SUSE-CU-2026:13850-1: Security update of suse/kiosk/tigervnc-x11vnc

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/kiosk/tigervnc-x11vnc
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13850-1
Container Tags        : suse/kiosk/tigervnc-x11vnc:1 , suse/kiosk/tigervnc-x11vnc:1.16 , suse/kiosk/tigervnc-x11vnc:1.16-1.4 , suse/kiosk/tigervnc-x11vnc:latest
Container Release     : 1.4
Severity              : important
Type                  : security
References            : 1281665 1282612 1285083 CVE-2026-109088 CVE-2026-94286 CVE-2026-96889
-----------------------------------------------------------------

The container suse/kiosk/tigervnc-x11vnc was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 12
Released:    Fri Oct 30 16:10:06 2026
Summary:     Security update for libXtst
Type:        security
Severity:    important
References:  1281665,1285083,CVE-2026-109088,CVE-2026-94286
This update for libXtst fixes the following issues:

- CVE-2026-94286: Out-of-bounds read in libXtst's RECORD reply parser (bsc#1281665).
- CVE-2026-109088: libXtst RECORD EnableContext Reply Endless Loop (bsc#1285083).

-----------------------------------------------------------------
Advisory ID: 11
Released:    Fri Oct 30 16:17:42 2026
Summary:     Security update for librsvg
Type:        security
Severity:    important
References:  1282612,CVE-2026-96889
This update for librsvg fixes the following issues:

- CVE-2026-96889: Use-after-free when XML includes have duplicated entities (bsc#1282612).

Changes for librsvg:

- Update to version 2.60.3:
 + This is a security release for bug #1241, RUSTSEC-2026-0305 /
 CVE-2026-96889 / bsc#1282612:
 - glgo#GNOME/librsvg#1241: Fix use-after-free when there are
 duplicate XML entities in nested Xinclude documents. Thanks to
 Rafael B. Dias for reporting this in detail.
 - Dependency updates: lopdf for RUSTSEC-2026-0187, crossbeam-epoch for
 RUSTSEC-2026-0204, time for RUSTSEC-2026-0009.
 - The minimum supported Rust version (MSRV) is 1.89.0.


The following package changes have been done:

- libXtst6-1.2.5-160100.3.1 updated
- librsvg-2-2-2.60.3-160100.1.1 updated