SUSE-CU-2026:13307-1: Security update of elemental/elemental-lifecycle-manager

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: elemental/elemental-lifecycle-manager
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13307-1
Container Tags        : elemental/elemental-lifecycle-manager:0 , elemental/elemental-lifecycle-manager:0.1.1 , elemental/elemental-lifecycle-manager:0.1.2-5.17 , elemental/elemental-lifecycle-manager:latest
Container Release     : 5.17
Severity              : important
Type                  : security
References            : 1275115 1282347 1283493 1284334 CVE-2026-102633 CVE-2026-32776
                        CVE-2026-32777 CVE-2026-32778 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405
                        CVE-2026-77214 CVE-2026-93990 
-----------------------------------------------------------------

The container elemental/elemental-lifecycle-manager was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1996
Released:    Tue Oct 27 17:06:39 2026
Summary:     Security update for expat
Type:        security
Severity:    important
References:  1275115,1282347,1283493,1284334,CVE-2026-102633,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778,CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-77214,CVE-2026-93990
This update for expat fixes the following issues:

- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).
- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

 * Bug fixes:
 * Fix an OOM-related memory leak on a failed overflow check
 * Fix memory alignment for architectures with 128bit pointers
 * Mark XML_SetHashSalt deprecated


The following package changes have been done:

- libexpat1-2.8.5-160000.1.1 updated