SUSE-CU-2026:14097-1: Security update of rancher/elemental-channel/sl-micro
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Thu Nov 12 15:11:10 UTC 2026
SUSE Container Update Advisory: rancher/elemental-channel/sl-micro
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14097-1
Container Tags : rancher/elemental-channel/sl-micro:6.2-kvm , rancher/elemental-channel/sl-micro:6.2-kvm-11.1
Container Release : 11.1
Severity : important
Type : security
References : 1217586 1271544 1271545 1271547 1271548 1274723 1274726 1276892
1276946 1277247 1277262 1277707 1277708 1277709 1277710 1277711
1277712 1277713 1277921 1277922 1279893 1280049 1280050 1280051
1280052 1280053 1280054 1281297 1282509 1282550 1282551 1282552
1282568 1282575 1282576 1282653 1283342 CVE-2023-42366 CVE-2026-103111
CVE-2026-18374 CVE-2026-19499 CVE-2026-19542 CVE-2026-38752 CVE-2026-38753
CVE-2026-38754 CVE-2026-38755 CVE-2026-6368 CVE-2026-6791 CVE-2026-77117
CVE-2026-80489 CVE-2026-86145 CVE-2026-8674 CVE-2026-86805 CVE-2026-88830
CVE-2026-88831 CVE-2026-88832 CVE-2026-88835 CVE-2026-88837 CVE-2026-88839
CVE-2026-88841 CVE-2026-89156 CVE-2026-89157 CVE-2026-89158 CVE-2026-89160
CVE-2026-89161 CVE-2026-89162
-----------------------------------------------------------------
The container rancher/elemental-channel/sl-micro was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 1747
Released: Wed Sep 23 21:42:24 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).
-----------------------------------------------------------------
Advisory ID: 1769
Released: Tue Sep 29 14:25:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
(bsc#1282509).
Other changes:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: 1856
Released: Tue Oct 6 18:06:37 2026
Summary: Security update for busybox
Type: security
Severity: moderate
References: 1217586,1271544,1271545,1271547,1271548,CVE-2023-42366,CVE-2026-38752,CVE-2026-38753,CVE-2026-38754,CVE-2026-38755
This update for busybox fixes the following issues:
- CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
- CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
- CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
- CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
- CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).
-----------------------------------------------------------------
Advisory ID: 1880
Released: Fri Oct 9 08:37:11 2026
Summary: Security update for busybox
Type: security
Severity: important
References: 1282550,1282551,1282552,1282568,1282575,1282576,1282653,CVE-2026-88830,CVE-2026-88831,CVE-2026-88832,CVE-2026-88835,CVE-2026-88837,CVE-2026-88839,CVE-2026-88841
This update for busybox fixes the following issues:
- CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer
overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
- CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
- CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap
buffer overflow when crafted filesystem images are processed (bsc#1282576).
- CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb
packages (bsc#1282551).
- CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
- CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
- CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()` failing to reset
the `field_start` cursor between package stanzas (bsc#1282653).
-----------------------------------------------------------------
Advisory ID: 2045
Released: Wed Nov 4 18:07:08 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1283342,CVE-2026-103111
This update for pcre2 fixes the following issue:
- CVE-2026-103111: there is an attacker-controlled regular expression and certain JIT API usage, allowing an out-of-
bounds write with arbitrary data (bsc#1283342).
The following package changes have been done:
- glibc-2.40-160000.7.1 updated
- libpcre2-8-0-10.45-160000.5.1 updated
- busybox-1.37.0-160000.8.1 updated
- container:bci-bci-base-16.0-f1e8d646d8608529472a09294358b504dfd818e55257797c889699e790842108-0 updated
More information about the sle-container-updates
mailing list