SUSE-CU-2026:12590-1: Security update of suse/sles/16.0/virt-launcher
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Oct 21 10:23:41 UTC 2026
SUSE Container Update Advisory: suse/sles/16.0/virt-launcher
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12590-1
Container Tags : suse/sles/16.0/virt-launcher:1.8 , suse/sles/16.0/virt-launcher:1.8.4 , suse/sles/16.0/virt-launcher:1.8.4-11.11
Container Release : 11.11
Severity : important
Type : security
References : 1211886 1243708 1257912 1263098 1280587 1280589 1280590 1280591
1280592 1280594 1280595 1280596 1280597 1280598 1280599 1281653
1281657 1281661 1282745 1283183 1283239 822653 CVE-2026-25727
CVE-2026-35189 CVE-2026-35191 CVE-2026-46675 CVE-2026-54872 CVE-2026-54875
CVE-2026-72897 CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-77696
CVE-2026-84782 CVE-2026-84784 CVE-2026-94283 CVE-2026-94284 CVE-2026-94285
-----------------------------------------------------------------
The container suse/sles/16.0/virt-launcher was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 1868
Released: Thu Oct 8 08:15:10 2026
Summary: Security update for libX11
Type: security
Severity: moderate
References: 1281653,1281657,1281661,CVE-2026-94283,CVE-2026-94284,CVE-2026-94285
This update for libX11 fixes the following issues:
- CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (bsc#1281653).
- CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser
(bsc#1281657).
- CVE-2026-94285: out-of-bounds read in libX11's byte-oriented codeset parser (bsc#1281661).
-----------------------------------------------------------------
Advisory ID: 1892
Released: Fri Oct 9 14:52:47 2026
Summary: Security update for virtiofsd
Type: security
Severity: important
References: 1257912,1283239,CVE-2026-25727
This update for virtiofsd fixes the following issue:
- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion
(bsc#1257912).
Changes for virtiofsd:
* Update the time crate (bsc#1257912, CVE-2026-25727)
* Add command line options for UID/GID translation (bsc#1283239)
* PassthroughFs: Add IdMap structures (bsc#1283239)
* Add host/guest UID/GID translation code (bsc#1283239)
* Custom UID/GID mapping for Attr (bsc#1283239)
* Add UID/GID mapping functions to PassthroughFs (bsc#1283239)
* Use explicit UID/GID types (bsc#1283239)
* Introduce explicit UID/GID types (bsc#1283239)
* Use SetattrIn without conversion (bsc#1283239)
* Use fuse::Attr in FileSystem interfaces (bsc#1283239)
-----------------------------------------------------------------
Advisory ID: 1897
Released: Sat Oct 10 13:21:45 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1283183,CVE-2026-46675
This update for libpng16 fixes the following issue:
- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression
(bsc#1283183).
Changes for libpng16:
- version update to 1.6.59:
* Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<JasonHonKL at users.noreply.github.com>.)
* Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
* Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
* Applied fixes and updates to the CMake build.
* Adopted the REUSE Specification for licensing the CI files.
-----------------------------------------------------------------
Advisory ID: 1899
Released: Mon Oct 12 10:05:58 2026
Summary: Recommended update for netcfg
Type: recommended
Severity: important
References: 1211886,1243708,1263098,1282745,822653
This update for netcfg fixes the following issues:
Changes in netcfg:
- Don't replace /etc/services on updates (bsc#1282745)
- Add missing changes from factory:
* Add missing %verify(not mode) (bsc#1263098)
* services: remove invalid SIEVE entry (bsc#1243708, bsc#822653)
* Add krb-prop entry (bsc#1211886)
-----------------------------------------------------------------
Advisory ID: 1909
Released: Tue Oct 13 17:13:54 2026
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References:
This update for rpm fixes the following issues:
Changes in rpm:
- Do not dependent on python3-base, it is perfectly OK to use
any Python interpreter for python-rpm-packaging.
- Remove obsolete Python2-based removal of Python directories.
-----------------------------------------------------------------
Advisory ID: 1916
Released: Wed Oct 14 17:16:30 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
The following package changes have been done:
- libX11-data-1.8.10-160000.5.1 updated
- netcfg-11.6-160000.4.1 updated
- virtiofsd-1.12.0-160000.4.1 updated
- libpng16-16-1.6.59-160000.1.1 updated
- libopenssl3-3.5.0-160000.11.1 updated
- libX11-6-1.8.10-160000.5.1 updated
- rpm-4.20.1-160000.4.1 updated
More information about the sle-container-updates
mailing list