SUSE-CU-2026:12719-1: Security update of suse/sle-micro-rancher/5.4

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sle-micro-rancher/5.4
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12719-1
Container Tags        : suse/sle-micro-rancher/5.4:5.4.4.5.205 , suse/sle-micro-rancher/5.4:latest
Container Release     : 4.5.205
Severity              : important
Type                  : security
References            : 1275074 1275079 1283183 1284687 1286261 CVE-2026-107161 CVE-2026-46675
                        CVE-2026-73282 CVE-2026-73283 
-----------------------------------------------------------------

The container suse/sle-micro-rancher/5.4 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4802-1
Released:    Wed Oct 21 09:58:03 2026
Summary:     Security update for cyrus-sasl
Type:        security
Severity:    important
References:  1284687,CVE-2026-107161
This update for cyrus-sasl fixes the following issue:

- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
  DIGEST-MD5 clients (bsc#1284687).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4811-1
Released:    Wed Oct 21 10:44:47 2026
Summary:     Security update for openssh
Type:        security
Severity:    moderate
References:  1275074,1275079,CVE-2026-73282,CVE-2026-73283
This update for openssh fixes the following issues:

- CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free
  (bsc#1275074).
- CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses
  (bsc#1275079).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4814-1
Released:    Wed Oct 21 12:10:26 2026
Summary:     Security update for libpng16
Type:        security
Severity:    moderate
References:  1283183,CVE-2026-46675
This update for libpng16 fixes the following issues:

- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression
  (bsc#1283183).

Changes for libpng16:

- version update to 1.6.59 (jsc#PED-16190):
 * Fixed a regression introduced in version 1.6.47 that caused libpng to reject
   hIST chunks in their correct position, after PLTE.
 * Prevented a double free of `png_struct` members after an allocation failure.
 * Applied fixes and updates to the CMake build.
 * Adopted the REUSE Specification for licensing the CI files.

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4847-1
Released:    Wed Oct 21 18:34:14 2026
Summary:     Security update for ca-certificates-mozilla
Type:        security
Severity:    important
References:  1286261
This update for ca-certificates-mozilla fixes the following issue:
  
Updated to 2.92 state (bsc#1286261)
Removed:
  
 - emSign ECC Root CA - C3
 - emSign ECC Root CA - G3
 - emSign Root CA - C1


The following package changes have been done:

- ca-certificates-mozilla-2.92-150200.50.2 updated
- libpng16-16-1.6.59-150000.3.28.1 updated
- libsasl2-3-2.1.27-150300.4.9.1 updated
- openssh-clients-8.4p1-150300.3.68.2 updated
- openssh-common-8.4p1-150300.3.68.2 updated
- openssh-server-8.4p1-150300.3.68.2 updated
- openssh-8.4p1-150300.3.68.2 updated