SUSE-CU-2026:12958-1: Security update of suse/sles/16.0/virt-launcher

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sles/16.0/virt-launcher
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12958-1
Container Tags        : suse/sles/16.0/virt-launcher:1.8 , suse/sles/16.0/virt-launcher:1.8.4 , suse/sles/16.0/virt-launcher:1.8.4-11.16
Container Release     : 11.16
Severity              : important
Type                  : security
References            : 1274723 1274726 1276892 1276946 1277247 1277262 1277707 1277708
                        1277709 1277710 1277711 1277712 1277713 1277921 1277922 1279893
                        1280049 1280050 1280051 1280052 1280053 1280054 1281297 1282509
                        CVE-2026-18374 CVE-2026-19499 CVE-2026-19542 CVE-2026-6368 CVE-2026-6791
                        CVE-2026-77117 CVE-2026-80489 CVE-2026-86145 CVE-2026-8674 CVE-2026-86805
                        CVE-2026-89156 CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161
                        CVE-2026-89162 
-----------------------------------------------------------------

The container suse/sles/16.0/virt-launcher was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1747
Released:    Wed Sep 23 21:42:24 2026
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:

- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
  (bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
  (bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).

-----------------------------------------------------------------
Advisory ID: 1769
Released:    Tue Sep 29 14:25:10 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:

- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
  trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
  (bsc#1282509).

Other changes:

- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).


The following package changes have been done:

- system-user-root-20190513-160000.2.2 added
- filesystem-84.87-160000.2.2 added
- glibc-2.40-160000.7.1 added
- terminfo-base-6.5.20250531-160000.3.1 added
- libncurses6-6.5.20250531-160000.3.1 added
- libpcre2-8-0-10.45-160000.4.1 added
- libgmp10-6.3.0-160000.2.2 added
- libcap2-2.73-160000.3.1 added
- libattr1-2.6.0-160000.1.1 added
- libacl1-2.4.0-160000.1.1 added
- libreadline8-8.2.13-160000.2.2 added
- libselinux1-3.8.1-160000.4.1 added
- bash-5.2.37-160000.2.2 added
- bash-sh-5.2.37-160000.2.2 added
- SLES-release-16.0-160000.43.1 added
- branding-SLE-16-160000.2.2 added
- container:registry.suse.com-bci-bci-micro-16.0-f88b68967fd8a6d5c7d6459ac7d1b9afcc26f7de6518b903a154be487900db0f-0 updated