SUSE-CU-2026:13110-1: Security update of suse/sles/16.0/toolbox

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sles/16.0/toolbox
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13110-1
Container Tags        : suse/sles/16.0/toolbox:16.3 , suse/sles/16.0/toolbox:16.3-1.141 , suse/sles/16.0/toolbox:latest
Container Release     : 1.141
Severity              : important
Type                  : security
References            : 1221863 1230111 1247498 1272698 1284687 CVE-2026-107161 CVE-2026-56391
-----------------------------------------------------------------

The container suse/sles/16.0/toolbox was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1950
Released:    Wed Oct 21 07:48:33 2026
Summary:     Security update for cyrus-sasl
Type:        security
Severity:    important
References:  1221863,1230111,1247498,1284687,CVE-2026-107161
This update for cyrus-sasl fixes the following issues:

Security issue fixed:

- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
  DIGEST-MD5 clients (bsc#1284687).

Non security issues fixed:

- Fix cyrus-sasl package failing to build with GCC 14 (bsc#1221863).
- Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).
- Make DIGEST-MD5 work with openssl3 (bsc#1230111).

-----------------------------------------------------------------
Advisory ID: 1951
Released:    Wed Oct 21 10:10:37 2026
Summary:     Security update for coreutils
Type:        security
Severity:    moderate
References:  1272698,CVE-2026-56391
This update for coreutils fixes the following issue:

- CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds read with multibyte input
  (bsc#1272698).


The following package changes have been done:

- coreutils-9.6-160000.3.1 updated
- libsasl2-3-2.1.28-160000.4.1 updated