SUSE-CU-2026:6973-1: Security update of suse/kiosk/firefox-esr

Mon Jul 13 07:22:46 UTC 2026

SUSE Container Update Advisory: suse/kiosk/firefox-esr
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:6973-1
Container Tags        : suse/kiosk/firefox-esr:140.12 , suse/kiosk/firefox-esr:140.12-74.18 , suse/kiosk/firefox-esr:esr , suse/kiosk/firefox-esr:latest
Container Release     : 74.18
Severity              : important
Type                  : security
References            : 1263366 1263367 1268131 1268434 1269779 CVE-2026-11850 CVE-2026-12912
                        CVE-2026-36849 CVE-2026-40355 CVE-2026-40356 CVE-2026-4775 
-----------------------------------------------------------------

The container suse/kiosk/firefox-esr was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2848-1
Released:    Fri Jul 10 13:38:57 2026
Summary:     Security update for krb5, krb5-mini
Type:        security
Severity:    important
References:  1263366,1263367,1268131,CVE-2026-11850,CVE-2026-40355,CVE-2026-40356
This update for krb5, krb5-mini fixes the following issues

- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).
- CVE-2026-40355: Denial of Service via NULL pointer dereference in NegoEx mechanism (bsc#1263366).
- CVE-2026-40356: Denial of Service via integer underflow and out-of-bounds read (bsc#1263367).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2853-1
Released:    Fri Jul 10 19:54:25 2026
Summary:     Security update for tiff
Type:        security
Severity:    important
References:  1268434,1269779,CVE-2026-12912,CVE-2026-36849,CVE-2026-4775
This update for tiff fixes the following issues:

Update to version 4.7.2.

Security issues fixed:

- CVE-2026-12912: heap-based buffer overflow when processing crafted PixarLog-compressed TIFF image (bsc#1269779).
- CVE-2026-36849: denial of service when processing a a crafted TIFF file containing a large SamplesPerPixel tag value
  (bsc#1268434).

Other updates and bugfixes:

- Version 4.7.2:
  - Software configuration changes:
    * cmake: Fix bundle identifiers to use reverse-DNS format
    * cmake: Fix and improve Apple framework build support
    * cmake: Use TurboJPEG CONFIG by default (issue #767)
    * cmake: changes related to 8-/12-bit modes
    * cmake: Replace CMath::CMath with direct link to avoid export.
    * Support for iOS-derived builds
    * Simplify cmake byte order version check
    * Add additional warnings, primarily floating precision conversions and integer arithmetic conversions
    * configure.ac: Require bootstrap with at least Autoconf 2.71.
  - Library changes:
    * New/improved functionalities::
    + Add TIFFGetMaxCompressionRatio() and use it in _TIFFReadEncoded[Tile|Strip)AndAllocBuffer() (issue #781)
  - Bug fixes:
    * Handle negative TIFFReadFile results before state updates (issue #854)
    * tif_dirread.c: fix copy-paste bug in ChopUpSingleUncompressedStrip
    * tif_read.c: Fixed division by zero in TIFFStartStrip() (issue #777)
    * tif_dirwrite.c: add integer overflow checks to allocation size calculations
    * tif_print.c: add integer overflow checks to allocation size calculations
    * tif_write.c: fix OOB read and underflow in TIFFAppendToStrip copy loop
    * DumpModeSeek: add bounds check to prevent OOB pointer advance
    * TIFFGrowStrips: fix use-after-free on partial realloc failure.
    * Fix NULL dereference in _TIFFReserveLargeEnoughWriteBuffer() by validating the strip bytecount array before
      accessing it.
    * TIFFRGBAImage: avoid int overflows in put functions (issue #830)
    * tif_getimage: fix inconsistent fromskew handling in put16bitbwtile (issue #792)
    * tif_getimage: Widen pointer-offset arithmetic in tif_getimage
    * putcontig8bitYCbCr44tile: fix wrong fromskew computation (issue #798)
    * putcontig8bitYCbCr42tile: Reject invalid YCbCr subsampling when image dimensions are smaller than the subsampling
      block to prevent out-of-bounds writes. (issue #753)
    * TIFFReadRGBAImage(): prevent integer overflow and later heap overflow (issue #787)
    * TIFFFillStrip/Tile(): avoid excessive memory allocation (issue #831)
    * TIFFLinkDirectory() checks for IFD loops (issue #788)
    * Check result of _TIFFCheckRealloc to prevent memory leaks and segmentation fault when reallocation fails.
    * TIFFVTileSize64(): in YCbCr contig non upsampled mode, validate td_samplesperpixel==3 (issue #805)
    * TIFFReadDirEntryPersampleShort(): be tolerant to tags like SampleFormat not having 1 or SamplesPerPixel values
      (https://github.com/OSGeo/gdal/issues/13465)
    * tif_getimage: reject tile widths that would overflow toskew (issue #808)
    * Fix integer overflow in _TIFFPartialReadStripArray on 32-bit.
    * TIFFAppendToStrip(): add some checks to avoid null-pointer-dereferencing (issue #777).
    * _TIFFGetStrileOffsetOrByteCountValue(): fix potential crash on corrupted files when file opened in 'O' mode
      (https://issues.oss-fuzz.com/issues/471328917)
    * TIFFReadDirectory(): re-set TIFF_LAZYSTRILELOAD if file opened in 'O' mode
    * _TIFFMergeFields(): avoid NULL ptr dereference (issue #755).
    * Check td_stripbytecount_p and td_stripoffset_p for NULL pointer before (re-)writing to file. (issue #749)
    * JPEGDecodeRaw: initialize output buffer to avoid returning uninitialized memory (issue #892)
    * JPEG decompressor: initialize output buffer when JPEG image is smaller than strile dimension to avoid heap memory
      disclosure (issue #826)
    * JPEG: fix generation of tiled 12-bit JPEG compressed files with libjpeg-turbo 3.0.3 (issue #773)
    * JPEGDecode(): fix memory leak in error code path (https://issues.oss-fuzz.com/issues/471945501)
    * tif_jpeg: reject mismatched JPEG data precision to avoid write overflow
    * Fix signed left-shift UB in LogLuv RANDITHER encoding (issue #850)
    * PixarLog: error out on invalid ABGR output buffer sizes.
    * PixarLog: complete ABGR bounds check for multi-row strip decoding.
    * PixarLog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 (issue #824)
    * PixarLog: fix undoing horizontal differencing when SamplesPerPixel != 3 and 4 (issue #789).
    * PixarLog codec: fix potential integer overflow/out-of-bounds access (issue #797)
    * TIFFAdvanceDirectory(): avoid potential read heap-buffer-overflow in mmap code path on 32 bit builds
      (https://issues.oss-fuzz.com/issues/506737072)
    * OJPEG: fix integer overflow in subsampling buffer allocation.
    * OJPEG: fix nullptr deref when changing compression method from OJPEG to something else (issue #795).
    * OJPEG fix potential integer overflow/out-of-bounds access (issue #796).
    * ojpeg: prevent EOF infinite loop (fixes commit 2a3d55b)
    * fix null pointer deference in issue #782.
    * fix stack-overflow in issue #784.
  - Other changes:
    * Change EXIF and GPS tag type from IFD8 to LONG8 per EXIF-specification (issue #739).
    * Harden integer size and offset calculations (issue #897)
    * TIFFComputeTile/TIFFComputeStrip: use overflow-checked multiplication
    * Move widening casts inside multiplication scope.
    * Lots of compiler warning fixes related to enabling more warning flags
    * Align writing and reading of TIFF_LONG8 and TIFF_IFD8 tags (issue #773)
    * TIFFFillStrip(): prevent harmless unsigned integer overflow

The following package changes have been done:

- libtiff6-4.7.2-150600.3.29.1 updated
- krb5-1.20.1-150600.11.19.1 updated
- container:suse-sle15-15.7-0180bc786e784f4f99302a008c5991e2d05f7fac404ce0fa2a07aaef564e6ef8-0 updated