SUSE-CU-2026:12764-1: Security update of bci/bci-busybox

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Sat Oct 24 13:41:57 UTC 2026 

SUSE Container Update Advisory: bci/bci-busybox
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12764-1
Container Tags        : bci/bci-busybox:15.7 , bci/bci-busybox:15.7-25.39 , bci/bci-busybox:latest
Container Release     : 25.39
Severity              : important
Type                  : security
References            : 1279961 1282550 1282551 1282552 1282568 1282575 1282576 1282653
                        1286261 1287180 CVE-2026-114406 CVE-2026-88830 CVE-2026-88831
                        CVE-2026-88832 CVE-2026-88835 CVE-2026-88837 CVE-2026-88839 CVE-2026-88841
-----------------------------------------------------------------

The container bci/bci-busybox was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4751-1
Released:    Tue Oct 20 11:21:20 2026
Summary:     Recommended update for ca-certificates-mozilla
Type:        recommended
Severity:    moderate
References:  1279961
This update for ca-certificates-mozilla fixes the following issues:

- Updated to 2.90 state (bsc#1279961):
    * Removed:
        + AffirmTrust Commercial
        + AffirmTrust Networking
        + AffirmTrust Premium
        + AffirmTrust Premium ECC
        + certSIGN ROOT CA
        + Entrust Root Certification Authority
        + PKI Root Certification Authority
        + FIRMAPROFESIONAL CA ROOT-A WEB
        + GLOBALTRUST 2020
        + Secure Global CA
        + SecureSign Root CA12
        + SecureTrust CA
        + TeliaSonera Root CA v1
        + Trustwave Global Certification Authority
        + Trustwave Global ECC P256 Certification Authority
        + Trustwave Global ECC P384 Certification Authority
        + XRamp Global Certification Authority
    * Added:
        + SECOM SMIME RSA Root CA 2024
        + SECOM TLS ECC Root CA 2024
        + SECOM TLS RSA Root CA 2024
        + SecureSign Root CA16
        + Telia EC Email Root CA v3
        + Telia EC TLS Root CA v3
        + Telia RSA Email Root CA v3
        + Telia RSA TLS Root CA v3

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4760-1
Released:    Tue Oct 20 15:48:17 2026
Summary:     Security update for busybox
Type:        security
Severity:    important
References:  1282550,1282551,1282552,1282568,1282575,1282576,1282653,CVE-2026-88830,CVE-2026-88831,CVE-2026-88832,CVE-2026-88835,CVE-2026-88837,CVE-2026-88839,CVE-2026-88841
This update for busybox fixes the following issues:

- CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer
  overflow when processing a crafted `ClientKeyExchange` message (bsc#1282575).
- CVE-2026-88831: httpd silently fails open when IP deny rules contain invalid CIDR prefix lengths (bsc#1282550).
- CVE-2026-88832: romfs volume ID parsing uses unbounded `strlen` on attacker-controlled metadata and allows for a heap
  buffer overflow when crafted filesystem images are processed (bsc#1282576).
- CVE-2026-88835: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb
  packages (bsc#1282551).
- CVE-2026-88837: httpd misidentifies yescrypt password hashes as plaintext (bsc#1282552).
- CVE-2026-88839: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint (bsc#1282568).
- CVE-2026-88841: OOB read and silent memory corruption of the status file due to `write_status_file()` failing to reset
  the `field_start` cursor between package stanzas (bsc#1282653).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4847-1
Released:    Fri Oct 23 15:10:44 2026
Summary:     Security update for ca-certificates-mozilla
Type:        security
Severity:    important
References:  1286261,1287180,CVE-2026-114406
This update for ca-certificates-mozilla fixes the following issue:
  
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180)
Removed:
  
 - emSign ECC Root CA - C3
 - emSign ECC Root CA - G3
 - emSign Root CA - C1


The following package changes have been done:

- busybox-1.37.0-150700.18.24.1 updated
- busybox-xz-1.37.0-150700.12.17.1 updated
- busybox-whois-1.37.0-150700.12.17.1 updated
- busybox-which-1.37.0-150700.12.17.1 updated
- busybox-wget-1.37.0-150700.12.17.1 updated
- busybox-vlan-1.37.0-150700.12.17.1 updated
- busybox-vi-1.37.0-150700.12.17.1 updated
- busybox-util-linux-1.37.0-150700.12.17.1 updated
- busybox-unzip-1.37.0-150700.12.17.1 updated
- busybox-udhcpc-1.37.0-150700.12.17.1 updated
- busybox-tunctl-1.37.0-150700.12.17.1 updated
- busybox-traceroute-1.37.0-150700.12.17.1 updated
- busybox-time-1.37.0-150700.12.17.1 updated
- busybox-tftp-1.37.0-150700.12.17.1 updated
- busybox-telnet-1.37.0-150700.12.17.1 updated
- busybox-tar-1.37.0-150700.12.17.1 updated
- busybox-sysvinit-tools-1.37.0-150700.12.17.1 updated
- busybox-syslogd-1.37.0-150700.12.17.1 updated
- busybox-sharutils-1.37.0-150700.12.17.1 updated
- busybox-sha3sum-1.37.0-150700.12.17.1 updated
- busybox-sh-1.37.0-150700.12.17.1 updated
- busybox-sendmail-1.37.0-150700.12.17.1 updated
- busybox-selinux-tools-1.37.0-150700.12.17.1 updated
- busybox-sed-1.37.0-150700.12.17.1 updated
- busybox-psmisc-1.37.0-150700.12.17.1 updated
- busybox-procps-1.37.0-150700.12.17.1 updated
- busybox-policycoreutils-1.37.0-150700.12.17.1 updated
- busybox-patch-1.37.0-150700.12.17.1 updated
- busybox-netcat-1.37.0-150700.12.17.1 updated
- busybox-net-tools-1.37.0-150700.12.17.1 updated
- busybox-ncurses-utils-1.37.0-150700.12.17.1 updated
- busybox-misc-1.37.0-150700.12.17.1 updated
- busybox-man-1.37.0-150700.12.17.1 updated
- busybox-less-1.37.0-150700.12.17.1 updated
- busybox-kbd-1.37.0-150700.12.17.1 updated
- busybox-iputils-1.37.0-150700.12.17.1 updated
- busybox-iproute2-1.37.0-150700.12.17.1 updated
- busybox-hostname-1.37.0-150700.12.17.1 updated
- busybox-hexedit-1.37.0-150700.12.17.1 updated
- busybox-grep-1.37.0-150700.12.17.1 updated
- busybox-gawk-1.37.0-150700.12.17.1 updated
- busybox-findutils-1.37.0-150700.12.17.1 updated
- busybox-ed-1.37.0-150700.12.17.1 updated
- busybox-dos2unix-1.37.0-150700.12.17.1 updated
- busybox-diffutils-1.37.0-150700.12.17.1 updated
- busybox-cpio-1.37.0-150700.12.17.1 updated
- busybox-coreutils-1.37.0-150700.12.17.1 updated
- busybox-bzip2-1.37.0-150700.12.17.1 updated
- busybox-bind-utils-1.37.0-150700.12.17.1 updated
- busybox-bc-1.37.0-150700.12.17.1 updated
- busybox-attr-1.37.0-150700.12.17.1 updated
- busybox-gzip-1.37.0-150700.12.17.1 updated
- ca-certificates-mozilla-prebuilt-2.92-150200.50.3 updated
- busybox-adduser-1.37.0-150700.12.17.1 updated
- busybox-links-1.37.0-150700.12.17.1 updated
- container:bci-bci-base-15.7-7a988cafacf98c38dc43b93d0035c8b3c00d83663d331707c6b2e40770739d31-0 updated

More information about the sle-container-updates mailing list