SUSE-CU-2026:12139-1: Security update of suse/sl-micro/6.1/base-iso-image

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sl-micro/6.1/base-iso-image
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12139-1
Container Tags        : suse/sl-micro/6.1/base-iso-image:2.2.1 , suse/sl-micro/6.1/base-iso-image:2.2.1-5.209 , suse/sl-micro/6.1/base-iso-image:latest
Container Release     : 5.209
Severity              : important
Type                  : security
References            : 1192869 1217580 1217584 1217585 1217586 1241661 1252888 1253245
                        1258163 1258167 1263989 1271544 1271545 1271547 1271548 1282550
                        1282551 1282552 1282568 1282575 1282576 1282653 CVE-2021-42380
                        CVE-2023-42363 CVE-2023-42364 CVE-2023-42365 CVE-2023-42366 CVE-2025-46394
                        CVE-2025-60876 CVE-2026-26157 CVE-2026-26158 CVE-2026-29004 CVE-2026-38752
                        CVE-2026-38753 CVE-2026-38754 CVE-2026-38755 CVE-2026-88830 CVE-2026-88831
                        CVE-2026-88832 CVE-2026-88835 CVE-2026-88837 CVE-2026-88839 CVE-2026-88841
-----------------------------------------------------------------

The container suse/sl-micro/6.1/base-iso-image was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 745
Released:    Mon Oct 12 10:48:20 2026
Summary:     Security update for busybox
Type:        security
Severity:    important
References:  1192869,1217580,1217584,1217585,1217586,1241661,1252888,1253245,1258163,1258167,1263989,1271544,1271545,1271547,1271548,1282550,1282551,1282552,1282568,1282575,1282576,1282653,CVE-2021-42380,CVE-2023-42363,CVE-2023-42364,CVE-2023-42365,CVE-2023-42366,CVE-2025-46394,CVE-2025-60876,CVE-2026-26157,CVE-2026-26158,CVE-2026-29004,CVE-2026-38752,CVE-2026-38753,CVE-2026-38754,CVE-2026-38755,CVE-2026-88830,CVE-2026-88831,CVE-2026-88832,CVE-2026-88835,CVE-2026-88837,CVE-2026-88839,CVE-2026-88841
This update for busybox fixes the following issues:

- CVE-2021-42380: additional for use-after-realloc in awk (bsc#1192869).
- CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
- CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
- CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
- CVE-2023-42366: heap-buffer-overflow in the next_token function (bsc#1217586).
- CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are
  used when naming other files included in the archive (bsc#1241661).
- CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
- CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
- CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries
  (bsc#1258167).
- CVE-2026-29004: a crafted DHCPv6 response can lead to a heap buffer overflow in the DHCPv6 client (bsc#1263989).
- CVE-2026-38752: Denial of Service via crafted AWK script (bsc#1271544).
- CVE-2026-38753: use-after-free in awk_sub() (bsc#1271545).
- CVE-2026-38754: heap overflow in ifsbreakup() (bsc#1271547).
- CVE-2026-38755: heap overflow in evalcommand() (bsc#1271548).
- CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer
  overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
- CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
- CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap
  buffer overflow when crafted filesystem images are processed (bsc#1282576).
- CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb
  packages (bsc#1282551).
- CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
- CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
- CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()` failing to reset
  the `field_start` cursor between package stanzas (bsc#1282653).


The following package changes have been done:

- busybox-1.36.1-slfo.1.1_2.1 updated