SUSE-CU-2026:14248-1: Security update of bci/bci-sle15-kernel-module-devel
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Nov 13 11:35:56 UTC 2026
SUSE Container Update Advisory: bci/bci-sle15-kernel-module-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14248-1
Container Tags : bci/bci-sle15-kernel-module-devel:15.7 , bci/bci-sle15-kernel-module-devel:15.7-62.3 , bci/bci-sle15-kernel-module-devel:latest
Container Release : 62.3
Severity : important
Type : security
References : 1268414 1268419 1268423 1268424 1268425 1268426 1268427 1268975
1274489 1274490 1277477 1277478 1277482 1278173 1280941 1281325
1285008 1285010 1285011 1285012 1285013 1285014 1285015 1285016
1285017 1285018 1285021 1285022 1285023 1285024 1285026 1285027
1285028 1285029 1285030 1285031 1287778 1287781 CVE-2026-107929
CVE-2026-111497 CVE-2026-11352 CVE-2026-11564 CVE-2026-11586
CVE-2026-11856 CVE-2026-12064 CVE-2026-18477 CVE-2026-18508 CVE-2026-18924
CVE-2026-19931 CVE-2026-34182 CVE-2026-80255 CVE-2026-82209 CVE-2026-86409
CVE-2026-86410 CVE-2026-86411 CVE-2026-86412 CVE-2026-86413 CVE-2026-86414
CVE-2026-87861 CVE-2026-87862 CVE-2026-87863 CVE-2026-87864 CVE-2026-8932
CVE-2026-92386 CVE-2026-92387 CVE-2026-92388 CVE-2026-92389 CVE-2026-92390
CVE-2026-92391 CVE-2026-92392 CVE-2026-94265 CVE-2026-94266 CVE-2026-9546
-----------------------------------------------------------------
The container bci/bci-sle15-kernel-module-devel was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4945-1
Released: Thu Oct 29 17:30:42 2026
Summary: Security update for brotli
Type: security
Severity: important
References: 1287778,CVE-2026-111497
This update for brotli fixes the following issue:
- CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287778).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5068-1
Released: Tue Nov 3 09:13:11 2026
Summary: Security update for curl
Type: security
Severity: important
References: 1268414,1268419,1268423,1268424,1268425,1268426,1268427,1277477,1277478,1277482,1278173,1285008,1285010,1285011,1285012,1285013,1285014,1285015,1285016,1285017,1285018,1285021,1285022,1285023,1285024,1285026,1285027,1285028,1285029,1285030,1285031,1287781,CVE-2026-107929,CVE-2026-11352,CVE-2026-11564,CVE-2026-11586,CVE-2026-11856,CVE-2026-12064,CVE-2026-18924,CVE-2026-19931,CVE-2026-80255,CVE-2026-82209,CVE-2026-86409,CVE-2026-86410,CVE-2026-86411,CVE-2026-86412,CVE-2026-86413,CVE-2026-86414,CVE-2026-87861,CVE-2026-87862,CVE-2026-87863,CVE-2026-87864,CVE-2026-8932,CVE-2026-92386,CVE-2026-92387,CVE-2026-92388,CVE-2026-92389,CVE-2026-92390,CVE-2026-92391,CVE-2026-92392,CVE-2026-94265,CVE-2026-94266,CVE-2026-9546
This update for curl fixes the following issues:
- CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
- CVE-2026-9546: sending old referer (bsc#1268419).
- CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
- CVE-2026-11564: Native CA trust persist (bsc#1268424).
- CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
- CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
- CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
- CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
- CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
- CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
- CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
- CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
- CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
- CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
- CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
- CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
- CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
- CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
- CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
- CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
- CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
- CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
- CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
- CVE-2026-92389: TFTP direction confusion (bsc#1285015).
- CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
- CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
- CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
- CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
- CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
- CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
Changes for curl:
- Updated curl to version 8.22.0. (jsc#PED-16984)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:5149-1
Released: Mon Nov 9 18:43:07 2026
Summary: Recommended update for openssl-3
Type: recommended
Severity: moderate
References: 1281325,CVE-2026-34182
This update for openssl-3 fixes the following issues:
- Build with enable-sslkeylog to support the SSLKEYLOGFILE
environment variable usage. (jsc#PED-17079)
- Allow to bypass the strict tag initialization and length
enforcement added in the fix for CVE-2026-34182 when the env
variable OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and
set to a non-zero value. (bsc#1281325)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5160-1
Released: Tue Nov 10 10:40:47 2026
Summary: Security update for tar
Type: security
Severity: moderate
References: 1274489,1274490,1280941,CVE-2026-18477,CVE-2026-18508
This update for tar fixes the following issues:
- CVE-2026-18477: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape (bsc#1274489).
- CVE-2026-18508: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
(bsc#1274490).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:5187-1
Released: Tue Nov 10 20:28:23 2026
Summary: Recommended update for libxmlb, snowball, bash
Type: recommended
Severity: moderate
References: 1268975
This update for libxmlb, snowball, bash fixes the following issues:
- Upgrade libxmlb, snowball, bash in preparation for fwupd upgrade.
The following package changes have been done:
- libbrotlicommon1-1.0.7-150200.3.8.1 updated
- libbrotlidec1-1.0.7-150200.3.8.1 updated
- libreadline7-7.0-150400.27.13.3 updated
- bash-4.4-150400.27.13.3 updated
- bash-sh-4.4-150400.27.13.3 updated
- libopenssl3-3.5.0-150700.5.56.1 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.56.1 updated
- libcurl4-8.22.0-150700.7.33.1 updated
- openssl-3-3.5.0-150700.5.56.1 updated
- tar-1.34-150000.3.45.1 updated
- container:registry.suse.com-bci-bci-base-15.7-dc390c80df991196a1dfc3337ec2d31e77a5ad5ee5a932d1efc636a005a5d4c5-0 updated
More information about the sle-container-updates
mailing list