SUSE-CU-2026:12614-1: Security update of suse/sles/16.0/libguestfs-tools
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Oct 21 10:33:41 UTC 2026
SUSE Container Update Advisory: suse/sles/16.0/libguestfs-tools
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12614-1
Container Tags : suse/sles/16.0/libguestfs-tools:1.9 , suse/sles/16.0/libguestfs-tools:1.9.0 , suse/sles/16.0/libguestfs-tools:1.9.0-2.11
Container Release : 2.11
Severity : important
Type : security
References : 1211886 1243708 1257912 1263098 1280587 1280589 1280590 1280591
1280592 1280594 1280595 1280596 1280597 1280598 1280599 1281653
1281657 1281661 1281756 1281757 1281758 1281759 1281760 1281761
1281762 1281763 1282745 1283183 1283239 822653 CVE-2026-25727
CVE-2026-35189 CVE-2026-35191 CVE-2026-46675 CVE-2026-54872 CVE-2026-54875
CVE-2026-72897 CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-77696
CVE-2026-84782 CVE-2026-84784 CVE-2026-94283 CVE-2026-94284 CVE-2026-94285
-----------------------------------------------------------------
The container suse/sles/16.0/libguestfs-tools was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 1866
Released: Thu Oct 8 08:13:45 2026
Summary: Security update for ntfs-3g_ntfsprogs
Type: security
Severity: moderate
References: 1281756,1281757,1281758,1281759,1281760,1281761,1281762,1281763
This update for ntfs-3g_ntfsprogs fixes the following issues:
- Denial-of-service in ntfs_inode_attach_all_extents() (bsc#1281758).
- Heap buffer overflow in ntfs_acl_owner() (bsc#1281756).
- Heap buffer overflow in ntfs_check_restart_area() (bsc#1281759).
- Heap buffer overflow in ntfs_ea_check_wsldev() (bsc#1281760).
- Heap buffer overflow in ntfs_external_attr_find() (bsc#1281761).
- Heap buffer overflow in ntfs_same_sid() (bsc#1281757).
- Heap data corruption in ntfs_mapping_pairs_decompress_i() (bsc#1281762).
- Heap out of bounds read/write in ntfs_ie_add_vcn() (bsc#1281763).
-----------------------------------------------------------------
Advisory ID: 1868
Released: Thu Oct 8 08:15:10 2026
Summary: Security update for libX11
Type: security
Severity: moderate
References: 1281653,1281657,1281661,CVE-2026-94283,CVE-2026-94284,CVE-2026-94285
This update for libX11 fixes the following issues:
- CVE-2026-94283: out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser (bsc#1281653).
- CVE-2026-94284: out-of-bounds read vulnerability in libX11's XIM trigger-keyregistration parser.registration parser
(bsc#1281657).
- CVE-2026-94285: out-of-bounds read in libX11's byte-oriented codeset parser (bsc#1281661).
-----------------------------------------------------------------
Advisory ID: 1892
Released: Fri Oct 9 14:52:47 2026
Summary: Security update for virtiofsd
Type: security
Severity: important
References: 1257912,1283239,CVE-2026-25727
This update for virtiofsd fixes the following issue:
- CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion
(bsc#1257912).
Changes for virtiofsd:
* Update the time crate (bsc#1257912, CVE-2026-25727)
* Add command line options for UID/GID translation (bsc#1283239)
* PassthroughFs: Add IdMap structures (bsc#1283239)
* Add host/guest UID/GID translation code (bsc#1283239)
* Custom UID/GID mapping for Attr (bsc#1283239)
* Add UID/GID mapping functions to PassthroughFs (bsc#1283239)
* Use explicit UID/GID types (bsc#1283239)
* Introduce explicit UID/GID types (bsc#1283239)
* Use SetattrIn without conversion (bsc#1283239)
* Use fuse::Attr in FileSystem interfaces (bsc#1283239)
-----------------------------------------------------------------
Advisory ID: 1897
Released: Sat Oct 10 13:21:45 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1283183,CVE-2026-46675
This update for libpng16 fixes the following issue:
- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression
(bsc#1283183).
Changes for libpng16:
- version update to 1.6.59:
* Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<JasonHonKL at users.noreply.github.com>.)
* Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
* Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
* Applied fixes and updates to the CMake build.
* Adopted the REUSE Specification for licensing the CI files.
-----------------------------------------------------------------
Advisory ID: 1899
Released: Mon Oct 12 10:05:58 2026
Summary: Recommended update for netcfg
Type: recommended
Severity: important
References: 1211886,1243708,1263098,1282745,822653
This update for netcfg fixes the following issues:
Changes in netcfg:
- Don't replace /etc/services on updates (bsc#1282745)
- Add missing changes from factory:
* Add missing %verify(not mode) (bsc#1263098)
* services: remove invalid SIEVE entry (bsc#1243708, bsc#822653)
* Add krb-prop entry (bsc#1211886)
-----------------------------------------------------------------
Advisory ID: 1916
Released: Wed Oct 14 17:16:30 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
The following package changes have been done:
- libX11-data-1.8.10-160000.5.1 updated
- netcfg-11.6-160000.4.1 updated
- virtiofsd-1.12.0-160000.4.1 updated
- libpng16-16-1.6.59-160000.1.1 updated
- libX11-6-1.8.10-160000.5.1 updated
- libntfs-3g89-2022.10.3-160000.5.1 updated
- ntfsprogs-2022.10.3-160000.5.1 updated
- ntfs-3g-2022.10.3-160000.5.1 updated
- libopenssl3-3.5.0-160000.11.1 updated
More information about the sle-container-updates
mailing list