SUSE-CU-2026:13984-1: Security update of suse/agentic/mcp/multi-linux-manager

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/agentic/mcp/multi-linux-manager
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13984-1
Container Tags        : suse/agentic/mcp/multi-linux-manager:0.6 , suse/agentic/mcp/multi-linux-manager:0.6.3 , suse/agentic/mcp/multi-linux-manager:0.6.3.10.6 , suse/agentic/mcp/multi-linux-manager:latest
Container Release     : 10.6
Severity              : important
Type                  : security
References            : 1252290 1281297 1282509 1283147 1289299 CVE-2026-84243 CVE-2026-8674
                        CVE-2026-86805 CVE-2026-97399 
-----------------------------------------------------------------

The container suse/agentic/mcp/multi-linux-manager was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 40
Released:    Wed Nov 11 22:50:04 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1252290,1281297,1282509,1283147,1289299,CVE-2026-84243,CVE-2026-8674,CVE-2026-86805,CVE-2026-97399
This update for glibc fixes the following issues:

- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
  trigger a process crash (bsc#1281297).
- CVE-2026-84243: directory traversal via `gettext` functions and the `LANGUAGE` environment variable can lead to
  arbitrary code execution (bsc#1289299).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
  (bsc#1282509).
- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash
  (bsc#1283147).


The following package changes have been done:

- glibc-2.40-160100.4.1 updated