SUSE-CU-2026:12083-1: Security update of suse/multi-linux-manager/5.2/x86_64/monitoring-blackbox_exporter
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Oct 9 09:13:56 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.2/x86_64/monitoring-blackbox_exporter
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12083-1
Container Tags : suse/multi-linux-manager/5.2/x86_64/monitoring-blackbox_exporter:0.26.0 , suse/multi-linux-manager/5.2/x86_64/monitoring-blackbox_exporter:5.2.1 , suse/multi-linux-manager/5.2/x86_64/monitoring-blackbox_exporter:5.2.1.5.5.1 , suse/multi-linux-manager/5.2/x86_64/monitoring-blackbox_exporter:latest
Container Release : 5.5.1
Severity : important
Type : security
References : 1212476 1216950 1227370 1236136 1236165 1236599 1239009 1242233
1243014 1243459 1243564 1243830 1247463 1250233 1250234 1252306
1252696 1253025 1253043 1256829 1256831 1256832 1256833 1257274
1257463 1258311 1259542 1259652 1259825 1261678 1262315 1262631
1262632 1262633 1262635 1262636 1262638 1263366 1263367 1263440
1263656 1263658 1266343 1266344 1266347 1266786 1267610 1268131
1268290 1268402 1268407 1268409 1268412 1268413 1268415 1268416
1268417 1268420 1268422 1268427 1268867 1269489 1270393 1271712
1272164 1272165 1272166 1272167 1272168 1272169 1272171 1273300
1274723 1274726 1274740 1274774 1274777 1274788 1274790 1274791
1274792 1274795 1274796 1274797 1274798 1275660 1275837 1275902
1276892 1276946 1277247 1277262 1277476 1277479 1277480 1277707
1277708 1277709 1277710 1277711 1277713 1277921 1277922 1278351
1279893 1280050 1280051 1280052 1280053 1280054 1280587 1280589
1280590 1280591 1280592 1280594 1280595 1280596 1280597 1280598
1280599 1281125 CVE-2024-12797 CVE-2024-13176 CVE-2024-9143 CVE-2025-11187
CVE-2025-15468 CVE-2025-15469 CVE-2025-27587 CVE-2025-4575 CVE-2025-66199
CVE-2025-9231 CVE-2025-9232 CVE-2026-10536 CVE-2026-11850 CVE-2026-12064
CVE-2026-13608 CVE-2026-14456 CVE-2026-14457 CVE-2026-18374 CVE-2026-18798
CVE-2026-19499 CVE-2026-19542 CVE-2026-2673 CVE-2026-28390 CVE-2026-34181
CVE-2026-34182 CVE-2026-35189 CVE-2026-35191 CVE-2026-40355 CVE-2026-40356
CVE-2026-42250 CVE-2026-42764 CVE-2026-4873 CVE-2026-5435 CVE-2026-54369
CVE-2026-54370 CVE-2026-54371 CVE-2026-54411 CVE-2026-54872 CVE-2026-54874
CVE-2026-54875 CVE-2026-5545 CVE-2026-5773 CVE-2026-58055 CVE-2026-59843
CVE-2026-59844 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848
CVE-2026-59850 CVE-2026-6238 CVE-2026-6253 CVE-2026-6276 CVE-2026-63072
CVE-2026-63073 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-6368
CVE-2026-6429 CVE-2026-6791 CVE-2026-7168 CVE-2026-72897 CVE-2026-75803
CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-77117 CVE-2026-77696
CVE-2026-80229 CVE-2026-80230 CVE-2026-80489 CVE-2026-8286 CVE-2026-8458
CVE-2026-84782 CVE-2026-84784 CVE-2026-86145 CVE-2026-89156 CVE-2026-89157
CVE-2026-89158 CVE-2026-89160 CVE-2026-89161 CVE-2026-8924 CVE-2026-8926
CVE-2026-8927 CVE-2026-9079 CVE-2026-9080 CVE-2026-9545 CVE-2026-9547
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.2/x86_64/monitoring-blackbox_exporter was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2848-1
Released: Fri Jul 10 13:38:57 2026
Summary: Security update for krb5, krb5-mini
Type: security
Severity: important
References: 1263366,1263367,1268131,CVE-2026-11850,CVE-2026-40355,CVE-2026-40356
This update for krb5, krb5-mini fixes the following issues
- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).
- CVE-2026-40355: Denial of Service via NULL pointer dereference in NegoEx mechanism (bsc#1263366).
- CVE-2026-40356: Denial of Service via integer underflow and out-of-bounds read (bsc#1263367).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2925-1
Released: Mon Jul 13 19:53:23 2026
Summary: Security update for curl
Type: security
Severity: important
References: 1262631,1268402,1268407,1268409,1268413,1268415,1268416,1268417,1268420,1268422,1268427,CVE-2026-10536,CVE-2026-12064,CVE-2026-4873,CVE-2026-8286,CVE-2026-8458,CVE-2026-8924,CVE-2026-8927,CVE-2026-9079,CVE-2026-9080,CVE-2026-9545,CVE-2026-9547
This update for curl fixes the following issues
- CVE-2026-4873: connection reuse ignores TLS requirement (bsc#1262631).
- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
- CVE-2026-8458: wrong reuse for different services (bsc#1268407).
- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
- CVE-2026-9079: stale proxy password leak (bsc#1268415).
- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
- CVE-2026-9547: SSH improper host validation (bsc#1268420).
- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3030-1
Released: Wed Jul 15 11:53:06 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3118-1
Released: Fri Jul 17 22:18:41 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions to/from uint32_t. Filter out -Wtime_t-conversion
from flags to build D target library files. [jsc#PED-15601]
- Remove loongarch64 from quadmath_arch. On LoongArch long double
is IEEE quad, so libquadmath is not needed and no longer built.
- includes fix for bogus expression simplification [bsc#1257463]
even when not available at build time. [bsc#1253043]
- Backport fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3141-1
Released: Tue Jul 21 09:04:39 2026
Summary: Recommended update for shadow
Type: recommended
Severity: important
References: 1270393
This update for shadow fixes the following issues:
- Fix regression about default GID by setting USERGROUPS_ENAB to no Update (bsc#1270393)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3163-1
Released: Tue Jul 21 16:50:54 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3330-1
Released: Tue Jul 28 11:35:51 2026
Summary: Security update for libssh
Type: security
Severity: moderate
References: 1272164,1272165,1272166,1272167,1272168,1272169,1272171,CVE-2026-59843,CVE-2026-59844,CVE-2026-59845,CVE-2026-59846,CVE-2026-59847,CVE-2026-59848,CVE-2026-59850
This update for libssh fixes the following issues:
- CVE-2026-59843: denial of service via zero advertised channel packet size (bsc#1272164).
- CVE-2026-59844: denial of service via oversized SFTP read length (bsc#1272165).
- CVE-2026-59845: denial of service via unchecked ProxyCommand fork() failure (bsc#1272166).
- CVE-2026-59846: information disclosure via ProxyCommand %r username expansion (bsc#1272167).
- CVE-2026-59847: integrity downgrade via OpenSSL AES-GCM tag verification (bsc#1272168).
- CVE-2026-59848: denial of service via SFTP responses with unknown request IDs (bsc#1272169).
- CVE-2026-59850: use-after-free via data callbacks on closed channels (bsc#1272171).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3444-1
Released: Fri Jul 31 22:04:31 2026
Summary: Security update for openssl-3
Type: security
Severity: moderate
References: 1271712
This update for openssl-3 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3798-1
Released: Tue Aug 25 14:40:59 2026
Summary: Security update for curl
Type: security
Severity: moderate
References: 1262632,1262633,1262635,1262636,1262638,1263440,1268412,CVE-2026-5545,CVE-2026-5773,CVE-2026-6253,CVE-2026-6276,CVE-2026-6429,CVE-2026-7168,CVE-2026-8926
This update for curl fixes the following issues:
- CVE-2026-5545: wrong reuse of HTTP Negotiate connection (bsc#1262632).
- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
- CVE-2026-6253: proxy credentials leak over redirect-to proxy (bsc#1262635).
- CVE-2026-6276: stale custom cookie host causes cookie leak (bsc#1262636).
- CVE-2026-6429: netrc credential leak with reused proxy connection (bsc#1262638).
- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3835-1
Released: Thu Aug 27 13:53:51 2026
Summary: Security update for openssl, openssl-3
Type: security
Severity: important
References: 1216950,1236136,1236599,1243014,1243459,1243564,1247463,1250233,1250234,1256829,1256831,1256832,1256833,1257274,1259652,1261678,1266344,1266347,CVE-2024-12797,CVE-2024-13176,CVE-2024-9143,CVE-2025-11187,CVE-2025-15468,CVE-2025-15469,CVE-2025-27587,CVE-2025-4575,CVE-2025-66199,CVE-2025-9231,CVE-2025-9232,CVE-2026-2673,CVE-2026-28390,CVE-2026-34182,CVE-2026-42764
This update for openssl, openssl-3 fixes the following issues:
OpenSSL is updated to 3.5.0 in SLE-15-SP7: (jsc#PED-16072)
* Enables Post-Quantum Cryptography (PQC) TLS support
Security issues fixed:
* CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
* CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
* CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
* CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652)
* CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833)
* CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB (bsc#1256832)
* CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829)
* CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831)
* CVE-2025-9231: Fix timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
* CVE-2025-9232: Fix out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
* CVE-2025-4575: Fix the x509 application adding trusted use instead of rejected use (bsc#1243564)
* CVE-2025-27587: Minerva side channel vulnerability in P-384 (bsc#1243459)
* CVE-2024-12797: Fixed RFC7250 handshakes with unauthenticated servers don't abort as
expected. (bsc#1236599)
* CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation.
* CVE-2024-9143: Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
* CVE-2024-13176: Fix timing side-channel in ECDSA signature computation (bsc#1236136)
POWER performance enhancements:
* Optimized MLDSA NTT, supports p8 and above architectures (jsc#PED-14569)
- Adapt spec file for immutability via systemd-tmpfiles (jsc#PED-14813)
- Fix check %{suse_version} > 1600 (jsc#PED-15816)
- Fix NULL pointer dereference when processing an OCSP response
- Remove showciphers.c in favor of openssl ciphers
- Use %ldconfig_scriptlets
- Enable livepatching support for ppc64le [bsc#1257274]
- Move ssl configuration files to the libopenssl package [bsc#1247463]
- Don't install unneeded NOTES
- Disable LTO for userspace livepatching [jsc#PED-13245]
- Fix P-384 curve on lower-than-P9 PPC64 targets [bsc#1243014]
- FIPS: Fix the speed command in FIPS mode for KMAC
- FIPS: Restore the check to deny SHA1 signatures in FIPS mode and
the functionality to allow/deny via crypto-policies. [jsc#PED-12224]
Update to 3.5.0:
* Changes:
- Default encryption cipher for the req, cms, and smime applications
changed from des-ede3-cbc to aes-256-cbc.
- The default TLS supported groups list has been changed to include
and prefer hybrid PQC KEM groups. Some practically unused groups
were removed from the default list.
- The default TLS keyshares have been changed to offer X25519MLKEM768
and and X25519.
- All BIO_meth_get_*() functions were deprecated.
* New features:
- Support for server side QUIC (RFC 9000)
- Support for 3rd party QUIC stacks including 0-RTT support
- Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
- A new configuration option no-tls-deprecated-ec to disable support
for TLS groups deprecated in RFC8422
- A new configuration option enable-fips-jitter to make the FIPS
provider to use the JITTER seed source
- Support for central key generation in CMP
- Support added for opaque symmetric key objects (EVP_SKEY)
- Support for multiple TLS keyshares and improved TLS key establishment
group configurability
- API support for pipelining in provided cipher algorithms
Changes between 3.3.0 and 3.4.0:
* Changes:
- Deprecation of TS_VERIFY_CTX_set_* functions and addition of
replacement TS_VERIFY_CTX_set0_* functions with improved semantics
- The X25519 and X448 key exchange implementation in the FIPS provider
is unapproved and has fips=no property.
- SHAKE-128 and SHAKE-256 implementations have no default digest length
anymore. That means these algorithms cannot be used with
EVP_DigestFinal/_ex() unless the xoflen param is set before.
- Setting config_diagnostics=1 in the config file will cause errors to
be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an
error in the ssl module configuration.
- An empty renegotiate extension will be used in TLS client hellos
instead of the empty renegotiation SCSV, for all connections with a
minimum TLS version > 1.0.
- Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and
SSL_CTX_flush_sessions() functions in favor of their respective _ex
functions which are Y2038-safe on platforms with Y2038-safe time_t
* New features:
- Support for directly fetched composite signature algorithms such as
RSA-SHA2-256 including new API functions
- FIPS indicators support in the FIPS provider and various updates of
the FIPS provider required for future FIPS 140-3 validations
- Implementation of RFC 9579 (PBMAC1) in PKCS#12
- An optional additional random seed source RNG JITTER using a statically
linked jitterentropy library
- New options -not_before and -not_after for explicit setting start and
end dates of certificates created with the req and x509 apps
- Support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
- Support for retrieving certificate request templates and CRLs in CMP
- Support for additional X.509v3 extensions related to Attribute Certificates
- Initial Attribute Certificate (RFC 5755) support
- Possibility to customize ECC groups initialization to use precomputed
values to save CPU time and use of this feature by the P-256 implementation
Changes between 3.2.0 and 3.3.0:
* Changes:
- Optimized AES-CTR for ARM Neoverse V1 and V2
- Various optimizations for cryptographic routines using RISC-V vector
crypto extensions
- Added assembly implementation for md5 on loongarch64
- Accept longer context for TLS 1.2 exporters
- The activate and soft_load configuration settings for providers in
openssl.cnf have been updated to require a value of [1|yes|true|on]
(in lower or UPPER case) to enable the setting. Conversely a value of
[0|no|false|off] will disable the setting.
- In openssl speed, changed the default hash function used with hmac from
md5 to sha256.
- The -verify option to the openssl crl and openssl req will make the
program exit with 1 on failure.
- The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(),
and related functions have been augmented to check for a minimum length
of the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
- OPENSSL_sk_push() and sk__push() functions now return 0 instead of -1
if called with a NULL stack argument.
- New limit on HTTP response headers is introduced to HTTP client.
The default limit is set to 256 header lines.
* Bug fixes and mitigations:
- The BIO_get_new_index() function can only be called 127 times before
it reaches its upper bound of BIO_TYPE_MASK and will now return -1
once its exhausted.
* new features:
- Support for qlog for tracing QUIC connections has been added
- Added APIs to allow configuring the negotiated idle timeout for QUIC
connections, and to allow determining the number of additional streams
that can currently be created for a QUIC connection.
- Added APIs to allow disabling implicit QUIC event processing for QUIC
SSL objects
- Added APIs to allow querying the size and utilisation of a QUIC
stream's write buffer
- New API SSL_write_ex2, which can be used to send an end-of-stream (FIN)
condition in an optimised way when using QUIC.
- Limited support for polling of QUIC connection and stream objects in a
non-blocking manner.
- Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
times with different output sizes.
- The BLAKE2s hash algorithm matches BLAKE2b's support for configurable
output length.
- The EVP_PKEY_fromdata function has been augmented to allow for the
derivation of CRT (Chinese Remainder Theorem) parameters when requested
- Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex()
using time_t which is Y2038 safe on 32 bit systems when 64 bit time
is enabled.
- Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms
config
options and the respective calls to SSL[_CTX]_set1_sigalgs() and
SSL[_CTX]_set1_client_sigalgs() that start with ? character are ignored
and the configuration will still be used.
- Added -set_issuer and -set_subject options to openssl x509 to override
the Issuer and Subject when creating a certificate. The -subj option
now is an alias for -set_subject.
- Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
- New option SSL_OP_PREFER_NO_DHE_KEX, which allows configuring a TLS1.3
server to prefer session resumption using PSK-only key exchange over
PSK with DHE, if both are available.
- New atexit configuration switch, which controls whether the OPENSSL_cleanup
is registered when libcrypto is unloaded.
- Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications.
- Support for using certificate profiles and extened delayed delivery in CMP
- FIPS: Mark SHA-1 as non-approved in the SLI. [jsc#PED-12224]
- Introduce --without lto. When %{optflags} contains -flto=*, tests cases are
also built using -flto=* which significantly increases build times, this
option disables lto which improve iteration times when developing.
Update to 3.2.4:
- Remove the engines' directories and symlinks that were added to
allow parallel installations with openssl-1_1.
- Add ktls capability [bsc#1216950]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3927-1
Released: Thu Sep 3 06:27:06 2026
Summary: Recommended update for shadow
Type: recommended
Severity: important
References: 1259542,1275902
This update for shadow fixes the following issues:
- Mark /etc/default/useradd as %config(noreplace) to restore the behavior
prior to the file being removed from shadow. (bsc#1275902)
- Fix regression caused in (bsc#1259542)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3980-1
Released: Sun Sep 6 09:44:23 2026
Summary: Recommended update for libtirpc
Type: recommended
Severity: important
References: 1274740
This update for libtirpc fixes the following issues:
- Fix: Possible mem leak from libtirpc [ thread::XRF51s_MK4mkPFEu7JKj0Ss:: ] (bsc#1274740):
* rpcb_clnt.c: fix memory leak in destroy_addr
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4029-1
Released: Mon Sep 7 09:45:31 2026
Summary: Security update for nghttp2
Type: security
Severity: moderate
References: 1269489,CVE-2026-58055
This update for nghttp2 fixes the following issue:
- CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning
(bsc#1269489).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4039-1
Released: Mon Sep 7 10:29:11 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4048-1
Released: Mon Sep 7 15:54:05 2026
Summary: Security update for curl
Type: security
Severity: low
References: 1277476,1277479,1277480,CVE-2026-13608,CVE-2026-80229,CVE-2026-80230
This update for curl fixes the following issues:
- CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause an authentication bypass (bsc#1277476).
- CVE-2026-80229: premature free can lead to OpenSSL provider use-after-free (bsc#1277479).
- CVE-2026-80230: OpenSSL pinning bypass can allow unauthenticated connections to succeed (bsc#1277480).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4055-1
Released: Mon Sep 7 17:48:12 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4110-1
Released: Wed Sep 9 17:00:16 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1212476,1227370,1236165,1239009,1242233,1243830,1252696,1253025,1258311,1259825,1262315,1275660
This update for crypto-policies fixes the following issues:
- Update crypto-policies for Post-Quantum Cryptography (PQC) TLS
support in SLE-15-SP7 (jsc#PED-16072):
* Add support for mlkem768x25519-sha256 in openssh 9.6p1 (bsc#1275660)
* Add support for python36 (jsc#PED-16072)
* Add support for sntrup761x25519-sha512 at openssh.com and remove
it for sntrup761x25519-sha512 in openssh 9.6p1 in SLE-15-SP7
as it only lists the former (bsc#1258311, bsc#1259825)
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
- Adapt the manpages to SUSE/openSUSE:
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: [bsc#1253025, bsc#1252696]
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
- Allow openssl to load when using the DEFAULT policy, and also
other policies, in FIPS mode. [bsc#1243830, bsc#1242233]
- Relax the nss version requirement since the mlkem768secp256r1
enablement has been reverted.
- Allow sshd in FIPS mode when using the DEFAULT policy [bsc#1227370]
- Enable SHA1 sigver in the DEFAULT policy.
- Remove also sequoia config and generator files
- Remove not needed fips bind mount service
- Update to version 20250124.4d262e7: [bsc#1239009, bsc#1236165]
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-setup-helper: add a libexec helper for anaconda
* fips-crypto-policy-overlay: automount FIPS policy
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* CONTRIBUTING.md: add a small section on updating policies
* CONTRIBUTING.md: remove trailing punctuation from headers
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
* nss: unconditionally load p11-kit-proxy.so
* gnutls: make DTLS0.9 controllable again
* gnutls: retire GNUTLS_NO_TLS_SESSION_HASH
* openssh: remove OPENSSH_MIN_RSA_SIZE / OPENSSH_MIN_RSA_SIZE_FORCE
* gnutls: remove extraneous newline
* sequoia: move away from subprocess.getstatusoutput
* python/cryptopolicies/cryptopolicies.py: add trailing commas
* python, tests: rename MalformedLine to MalformedLineError
* Makefile: introduce SKIP_LINTING flag for packagers to use
* Makefile: run ruff
* tests: use pathlib
* tests: run(check=True) + CalledProcessError where convenient
* tests: use subprocess.run
* tests/krb5.py: check all generated policies
* tests: print to stderr on error paths
* tests/nss.py: also use encoding='utf-8'
* tests/nss.py: also use removesuffix
* tests/nss.py: skip creating tempfiles
* tests/java.pl -> tests/java.py
* tests/gnutls.pl -> tests/gnutls.py
* tests/openssl.pl -> tests/openssl.py
* tests/verify-output.pl: remove
* libreswan: do not use up pfs= / ikev2= keywords for default behaviour
- Update to version 20241010.5930b9a:
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* nss: be stricter with new purposes
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* TEST-PQ: disable pure Kyber768
* nss: wire XYBER768D00 to X25519-KYBER768
* TEST-PQ: update
* TEST-PQ: also enable sntrup761x25519-sha512 at openssh.com
* TEST-PQ, alg_lists, openssl: enable more experimental `sign` values
* TEST-PQ, python: add more groups, mark experimental
* openssl: mark liboqsprovider groups optional with ?
- Update to version 20240201.9f501f3:
* .gitlab-ci.yml: install sequoia-policy-config
* java: disable ChaCha20-Poly1305 where applicable
* fips-mode-setup: make sure ostree is detected in chroot
* fips-finish-install: make sure ostree is detected in chroot
* TEST-PQ: enable X25519-KYBER768 / P384-KYBER768 for openssl
* TEST-PQ: add a no-op subpolicy
* update-crypto-policies: Keep mid-sentence upper case
* fips-mode-setup: Write error messages to stderr
* fips-mode-setup: Fix some shellcheck warnings
* fips-mode-setup: Fix test for empty /boot
* fips-mode-setup: Avoid 'boot=UUID=' if /boot == /
* Update man pages
- Update to version 20231108.adb5572b:
* Print matches in syntax deprecation warnings
* Restore support for scoped ssh_etm directives
* fips-mode-setup: Fix usage with --no-bootcfg
* turn ssh_etm into an etm at SSH tri-state
* fips-mode-setup: increase chroot-friendliness
* bind: fix a typo that led to duplication of ECDSAPxxxSHAxxx
* pylintrc: use-implicit-booleaness-not-comparison-to-*
- avoid the cycle rpm/cmake/crypto-policies/python-rpm-macros:
we only need python3-base here, we don't need the python
macros as no module is being built
- Remove dependency on /usr/bin/python3, making scripts to depends on
the real python3 binary, not the link. bsc#1212476
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4124-1
Released: Thu Sep 10 18:11:41 2026
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1277247
This update for glibc fixes the following issues:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural
optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4127-1
Released: Fri Sep 11 08:49:46 2026
Summary: Recommended update for permissions
Type: recommended
Severity: moderate
References: 1273300,1278351
This update for permissions fixes the following issue:
- Update to version 20250826:
* profiles: backport nvidia-modprobe (bsc#1278351)
* profiles: add cacti-spine cap_net_raw (bsc#1273300)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4176-1
Released: Mon Sep 14 12:29:48 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
- update to 2.5.2:
* attr: eliminate a dead store in attr_copy_action()
* libattr: Set symbol versions for legacy syscalls via attribute
or asm
* exports: use LGPL for library code
* documentation updates
* translation updates (Polish, Dutch, Gregorian, French)
* build system updates
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4241-1
Released: Thu Sep 17 13:48:51 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277713,1279893,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4250-1
Released: Thu Sep 17 18:00:36 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1267610,1274723,1274726,1276892,1276946,1277262,1277921,1277922,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4414-1
Released: Fri Oct 2 09:37:26 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,1281125,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
Other non-security fixes:
- Add a conflicts with previous crypto-policies versions (bsc#1281125)
The following package changes have been done:
- crypto-policies-20250714.cd6043a-150700.6.4.2 updated
- libssh-config-0.9.8-150600.11.15.1 updated
- libtirpc-netconfig-1.3.4-150300.3.26.1 updated
- glibc-2.38-150600.14.58.1 updated
- libpcre2-8-0-10.42-150600.3.3.1 updated
- libnghttp2-14-1.64.0-150700.3.6.1 updated
- libgcc_s1-15.3.0+git11272-150000.1.12.1 updated
- libbz2-1-1.0.8-150400.3.4.1 updated
- libattr1-2.6.0-150000.4.3.1 updated
- libacl1-2.4.0-150000.4.6.1 updated
- libstdc++6-15.3.0+git11272-150000.1.12.1 updated
- login_defs-4.17.2-150600.17.24.1 updated
- permissions-20250826-150700.16.5.1 updated
- libopenssl3-3.5.0-150700.5.53.2 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.53.2 updated
- krb5-1.20.1-150600.11.19.1 updated
- libtirpc3-1.3.4-150300.3.26.1 updated
- libssh4-0.9.8-150600.11.15.1 updated
- libcurl4-8.14.1-150700.7.26.1 updated
- pam-1.3.0-150000.6.89.1 updated
- libsubid5-4.17.2-150600.17.24.1 updated
- shadow-4.17.2-150600.17.24.1 updated
- curl-8.14.1-150700.7.26.1 updated
- container:bci-bci-base-15.7-639cc27d64fa2f2a457d7b6d4dbdd89247dbfd872ad438f5a1799fb085c6c720-0 updated
More information about the sle-container-updates
mailing list