SUSE-CU-2026:13685-1: Security update of suse/sles/16.0/libguestfs-tools

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sles/16.0/libguestfs-tools
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13685-1
Container Tags        : suse/sles/16.0/libguestfs-tools:1.9 , suse/sles/16.0/libguestfs-tools:1.9.1 , suse/sles/16.0/libguestfs-tools:1.9.1-2.24
Container Release     : 2.24
Severity              : important
Type                  : security
References            : 1271446 1271447 1271448 1271449 1272195 1272196 1273156 1275115
                        1282347 1283299 1283300 1283301 1283302 1283303 1283304 1283493
                        1283831 1284334 CVE-2026-102555 CVE-2026-102556 CVE-2026-102557
                        CVE-2026-102558 CVE-2026-102559 CVE-2026-102560 CVE-2026-102633
                        CVE-2026-103399 CVE-2026-12547 CVE-2026-12548 CVE-2026-15711
                        CVE-2026-15712 CVE-2026-15713 CVE-2026-15714 CVE-2026-32776 CVE-2026-32777
                        CVE-2026-32778 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-66339
                        CVE-2026-77214 CVE-2026-93990 
-----------------------------------------------------------------

The container suse/sles/16.0/libguestfs-tools was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1996
Released:    Tue Oct 27 17:06:39 2026
Summary:     Security update for expat
Type:        security
Severity:    important
References:  1275115,1282347,1283493,1284334,CVE-2026-102633,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778,CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-77214,CVE-2026-93990
This update for expat fixes the following issues:

- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).
- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

 * Bug fixes:
 * Fix an OOM-related memory leak on a failed overflow check
 * Fix memory alignment for architectures with 128bit pointers
 * Mark XML_SetHashSalt deprecated

-----------------------------------------------------------------
Advisory ID: 2000
Released:    Thu Oct 29 11:23:31 2026
Summary:     Security update for libsoup
Type:        security
Severity:    important
References:  1271446,1271447,1271448,1271449,1272195,1272196,1273156,1283299,1283300,1283301,1283302,1283303,1283304,1283831,CVE-2026-102555,CVE-2026-102556,CVE-2026-102557,CVE-2026-102558,CVE-2026-102559,CVE-2026-102560,CVE-2026-103399,CVE-2026-12547,CVE-2026-12548,CVE-2026-15711,CVE-2026-15712,CVE-2026-15713,CVE-2026-15714,CVE-2026-66339
This update for libsoup fixes the following issues:

- CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch
  (bsc#1272195).
- CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation (bsc#1272196).
- CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol
  violation (bsc#1271446).
- CVE-2026-15712: SoupClientMessageIOHTTP2: HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-
  termination assumption (bsc#1271447).
- CVE-2026-15713: SoupCache: libsoup: HTTP/2 frame window exhaustion remote denial of service via memory leak
  (bsc#1271448).
- CVE-2026-15714: SoupMultipartInputStream: libsoup: Out-of-bounds read in soup_multipart_input_stream_read_headers
  via an oversized multipart boundary string (bsc#1271449).
- CVE-2026-66339: proxy credentials leak to destination server via `Proxy-Authorization` header in CONNECT tunnels
  (bsc#1273156).
- CVE-2026-102555: Heap buffer overflow via uninitialized length in data-URI base64 decoding (bsc#1283299).
- CVE-2026-102556: Heap buffer overflow from WebSocket Pong signal type confusion (bsc#1283300).
- CVE-2026-102557: Heap buffer overflow during WebSocket message reassembly (bsc#1283301).
- CVE-2026-102558: Heap buffer overflow during WebSocket receive-buffer growth (bsc#1283302).
- CVE-2026-102559: Heap buffer overflow during WebSocket client-frame masking (bsc#1283303).
- CVE-2026-102560: Heap buffer overflow during outgoing permessage-deflate buffer growth (bsc#1283304).
- CVE-2026-103399: incomplete request body draining in HTTP/1.x early responses can allow HTTP request smuggling
  (bsc#1283831).


The following package changes have been done:

- libexpat1-2.8.5-160000.1.1 updated
- libsoup-3_0-0-3.6.6-160000.5.1 updated