SUSE-CU-2026:6835-1: Security update of suse/multi-linux-manager/5.1/x86_64/server-migration-14-16
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Jul 8 09:11:10 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.1/x86_64/server-migration-14-16
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:6835-1
Container Tags : suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.4 , suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.4.8.22.1 , suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:latest
Container Release : 8.22.1
Severity : important
Type : security
References : 1250782 1250782 1259327 1261206 1261280 1261606 1262464 1262465
1263804 1263804 1263804 1264965 1264971 1265172 1265172 1265172
1265173 1265173 1265173 1265174 1265174 1265174 1265175 1265175
1265175 1265176 1265177 1265177 1265177 1265178 1265178 1265178
1265179 1265179 1265179 1265180 1265181 1265181 1265181 1265182
1265182 1266340 1266340 1266341 1266341 1266342 1266342 1266343
1266345 1266349 1266349 1266350 1266351 1266352 1266353 1266355
1266356 1266357 1266357 CVE-2026-27456 CVE-2026-34180 CVE-2026-34180
CVE-2026-34181 CVE-2026-34183 CVE-2026-34743 CVE-2026-4046 CVE-2026-42766
CVE-2026-42766 CVE-2026-42767 CVE-2026-42768 CVE-2026-42769 CVE-2026-42770
CVE-2026-45445 CVE-2026-45446 CVE-2026-45447 CVE-2026-45447 CVE-2026-5450
CVE-2026-5928 CVE-2026-6472 CVE-2026-6472 CVE-2026-6472 CVE-2026-6473
CVE-2026-6473 CVE-2026-6473 CVE-2026-6474 CVE-2026-6474 CVE-2026-6474
CVE-2026-6475 CVE-2026-6475 CVE-2026-6475 CVE-2026-6476 CVE-2026-6477
CVE-2026-6477 CVE-2026-6477 CVE-2026-6478 CVE-2026-6478 CVE-2026-6478
CVE-2026-6479 CVE-2026-6479 CVE-2026-6479 CVE-2026-6575 CVE-2026-6637
CVE-2026-6637 CVE-2026-6637 CVE-2026-6638 CVE-2026-6638 CVE-2026-7383
CVE-2026-7383 CVE-2026-9076 CVE-2026-9076
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1944-1
Released: Mon May 18 09:47:19 2026
Summary: Security update for postgresql18
Type: security
Severity: important
References: 1263804,1265172,1265173,1265174,1265175,1265176,1265177,1265178,1265179,1265180,1265181,1265182,CVE-2026-6472,CVE-2026-6473,CVE-2026-6474,CVE-2026-6475,CVE-2026-6476,CVE-2026-6477,CVE-2026-6478,CVE-2026-6479,CVE-2026-6575,CVE-2026-6637,CVE-2026-6638
This update for postgresql18 fixes the following issues
Update to version 18.4.
Security issues:
- CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
- CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
- CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
- CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
- CVE-2026-6476: Properly quote subscription names in pg_createsubscriber (bsc#1265176).
- CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
- CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
- CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
- CVE-2026-6575: Detect faulty input when restoring attribute MCV statistics (bsc#1265180).
- CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
- CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).
Non security issue:
- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional
updates (jsc#PED-14820).
- /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2001-1
Released: Tue May 19 10:20:57 2026
Summary: Security update for postgresql16
Type: security
Severity: important
References: 1263804,1265172,1265173,1265174,1265175,1265177,1265178,1265179,1265181,1265182,CVE-2026-6472,CVE-2026-6473,CVE-2026-6474,CVE-2026-6475,CVE-2026-6477,CVE-2026-6478,CVE-2026-6479,CVE-2026-6637,CVE-2026-6638
This update for postgresql16 fixes the following issues
Update to version 16.13.
Security issues:
- CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
- CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
- CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
- CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
- CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
- CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
- CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
- CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
- CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).
Non security issue:
- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional
updates (jsc#PED-14824).
- /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:2041-1
Released: Thu May 21 16:29:18 2026
Summary: Recommended update for openssl-1_1
Type: recommended
Severity: moderate
References: 1250782
This update for openssl-1_1 fixes the following issues:
- Fix 30-test_fips_sli.t fails intermittently on s390x (bsc#1250782):
* Fix AES_GCM IV test sometimes failing on s390x.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2051-1
Released: Mon May 25 15:59:43 2026
Summary: Security update for xz
Type: security
Severity: important
References: 1261280,CVE-2026-34743
This update for xz fixes the following issue
- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2117-1
Released: Fri May 29 17:29:37 2026
Summary: Security update for postgresql14
Type: security
Severity: important
References: 1263804,1265172,1265173,1265174,1265175,1265177,1265178,1265179,1265181,CVE-2026-6472,CVE-2026-6473,CVE-2026-6474,CVE-2026-6475,CVE-2026-6477,CVE-2026-6478,CVE-2026-6479,CVE-2026-6637
This update for postgresql14 fixes the following issues
Update to version 14.23.
Security issues:
- CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
- CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
- CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
- CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
- CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
- CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
- CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
- CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
Non security issue:
- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional
updates (jsc#PED-14823).
- /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2231-1
Released: Wed Jun 3 12:57:18 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1261206,1262464,1262465,CVE-2026-4046,CVE-2026-5450,CVE-2026-5928
This update for glibc fixes the following issues
- CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
- CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
- CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:2278-1
Released: Fri Jun 5 11:00:12 2026
Summary: Recommended update for timezone
Type: recommended
Severity: important
References: 1264965
This update for timezone fixes the following issues:
- Update to 2026b:
* British Columbia moved to permanent -07 on 2026-03-09. (bsc#1264965)
* Some more overflow bugs have been fixed in zic.
- Update to 2026a:
* Moldova has used EU transition times since 2022.
* The 'right' TZif files are no longer installed by default.
* -DTZ_RUNTIME_LEAPS=0 disables runtime support for leap seconds.
* TZif files are no longer limited to 50 bytes of abbreviations.
* zic is no longer limited to 50 leap seconds.
* Several integer overflow bugs have been fixed.
- Update to 2025c:
* Update Baja California DST rules in 1953, 1961-1975
* An unset TZ is no longer invalid when /etc/localtime is
missing, and is abbreviated 'UTC' not '-00'. This reverts to 2024b behavior
* tzset etc. are now more cautious about questionable TZ settings.
* tzset etc. now treat ' ' like '_' in time zone abbreviations
* tzfree now preserves errno, consistently with POSIX.1-2024 'free'.
* zic has new options inspired by FreeBSD.
* multiple changes visible to developers
- Use 'REDO=posix_right' to keep installing 'right' TZif files.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2392-1
Released: Mon Jun 15 10:05:31 2026
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1250782,1266340,1266341,1266342,1266349,1266357,CVE-2026-34180,CVE-2026-42766,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076
This update for openssl-1_1 fixes the following issues
- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:2434-1
Released: Wed Jun 17 16:40:10 2026
Summary: Recommended update for coreutils
Type: recommended
Severity: important
References: 1259327
This update for coreutils fixes the following issues:
- proc: Use affinity mask even on systems with more than 1024 CPUs (bsc#1259327)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2485-1
Released: Mon Jun 22 14:06:22 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1261606,CVE-2026-27456
This update for util-linux fixes the following issue
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2648-1
Released: Fri Jun 26 13:05:57 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266340,1266341,1266342,1266343,1266345,1266349,1266350,1266351,1266352,1266353,1266355,1266356,1266357,CVE-2026-34180,CVE-2026-34181,CVE-2026-34183,CVE-2026-42766,CVE-2026-42767,CVE-2026-42768,CVE-2026-42769,CVE-2026-42770,CVE-2026-45445,CVE-2026-45446,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076
This update for openssl-3 fixes the following issues
- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
- CVE-2026-34181: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (bsc#1266343).
- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:2661-1
Released: Fri Jun 26 15:15:48 2026
Summary: Recommended update for curl
Type: recommended
Severity: important
References: 1264971
This update for curl fixes the following issues:
- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero
Content-Length empty body check (bsc#1264971)
The following package changes have been done:
- glibc-2.38-150600.14.49.1 updated
- libuuid1-2.40.4-150700.4.13.1 updated
- liblzma5-5.4.1-150600.3.6.1 updated
- libopenssl3-3.2.3-150700.5.36.1 updated
- coreutils-8.32-150400.9.12.1 updated
- libopenssl-3-fips-provider-3.2.3-150700.5.36.1 updated
- libcurl4-8.14.1-150700.7.17.1 updated
- postgresql16-contrib-16.14-150600.16.33.1 updated
- timezone-2026b-150600.91.9.1 updated
- glibc-locale-base-2.38-150600.14.49.1 updated
- libopenssl1_1-1.1.1w-150700.11.22.1 updated
- libpq5-18.4-150600.13.11.1 updated
- glibc-locale-2.38-150600.14.49.1 updated
- postgresql14-14.23-150600.16.31.1 updated
- postgresql16-16.14-150600.16.33.1 updated
- postgresql14-server-14.23-150600.16.31.1 updated
- postgresql16-server-16.14-150600.16.33.1 updated
- postgresql14-contrib-14.23-150600.16.31.1 updated
- container:bci-bci-base-15.7-d2aab68ae05470b62bbe38c4ca03ff5bf72b405197482ed96e34dd0087d7bde2-0 updated
More information about the sle-container-updates
mailing list