SUSE-CU-2026:13645-1: Security update of suse/kiosk/firefox-esr
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Nov 4 09:16:15 UTC 2026
SUSE Container Update Advisory: suse/kiosk/firefox-esr
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13645-1
Container Tags : suse/kiosk/firefox-esr:153.5 , suse/kiosk/firefox-esr:153.5-75.63 , suse/kiosk/firefox-esr:esr , suse/kiosk/firefox-esr:latest
Container Release : 75.63
Severity : important
Type : security
References : 1263116 1268414 1268419 1268423 1268424 1268425 1268426 1268427
1277477 1277478 1277482 1278173 1284274 1285008 1285010 1285011
1285012 1285013 1285014 1285015 1285016 1285017 1285018 1285021
1285022 1285023 1285024 1285026 1285027 1285028 1285029 1285030
1285031 1287778 1287781 CVE-2026-105326 CVE-2026-107929 CVE-2026-111497
CVE-2026-11352 CVE-2026-11564 CVE-2026-11586 CVE-2026-11856 CVE-2026-12064
CVE-2026-18924 CVE-2026-19931 CVE-2026-41079 CVE-2026-80255 CVE-2026-82209
CVE-2026-86409 CVE-2026-86410 CVE-2026-86411 CVE-2026-86412 CVE-2026-86413
CVE-2026-86414 CVE-2026-87861 CVE-2026-87862 CVE-2026-87863 CVE-2026-87864
CVE-2026-8932 CVE-2026-92386 CVE-2026-92387 CVE-2026-92388 CVE-2026-92389
CVE-2026-92390 CVE-2026-92391 CVE-2026-92392 CVE-2026-94265 CVE-2026-94266
CVE-2026-9546
-----------------------------------------------------------------
The container suse/kiosk/firefox-esr was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4945-1
Released: Thu Oct 29 17:30:42 2026
Summary: Security update for brotli
Type: security
Severity: important
References: 1287778,CVE-2026-111497
This update for brotli fixes the following issue:
- CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287778).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5068-1
Released: Tue Nov 3 09:13:11 2026
Summary: Security update for curl
Type: security
Severity: important
References: 1268414,1268419,1268423,1268424,1268425,1268426,1268427,1277477,1277478,1277482,1278173,1285008,1285010,1285011,1285012,1285013,1285014,1285015,1285016,1285017,1285018,1285021,1285022,1285023,1285024,1285026,1285027,1285028,1285029,1285030,1285031,1287781,CVE-2026-107929,CVE-2026-11352,CVE-2026-11564,CVE-2026-11586,CVE-2026-11856,CVE-2026-12064,CVE-2026-18924,CVE-2026-19931,CVE-2026-80255,CVE-2026-82209,CVE-2026-86409,CVE-2026-86410,CVE-2026-86411,CVE-2026-86412,CVE-2026-86413,CVE-2026-86414,CVE-2026-87861,CVE-2026-87862,CVE-2026-87863,CVE-2026-87864,CVE-2026-8932,CVE-2026-92386,CVE-2026-92387,CVE-2026-92388,CVE-2026-92389,CVE-2026-92390,CVE-2026-92391,CVE-2026-92392,CVE-2026-94265,CVE-2026-94266,CVE-2026-9546
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-9546: sending old referer (bsc#1268419).
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
- CVE-2026-11564: Native CA trust persist (bsc#1268424).
- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
Changes for curl:
- Updated curl to version 8.22.0. (jsc#PED-16984)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5078-1
Released: Tue Nov 3 09:21:20 2026
Summary: Security update for cups
Type: security
Severity: important
References: 1263116,1284274,CVE-2026-105326,CVE-2026-41079
This update for cups fixes the following issues:
- CVE-2026-41079: crafted SNMP response can lead to stack-based out-of-bounds read and sensitive memory disclosure
(bsc#1263116).
- CVE-2026-105326: argument injection in `mailto` notifier allows unauthenticated remote code execution (bsc#1284274).
The following package changes have been done:
- libbrotlicommon1-1.0.7-150200.3.8.1 updated
- libbrotlidec1-1.0.7-150200.3.8.1 updated
- libcurl4-8.22.0-150700.7.33.1 updated
- cups-config-2.2.7-150000.3.101.2 updated
- libcups2-2.2.7-150000.3.101.2 updated
- container:suse-sle15-15.7-7df35f6ac67ddb16ac906885538442fa28f9bfbc35454db5bd43d13fd180b846-0 updated
More information about the sle-container-updates
mailing list