SUSE-CU-2026:13076-1: Security update of suse/sles/16.0/libguestfs-tools

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Mon Oct 26 20:31:52 UTC 2026 

SUSE Container Update Advisory: suse/sles/16.0/libguestfs-tools
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13076-1
Container Tags        : suse/sles/16.0/libguestfs-tools:1.9 , suse/sles/16.0/libguestfs-tools:1.9.0 , suse/sles/16.0/libguestfs-tools:1.9.0-2.16
Container Release     : 2.16
Severity              : important
Type                  : security
References            : 1232226 1236282 1248842 1256436 1256766 1256822 1257005 1258319
                        1260078 1260082 1261206 1261639 1261809 1262464 1262465 1263656
                        1263658 1274723 1274726 1276892 1276946 1277247 1277262 1277707
                        1277708 1277709 1277710 1277711 1277712 1277713 1277921 1277922
                        1279893 1280049 1280050 1280051 1280052 1280053 1280054 1281297
                        1282509 CVE-2025-0395 CVE-2025-15281 CVE-2025-58050 CVE-2026-0861
                        CVE-2026-0915 CVE-2026-18374 CVE-2026-19499 CVE-2026-19542 CVE-2026-4046
                        CVE-2026-4437 CVE-2026-4438 CVE-2026-4878 CVE-2026-5435 CVE-2026-5450
                        CVE-2026-5928 CVE-2026-6238 CVE-2026-6368 CVE-2026-6791 CVE-2026-77117
                        CVE-2026-80489 CVE-2026-86145 CVE-2026-8674 CVE-2026-86805 CVE-2026-89156
                        CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161 CVE-2026-89162
-----------------------------------------------------------------

The container suse/sles/16.0/libguestfs-tools was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 218
Released:    Thu Jan 29 18:44:57 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1236282,1256436,1256766,1256822,1257005,CVE-2025-0395,CVE-2025-15281,CVE-2026-0861,CVE-2026-0915
This update for glibc fixes the following issues:

Security fixes:

- CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
- CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
- CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
- CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).

Other fixes:

- NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

-----------------------------------------------------------------
Advisory ID: 516
Released:    Fri Apr 10 08:36:43 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1258319,1260078,1260082,CVE-2026-4437,CVE-2026-4438
This update for glibc fixes the following issues:

Security fixes:

- CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
- CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).

Other fixes:

- nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).

-----------------------------------------------------------------
Advisory ID: 528
Released:    Fri Apr 10 20:29:30 2026
Summary:     Security update for pcre2
Type:        security
Severity:    moderate
References:  1248842,CVE-2025-58050
This update for pcre2 fixes the following issue:

- CVE-2025-58050: integer overflow leads to heap buffer overread in match_ref due to missing boundary restoration in SCS
  (bsc#1248842).

-----------------------------------------------------------------
Advisory ID: 625
Released:    Wed Apr 22 12:22:37 2026
Summary:     Security update for libcap
Type:        security
Severity:    important
References:  1261809,CVE-2026-4878
This update for libcap fixes the following issues:

- CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in
  `cap_set_file()` (bsc#1261809).

-----------------------------------------------------------------
Advisory ID: 708
Released:    Wed May  6 12:44:56 2026
Summary:     Recommended update for libselinux
Type:        recommended
Severity:    moderate
References:  1261639
This update for libselinux fixes the following issues:

- Backport commit 'libselinux: retain LIFO order for path substitutions' (bsc#1261639)
    * otherwise we can not add equivalencies that overload each other in the policy
    * libselinux: retain LIFO order for path substitutions

-----------------------------------------------------------------
Advisory ID: 761
Released:    Mon May 18 07:38:10 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1261206,1262464,1262465,CVE-2026-4046,CVE-2026-5450,CVE-2026-5928
This update for glibc fixes the following issues

- CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
- CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
- CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).

-----------------------------------------------------------------
Advisory ID: 996
Released:    Sat Jun 20 20:17:58 2026
Summary:     Recommended update for libselinux
Type:        recommended
Severity:    moderate
References:  1232226
This update for libselinux fixes the following issues:

- Backport patch for restorecon to log error on readonly fs (bsc#1232226)

-----------------------------------------------------------------
Advisory ID: 1157
Released:    Fri Jul  3 15:19:16 2026
Summary:     Security update for glibc
Type:        security
Severity:    moderate
References:  1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues

- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
  (bsc#1263658).

-----------------------------------------------------------------
Advisory ID: 1747
Released:    Wed Sep 23 21:42:24 2026
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:

- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
  (bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
  (bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).

-----------------------------------------------------------------
Advisory ID: 1769
Released:    Tue Sep 29 14:25:10 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:

- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
  trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
  (bsc#1282509).

Other changes:

- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).


The following package changes have been done:

- system-user-root-20190513-160000.2.2 added
- filesystem-84.87-160000.2.2 added
- glibc-2.40-160000.7.1 added
- terminfo-base-6.5.20250531-160000.3.1 added
- libncurses6-6.5.20250531-160000.3.1 added
- libpcre2-8-0-10.45-160000.4.1 added
- libgmp10-6.3.0-160000.2.2 added
- libcap2-2.73-160000.3.1 added
- libattr1-2.6.0-160000.1.1 added
- libacl1-2.4.0-160000.1.1 added
- libreadline8-8.2.13-160000.2.2 added
- libselinux1-3.8.1-160000.4.1 added
- bash-sh-5.2.37-160000.2.2 added
- SLES-release-16.0-160000.43.1 added
- branding-SLE-16-160000.2.2 added
- container:registry.suse.com-bci-bci-micro-16.0-f88b68967fd8a6d5c7d6459ac7d1b9afcc26f7de6518b903a154be487900db0f-0 updated

More information about the sle-container-updates mailing list