SUSE-CU-2026:12956-1: Security update of suse/sles/16.0/virt-launcher

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sles/16.0/virt-launcher
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12956-1
Container Tags        : suse/sles/16.0/virt-launcher:1.8 , suse/sles/16.0/virt-launcher:1.8.4 , suse/sles/16.0/virt-launcher:1.8.4-11.13
Container Release     : 11.13
Severity              : important
Type                  : security
References            : 1221863 1230111 1247498 1269664 1279843 1280702 1284528 1284687
                        CVE-2026-107161 CVE-2026-13757 CVE-2026-18938 
-----------------------------------------------------------------

The container suse/sles/16.0/virt-launcher was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1919
Released:    Thu Oct 15 14:13:14 2026
Summary:     Security update for p11-kit
Type:        security
Severity:    moderate
References:  1269664,1280702,CVE-2026-13757,CVE-2026-18938
This update for p11-kit fixes the following issues:

- CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
- CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage
  on 32 bit systems (bsc#1280702).

-----------------------------------------------------------------
Advisory ID: 1950
Released:    Wed Oct 21 07:48:33 2026
Summary:     Security update for cyrus-sasl
Type:        security
Severity:    important
References:  1221863,1230111,1247498,1284687,CVE-2026-107161
This update for cyrus-sasl fixes the following issues:

Security issue fixed:

- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
  DIGEST-MD5 clients (bsc#1284687).

Non security issues fixed:

- Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).
- Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).
- Make DIGEST-MD5 work with openssl3 (bsc#1230111).

-----------------------------------------------------------------
Advisory ID: 1954
Released:    Wed Oct 21 11:15:30 2026
Summary:     Recommended update for libvirt
Type:        recommended
Severity:    moderate
References:  1279843,1284528
This update for libvirt fixes the following issues:

Changes in libvirt:

- qemu:
    * Avoid returning error when query job cannot be acquired in virDomainGetXMLDesc() (bsc#1284528)
    * Additional commits to fix incoming migration to QEMU 10.0.0 and newer (bsc#1279843)
- Add ClearwaterForest CPU model (jsc#PED-16192)


The following package changes have been done:

- libsasl2-3-2.1.28-160000.4.1 updated
- libp11-kit0-0.25.5-160000.3.1 updated
- cyrus-sasl-2.1.28-160000.4.1 updated
- cyrus-sasl-digestmd5-2.1.28-160000.4.1 updated
- libvirt-libs-11.4.0-160000.7.1 updated
- libvirt-daemon-log-11.4.0-160000.7.1 updated
- libvirt-client-11.4.0-160000.7.1 updated
- libvirt-daemon-common-11.4.0-160000.7.1 updated
- libvirt-daemon-driver-qemu-11.4.0-160000.7.1 updated