SUSE-CU-2026:13839-1: Security update of suse/kiosk/firefox-esr

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/kiosk/firefox-esr
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13839-1
Container Tags        : suse/kiosk/firefox-esr:153.5 , suse/kiosk/firefox-esr:153.5-11.8 , suse/kiosk/firefox-esr:esr
Container Release     : 11.8
Severity              : important
Type                  : security
References            : 1282612 CVE-2026-96889 
-----------------------------------------------------------------

The container suse/kiosk/firefox-esr was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 11
Released:    Fri Oct 30 16:17:42 2026
Summary:     Security update for librsvg
Type:        security
Severity:    important
References:  1282612,CVE-2026-96889
This update for librsvg fixes the following issues:

- CVE-2026-96889: Use-after-free when XML includes have duplicated entities (bsc#1282612).

Changes for librsvg:

- Update to version 2.60.3:
 + This is a security release for bug #1241, RUSTSEC-2026-0305 /
 CVE-2026-96889 / bsc#1282612:
 - glgo#GNOME/librsvg#1241: Fix use-after-free when there are
 duplicate XML entities in nested Xinclude documents. Thanks to
 Rafael B. Dias for reporting this in detail.
 - Dependency updates: lopdf for RUSTSEC-2026-0187, crossbeam-epoch for
 RUSTSEC-2026-0204, time for RUSTSEC-2026-0009.
 - The minimum supported Rust version (MSRV) is 1.89.0.


The following package changes have been done:

- librsvg-2-2-2.60.3-160100.1.1 updated