SUSE-CU-2026:2198-1: Security update of suse/sle-micro/5.2/toolbox

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sle-micro/5.2/toolbox
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:2198-1
Container Tags        : suse/sle-micro/5.2/toolbox:14.2 , suse/sle-micro/5.2/toolbox:14.2-7.11.264 , suse/sle-micro/5.2/toolbox:latest
Container Release     : 7.11.264
Severity              : important
Type                  : security
References            : 1246602 1254670 1257181 1258229 1259051 1259619 1259711 1259726
                        1259729 CVE-2025-53906 CVE-2025-70873 CVE-2025-7709 CVE-2026-1299
                        CVE-2026-26269 CVE-2026-28417 CVE-2026-32776 CVE-2026-32777 CVE-2026-32778
-----------------------------------------------------------------

The container suse/sle-micro/5.2/toolbox was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1065-1
Released:    Thu Mar 26 11:38:12 2026
Summary:     Security update for sqlite3
Type:        security
Severity:    moderate
References:  1254670,1259619,CVE-2025-70873,CVE-2025-7709
This update for sqlite3 fixes the following issues:

Update sqlite3 to 3.51.3:

- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).
- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).

Changelog:

 * Fix the WAL-reset database corruption bug:
   https://sqlite.org/wal.html#walresetbug

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1090-1
Released:    Thu Mar 26 18:44:54 2026
Summary:     Security update for python3
Type:        security
Severity:    important
References:  1257181,CVE-2026-1299
This update for python3 fixes the following issues:

- CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1095-1
Released:    Thu Mar 26 19:05:08 2026
Summary:     Security update for vim
Type:        security
Severity:    moderate
References:  1246602,1258229,1259051,CVE-2025-53906,CVE-2026-26269,CVE-2026-28417
This update for vim fixes the following issues:

Update Vim to version 9.2.0110:

- CVE-2025-53906: malicious zip archive may cause a path traversal in Vim's zip (bsc#1246602).
- CVE-2026-26269: Netbeans specialKeys stack buffer overflow (bsc#1258229).
- CVE-2026-28417: crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:1137-1
Released:    Sat Mar 28 03:33:57 2026
Summary:     Security update for expat
Type:        security
Severity:    important
References:  1259711,1259726,1259729,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778
This update for expat fixes the following issues:

- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity
  declaration value (bsc#1259726).
- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition (bsc#1259729).


The following package changes have been done:

- libexpat1-2.7.1-150000.3.45.1 updated
- libpython3_6m1_0-3.6.15-150300.10.109.1 updated
- libsqlite3-0-3.51.3-150000.3.39.1 updated
- python3-base-3.6.15-150300.10.109.1 updated
- vim-data-common-9.2.0110-150000.5.86.1 updated
- vim-9.2.0110-150000.5.86.1 updated