SUSE-IU-2026:6428-1: Security update of suse/sl-micro/6.1/kvm-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Tue Aug 25 07:37:57 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.1/kvm-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:6428-1
Image Tags : suse/sl-micro/6.1/kvm-os-container:2.2.1 , suse/sl-micro/6.1/kvm-os-container:2.2.1-5.175 , suse/sl-micro/6.1/kvm-os-container:latest
Image Release : 5.175
Severity : important
Type : security
References : 1234563 1236533 1239763 1239866 1243254 1243505 1259924 1261606
1268886 1269039 1269040 1269041 1269042 1269043 1269044 1269045
1269046 1269047 1269048 1269049 1269050 1269051 1269052 1269053
1269054 1269055 1269056 1269057 1269058 1269060 1269583 1270219
1273429 1273430 1273431 1273432 1273433 1273434 1273435 1273436
1273437 1273438 1273439 1273440 1273441 CVE-2023-45288 CVE-2024-45337
CVE-2025-69720 CVE-2026-13595 CVE-2026-27456 CVE-2026-53612 CVE-2026-53613
CVE-2026-53614 CVE-2026-53783 CVE-2026-53784 CVE-2026-53785 CVE-2026-53786
CVE-2026-53788 CVE-2026-53789 CVE-2026-53790 CVE-2026-53791 CVE-2026-53792
CVE-2026-53793 CVE-2026-53794 CVE-2026-53795 CVE-2026-53796 CVE-2026-53797
CVE-2026-53798 CVE-2026-53799 CVE-2026-53800 CVE-2026-53801 CVE-2026-53802
CVE-2026-53803 CVE-2026-70452 CVE-2026-70453 CVE-2026-70454 CVE-2026-70455
CVE-2026-70456 CVE-2026-70457 CVE-2026-70458 CVE-2026-70459 CVE-2026-70460
CVE-2026-70461 CVE-2026-70462 CVE-2026-70463 CVE-2026-70464
-----------------------------------------------------------------
The container suse/sl-micro/6.1/kvm-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 681
Released: Mon Aug 24 16:43:09 2026
Summary: Security update for rsync
Type: security
Severity: important
References: 1259924,1269039,1269040,1269041,1269042,1269043,1269044,1269045,1269046,1269047,1269048,1269049,1269050,1269051,1269052,1269053,1269054,1269055,1269056,1269057,1269058,1269060,1273429,1273430,1273431,1273432,1273433,1273434,1273435,1273436,1273437,1273438,1273439,1273440,1273441,CVE-2025-69720,CVE-2026-53783,CVE-2026-53784,CVE-2026-53785,CVE-2026-53786,CVE-2026-53788,CVE-2026-53789,CVE-2026-53790,CVE-2026-53791,CVE-2026-53792,CVE-2026-53793,CVE-2026-53794,CVE-2026-53795,CVE-2026-53796,CVE-2026-53797,CVE-2026-53798,CVE-2026-53799,CVE-2026-53800,CVE-2026-53801,CVE-2026-53802,CVE-2026-53803,CVE-2026-70452,CVE-2026-70453,CVE-2026-70454,CVE-2026-70455,CVE-2026-70456,CVE-2026-70457,CVE-2026-70458,CVE-2026-70459,CVE-2026-70460,CVE-2026-70461,CVE-2026-70462,CVE-2026-70463,CVE-2026-70464
This update for rsync fixes the following issues:
- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
- CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
- CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement
(bsc#1269053).
- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
- CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege
escalation) (bsc#1269056).
- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion
outside the source tree (bsc#1269057).
- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure
(bsc#1269058).
- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths
(bsc#1269040).
- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant
to block (bsc#1273441).
- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs
(bsc#1273437).
- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory
transfer root (bsc#1273434).
- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-
module symlink (bsc#1273433).
- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
- CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule
(bsc#1273430).
- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
-----------------------------------------------------------------
Advisory ID: 682
Released: Mon Aug 24 17:02:22 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1234563,1236533,1239763,1239866,1243254,1243505,1261606,1268886,1269583,1270219,CVE-2023-45288,CVE-2024-45337,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614
This update for util-linux fixes the following issues:
Security issues fixed:
- CVE-2026-13595: heap use-after-free read in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU race condition in the mount program when setting up loop devices (bsc#1261606).
- Several security issues in releases prior to v2.42.2 and v2.41.5 (bsc#1268886).
Other updates and bugfixes:
- Ignore `pam-config` error that prevents update failure if `common*` pam configuration is not symlink to `common-*-pc`
(bsc#1270219).
The following package changes have been done:
- libuuid1-2.40.4-slfo.1.1_7.1 updated
- libsmartcols1-2.40.4-slfo.1.1_7.1 updated
- libblkid1-2.40.4-slfo.1.1_7.1 updated
- libmount1-2.40.4-slfo.1.1_7.1 updated
- libfdisk1-2.40.4-slfo.1.1_7.1 updated
- util-linux-2.40.4-slfo.1.1_7.1 updated
- SL-Micro-release-6.1-slfo.1.12.65 updated
- util-linux-systemd-2.40.4-slfo.1.1_7.1 updated
- rsync-3.3.0-slfo.1.1_7.1 updated
- container:SL-Micro-base-container-2.2.1-5.171 updated
More information about the sle-container-updates
mailing list