SUSE-CU-2026:6860-1: Security update of suse/sles/16.0/toolbox
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Thu Jul 9 07:52:42 UTC 2026
SUSE Container Update Advisory: suse/sles/16.0/toolbox
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:6860-1
Container Tags : suse/sles/16.0/toolbox:16.3 , suse/sles/16.0/toolbox:16.3-1.92 , suse/sles/16.0/toolbox:latest
Container Release : 1.92
Severity : important
Type : security
References : 1268402 1268407 1268409 1268413 1268415 1268416 1268417 1268420
1268422 1268427 CVE-2026-10536 CVE-2026-12064 CVE-2026-8286 CVE-2026-8458
CVE-2026-8924 CVE-2026-8927 CVE-2026-9079 CVE-2026-9080 CVE-2026-9545
CVE-2026-9547
-----------------------------------------------------------------
The container suse/sles/16.0/toolbox was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 1185
Released: Wed Jul 8 14:26:59 2026
Summary: Recommended update for strace
Type: recommended
Severity: moderate
References:
This update for strace fixes the following issues:
- Update to strace 7.1:
* Implemented wall-clock-aware columns for the -c/--summary-only report,
allowing wall-clock and system CPU times to be displayed side by side in a single run.
* Included out-of-range syscalls in the -c/--summary-only report.
* Updated decoding of sched_getattr syscall.
* Implemented decoding of FS_IOC_SHUTDOWN, PIDFD_GET_INFO
and PIDFD_GET_*_NAMESPACE ioctl commands.
* Implemented decoding of IFLA_BR_FDB_N_LEARNED, IFLA_BR_FDB_MAX_LEARNED
and IFLA_BR_STP_MODE netlink attributes.
* Updated lists of CLONE_*, FSMOUNT_*, KT_*, KVM_*, LANDLOCK_*,
NETDEV_*, NL80211_* and PIDFD_* constants.
* Updated lists of ioctl commands from Linux 7.1.
* Implement EPERM diagnostics and give a hint about yama (jsc#PED-15928).
- Update to strace 7.0:
* Implemented optional colorized trace output.
* Implemented decoding of rseq and rseq_slice_yield syscalls.
* Implemented decoding of BPF_TRACE_FSESSION bpf attach type.
* Implemented decoding of BPF_PROG_ASSOC_STRUCT_OPS bpf command.
* Implemented decoding of UDMABUF_CREATE, UDMABUF_CREATE_LIST,
and VIDIOC_QUERYMENU ioctl commands.
* Updated decoding of statmount syscall flags.
* Updated lists of BPF_*, BTRFS_*, FS_*, IORING_*, KEY_*, KVM_*, NT_*,
OPEN_TREE_*, PR_*, V4L2_* and *_MAGIC constants.
* Updated lists of ioctl commands from Linux 7.0.
- Update to strace 6.19:
* Implemented decoding of listns syscall.
* Implemented decoding of F_GET_RW_HINT, F_SET_RW_HINT, F_GET_FILE_RW_HINT,
F_SET_FILE_RW_HINT, F_GETDELEG and F_SETDELEG fcntl commands.
* Implemented decoding of IORING_REGISTER_SEND_MSG_RING, IORING_REGISTER_ZCRX_IFQ,
IORING_REGISTER_RESIZE_RINGS, IORING_REGISTER_MEM_REGION, IORING_REGISTER_QUERY
and IORING_REGISTER_ZCRX_CTRL opcodes of io_uring_register syscall.
* Implemented decoding of extended argument structures for io_uring_enter
syscall when IORING_ENTER_EXT_ARG or IORING_ENTER_EXT_ARG_REG flags are set.
* Implemented decoding of attr_ptr and attr_type_mask fields of
struct io_uring_sqe for io_uring_register syscall.
* Implemented opcode-specific decoding of flags union and ioprio fields
of struct io_uring_sqe for io_uring_register syscall.
* Implemented decoding of 128-byte SQEs for io_uring_register syscall.
* Implemented decoding of socket operations (SOCKET_URING_OP_*) for io_uring URING_CMD
and URING_CMD128 operations when the file descriptor is a socket.
* Updated decoding of struct mnt_id_req and struct perf_event_attr.
* Updated lists of ABS_*, BPF_*, ETHTOOL_*, ETH_P_*, IORING_*, KVM_*, PERF_*,
TLS_*, V4L2_* and *_MAGIC constants.
* Updated lists of ioctl commands from Linux 6.19.
- Update to strace 6.18:
* Added -e kvm=vcpu+ option for kvm_run struct decoding.
* Implemented decoding of FS_IOC_GETFSUUID, FS_IOC_GETFSSYSFSPATH
and FS_IOC_GETLBMD_CAP ioctl commands.
* Implemented decoding of BPF_PROG_STREAM_READ_BY_FD bpf command.
* Updated decoding of BPF_BTF_LOAD, BPF_MAP_CREATE, BPF_PROG_ATTACH, BPF_PROG_DETACH,
BPF_PROG_LOAD, BPF_PROG_QUERY and BPF_*_GET_*_ID bpf commands.
* Updated decoding of bpf_map_info and bpf_prog_info structures.
* Updated lists of AUDIT_*, BR_*, FF_*, IFLA_*, INPUT_PROP_*, IORING_*,
KEXEC_FILE_*, KEY_*, KVM_CAP_*, NL80211_CMD_*, RWF_* and TEE_* constants.
- Update to strace 6.17:
* Implemented decoding of file_getattr and file_setattr syscalls.
* Implemented decoding of SO_INQ socket option.
* Updated lists of BPF_*, BTN_*, BTRFS_*, DEVCONF_*, ETHTOOL_*, FALLOC_*,
KEXEC_*, KEY_*, KVM_*, NETCONFA_*, NFT_*, PR_*, SCM_*, V4L2_* and XDP_* constants.
* Updated lists of ioctl commands from Linux 6.17.
- Update to strace 6.16:
* Added -N/--arg-names option for printing syscall argument names.
* Implemented setting of system call information using
PTRACE_SET_SYSCALL_INFO ptrace API introduced in Linux 6.16.
* Implemented decoding of SO_RCVPRIORITY and SO_PASSRIGHTS socket options.
* Implemented decoding of RTA_NH_ID and RTA_FLOWLABEL netlink attributes.
* Updated decoding of statx syscall.
* Updated lists of BR_*, CRYPTOCFGA_*, FUTEX2_*, IORING_*, IPSET_*, KVM_*,
MDB_*, NETDEV_*, PR_*, RXRPC_*, SW_*, THERMAL_* and V4L2_* constants.
* Updated lists of ioctl commands from Linux 6.16.
- Update to strace 6.15:
* Implemented decoding of open_tree_attr syscall.
* Implemented decoding of AF_TIPC socket addresses and socket options.
* Updated decoding of statmount syscall.
* Updated lists of AUDIT_*, BPF_*, BTRFS_*, COUNTER_*, FAN_*, FRA_*, IFLA_*,
IORING_*, KVM_*, LANDLOCK_*, PKEY_*, RTPROT_*, TCP_* and V4L2_* constants.
* Updated lists of ioctl commands from Linux 6.15.
-----------------------------------------------------------------
Advisory ID: 1187
Released: Wed Jul 8 15:46:40 2026
Summary: Security update for curl
Type: security
Severity: important
References: 1268402,1268407,1268409,1268413,1268415,1268416,1268417,1268420,1268422,1268427,CVE-2026-10536,CVE-2026-12064,CVE-2026-8286,CVE-2026-8458,CVE-2026-8924,CVE-2026-8927,CVE-2026-9079,CVE-2026-9080,CVE-2026-9545,CVE-2026-9547
This update for curl fixes the following issues
- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
- CVE-2026-8458: wrong reuse for different services (bsc#1268407).
- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
- CVE-2026-9079: stale proxy password leak (bsc#1268415).
- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
- CVE-2026-9547: SSH improper host validation (bsc#1268420).
- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
The following package changes have been done:
- curl-8.14.1-160000.8.1 updated
- libcurl-mini4-8.14.1-160000.8.1 updated
- strace-7.1-160000.1.1 updated
More information about the sle-container-updates
mailing list