SUSE-CU-2026:14104-1: Security update of rancher/seedimage-builder

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Thu Nov 12 15:12:46 UTC 2026 

SUSE Container Update Advisory: rancher/seedimage-builder
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14104-1
Container Tags        : rancher/seedimage-builder:1.7.6 , rancher/seedimage-builder:1.7.6-7.1
Container Release     : 7.1
Severity              : important
Type                  : security
References            : 1255300 1257312 1257471 1260535 1263254 1264378 1264449 1264450
                        1265304 1265428 1265578 1265580 1265581 1265582 1265583 1265584
                        1265585 1265586 1265587 1265588 1265589 1265758 1274723 1274726
                        1275441 1276892 1276946 1277262 1277707 1277708 1277709 1277710
                        1277711 1277713 1277921 1277922 1278729 1279893 1280050 1280051
                        1280052 1280053 1280054 CVE-2026-18374 CVE-2026-19499 CVE-2026-19542
                        CVE-2026-32792 CVE-2026-33278 CVE-2026-33814 CVE-2026-40622 CVE-2026-41066
                        CVE-2026-41292 CVE-2026-41888 CVE-2026-42534 CVE-2026-42923 CVE-2026-42944
                        CVE-2026-42959 CVE-2026-42960 CVE-2026-43284 CVE-2026-43500 CVE-2026-44390
                        CVE-2026-44608 CVE-2026-6368 CVE-2026-6791 CVE-2026-72693 CVE-2026-77117
                        CVE-2026-80489 CVE-2026-8090 CVE-2026-8091 CVE-2026-8092 CVE-2026-8094
                        CVE-2026-86145 CVE-2026-89156 CVE-2026-89157 CVE-2026-89158 CVE-2026-89160
                        CVE-2026-89161 
-----------------------------------------------------------------

The container rancher/seedimage-builder was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 728
Released:    Mon Sep 14 17:52:13 2026
Summary:     Security update for glibc
Type:        security
Severity:    moderate
References:  1263254,1274723,1274726,1276892,1276946,1277262,1277921,1277922,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-41066,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489
This update for glibc fixes the following issues:

- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).

-----------------------------------------------------------------
Advisory ID: 730
Released:    Tue Sep 15 09:31:40 2026
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1255300,1257312,1257471,1260535,1265304,1277707,1277708,1277709,1277710,1277711,1277713,1279893,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161
This update for pcre2 fixes the following issues:

- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
  (bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
  (bsc#1280050).

-----------------------------------------------------------------
Advisory ID: 732
Released:    Wed Sep 16 11:16:27 2026
Summary:     Security update for kbd
Type:        security
Severity:    important
References:  1264378,1265578,1265580,1265581,1265582,1265583,1265584,1265585,1265586,1265587,1265588,1265589,1275441,CVE-2026-32792,CVE-2026-33278,CVE-2026-40622,CVE-2026-41292,CVE-2026-42534,CVE-2026-42923,CVE-2026-42944,CVE-2026-42959,CVE-2026-42960,CVE-2026-44390,CVE-2026-44608,CVE-2026-72693,CVE-2026-8090,CVE-2026-8091,CVE-2026-8092,CVE-2026-8094
This update for kbd fixes the following issue:

- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows
  `passwordless` root login (bsc#1275441).

-----------------------------------------------------------------
Advisory ID: 734
Released:    Thu Sep 17 09:07:22 2026
Summary:     Recommended update for grub2
Type:        recommended
Severity:    moderate
References:  1264449,1264450,1265428,1265758,1278729,CVE-2026-33814,CVE-2026-41888,CVE-2026-43284,CVE-2026-43500
This update for grub2 fixes the following issues:

- Add SBAT Provides to support shim SBAT dependency checks (bsc#1278729)


The following package changes have been done:

- boost-license1_84_0-1.84.0-slfo.1.1_1.4 added
- btrfsprogs-udev-rules-6.8.1-slfo.1.1_1.2 updated
- compat-usrmerge-tools-84.87-slfo.1.1_1.5 updated
- crypto-policies-20230920.570ea89-slfo.1.1_2.1 updated
- elemental-httpfy-1.7.5-slfo.1.1_1.1 updated
- elemental-seedimage-hooks-1.7.5-slfo.1.1_1.1 updated
- libsemanage-conf-3.5-slfo.1.1_1.3 updated
- libssh-config-0.10.6-slfo.1.1_6.1 updated
- pkgconf-m4-1.8.0-slfo.1.1_1.5 updated
- system-user-root-20190513-slfo.1.1_1.2 updated
- filesystem-84.87-slfo.1.1_1.2 updated
- glibc-2.38-slfo.1.1_10.1 updated
- libzstd1-1.5.5-slfo.1.1_1.4 updated
- libz1-1.2.13-slfo.1.1_2.1 updated
- libxxhash0-0.8.1-slfo.1.1_2.1 updated
- libverto1-0.3.2-slfo.1.1_1.2 updated
- libuuid1-2.40.4-slfo.1.1_7.1 updated
- liburcu8-0.14.0-slfo.1.1_1.3 updated
- libunistring5-1.1-slfo.1.1_1.2 updated
- libtextstyle0-0.21.1-slfo.1.1_2.1 updated
- libtasn1-6-4.19.0-slfo.1.1_3.1 updated
- libsmartcols1-2.40.4-slfo.1.1_7.1 updated
- libsepol2-3.5-slfo.1.1_1.3 updated
- libseccomp2-2.5.4-slfo.1.1_1.4 updated
- libsasl2-3-2.1.28-slfo.1.1_1.2 updated
- libpopt0-1.19-slfo.1.1_1.3 updated
- libpkgconf3-1.8.0-slfo.1.1_1.5 added
- libpcre2-8-0-10.42-slfo.1.1_2.1 updated
- libparted-fs-resize0-3.5-slfo.1.1_1.2 updated
- libnss_usrfiles2-2.27-slfo.1.1_1.3 updated
- libnghttp2-14-1.52.0-slfo.1.1_3.1 updated
- liblzo2-2-2.10-slfo.1.1_1.3 updated
- liblzma5-5.4.3-slfo.1.1_3.1 updated
- liblz4-1-1.9.4-slfo.1.1_1.2 updated
- liblua5_4-5-5.4.6-slfo.1.1_1.3 updated
- libkeyutils1-1.6.3-slfo.1.1_1.3 updated
- libjson-c5-0.16-slfo.1.1_1.2 updated
- libjitterentropy3-3.4.1-slfo.1.1_1.3 updated
- libip4tc2-1.8.9-slfo.1.1_2.1 added
- libgpg-error0-1.47-slfo.1.1_1.3 updated
- libgmp10-6.3.0-slfo.1.1_1.5 updated
- libgcc_s1-14.3.0+git11799-slfo.1.1_1.1 updated
- libfuse2-2.9.9-slfo.1.1_1.2 added
- libffi8-3.4.6-slfo.1.1_1.4 updated
- libexpat1-2.7.1-slfo.1.1_5.1 updated
- libeconf0-0.7.2-slfo.1.1_1.3 updated
- libcrypt1-4.4.36-slfo.1.1_1.4 updated
- libcom_err2-1.47.0-slfo.1.1_1.2 updated
- libcap2-2.69-slfo.1.1_2.1 updated
- libcap-ng0-0.8.3-slfo.1.1_1.4 updated
- libbz2-1-1.0.8-slfo.1.1_2.1 updated
- libburn4-1.5.4-slfo.1.1_1.2 updated
- libbtrfsutil1-6.8.1-slfo.1.1_1.2 updated
- libbtrfs0-6.8.1-slfo.1.1_1.2 updated
- libbrotlicommon1-1.1.0-slfo.1.1_1.3 updated
- libaudit1-3.1.1-slfo.1.1_2.1 updated
- libattr1-2.5.1-slfo.1.1_1.3 updated
- libargon2-1-20190702-slfo.1.1_1.2 added
- libalternatives1-1.2+30.a5431e9-slfo.1.1_1.3 updated
- libaio1-0.3.113-slfo.1.1_1.2 updated
- libacl1-2.3.1-slfo.1.1_1.3 updated
- fillup-1.42-slfo.1.1_2.2 updated
- dosfstools-4.2-slfo.1.1_1.2 updated
- diffutils-3.10-slfo.1.1_1.3 updated
- libpng16-16-1.6.58-slfo.1.1_1.1 updated
- libidn2-0-2.3.4-slfo.1.1_1.2 updated
- pkgconf-1.8.0-slfo.1.1_1.5 updated
- libselinux1-3.5-slfo.1.1_1.3 updated
- netcfg-11.6-slfo.1.1_1.2 updated
- libxml2-2-2.11.6-slfo.1.1_9.1 updated
- squashfs-4.6.1-slfo.1.1_1.2 updated
- libgcrypt20-1.10.3-slfo.1.1_4.1 updated
- libstdc++6-14.3.0+git11799-slfo.1.1_1.1 updated
- libp11-kit0-0.25.3-slfo.1.1_1.2 updated
- libblkid1-2.40.4-slfo.1.1_7.1 updated
- perl-base-5.38.2-slfo.1.1_3.1 updated
- libext2fs2-1.47.0-slfo.1.1_1.2 updated
- libudev1-254.27-slfo.1.1_5.1 updated
- chkstat-1600_20240206-slfo.1.1_1.5 added
- libzio1-1.08-slfo.1.1_1.3 updated
- libjte2-1.22-slfo.1.1_1.2 updated
- libbrotlidec1-1.1.0-slfo.1.1_1.3 updated
- alts-1.2+30.a5431e9-slfo.1.1_1.3 updated
- libpsl5-0.21.2-slfo.1.1_1.2 updated
- sed-4.9-slfo.1.1_2.1 updated
- libsubid4-4.15.1-slfo.1.1_1.3 added
- libsemanage2-3.5-slfo.1.1_1.3 updated
- findutils-4.9.0-slfo.1.1_2.1 updated
- libsystemd0-254.27-slfo.1.1_5.1 updated
- libncurses6-6.4.20240224-slfo.1.1_2.1 updated
- terminfo-base-6.4.20240224-slfo.1.1_2.1 updated
- libinih0-56-slfo.1.1_1.3 updated
- libboost_thread1_84_0-1.84.0-slfo.1.1_1.4 added
- p11-kit-0.25.3-slfo.1.1_1.2 updated
- p11-kit-tools-0.25.3-slfo.1.1_1.2 updated
- libmount1-2.40.4-slfo.1.1_7.1 updated
- libfdisk1-2.40.4-slfo.1.1_7.1 updated
- libisofs6-1.5.4-slfo.1.1_1.2 updated
- libfreetype6-2.14.3-slfo.1.1_1.1 updated
- ncurses-utils-6.4.20240224-slfo.1.1_2.1 updated
- libreadline8-8.2-slfo.1.1_1.4 updated
- libedit0-20210910.3.1-slfo.1.1_1.3 updated
- gptfdisk-1.0.9-slfo.1.1_2.1 updated
- libisoburn1-1.5.4-slfo.1.1_1.2 updated
- bash-5.2.15-slfo.1.1_1.6 updated
- bash-sh-5.2.15-slfo.1.1_1.6 updated
- xz-5.4.3-slfo.1.1_3.1 updated
- systemd-default-settings-branding-openSUSE-0.7-slfo.1.1_1.2 added
- systemd-default-settings-0.7-slfo.1.1_1.2 added
- pkgconf-pkg-config-1.8.0-slfo.1.1_1.5 updated
- login_defs-4.15.1-slfo.1.1_1.3 updated
- libdevmapper1_03-2.03.22_1.02.196-slfo.1.1_1.3 updated
- gzip-1.13-slfo.1.1_4.1 updated
- grep-3.11-slfo.1.1_1.2 updated
- gettext-runtime-0.21.1-slfo.1.1_2.1 updated
- coreutils-9.4-slfo.1.1_2.1 updated
- ALP-dummy-release-0.1-slfo.1.1_1.5 updated
- libparted2-3.5-slfo.1.1_1.2 updated
- libdevmapper-event1_03-2.03.22_1.02.196-slfo.1.1_1.3 updated
- info-7.0.3-slfo.1.1_1.3 updated
- xfsprogs-6.5.0-slfo.1.1_1.2 updated
- thin-provisioning-tools-0.9.0-slfo.1.1_1.4 updated
- systemd-rpm-macros-24-slfo.1.1_1.2 updated
- systemd-presets-common-SUSE-15-slfo.1.1_1.2 updated
- rpm-config-SUSE-20240214-slfo.1.1_1.2 updated
- rpm-4.18.0-slfo.1.1_3.1 updated
- permissions-config-1600_20240206-slfo.1.1_1.5 updated
- glibc-locale-base-2.38-slfo.1.1_10.1 updated
- e2fsprogs-1.47.0-slfo.1.1_1.2 updated
- ca-certificates-2+git20240805.fd24d50-slfo.1.1_1.2 updated
- ca-certificates-mozilla-2.84-slfo.1.1_1.1 updated
- btrfsprogs-6.8.1-slfo.1.1_1.2 updated
- parted-3.5-slfo.1.1_1.2 updated
- liblvm2cmd2_03-2.03.22-slfo.1.1_1.3 updated
- xorriso-1.5.4-slfo.1.1_1.2 updated
- device-mapper-2.03.22_1.02.196-slfo.1.1_1.3 updated
- systemd-presets-branding-ALP-transactional-20230214-slfo.1.1_1.2 added
- permissions-1600_20240206-slfo.1.1_1.5 updated
- mtools-4.0.43-slfo.1.1_1.2 updated
- libopenssl3-3.1.4-slfo.1.1_13.1 updated
- pam-1.6.1-slfo.1.1_5.1 updated
- grub2-2.12-slfo.1.1_8.1 updated
- grub2-i386-pc-2.12-slfo.1.1_8.1 updated
- suse-module-tools-16.0.43-slfo.1.1_1.2 updated
- kmod-32-slfo.1.1_2.1 updated
- rsync-3.3.0-slfo.1.1_7.1 updated
- libldap2-2.6.4-slfo.1.1_1.2 added
- libkmod2-32-slfo.1.1_2.1 updated
- libcryptsetup12-2.6.1-slfo.1.1_2.1 updated
- krb5-1.21.3-slfo.1.1_5.1 updated
- util-linux-2.40.4-slfo.1.1_7.1 updated
- shadow-4.15.1-slfo.1.1_1.3 updated
- pam-config-2.11+git.20240906-slfo.1.1_2.1 updated
- kbd-2.6.4-slfo.1.1_2.1 updated
- libssh4-0.10.6-slfo.1.1_6.1 updated
- libsnapper7-0.11.2-slfo.1.1_1.2 updated
- aaa_base-84.87+git20250903.33e5ba4-slfo.1.1_1.1 updated
- libcurl4-8.14.1-slfo.1.1_10.1 updated
- dbus-1-daemon-1.14.10-slfo.1.1_1.2 added
- curl-8.14.1-slfo.1.1_10.1 updated
- dbus-1-tools-1.14.10-slfo.1.1_1.2 updated
- systemd-254.27-slfo.1.1_5.1 updated
- sysuser-shadow-3.1-slfo.1.1_1.2 updated
- dbus-1-common-1.14.10-slfo.1.1_1.2 updated
- libdbus-1-3-1.14.10-slfo.1.1_1.2 updated
- dbus-1-1.14.10-slfo.1.1_1.2 updated
- system-group-kvm-20170617-slfo.1.1_1.2 updated
- system-group-hardware-20170617-slfo.1.1_1.2 updated
- udev-254.27-slfo.1.1_5.1 updated
- snapper-0.11.2-slfo.1.1_1.2 updated
- lvm2-2.03.22-slfo.1.1_1.3 updated
- elemental-toolkit-2.2.9-slfo.1.1_1.1 updated
- container:suse-toolbox-image-1.0.0-5.120 added
- boost-license1_86_0-1.86.0-160000.2.2 removed
- container:bci-bci-base-16.0-f1e8d646d8608529472a09294358b504dfd818e55257797c889699e790842108-0 removed
- cpio-2.15-160000.3.1 removed
- dbus-broker-36-160000.3.1 removed
- dbus-broker-block-restart-36-160000.3.1 removed
- dracut-059+suse.732.g39fc900f5-160000.1.1 removed
- elfutils-0.192-160000.3.1 removed
- envsubst-0.22.5-160000.2.2 removed
- file-5.46-160000.2.2 removed
- file-magic-5.46-160000.2.2 removed
- fuse3-3.16.2-160000.3.1 removed
- gawk-5.3.2-160000.3.1 removed
- glibc-gconv-modules-extra-2.40-160000.7.1 removed
- grub2-common-2.12-160000.8.1 removed
- libasm1-0.192-160000.3.1 removed
- libboost_thread1_86_0-1.86.0-160000.2.2 removed
- libdw1-0.192-160000.3.1 removed
- libelf1-0.192-160000.3.1 removed
- libfuse3-3-3.16.2-160000.3.1 removed
- libkbdfile1-2.7.1-160000.3.1 removed
- libkeymap1-2.7.1-160000.3.1 removed
- libkfont0-2.7.1-160000.3.1 removed
- liblastlog2-2-2.41.1-160000.5.1 removed
- libldap-2-2.6.13+157-160000.1.1 removed
- libldap-data-2.6.13+157-160000.1.1 removed
- liblz1-1.15-160000.2.2 removed
- libmagic1-5.46-160000.2.2 removed
- libmpdec4-4.0.1-160000.2.2 removed
- libmpfr6-4.2.1-160000.2.2 removed
- libpkgconf5-2.2.0-160000.2.2 removed
- libpython3_13-1_0-3.13.14-160000.2.1 removed
- libsqlite3-0-3.53.2-160000.1.1 removed
- libsubid5-4.17.2-160000.2.2 removed
- pam-extra-1.7.1-160000.5.1 removed
- permctl-1699_20250120-160000.2.2 removed
- pigz-2.8-160000.2.2 removed
- python3-base-3.13.14-160000.2.1 removed
- python313-base-3.13.14-160000.2.1 removed
- system-user-lp-20170617-160000.2.2 removed
- systemd-default-settings-branding-upstream-0.10-160000.2.2 removed
- systemd-presets-branding-SLE-15.1-160000.4.1 removed
- util-linux-systemd-2.41.1-160000.5.1 removed
- zstd-1.5.7-160000.2.2 removed

More information about the sle-container-updates mailing list