SUSE-CU-2026:13474-1: Security update of suse/ltss/sle15.4/sle15

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/ltss/sle15.4/sle15
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13474-1
Container Tags        : suse/ltss/sle15.4/bci-base:15.4 , suse/ltss/sle15.4/bci-base:15.4-6.57 , suse/ltss/sle15.4/sle15:15.4 , suse/ltss/sle15.4/sle15:15.4-6.57 , suse/ltss/sle15.4/sle15:latest
Container Release     : 6.57
Severity              : important
Type                  : security
References            : 1262633 1263440 1264971 1268412 1268414 1268426 1277476 1277477
                        1277478 1277479 1277480 1277482 1278173 1285008 1285010 1285012
                        1285013 1285014 1285015 1285016 1285017 1285018 1285021 1285022
                        1285023 1285026 1285030 1285031 CVE-2026-107929 CVE-2026-11856
                        CVE-2026-13608 CVE-2026-18924 CVE-2026-19931 CVE-2026-5773 CVE-2026-7168
                        CVE-2026-80229 CVE-2026-80230 CVE-2026-80255 CVE-2026-82209 CVE-2026-86409
                        CVE-2026-86410 CVE-2026-86414 CVE-2026-87862 CVE-2026-87863 CVE-2026-87864
                        CVE-2026-8926 CVE-2026-8932 CVE-2026-92386 CVE-2026-92387 CVE-2026-92388
                        CVE-2026-92389 CVE-2026-92390 CVE-2026-92391 CVE-2026-92392 CVE-2026-94266
-----------------------------------------------------------------

The container suse/ltss/sle15.4/sle15 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3958-1
Released:    Thu Sep  3 15:31:59 2026
Summary:     Security update for curl
Type:        security
Severity:    moderate
References:  1262633,1263440,1264971,1268412,1277476,1277479,1277480,CVE-2026-13608,CVE-2026-5773,CVE-2026-7168,CVE-2026-80229,CVE-2026-80230,CVE-2026-8926
This update for curl fixes the following issues:

- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).

Changes for curl:

- Call http_size() first to prioritize Transfer-Encoding: chunked over a zero
 Content-Length empty body check (bsc#1264971)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4954-1
Released:    Fri Oct 30 17:18:59 2026
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1268414,1268426,1277477,1277478,1277482,1278173,1285008,1285010,1285012,1285013,1285014,1285015,1285016,1285017,1285018,1285021,1285022,1285023,1285026,1285030,1285031,CVE-2026-107929,CVE-2026-11856,CVE-2026-18924,CVE-2026-19931,CVE-2026-80255,CVE-2026-82209,CVE-2026-86409,CVE-2026-86410,CVE-2026-86414,CVE-2026-87862,CVE-2026-87863,CVE-2026-87864,CVE-2026-8932,CVE-2026-92386,CVE-2026-92387,CVE-2026-92388,CVE-2026-92389,CVE-2026-92390,CVE-2026-92391,CVE-2026-92392,CVE-2026-94266
This update for curl fixes the following issues:

- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).


The following package changes have been done:

- curl-8.14.1-150400.5.98.1 updated
- libcurl4-8.14.1-150400.5.98.1 updated