies` (bsc#1263083).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3684-1
Released: Fri Aug 21 20:23:10 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1261606,1268886,1269583,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free read in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices (bsc#1261606).
- Several security issues in releases prior to v2.42.2 and v2.41.5 (bsc#1268886).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3712-1
Released: Mon Aug 24 04:52:59 2026
Summary: Maintenance update for Multi-Linux Manager 5.1.5
Type: recommended
Severity: important
References: 1243168,1244141,1245944,1247004,1253505,1254201,1257102,1257295,1258500,1258567,1259225,1259254,1259594,1259720,1260342,1260396,1261195,1262012,1262168,1262664,1263822,1263823,1265334,1266481,1267619,1267871,1268006,1268151,1268229,1268309,1268325,1268567,1268570,1268673,1269192,1269267,1269408,1270040,1274571,1274984,1275217,CVE-2026-39821
Maintenance update for Multi-Linux Manager 5.1.5: Server, Proxy and Retail Branch Server
This is a codestream only update
The following package changes have been done:
- libssh-config-0.9.8-150600.11.15.1 updated
- glibc-2.38-150600.14.52.1 updated
- libuuid1-2.40.4-150700.4.18.1 updated
- libsmartcols1-2.40.4-150700.4.18.1 updated
- libgcc_s1-15.3.0+git11272-150000.1.12.1 updated
- libxml2-2-2.12.10-150700.4.14.1 updated
- libstdc++6-15.3.0+git11272-150000.1.12.1 updated
- libudev1-254.27-150600.4.71.2 updated
- login_defs-4.17.2-150600.17.21.1 updated
- libglib-2_0-0-2.78.6-150600.4.38.1 updated
- libopenssl3-3.2.3-150700.5.40.1 updated
- libgcrypt20-1.11.0-150700.5.10.1 updated
- libblkid1-2.40.4-150700.4.18.1 updated
- perl-base-5.26.1-150300.17.23.1 updated
- libopenssl-3-fips-provider-3.2.3-150700.5.40.1 updated
- krb5-1.20.1-150600.11.19.1 updated
- gpg2-2.4.4-150600.3.18.1 updated
- libmount1-2.40.4-150700.4.18.1 updated
- libfdisk1-2.40.4-150700.4.18.1 updated
- libssh4-0.9.8-150600.11.15.1 updated
- libcurl4-8.14.1-150700.7.20.1 updated
- pam-1.3.0-150000.6.89.1 updated
- libsubid5-4.17.2-150600.17.21.1 updated
- shadow-4.17.2-150600.17.21.1 updated
- util-linux-2.40.4-150700.4.18.1 updated
- openssl-3-3.2.3-150700.5.40.1 updated
- libpython3_11-1_0-3.11.15-150600.3.65.1 updated
- python311-base-3.11.15-150600.3.65.1 updated
- python311-tornado6-6.3.2-150400.9.21.1 updated
- salt-3006.0-150700.14.26.14 updated
- python311-salt-3006.0-150700.14.26.14 updated
- libopenssl1_1-1.1.1w-150700.11.25.2 updated
- container:bci-bci-base-15.7-4de2a562289c9545ddd1e888292b3fa87a6156d62d9bb6f2574c92a9e0e8fe98-0 updated
More information about the sle-container-updates
mailing list