SUSE-CU-2026:11349-1: Security update of bci/bci-base

Fri Oct 2 08:03:00 UTC 2026

SUSE Container Update Advisory: bci/bci-base
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:11349-1
Container Tags        : bci/bci-base:16.0 , bci/bci-base:16.0-23.9
Container Release     : 23.9
Severity              : important
Type                  : security
References            : 1271272 1274723 1274726 1276892 1276946 1277247 1277262 1277707
                        1277708 1277709 1277710 1277711 1277712 1277713 1277921 1277922
                        1279541 1279893 1280049 1280050 1280051 1280052 1280053 1280054
                        1280941 1281297 1282509 CVE-2026-18374 CVE-2026-19499 CVE-2026-19542
                        CVE-2026-6368 CVE-2026-6791 CVE-2026-77117 CVE-2026-80489 CVE-2026-86145
                        CVE-2026-8674 CVE-2026-86805 CVE-2026-89156 CVE-2026-89157 CVE-2026-89158
                        CVE-2026-89160 CVE-2026-89161 CVE-2026-89162 
-----------------------------------------------------------------

The container bci/bci-base was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1747
Released:    Wed Sep 23 21:42:24 2026
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:

- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
  (bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
  (bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).

-----------------------------------------------------------------
Advisory ID: 1762
Released:    Fri Sep 25 11:09:47 2026
Summary:     Recommended update for tar
Type:        recommended
Severity:    moderate
References:  1271272,1280941
This update for tar fixes the following issues:

Changes in tar:

- Fixes tar incorrectly skipping members in certain archives containing
  dirs with non-zero sizes. (bsc#1271272)
- Avoid acl_ prefix for functions:
    * The acl.h header from libacl uses acl_ prefix for its functions.
      Avoid defining functions with the same name in order to protect its namespace. (bsc#1280941)

-----------------------------------------------------------------
Advisory ID: 1766
Released:    Mon Sep 28 12:03:37 2026
Summary:     Recommended update for libzypp, libsolv
Type:        recommended
Severity:    moderate
References:  1279541
This update for libzypp, libsolv fixes the following issues:

Changes in libzypp:

version 17.38.16 (35):

- This fix resolves issues in online migrations to SLES 16.1. (bsc#1279541)

Changes in libsolv:

bump version to 0.7.39:

- improve SUSE product link dependency generation if there are
  multiple release packages for the same product [bsc#1279541]
- fix possible segfault in the SUSE namespace dependency generation

-----------------------------------------------------------------
Advisory ID: 1769
Released:    Tue Sep 29 14:25:10 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:

- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
  trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
  (bsc#1282509).

Other changes:

- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

The following package changes have been done:

- glibc-locale-base-2.40-160000.7.1 updated
- glibc-2.40-160000.7.1 updated
- libpcre2-8-0-10.45-160000.4.1 updated
- libsolv-tools-base-0.7.40-160000.1.1 updated
- libzypp-17.38.16-160000.1.1 updated
- skelcd-EULA-BCI-20250701-160000.3.32 updated
- tar-1.35-160000.5.1 updated