SUSE-IU-2026:17-1: Security update of suse/sl-micro/6.0/base-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.0/base-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:17-1
Image Tags        : suse/sl-micro/6.0/base-os-container:2.1.3 , suse/sl-micro/6.0/base-os-container:2.1.3-7.81 , suse/sl-micro/6.0/base-os-container:latest
Image Release     : 7.81
Severity          : important
Type              : security
References        : 1254297 1254441 1254662 1254878 1255731 1255732 1255733 1255734
                        CVE-2025-10158 CVE-2025-13601 CVE-2025-14087 CVE-2025-14512 CVE-2025-14524
                        CVE-2025-14819 CVE-2025-15079 CVE-2025-15224 
-----------------------------------------------------------------

The container suse/sl-micro/6.0/base-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 546
Released:    Thu Jan  8 16:18:54 2026
Summary:     Security update for curl
Type:        security
Severity:    moderate
References:  1255731,1255732,1255733,1255734,CVE-2025-14524,CVE-2025-14819,CVE-2025-15079,CVE-2025-15224
This update for curl fixes the following issues:

- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).

-----------------------------------------------------------------
Advisory ID: 551
Released:    Thu Jan  8 16:49:46 2026
Summary:     Security update for rsync
Type:        security
Severity:    moderate
References:  1254441,CVE-2025-10158
This update for rsync fixes the following issues:

- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)

-----------------------------------------------------------------
Advisory ID: 550
Released:    Thu Jan  8 17:00:18 2026
Summary:     Security update for glib2
Type:        security
Severity:    important
References:  1254297,1254662,1254878,CVE-2025-13601,CVE-2025-14087,CVE-2025-14512
This update for glib2 fixes the following issues:

- CVE-2025-13601: Fixed Integer overflow in in g_escape_uri_string() (bsc#1254297)
- CVE-2025-14087: Fixed buffer underflow in GVariant parser leads to heap corruption (bsc#1254662)
- CVE-2025-14512: Fixed Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (bsc#1254878)



The following package changes have been done:

- SL-Micro-release-6.0-25.62 updated
- libglib-2_0-0-2.76.2-11.1 updated
- libgobject-2_0-0-2.76.2-11.1 updated
- libgmodule-2_0-0-2.76.2-11.1 updated
- libcurl-mini4-8.14.1-3.1 updated
- libgio-2_0-0-2.76.2-11.1 updated
- glib2-tools-2.76.2-11.1 updated
- curl-8.14.1-3.1 updated
- rsync-3.2.7-5.1 updated
- container:suse-toolbox-image-1.0.0-9.56 updated