SUSE-IU-2026:5542-1: Security update of suse/sl-micro/6.2/baremetal-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.2/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:5542-1
Image Tags        : suse/sl-micro/6.2/baremetal-os-container:2.3.1 , suse/sl-micro/6.2/baremetal-os-container:2.3.1-8.45 , suse/sl-micro/6.2/baremetal-os-container:latest
Image Release     : 8.45
Severity          : important
Type              : security
References        : 1244116 1262043 1262044 1262069 1262070 1262071 1262072 1265060
                        1265061 1265062 1265070 CVE-2025-48060 CVE-2026-32316 CVE-2026-33947
                        CVE-2026-33948 CVE-2026-39956 CVE-2026-39979 CVE-2026-40164 CVE-2026-40612
                        CVE-2026-41256 CVE-2026-41257 CVE-2026-43894 
-----------------------------------------------------------------

The container suse/sl-micro/6.2/baremetal-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1169
Released:    Tue Jul  7 14:32:56 2026
Summary:     Security update for jq
Type:        security
Severity:    important
References:  1244116,1262043,1262044,1262069,1262070,1262071,1262072,1265060,1265061,1265062,1265070,CVE-2025-48060,CVE-2026-32316,CVE-2026-33947,CVE-2026-33948,CVE-2026-39956,CVE-2026-39979,CVE-2026-40164,CVE-2026-40612,CVE-2026-41256,CVE-2026-41257,CVE-2026-43894
This update for jq fixes the following issues:

- CVE-2025-48060: improper handling of string data in `jv_string_empty` can lead to heap buffer overflow and a crash
  when processing crafted input (bsc#1244116).
- CVE-2026-32316: integer overflow within the `jvp_string_append()` and `jvp_string_copy_replace_bad` functions can
  lead to heap buffer overflow when evaluating untrusted jq queries (bsc#1262044).
- CVE-2026-33947: unbounded recursion in functions `jv_setpath()`, `jv_getpath()`, and `delpaths_sorted()` can lead to
  excessive resource consumption when processing crafted JSON input (bsc#1262069).
- CVE-2026-39956: missing runtime type checks in `_strindices` and `jv_string_indexes()` can lead to a crash when
  evaluating untrusted jq filters against a release build (bsc#1262070).
- CVE-2026-39979: incorrect processing of non-nul-terminated counted buffers in `jv_parse_sized` can lead to an
  out-of-bounds read when processing malformed JSON (bsc#1262071).
- CVE-2026-40164: use of `MurmurHash3` with a hardcoded seed allows pre-computation of key collisions and can lead to a
  denial of service via resource exhaustion when processing crafted JSON objects (bsc#1262072).
- CVE-2026-40612: recursion into nested arrays/objects with no depth limit in `jv_contains` can lead to a C stack
  exhaustion when processing crafted input (bsc#1265060).
- CVE-2026-41256: truncation of top-level jq programs loaded with `-f` and can lead to the execution of unintended
  programs (bsc#1265061).
- CVE-2026-41257: integer overflow in `stack_reallocate` can lead to memory corruption and DoS when processing jq
  bytecode (bsc#1265062).
- CVE-2026-43894: signed integer overflow in the `decNumberFromString` `D2U()` macro can lead to an out-of-bounds
  memory write when processing large number literals (bsc#1265070).
- CVE-2026-33948: improper handling of buffer sizes via `strlen()` instead of `fgets()` in CLI input parsing allows
  validation bypass via embedded NUL bytes (bsc#1262043).


The following package changes have been done:

- libjq1-1.7.1-160000.3.1 updated
- jq-1.7.1-160000.3.1 updated