SUSE-IU-2026:8385-1: Security update of suse/sl-micro/6.1/baremetal-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Oct 28 08:26:33 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.1/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8385-1
Image Tags : suse/sl-micro/6.1/baremetal-os-container:2.2.1 , suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.194 , suse/sl-micro/6.1/baremetal-os-container:latest
Image Release : 7.194
Severity : important
Type : security
References : 1233517 1244325 1249584 1249584 1251827 1257144 1257144 1257496
1257496 1259711 1259711 1259726 1259726 1259729 1259729 1259963
1262263 1264459 1264713 1267631 1268572 1268573 1275115 1275594
1275732 1275859 1275860 1275915 1282347 1283493 1284334 CVE-2025-11561
CVE-2025-23013 CVE-2025-59375 CVE-2025-59375 CVE-2026-102633
CVE-2026-24515 CVE-2026-24515 CVE-2026-25210 CVE-2026-25210 CVE-2026-32776
CVE-2026-32776 CVE-2026-32777 CVE-2026-32777 CVE-2026-32778 CVE-2026-32778
CVE-2026-41080 CVE-2026-43284 CVE-2026-45186 CVE-2026-50219 CVE-2026-56131
CVE-2026-56132 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406
CVE-2026-56407 CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411
CVE-2026-56412 CVE-2026-66046 CVE-2026-72522 CVE-2026-76641 CVE-2026-76956
CVE-2026-76957 CVE-2026-77214 CVE-2026-93990
-----------------------------------------------------------------
The container suse/sl-micro/6.1/baremetal-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 29
Released: Wed Mar 5 15:55:47 2025
Summary: Security update for pam_u2f
Type: security
Severity: important
References: 1233517,1249584,CVE-2025-23013,CVE-2025-59375
This update for pam_u2f fixes the following issues:
- CVE-2025-23013: Fixed problematic PAM_IGNORE return values in `pam_sm_authenticate()`(bsc#1233517).
-----------------------------------------------------------------
Advisory ID: 344
Released: Wed Nov 26 15:27:32 2025
Summary: Security update for sssd
Type: security
Severity: important
References: 1244325,1251827,1257144,1257496,CVE-2025-11561,CVE-2026-24515,CVE-2026-25210
This update for sssd fixes the following issues:
- CVE-2025-11561: Fixed default Kerberos configuration allowing
privilege escalation on AD-joined Linux systems (bsc#1251827)
Other fixes:
- Install file in krb5.conf.d to include sssd krb5 config snippets
(bsc#1244325)
-----------------------------------------------------------------
Advisory ID: 466
Released: Tue Mar 31 11:59:46 2026
Summary: Recommended update for rust-keylime
Type: recommended
Severity: moderate
References: 1259711,1259726,1259729,1259963,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778
This update for rust-keylime fixes the following issues:
- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add a patch to re-generate TSS bindings
- Update to version 0.2.9+8:
* build(deps):
+ bump thiserror from 2.0.17 to 2.0.18
+ bump docker/login-action from 3 to 4
+ bump docker/metadata-action from 5 to 6
+ bump docker/build-push-action from 6 to 7
+ bump actions/upload-artifact from 6 to 7
+ bump mockoon/cli-action from 2 to 3
+ bump http from 1.3.1 to 1.4.0
+ bump serde from 1.0.219 to 1.0.228
+ bump clap from 4.5.45 to 4.5.54
+ bump actix-web from 4.11.0 to 4.12.1
* Remove generate-bindings feature from tss-esapi
* Use port constants instead of hardcoded values in tests
* push-attestation:
+ use registrar TLS port when TLS is enabled
+ drop support for mTLS to registrar
+ drop mTLS support and require PoP authentication
+ drop self-signed mTLS certificate generation
* dist: Make the services to conflict with each other
* cargo:
+ bump tracing_subscriber to version 0.3.20
+ bump time to version 0.3.47
* Update reqwest from 0.12 to 0.13
* auth:
+ load CA certificate in authentication client
+ reuse existing ContextInfo to avoid duplicate TPM objects
* packit: add missing e2e tests
* registrar: rename insecure option to disable_tls
* config:
+ add missing config options to keylime-agent.conf
+ add support for 'default' in registrar_api_versions option
+ add support for 'default' in registrar_tls_ca_cert option
+ drop unused config options and constants
* resilient_client: reauthenticate if a 403 error is received
-----------------------------------------------------------------
Advisory ID: 769
Released: Tue Oct 27 15:41:39 2026
Summary: Security update for expat
Type: security
Severity: important
References: 1249584,1257144,1257496,1259711,1259726,1259729,1262263,1264459,1264713,1267631,1268572,1268573,1275115,1275594,1275732,1275859,1275860,1275915,1282347,1283493,1284334,CVE-2025-59375,CVE-2026-102633,CVE-2026-24515,CVE-2026-25210,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778,CVE-2026-41080,CVE-2026-43284,CVE-2026-45186,CVE-2026-50219,CVE-2026-56131,CVE-2026-56132,CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,CVE-2026-56411,CVE-2026-56412,CVE-2026-66046,CVE-2026-72522,CVE-2026-76641,CVE-2026-76956,CVE-2026-76957,CVE-2026-77214,CVE-2026-93990
This update for expat fixes the following issues:
- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the
encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity
declaration value (bsc#1259726).
- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition
(bsc#1259729).
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a
policy violation (bsc#1267631).
- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within
handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,
CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,
CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()
function (bsc#1275732).
- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger
memory corruption (bsc#1275915).
- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-
after-free can occur (bsc#1275859).
- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).
- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).
Changes for expat:
Update to 2.8.5 (jsc#PED-16154):
* Bug fixes:
* Fix an OOM-related memory leak on a failed overflow check
* Fix memory alignment for architectures with 128bit pointers
* Mark XML_SetHashSalt deprecated
* CMake: only add /source-charset:utf-8 when /utf-8 is not present
* lib: resolve undefined behavior from overshifting a signed int
* lib: support read-only hash table lookup with non-zero-terminated
keys
* lib: use a C99 bool for ENTITY.open
* version info bumped from 13:3:12 to 13:4:12
* fix support for 2+ GiB documents (regression from 2.8.2)
* reject empty version in the XML declaration
* fix printf format for AIX
* CMake|AIX: enable EXPAT_DEV_URANDOM by default
* version info bumped from 13:2:12 to 13:3:12
* Existing API function XML_SetHashSalt is now deprecated
* because of its limitations, and its use should be
* considered a vulnerability. Please either use the new API
* function XML_SetHashSalt16Bytes (with known-high-quality
* entropy input only!) instead, or leave the derivation of
* a 16-bytes hash salt from high quality entropy to Expat's
* internal machinery (by *not* calling either of the two
* XML_SetHashSalt* functions).
* xmlwf: Fix a memory leak
* WASI: Fix format specifiers for 32bit WASI SDK
* Fix alignment of internal allocations for some non-amd64
architectures (e.g. sparc32); fixes up on the fix to
CVE-2025-59375 (of Expat 2.7.2)
* Fix a class of false positives where input should have been
rejected with error XML_ERROR_ASYNC_ENTITY; regression from
CVE-2024-8176 (of Expat 2.7.0)
* Prove and regression-proof absence of integer overflow
from function expat_realloc
* Remove 'harmless' cast that truncated a size_t to unsigned
* xmlwf: Resolve use of functions XML_GetErrorLineNumber
and XML_GetErrorColumnNumber
* CVE-2025-59375 -- Disallow use of disproportional amounts of
dynamic memory from within an Expat parser
* xmlwf: Fix (internal) help generator
* xmlwf: Mention supported environment variables in
The following package changes have been done:
- libexpat1-2.8.5-slfo.1.1_1.1 updated
- SL-Micro-release-6.1-slfo.1.12.83 updated
- container:SL-Micro-base-container-2.2.1-5.207 updated
More information about the sle-container-updates
mailing list