SUSE-CU-2026:13467-1: Security update of suse/sle-micro/5.4/toolbox

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sle-micro/5.4/toolbox
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13467-1
Container Tags        : suse/sle-micro/5.4/toolbox:16.3 , suse/sle-micro/5.4/toolbox:16.3-5.19.306 , suse/sle-micro/5.4/toolbox:latest
Container Release     : 5.19.306
Severity              : important
Type                  : security
References            : 1268414 1268426 1277477 1277478 1277482 1278173 1285008 1285010
                        1285012 1285013 1285014 1285015 1285016 1285017 1285018 1285021
                        1285022 1285023 1285026 1285030 1285031 CVE-2026-107929 CVE-2026-11856
                        CVE-2026-18924 CVE-2026-19931 CVE-2026-80255 CVE-2026-82209 CVE-2026-86409
                        CVE-2026-86410 CVE-2026-86414 CVE-2026-87862 CVE-2026-87863 CVE-2026-87864
                        CVE-2026-8932 CVE-2026-92386 CVE-2026-92387 CVE-2026-92388 CVE-2026-92389
                        CVE-2026-92390 CVE-2026-92391 CVE-2026-92392 CVE-2026-94266 
-----------------------------------------------------------------

The container suse/sle-micro/5.4/toolbox was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4954-1
Released:    Fri Oct 30 17:18:59 2026
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1268414,1268426,1277477,1277478,1277482,1278173,1285008,1285010,1285012,1285013,1285014,1285015,1285016,1285017,1285018,1285021,1285022,1285023,1285026,1285030,1285031,CVE-2026-107929,CVE-2026-11856,CVE-2026-18924,CVE-2026-19931,CVE-2026-80255,CVE-2026-82209,CVE-2026-86409,CVE-2026-86410,CVE-2026-86414,CVE-2026-87862,CVE-2026-87863,CVE-2026-87864,CVE-2026-8932,CVE-2026-92386,CVE-2026-92387,CVE-2026-92388,CVE-2026-92389,CVE-2026-92390,CVE-2026-92391,CVE-2026-92392,CVE-2026-94266
This update for curl fixes the following issues:

- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).


The following package changes have been done:

- curl-8.14.1-150400.5.98.1 updated
- libcurl4-8.14.1-150400.5.98.1 updated