SUSE-IU-2026:7746-1: Security update of suse/sl-micro/6.2/rt-iso-image

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.2/rt-iso-image
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:7746-1
Image Tags        : suse/sl-micro/6.2/rt-iso-image:2.3.1 , suse/sl-micro/6.2/rt-iso-image:2.3.1-7.183 , suse/sl-micro/6.2/rt-iso-image:latest
Image Release     : 7.183
Severity          : important
Type              : security
References        : 1282550 1282551 1282552 1282568 1282575 1282576 1282653 CVE-2026-88830
                        CVE-2026-88831 CVE-2026-88832 CVE-2026-88835 CVE-2026-88837 CVE-2026-88839
                        CVE-2026-88841 
-----------------------------------------------------------------

The container suse/sl-micro/6.2/rt-iso-image was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1880
Released:    Fri Oct  9 08:37:11 2026
Summary:     Security update for busybox
Type:        security
Severity:    important
References:  1282550,1282551,1282552,1282568,1282575,1282576,1282653,CVE-2026-88830,CVE-2026-88831,CVE-2026-88832,CVE-2026-88835,CVE-2026-88837,CVE-2026-88839,CVE-2026-88841
This update for busybox fixes the following issues:

- CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer
  overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
- CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
- CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap
  buffer overflow when crafted filesystem images are processed (bsc#1282576).
- CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb
  packages (bsc#1282551).
- CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
- CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
- CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()` failing to reset
  the `field_start` cursor between package stanzas (bsc#1282653).


The following package changes have been done:

- busybox-1.37.0-160000.8.1 updated