SUSE-CU-2026:14109-1: Security update of suse/sle15
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Thu Nov 12 16:37:28 UTC 2026
SUSE Container Update Advisory: suse/sle15
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14109-1
Container Tags : bci/bci-base:15.7 , bci/bci-base:15.7-5.23.69 , bci/bci-base:latest , suse/sle15:15.7 , suse/sle15:15.7-5.23.69 , suse/sle15:latest
Container Release : 5.23.69
Severity : important
Type : security
References : 1268414 1268419 1268423 1268424 1268425 1268426 1268427 1268975
1274489 1274490 1277477 1277478 1277482 1278173 1279541 1280941
1281325 1285008 1285010 1285011 1285012 1285013 1285014 1285015
1285016 1285017 1285018 1285021 1285022 1285023 1285024 1285026
1285027 1285028 1285029 1285030 1285031 1287778 1287781 1288144
CVE-2026-107929 CVE-2026-111497 CVE-2026-11352 CVE-2026-11564
CVE-2026-11586 CVE-2026-117556 CVE-2026-11856 CVE-2026-12064
CVE-2026-18477 CVE-2026-18508 CVE-2026-18924 CVE-2026-19931 CVE-2026-34182
CVE-2026-80255 CVE-2026-82209 CVE-2026-86409 CVE-2026-86410 CVE-2026-86411
CVE-2026-86412 CVE-2026-86413 CVE-2026-86414 CVE-2026-87861 CVE-2026-87862
CVE-2026-87863 CVE-2026-87864 CVE-2026-8932 CVE-2026-92386 CVE-2026-92387
CVE-2026-92388 CVE-2026-92389 CVE-2026-92390 CVE-2026-92391 CVE-2026-92392
CVE-2026-94265 CVE-2026-94266 CVE-2026-9546
-----------------------------------------------------------------
The container suse/sle15 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4945-1
Released: Thu Oct 29 17:30:42 2026
Summary: Security update for brotli
Type: security
Severity: important
References: 1287778,CVE-2026-111497
This update for brotli fixes the following issue:
- CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287778).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:5045-1
Released: Mon Nov 2 18:31:58 2026
Summary: Recommended update for libsolv, libzypp, zypper
Type: recommended
Severity: moderate
References: 1279541
This update for libsolv, libzypp, zypper fixes the following issues:
- improve SUSE product link dependency generation if there are
multiple release packages for the same product [bsc#1279541]
- fix possible segfault in the SUSE namespace dependency generation
- bump version to 0.7.39
- BuildRequires: %{libsolv_devel_package} >= 0.7.40 (bsc#1279541)
This fix resolves issues in online migrations to SLES 16.1.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5068-1
Released: Tue Nov 3 09:13:11 2026
Summary: Security update for curl
Type: security
Severity: important
References: 1268414,1268419,1268423,1268424,1268425,1268426,1268427,1277477,1277478,1277482,1278173,1285008,1285010,1285011,1285012,1285013,1285014,1285015,1285016,1285017,1285018,1285021,1285022,1285023,1285024,1285026,1285027,1285028,1285029,1285030,1285031,1287781,CVE-2026-107929,CVE-2026-11352,CVE-2026-11564,CVE-2026-11586,CVE-2026-11856,CVE-2026-12064,CVE-2026-18924,CVE-2026-19931,CVE-2026-80255,CVE-2026-82209,CVE-2026-86409,CVE-2026-86410,CVE-2026-86411,CVE-2026-86412,CVE-2026-86413,CVE-2026-86414,CVE-2026-87861,CVE-2026-87862,CVE-2026-87863,CVE-2026-87864,CVE-2026-8932,CVE-2026-92386,CVE-2026-92387,CVE-2026-92388,CVE-2026-92389,CVE-2026-92390,CVE-2026-92391,CVE-2026-92392,CVE-2026-94265,CVE-2026-94266,CVE-2026-9546
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-9546: sending old referer (bsc#1268419).
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
- CVE-2026-11564: Native CA trust persist (bsc#1268424).
- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
Changes for curl:
- Updated curl to version 8.22.0. (jsc#PED-16984)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5138-1
Released: Mon Nov 9 14:00:43 2026
Summary: Security update for zchunk
Type: security
Severity: moderate
References: 1288144,CVE-2026-117556
This update for zchunk fixes the following issue:
- CVE-2026-117556: heap out-of-bounds read in `read_preface()` allows attackers to cause an application crash via a
crafted `.zck` file (bsc#1288144).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:5149-1
Released: Mon Nov 9 18:43:07 2026
Summary: Recommended update for openssl-3
Type: recommended
Severity: moderate
References: 1281325,CVE-2026-34182
This update for openssl-3 fixes the following issues:
- Build with enable-sslkeylog to support the SSLKEYLOGFILE
environment variable usage. (jsc#PED-17079)
- Allow to bypass the strict tag initialization and length
enforcement added in the fix for CVE-2026-34182 when the env
variable OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and
set to a non-zero value. (bsc#1281325)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5160-1
Released: Tue Nov 10 10:40:47 2026
Summary: Security update for tar
Type: security
Severity: moderate
References: 1274489,1274490,1280941,CVE-2026-18477,CVE-2026-18508
This update for tar fixes the following issues:
- CVE-2026-18477: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (bsc#1274489).
- CVE-2026-18508: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
(bsc#1274490).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:5187-1
Released: Tue Nov 10 20:28:23 2026
Summary: Recommended update for libxmlb, snowball, bash
Type: recommended
Severity: moderate
References: 1268975
This update for libxmlb, snowball, bash fixes the following issues:
- Upgrade libxmlb, snowball, bash in preparation for fwupd upgrade.
The following package changes have been done:
- bash-sh-4.4-150400.27.13.3 updated
- bash-4.4-150400.27.13.3 updated
- curl-8.22.0-150700.7.33.1 updated
- libbrotlicommon1-1.0.7-150200.3.8.1 updated
- libbrotlidec1-1.0.7-150200.3.8.1 updated
- libcurl4-8.22.0-150700.7.33.1 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.56.1 updated
- libopenssl3-3.5.0-150700.5.56.1 updated
- libreadline7-7.0-150400.27.13.3 updated
- libsolv-tools-base-0.7.40-150700.11.13.1 updated
- libzck1-1.5.1-150700.3.3.1 updated
- libzypp-17.38.16-150700.6.19.1 updated
- openssl-3-3.5.0-150700.5.56.1 updated
- tar-1.34-150000.3.45.1 updated
- zypper-1.14.101-150700.13.12.1 updated
More information about the sle-container-updates
mailing list