SUSE-CU-2026:12392-1: Security update of elemental/elemental
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Sat Oct 17 07:30:36 UTC 2026
SUSE Container Update Advisory: elemental/elemental
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12392-1
Container Tags : elemental/elemental:3.0 , elemental/elemental:3.0.3-4.10
Container Release : 4.10
Severity : critical
Type : security
References : 1205770 1211886 1216378 1218459 1221126 1222465 1228081 1228659
1228728 1229587 1231354 1231986 1232226 1232226 1232234 1233358
1234765 1234959 1235731 1236193 1236282 1237375 1237515 1238137
1239177 1240883 1241612 1241964 1242096 1242998 1243148 1243708
1244449 1244459 1244573 1244573 1245470 1245524 1245551 1245636
1245738 1245953 1246080 1246231 1246559 1247242 1247286 1247495
1247850 1247858 1247875 1248158 1248261 1248356 1248501 1248516
1248586 1248842 1249052 1249088 1249370 1249385 1249435 1249584
1249686 1249964 1250232 1250233 1250234 1250513 1250553 1250655
1250661 1250664 1250696 1250974 1251227 1251789 1251793 1251862
1251923 1251931 1251948 1251952 1251981 1252095 1252148 1252217
1252306 1252431 1252696 1252930 1252931 1252932 1252933 1252934
1252935 1252992 1252993 1253025 1253043 1253098 1253139 1253389
1253679 1253682 1254157 1254158 1254159 1254160 1254264 1254299
1254395 1254415 1254441 1254441 1254480 1254563 1254666 1254670
1254889 1254924 1254924 1254928 1255024 1255024 1255326 1255326
1255678 1255725 1256341 1256427 1256436 1256466 1256525 1256526
1256766 1256804 1256805 1256807 1256808 1256809 1256810 1256811
1256812 1256822 1256829 1256830 1256831 1256832 1256833 1256834
1256835 1256836 1256837 1256838 1256839 1256840 1257005 1257055
1257101 1257144 1257274 1257364 1257365 1257463 1257463 1257496
1257527 1257593 1257594 1257595 1257661 1257875 1258002 1258020
1258022 1258311 1258319 1258344 1258392 1258423 1258506 1258859
1259071 1259118 1259132 1259215 1259418 1259418 1259438 1259543
1259619 1259650 1259650 1259652 1259652 1259697 1259704 1259711
1259726 1259729 1259825 1259867 1259924 1260078 1260082 1260357
1260441 1260442 1260443 1260444 1260445 1260754 1260755 1261206
1261280 1261400 1261535 1261606 1261606 1261639 1261678 1261772
1261809 1261822 1261824 1261957 1261982 1261983 1262083 1262134
1262144 1262221 1262223 1262223 1262263 1262305 1262315 1262464
1262465 1262684 1262693 1262711 1262719 1263078 1263084 1263098
1263117 1263656 1263658 1264511 1264512 1264513 1264514 1264515
1264713 1265296 1265386 1265400 1266226 1266304 1266328 1266340
1266341 1266342 1266343 1266344 1266345 1266347 1266349 1266350
1266351 1266352 1266353 1266355 1266356 1266357 1266361 1266385
1266786 1267423 1267631 1267644 1267647 1268012 1268013 1268290
1268349 1268572 1268573 1268747 1268867 1268886 1269039 1269040
1269041 1269042 1269043 1269044 1269045 1269046 1269047 1269048
1269049 1269050 1269051 1269052 1269053 1269054 1269055 1269056
1269057 1269058 1269060 1269150 1269571 1269583 1269584 1269622
1269623 1269664 1269790 1270219 1270252 1270254 1270439 1270534
1271045 1271351 1271352 1271354 1271372 1271386 1271444 1271645
1271712 1271931 1271932 1271933 1271934 1271980 1272554 1272616
1273429 1273430 1273431 1273432 1273433 1273434 1273435 1273436
1273437 1273438 1273439 1273440 1273441 1273901 1274723 1274726
1274774 1274777 1274788 1274790 1274791 1274792 1274795 1274796
1274797 1274798 1274861 1275096 1275219 1275441 1275441 1275492
1275594 1275732 1275837 1275859 1275860 1275915 1276892 1276946
1277247 1277262 1277707 1277708 1277709 1277710 1277711 1277712
1277713 1277919 1277921 1277922 1278135 1278347 1278348 1278349
1278729 1279051 1279565 1279893 1279961 1280049 1280050 1280051
1280052 1280053 1280054 1280587 1280589 1280590 1280591 1280592
1280594 1280595 1280596 1280597 1280598 1280599 1280702 1281297
1282301 1282303 1282509 1282745 1283183 822653 CVE-2023-45853
CVE-2024-10041 CVE-2024-2236 CVE-2024-56738 CVE-2025-0395 CVE-2025-10158
CVE-2025-10158 CVE-2025-10911 CVE-2025-11187 CVE-2025-13151 CVE-2025-14104
CVE-2025-15281 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469 CVE-2025-15649
CVE-2025-28162 CVE-2025-28164 CVE-2025-54770 CVE-2025-54771 CVE-2025-58050
CVE-2025-59375 CVE-2025-61661 CVE-2025-61662 CVE-2025-61663 CVE-2025-61664
CVE-2025-64505 CVE-2025-64506 CVE-2025-64720 CVE-2025-65018 CVE-2025-66199
CVE-2025-66293 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420
CVE-2025-69421 CVE-2025-69720 CVE-2025-70873 CVE-2025-7709 CVE-2025-8732
CVE-2025-9230 CVE-2025-9231 CVE-2025-9232 CVE-2026-0861 CVE-2026-0915
CVE-2026-0989 CVE-2026-0990 CVE-2026-0992 CVE-2026-11822 CVE-2026-11824
CVE-2026-11979 CVE-2026-12087 CVE-2026-13221 CVE-2026-13595 CVE-2026-13757
CVE-2026-14456 CVE-2026-14457 CVE-2026-16742 CVE-2026-1757 CVE-2026-18374
CVE-2026-18798 CVE-2026-18938 CVE-2026-19499 CVE-2026-19542 CVE-2026-22695
CVE-2026-22795 CVE-2026-22796 CVE-2026-22801 CVE-2026-23865 CVE-2026-24515
CVE-2026-25210 CVE-2026-25646 CVE-2026-2673 CVE-2026-2673 CVE-2026-27171
CVE-2026-27456 CVE-2026-27456 CVE-2026-28387 CVE-2026-28388 CVE-2026-28389
CVE-2026-28390 CVE-2026-29111 CVE-2026-29111 CVE-2026-29518 CVE-2026-31789
CVE-2026-31790 CVE-2026-3184 CVE-2026-32776 CVE-2026-32777 CVE-2026-32778
CVE-2026-33416 CVE-2026-33636 CVE-2026-34180 CVE-2026-34181 CVE-2026-34182
CVE-2026-34183 CVE-2026-34743 CVE-2026-34757 CVE-2026-35189 CVE-2026-35191
CVE-2026-40226 CVE-2026-4046 CVE-2026-40467 CVE-2026-40468 CVE-2026-40553
CVE-2026-41035 CVE-2026-41035 CVE-2026-4105 CVE-2026-4105 CVE-2026-41080
CVE-2026-41989 CVE-2026-41990 CVE-2026-41991 CVE-2026-41992 CVE-2026-42250
CVE-2026-42764 CVE-2026-42766 CVE-2026-42767 CVE-2026-42768 CVE-2026-42769
CVE-2026-42770 CVE-2026-43617 CVE-2026-43617 CVE-2026-43618 CVE-2026-43618
CVE-2026-43619 CVE-2026-43619 CVE-2026-43620 CVE-2026-43620 CVE-2026-4437
CVE-2026-4438 CVE-2026-44507 CVE-2026-44508 CVE-2026-44509 CVE-2026-44510
CVE-2026-44604 CVE-2026-44605 CVE-2026-45186 CVE-2026-45232 CVE-2026-45445
CVE-2026-45446 CVE-2026-45447 CVE-2026-46675 CVE-2026-4878 CVE-2026-50219
CVE-2026-50811 CVE-2026-53612 CVE-2026-53613 CVE-2026-53614 CVE-2026-53783
CVE-2026-53784 CVE-2026-53785 CVE-2026-53786 CVE-2026-53788 CVE-2026-53789
CVE-2026-53790 CVE-2026-53791 CVE-2026-53792 CVE-2026-53793 CVE-2026-53794
CVE-2026-53795 CVE-2026-53796 CVE-2026-53797 CVE-2026-53798 CVE-2026-53799
CVE-2026-53800 CVE-2026-53801 CVE-2026-53802 CVE-2026-53803 CVE-2026-5435
CVE-2026-54369 CVE-2026-54370 CVE-2026-54371 CVE-2026-54411 CVE-2026-5450
CVE-2026-54872 CVE-2026-54874 CVE-2026-54875 CVE-2026-56131 CVE-2026-56132
CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407
CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412
CVE-2026-57432 CVE-2026-5928 CVE-2026-5958 CVE-2026-6238 CVE-2026-63072
CVE-2026-63073 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-6368
CVE-2026-66046 CVE-2026-6732 CVE-2026-6791 CVE-2026-70452 CVE-2026-70453
CVE-2026-70454 CVE-2026-70455 CVE-2026-70456 CVE-2026-70457 CVE-2026-70458
CVE-2026-70459 CVE-2026-70460 CVE-2026-70461 CVE-2026-70462 CVE-2026-70463
CVE-2026-70464 CVE-2026-72522 CVE-2026-72693 CVE-2026-72897 CVE-2026-7383
CVE-2026-75803 CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-76641
CVE-2026-76642 CVE-2026-76956 CVE-2026-76957 CVE-2026-77117 CVE-2026-77696
CVE-2026-78408 CVE-2026-78410 CVE-2026-80489 CVE-2026-8376 CVE-2026-84782
CVE-2026-84784 CVE-2026-86145 CVE-2026-8674 CVE-2026-86805 CVE-2026-89156
CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161 CVE-2026-89162
CVE-2026-9076
-----------------------------------------------------------------
The container elemental/elemental was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 20
Released: Mon Nov 17 16:06:01 2025
Summary: Recommended update for selinux-policy
Type: recommended
Severity: critical
References: 1205770,1229587,1232226,1235731,1238137,1240883,1242998,1244573,1245470,1247875,1249052,1249370,1249435,1250661,1250696,1250974,1251227,1251793,1251862,1251923,1251952
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git239.fcbf2d509:
* fail2ban: bump module version
* fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
* fail2ban: fix typos in interface descriptions
* fail2ban: tweak file context regex for /run/fail2ban
* fail2ban: drop file context for old rc.d file
* Allow wicket to manage its proc directories (bsc#1235731)
* Allow NM to manage wicked pid files (bsc#1235731)
* Allow NM to reach systemd unit files (bsc#1235731)
* Make wicked script backwards compatible (bsc#1251923)
* Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
* Allow salt_t transition to rpm_script_t (bsc#1250696)
* grub snapper plugin is now named 00-grub (bsc#1251793)
* Assign alts_exec_t exec_file attribute (bsc#1250974)
* Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)
* Allow sshd_session_t write to wtmpdb
* Support /usr/libexec/ssh as well as openssh folder
* Set xenstored_use_store_type_domain boolean true(bsc#1247875)
* Adjust guest and xguest users policy for sshd-session
* Allow valkey-server create and use netlink_rdma_socket
* Allow blueman get attributes of filesystems with extended attributes
* Update files_search_base_file_types()
* Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)
* Allow geoclue get attributes of the /dev/shm filesystem
* Allow apcupsd get attributes of the /dev/shm filesystem
* Allow sshd-session read cockpit pid files
* Add /opt/.snapshots to the snapper file context (bsc#1232226)
* Allow nfs generator create and use netlink sockets
* Conditionally allow virt guests to read certificates in user home directories
* xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
* Allow nfs-generator create and use udp sockets
* Allow kdump search kdumpctl_tmp_t directories
* Allow init open and read user tmp files
* Fix the systemd_logind_stream_connect() interface
* Allow staff and sysadm execute iotop using sudo
* Allow sudodomains connect to systemd-logind over a unix socket
* /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
* Add default contexts for sshd-seesion
* Define types for new openssh executables
* Fix systemd_manage_unit_symlinks() interface definition
* Support coreos installation methods
* Add a new type for systemd-ssh-issue PID files
* Allow gnome-remote-desktop connect to unreserved ports
* Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)
* Allow mdadm the CAP_SYS_PTRACE capability
* Allow iptables manage its private fifo_files in /tmp
* Allow auditd manage its private run dirs
* Revert 'Allow virt_domain write to virt_image_t files'
* Allow gdm create /etc/.pwd.lock with a file transition
* Allow gdm bind a socket in the /run/systemd/userdbd directory
* Allow nsswitch_domain connect to xdm over a unix domain socket
* Allow systemd homed getattr all tmpfs files (bsc#1240883)
* Allow systemd (PID 1) create lastlog entries
* Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
* Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
* Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
* Allow systemd-oomd watch tmpfs dirs
* Allow chronyc the setgid and setuid capabilities
* Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
* Allow stalld map sysfs files
* Allow NetworkManager-dispatcher-winbind get pidfs attributes
* Allow openvpn create and use generic netlink socket
* policy_capabilities: remove estimated from released versions
* policy_capabilities: add stub for userspace_initial_context
* add netlink_xperm policy capability and nlmsg permission definitions
* policy_capabilities: add ioctl_skip_cloexec
* selinux-policy: add allow rule for tuned_ppd_t
* selinux-policy: add allow rule for switcheroo_control_t
* Label /run/audit with auditd_var_run_t
* Allow virtqemud start a vm which uses nbdkit
* Add nbdkit_signal() and nbdkit_signull() interfaces
* Fix insights_client interfaces names
* Add insights_core and insights_client interfaces
* Fix selinux-autorelabel-generator label after upstream changes
* Revert 'Remove the mysql module sources'
* Revert 'Allow rasdaemon write access to sysfs (bsc#1229587)'
* Reset postfix.fc to upstream, add alias instead
* dist/targeted/modules.conf: enable slrnpull module
* Allow bootupd delete symlinks in the /boot directory
* Allow systemd-coredumpd capabilities in the user namespace
* Allow openvswitch read virtqemud process state
* Allow systemd-networkd to create leases directory
* Apply generator template to selinux-autorelabel generator
* Support virtqemud handle hotplug hostdev devices
* Allow virtstoraged create qemu /var/run files
* Allow unconfined_domain_type cap2_userns capabilities
* Label /usr/libexec/postfix/tlsproxy with postfix_smtp_exec_t
* Remove the mysql module sources
* dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
* Update kmscon policy module to kmscon version 9 (bsc#1238137)
* Allow login to getattr pidfs
* Allow systemd to map files under /sys
* systemd: drop duplicate init_nnp_daemon_domain lines
* Fix typo
* Allow logwatch stream connect to opensmtpd
* Allow geoclue read NetworkManager pid files
* Allow unconfined user a file transition for creating sudo log directory
* Allow virtqemud read/write inherited dri devices
* Allow xdm_t create user namespaces
* Update policy for login_userdomain
* Add ppd_base_profile to file transition to get tuned_rw_etc_t type
* Update policy for bootupd
* Allow logwatch work with opensmtpd
* Update dovecot policy for dovecot 2.4.1
* Allow ras-mc-ctl write to sysfs files
* Allow anaconda-generator get attributes of all filesystems
* Add the rhcd_rw_fifo_files() interface
* Allow systemd-coredump the sys_chroot capability
* Allow hostapd write to socket files in /tmp
* Recognize /var/home as an alternate path for /home
* Label /var/lib/lastlog with lastlog_t
* Allow virtqemud write to sysfs files
* Allow irqbalance search sssd lib directories
* Allow samba-dcerpcd send sigkills to passwd
* Allow systemd-oomd watch dbus pid sock files
* Allow some confined users read and map generic log files
* Allow login_userdomain watch the /run/log/journal directory
* Allow login_userdomain dbus chat with tuned-ppd
* Allow login_userdomain dbus chat with switcheroo-control
* Allow userdomain to connect to systemd-oomd over a unix socket
* Add insights_client_delete_lib_dirs() interface
* Allow virtqemud_t use its private tmpfs files (bsc#1242998)
* Allow virtqemud_t setattr to /dev/userfaultfd (bsc#1242998)
* Allow virtqemud_t read and write /dev/ptmx (bsc#1242998)
* Extend virtqemud_t tcp_socket permissions (bsc#1242998)
* Allow virtqemud_t to read and write generic pty (bsc#1242998)
* Allow systemd-importd create and unlink init pid socket
* Allow virtqemud handle virt_content_t chr files
* Allow svirt read virtqemud fifo files
* All sblim-sfcbd the dac_read_search capability
* Allow sblim domain read systemd session files
* Allow sblim-sfcbd execute dnsdomainname
* Confine nfs-server generator
* Allow systemd-timedated start/stop timemaster services
* Allow 'hostapd_cli ping' run as a systemd service
* Allow power-profiles-daemon get attributes of filesystems with extended attributes
* Allow 'oomctl dump' to interact with systemd-oomd
* Basic functionality for systemd-oomd
* Basic enablement for systemd-oomd
* Allow samba-bgqd send to smbd over a unix datagram socket
* Update kernel_secretmem_use()
* Add the file/watch_mountns permission
* Update systemd-generators policy
* Allow plymouthd_t read proc files of systemd_passwd_agent (bsc#1245470)
* Allow insights-client file transition for files in /var/tmp
* Allow tuned-ppd manage tuned log files
* Allow systemd-coredump mount on tmpfs filesystems
* Update sssd_dontaudit_read_public_files()
* Allow zram-generator raw read fixed disk device
* Add fs_write_cgroup_dirs() and fs_setattr_cgroup_dirs() interfaces
-----------------------------------------------------------------
Advisory ID: 29
Released: Wed Nov 19 10:37:50 2025
Summary: Security update for expat
Type: security
Severity: important
References: 1249584,CVE-2025-59375
This update for expat fixes the following issues:
- CVE-2025-59375: Fixed large dynamic memory allocations via a small document submitted for parsing (bsc#1249584)
-----------------------------------------------------------------
Advisory ID: 106
Released: Mon Dec 15 13:52:50 2025
Summary: Security update for grub2
Type: security
Severity: important
References: 1234959,1245636,1245738,1245953,1246231,1247242,1249088,1249385,1252930,1252931,1252932,1252933,1252934,1252935,CVE-2024-56738,CVE-2025-54770,CVE-2025-54771,CVE-2025-61661,CVE-2025-61662,CVE-2025-61663,CVE-2025-61664
This update for grub2 fixes the following issues:
Changes in grub2:
- CVE-2025-54771: Fixed grub_file_close() does not properly controls the fs refcount (bsc#1252931)
- CVE-2025-54770: Fixed missing unregister call for net_set_vlan command may lead to use-after-free (bsc#1252930)
- CVE-2025-61662: Fixed missing unregister call for gettext command may lead to use-after-free (bsc#1252933)
- CVE-2025-61663: Fixed missing unregister call for normal commands may lead to use-after-free (bsc#1252934)
- CVE-2025-61664: Fixed missing unregister call for normal_exit command may lead to use-after-free (bsc#1252935)
- CVE-2025-61661: Fixed out-of-bounds write in grub_usb_get_string() function (bsc#1252932)
- Bump upstream SBAT generation to 6
- Fix 'sparse file not allowed' error after grub2-reboot (bsc#1245738)
- Fix PowerPC network boot prefix to correctly locate grub.cfg (bsc#1249385)
- turn off page flipping for i386-pc using VBE video backend (bsc#1245636)
- Fix boot hangs in setting up serial console when ACPI SPCR table is present
and redirection is disabled (bsc#1249088)
- Fix timeout when loading initrd via http after PPC CAS reboot (bsc#1245953)
- Skip mount point in grub_find_device function (bsc#1246231)
- CVE-2024-56738: Fixed side-channel attack due to not constant-time algorithm in grub_crypto_memcmp (bsc#1234959)
-----------------------------------------------------------------
Advisory ID: 107
Released: Mon Dec 15 19:16:15 2025
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1250232,1250233,1250234,CVE-2025-9230,CVE-2025-9231,CVE-2025-9232
This update for openssl-3 fixes the following issues:
- CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
- CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
- CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
-----------------------------------------------------------------
Advisory ID: 109
Released: Tue Dec 16 15:14:02 2025
Summary: Recommended update for freetype2
Type: recommended
Severity: moderate
References:
This update for freetype2 fixes the following issues:
Changes in freetype2:
- update to 2.13.3:
- Do not build the ft2demos flavor in SLE16 where Qt5 will not be
available
-----------------------------------------------------------------
Advisory ID: 126
Released: Sun Jan 11 17:27:45 2026
Summary: Recommended update for lz4
Type: recommended
Severity: moderate
References:
This update for lz4 fixes the following issues:
- align rpm changelog with sle15 and do not ignore test suite result
-----------------------------------------------------------------
Advisory ID: 131
Released: Mon Jan 12 12:14:46 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1254157,1254158,1254159,1254160,1254480,CVE-2025-64505,CVE-2025-64506,CVE-2025-64720,CVE-2025-65018,CVE-2025-66293
This update for libpng16 fixes the following issues:
- CVE-2025-64505: heap buffer over-read in `png_do_quantize` when processing PNG files malformed palette indices
(bsc#1254157).
- CVE-2025-64506: heap buffer over-read in `png_write_image_8bit` when processing 8-bit input with `convert_to_8bit`
enabled (bsc#1254158).
- CVE-2025-64720: out-of-bounds read in `png_image_read_composite` when processing palette images with
`PNG_FLAG_OPTIMIZE_ALPHA` enabled (bsc#1254159).
- CVE-2025-65018: heap buffer overflow in `png_image_finish_read` when processing specially crafted 16-bit interlaced
PNGs with 8-bit output format (bsc#1254160).
- CVE-2025-66293: out-of-bounds read of the `png_sRGB_base` array when processing palette PNG images with partial
transparency and gamma correction (bsc#1254480).
-----------------------------------------------------------------
Advisory ID: 154
Released: Mon Jan 19 15:46:34 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: critical
References: 1231354,1233358,1241964,1244459,1244573,1246080,1246559,1251789,1251931,1252095,1252431,1252992,1252993,1253098,1253389,1254395,1254889,1255024
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git345.3965b24b0:
* Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)
Update to version 20250627+git343.b66ec7135:
* Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
Update to version 20250627+git341.4beeb2d65:
* Allow virtlogd_t dac_override (bsc#1253389)
* Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
* Allow virtqemud_t to read/write device_t (bsc#1251789)
* update support for polkit agent helper (bsc#1251931)
* Allow system_mail_t read apache system content conditionally
* Allow login_userdomain read lastlog
* Allow sshd-net read and write to sshd vsock socket
* Update ktls policy
* Add comprehensive SELinux policy module for bwrap thumbnail generation
* Revert 'Allow thumb_t create permission in the user namespace'
* Allow systemd-machined read svirt process state
* Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
* Allow sysadm access to TPM
* Allow tlp get the attributes of the pidfs filesystem
* Allow kmscon to read netlink_kobject_uevent_socket
* Allow systemd-ssh-issue read kernel sysctls
* fix: bz2279215 Allow speech-dispatcher access to user home/cache files
* Allow create kerberos files in postgresql db home
* Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
* Allow shell comamnds in locate systemd service (bsc#1246559)
* Introduce initrc_nnp_daemon_domain interface
* Label /var/lib/cosmic-greeter with xdm_var_lib_t
* Allow setroubleshoot-fixit get attributes of xattr fs
* Allow insights-client manage /etc symlinks
* Allow insights-client get attributes of the rpm executable
* Allow nfsidmapd search virt lib directories
* Allow iotop stream connect to systemd-userdbd
* Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
* Allow gnome-remote-desktop read sssd public files
* Allow thumb_t stream connect to systemd-userdbd
* Add auth_nnp_domtrans_chkpwd()
* Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
* Allow bluez dbus API passing unix domain sockets
* Allow bluez dbus api pass sockets over dbus
* Dontaudit systemd-generator connect to sssd over a unix stream socket
* Allow init watch/watch_reads systemd-machined user ptys
* Introduce sap_service_transition_to_unconfined_user boolean
* allow init to read sap symlinks
* Allow SAP domain to relocation text in all files
- Fix macros.selinux-policy to allow changing booleans when policy
is not loaded. Previous logic was broken (bsc#1254395)
Update to version 20250627+git293.3432d4834:
* Allow pcscd_t to search cgroup (bsc#1253098)
* Fix syntax error in userdomain.if
* Allow nnp_transition for OpenSMTPD (bsc#1252431)
* Allow ras-mc-ctl get attributes of the kmod executable
* Define file equivalency for /var/opt
* Allow virtnodedev_t the perfmon capability
* Allow nut_upsdrvctl_t the sys_ptrace capability
* Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
* Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
* Allow pcrlock to delete pid entries
* Allow systemd_pcrlock_t to manage its pid files
* Mark snapper_sdbootutil_plugin_t as permissive
* Drop unnamed filetrans, should be done upstream (bsc#1241964)
* Label pcrlock pid file correctly (bsc#1241964)
* Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
* snapper takes output from stdout/err, allow pcrlock to write
* Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
* Allow snapper sdbootutil plugin to read snapper data and conf
* Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
* Replace snapper tmp file access for pcrlock (bsc#1241964)
* Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
* Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
* Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
* Allow snapper sdbootutil sys_admin (bsc#1241964)
* Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
* Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
* Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
* Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
* Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
* Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
* Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)
* systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
* Allow cupsd to manage cupsd_rw_etc_t lnk_files
* Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
* Allow spamc read aliases file
* Mark configfs_t as mountpoint (bsc#1246080)
* Allow systemd-machined watch cgroup files
* Allow sshd-auth read generic proc files
* Allow sshd-auth read and write user domain ptys
* Allow logwatch read and write sendmail unix stream sockets
* Allow logwatch domain transition on rpm execution
* Allow thumb_t mounton its private tmpfs files
* Allow thumb_t create permission in the user namespace
* Allow corenet_unconfined_type name_bind to icmp_socket
* Allow systemd-networkd to manage systemd_networkd_var_lib_t files
* Allow sshd-session get attributes of sshd vsock socket
-----------------------------------------------------------------
Advisory ID: 162
Released: Thu Jan 22 09:15:08 2026
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: important
References: 1250655,1250664,1253679,1254264,1254928
This update for suse-module-tools fixes the following issues:
- Update to version 16.0.64:
* udev rules: write block queue attributes only if necessary (bsc#1254928)
- Update to version 16.0.63:
* 80-hotplug-cpu-mem.rules: remount tmpfs on 'online' uevents (bsc#1254264)
* udev: use systemd service to remount tmpfs (bsc#1253679)
- Update to version 16.0.62:
* spec file: remove %udev_rules_update call (bsc#1250664)
- Update to version 16.0.61:
* weak-modules2: skip livepatch dir when checking for unresolved symbols (bsc#1250655)
-----------------------------------------------------------------
Advisory ID: 172
Released: Thu Jan 22 15:29:42 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1256525,1256526,CVE-2026-22695,CVE-2026-22801
This update for libpng16 fixes the following issues:
- CVE-2026-22695: Fixed heap buffer over-read in png_image_finish_read (bsc#1256525).
- CVE-2026-22801: Fixed integer truncation causing heap buffer over-read in png_image_write_* (bsc#1256526).
-----------------------------------------------------------------
Advisory ID: 206
Released: Wed Jan 28 12:26:08 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1248516
This update for grub2 fixes the following issues:
- Optimize PBKDF2 to reduce the decryption time (bsc#1248516)
* lib/crypto: Introduce new HMAC functions to reuse buffers
* lib/pbkdf2: Optimize PBKDF2 by reusing HMAC handle
* kern/misc: Implement faster grub_memcpy() for aligned buffers
-----------------------------------------------------------------
Advisory ID: 218
Released: Thu Jan 29 18:44:57 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1236282,1256436,1256766,1256822,1257005,CVE-2025-0395,CVE-2025-15281,CVE-2026-0861,CVE-2026-0915
This update for glibc fixes the following issues:
Security fixes:
- CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
- CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
- CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
- CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).
Other fixes:
- NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)
-----------------------------------------------------------------
Advisory ID: 237
Released: Mon Feb 2 14:00:02 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1256829,1256830,1256831,1256832,1256833,1256834,1256835,1256836,1256837,1256838,1256839,1256840,1257274,CVE-2025-11187,CVE-2025-15467,CVE-2025-15468,CVE-2025-15469,CVE-2025-66199,CVE-2025-68160,CVE-2025-69418,CVE-2025-69419,CVE-2025-69420,CVE-2025-69421,CVE-2026-22795,CVE-2026-22796
This update for openssl-3 fixes the following issues:
Security fixes:
- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).
- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).
- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).
- CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs >16MB (bsc#1256832).
- CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).
- CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
- CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
- CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
- CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
- CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
- CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
- CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).
Other fixes:
- Enable livepatching support for ppc64le (bsc#1257274).
-----------------------------------------------------------------
Advisory ID: 244
Released: Thu Feb 5 12:26:20 2026
Summary: Security update for libxml2
Type: security
Severity: moderate
References: 1256805,CVE-2026-0989
This update for libxml2 fixes the following issues:
- CVE-2026-0989: Fixed call stack exhaustion leading to application crash
due to RelaxNG parser not limiting the recursion depth when
resolving `<include>` directives (bsc#1256805).
-----------------------------------------------------------------
Advisory ID: 252
Released: Wed Feb 11 12:13:17 2026
Summary: Recommended update for systemd
Type: recommended
Severity: important
References: 1228081,1228659,1228728,1231986,1234765,1244449,1248356,1248501,1251981,1254563,1255326,1256427
This update for systemd fixes the following issues:
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
- core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
- Name libsystemd-{shared,core} based on the major version of systemd and the
package release number (bsc#1228081, bsc#1256427)
- systemd-update-helper: clean up the flags immediately after they have been consumed.
- systemd.spec: don't reexecute PID1 on transactional updates.
- Drop most of the workarounds contained in the fixlets.
- Drop %filetriggers build flag. It was introduced to ease backport of Base:System to SLE distros
where file-triggers were unreliable but that is no longer the case on the latest SLE distros.
- Fix: systemd Tainted: unmerged-bin (bsc#1228728, bsc#1251981)
- timer: rebase last_trigger timestamp if needed
- timer: rebase the next elapse timestamp only if timer didn't already run
- main: switch explicitly to tty1 on soft-reboot (bsc#1231986)
- terminal-util: modernize vtnr_from_tty() a bit
- units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
- systemd.spec: use %sysusers_generate_pre so that some systemd users are
already available in %pre (bsc#1248501)
- core/cgroup: Properly handle aborting a pending freeze operation
- detect-virt: add bare-metal support for GCE (bsc#1244449)
- uki.conf is used by the ukify tool to create an Unified Kernel Image[...]
- Make sure that the ordering trick used to update the udev package as close as
as possible to the update of the systemd package also works with zypper.
- Fix: Snapshot 20240730 - unbootable after transactional-update dup (bsc#1228659)
* We also need to add 'Suggests: udev', which serves the same purpose as
'OrderWithRequires: udev' but is part of the repository metadata.
It should therefore hint zypper to install systemd and udev as close together as possible
- Fix systemd-network recommending libidn2-devel (bsc#1234765)
-----------------------------------------------------------------
Advisory ID: 305
Released: Fri Feb 20 16:44:31 2026
Summary: Recommended update for lvm2
Type: recommended
Severity: important
References: 1257661
This update for lvm2 fixes the following issues:
- L3: LVM_SUPPRESS_FD_WARNINGS is no longer effective (bsc#1257661)
* libdaemon: fix suppressing stray fd warnings
-----------------------------------------------------------------
Advisory ID: 310
Released: Thu Feb 26 08:38:22 2026
Summary: Recommended update for openssl-3
Type: recommended
Severity: low
References:
This update for openssl-3 fixes the following issues:
- removed test patches because they are not needed.
-----------------------------------------------------------------
Advisory ID: 314
Released: Thu Feb 26 17:51:31 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References:
This update for gcc15 fixes the following issues:
Update to GCC 15.2 release
* the GCC 15.2 release contains regression fixes accumulated since
the GCC 15.1 release
- Fixes PR120714, RISC-V: incorrect frame pointer CFA address for
stack-clash protection loops
-----------------------------------------------------------------
Advisory ID: 327
Released: Fri Feb 27 11:34:41 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: important
References: 1247286,1247495,1248158,1249686,1250513,1257875
This update for aaa_base fixes the following issues:
- Update to version 84.87+git20260210.ecce285:
* For boo#1257875 get intrinsic DEFAULT_WM back
* DIR_COLORS: add vt220 and .jxl
- Update to version 84.87+git20260112.8f614f3:
* add ghost entries for the removed dirs
* Revert list directories above all normal files.
- Update to version 84.87+git20251217.34fd7bc:
* add tmpfiles template adm-backup.conf (jsc#PED-14803)
* Fix old script to support copy mode as well
* Support for XDG environment variables for the su,
* adapted sugggestions
* Patching nsswitch.conf only if it has not been generated by nsswitch-config (jsc#PED-13807).
* Avoid nasty exceptions running tput
- Update to version 84.87+git20251111.509a363:
* Avoid escape sequences on dump terminal of s390
- Update to version 84.87+git20251111.16d9d43:
* Set XDG environment variables consistently without trailing slash
- Update to version 84.87+git20251110.af063e6:
* Avoid escape sequences on dump terminal of s390
* Set erase character from kbs entry of terminfo
- Update to version 84.87+git20251030.441f926:
* Add systemd to /etc/nsswitch.conf (bsc#1250513)
* Add group-directories-first option
* prevent normal users from accessing dmesg (bsc#1249686)
* Use explicit defaults for XDG environment variables
- Update to version 84.87+git20250903.33e5ba4:
* Correct fix for (bsc#1247495, bsc#1248158)
- Update to version 84.87+git20250805.3069494:
* Remove initviocons for tcsh as well and
* Update csh.login
* Add missing quoting and remove unneeded uses of eval
- Update to version 84.87+git20250801.f305627:
* Remove sysconfig.language (bsc#1247286)
- Update to version 84.87+git20250801.b2fa3fe:
* Allow /etc/locale.conf to have no newline
-----------------------------------------------------------------
Advisory ID: 338
Released: Tue Mar 3 09:57:47 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1254299,1254415,1258022
This update for grub2 fixes the following issues:
- Support dm multipath bootlist on PowerPC (bsc#1254415)
- Backport upstream's commit to prevent BIOS assert (bsc#1258022)
- Fix error 'grub-core/script/lexer.c:352:out of memory' after PowerPC CAS Reboot (bsc#1254299)
* Fix PowerPC CAS reboot to evaluate menu context
-----------------------------------------------------------------
Advisory ID: 344
Released: Tue Mar 3 17:13:34 2026
Summary: Security update for expat
Type: security
Severity: moderate
References: 1257144,1257496,CVE-2026-24515,CVE-2026-25210
This update for expat fixes the following issues:
- CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may cause a NULL
dereference (bsc#1257144).
- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
-----------------------------------------------------------------
Advisory ID: 353
Released: Wed Mar 4 11:51:24 2026
Summary: Security update for libxml2, libxslt
Type: security
Severity: moderate
References: 1247850,1247858,1250553,1256804,1256807,1256808,1256809,1256810,1256811,1256812,1257593,1257594,1257595,CVE-2025-10911,CVE-2025-8732,CVE-2026-0990,CVE-2026-0992,CVE-2026-1757
This update for libxml2, libxslt fixes the following issues:
Changes in libxml2:
- CVE-2026-0990: call stack overflow may lead to application crash due to infinite recursion in
`xmlCatalogXMLResolveURI` (bsc#1256807, bsc#1256811).
- CVE-2026-0992: excessive resource consumption when processing XML catalogs due to exponential behavior when handling
`nextCatalog` elements (bsc#1256809, bsc#1256812).
- CVE-2025-8732: infinite recursion in catalog parsing functions when processing malformed SGML catalog files
(bsc#1247858).
- CVE-2026-1757: memory leak in the `xmllint` interactive shell (bsc#1257594, bsc#1257595).
- CVE-2025-10911: parsing xsl nodes may lead to use-after-free with key data stored cross-RVT (bsc#1250553)
-----------------------------------------------------------------
Advisory ID: 396
Released: Tue Mar 17 15:49:10 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1257364,1257365,1258020,CVE-2025-28162,CVE-2025-28164,CVE-2026-25646
This update for libpng16 fixes the following issues:
- CVE-2026-25646: Heap buffer overflow vulnerability in png_set_dither/png_set_quantize (bsc#1258020)
- CVE-2025-28162: Fixed a memory leaks when running `pngimage`. (bsc#1257364)
- CVE-2025-28164: Fixed a memory leaks when running `pngimage`. (bsc#1257365)
-----------------------------------------------------------------
Advisory ID: 407
Released: Wed Mar 18 23:55:39 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Fixed bogus expression simplification (bsc#1257463)
-----------------------------------------------------------------
Advisory ID: 466
Released: Mon Mar 30 16:59:16 2026
Summary: Security update for expat
Type: security
Severity: important
References: 1259711,1259726,1259729,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778
This update for expat fixes the following issues:
- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity
declaration value (bsc#1259726).
- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition
(bsc#1259729).
-----------------------------------------------------------------
Advisory ID: 472
Released: Wed Apr 1 16:56:43 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: important
References: 1237375,1255024,1255725,1259438,1259704
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git355.5249ba7d5:
* Revert 'Define file equivalency for /var/opt' (bsc#1259704)
* Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
Update to version 20250627+git351.529352149:
* Allow syslog_t access ISC dhcpd /dev/log socket (bsc#1255725)
* privoxy: account for openSUSE chroot configuration (bsc#1237375)
Update to version 20250627+git347.b8926451e:
* Add support for 'mariadb at .service' (bsc#1255024).
-----------------------------------------------------------------
Advisory ID: 480
Released: Tue Apr 7 13:57:38 2026
Summary: Security update for libpng16
Type: security
Severity: important
References: 1260754,1260755,CVE-2026-33416,CVE-2026-33636
This update for libpng16 fixes the following issues:
- CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code
execution (bsc#1260754).
- CVE-2026-33636: out-of-bounds read/write in the palette expansion on ARM Neon can lead to information leak and
crashes (bsc#1260755).
-----------------------------------------------------------------
Advisory ID: 484
Released: Tue Apr 7 16:33:05 2026
Summary: Security update for libtasn1
Type: security
Severity: moderate
References: 1256341,CVE-2025-13151
This update for libtasn1 fixes the following issues:
- CVE-2025-13151: lack of validation of input data size leads to stack-based buffer overflow in
`asn1_expend_octet_string` (bsc#1256341).
-----------------------------------------------------------------
Advisory ID: 485
Released: Tue Apr 7 17:17:05 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1255326,1258344,1259418,1259650,1259697,CVE-2026-29111,CVE-2026-4105
This update for systemd fixes the following issues:
Update to systemd v257.13:
Security issues:
- CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
- CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
- udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).
Non security issues:
- Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
- Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
Changelog:
- 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
- 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
- 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
- fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
For a complete list of changes, visit:
https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28
-----------------------------------------------------------------
Advisory ID: 500
Released: Thu Apr 9 13:14:21 2026
Summary: Recommended update for patterns-base
Type: recommended
Severity: moderate
References:
This update for patterns-base fixes the following issues:
Changes in patterns-base:
- Drop biosdevname, this is being replaced by systemd predictable
network interface naming (jsc#PED-262).
-----------------------------------------------------------------
Advisory ID: 502
Released: Thu Apr 9 13:18:30 2026
Summary: Security update for zlib
Type: security
Severity: moderate
References: 1216378,1258392,CVE-2023-45853,CVE-2026-27171
This update for zlib fixes the following issues:
- CVE-2026-27171: Fixed an infinite loop via the crc32_combine64 and crc32_combine_gen64 functions due to missing checks for negative lengths. (bsc#1258392)
- CVE-2023-45853: Fixed an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6. (bsc#1216378)
-----------------------------------------------------------------
Advisory ID: 510
Released: Thu Apr 9 15:00:19 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1222465,1254666,1258859,CVE-2025-14104,CVE-2026-3184
This update for util-linux fixes the following issues:
Security issues:
- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).
Non security issues:
- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).
-----------------------------------------------------------------
Advisory ID: 516
Released: Fri Apr 10 08:36:43 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1258319,1260078,1260082,CVE-2026-4437,CVE-2026-4438
This update for glibc fixes the following issues:
Security fixes:
- CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
- CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).
Other fixes:
- nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).
-----------------------------------------------------------------
Advisory ID: 528
Released: Fri Apr 10 20:29:30 2026
Summary: Security update for pcre2
Type: security
Severity: moderate
References: 1248842,CVE-2025-58050
This update for pcre2 fixes the following issue:
- CVE-2025-58050: integer overflow leads to heap buffer overread in match_ref due to missing boundary restoration in SCS
(bsc#1248842).
-----------------------------------------------------------------
Advisory ID: 529
Released: Fri Apr 10 20:56:55 2026
Summary: Security update for sqlite3
Type: security
Severity: moderate
References: 1248586,1252217,1254670,1259619,CVE-2025-70873,CVE-2025-7709
This update for sqlite3 fixes the following issues:
Update sqlite3 to version 3.51.3:
Security issues:
- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).
- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).
Non security issue:
- sqlite3 won't build when using --with icu (bsc#1248586).
Changelog:
Update to version 3.51.3:
* Fix the WAL-reset database corruption bug:
https://sqlite.org/wal.html#walresetbug
* Other minor bug fixes.
Update to version 3.51.2:
* Fix an obscure deadlock in the new broken-posix-lock detection
logic.
* Fix multiple problems in the EXISTS-to-JOIN optimization.
Update to version 3.51.1:
* Fix incorrect results from nested EXISTS queries caused by the
optimization in item 6b in the 3.51.0 release.
* Fix a latent bug in fts5vocab virtual table, exposed by new
optimizations in the 3.51.0 release
Update to version 3.51.0:
* New macros in sqlite3.h:
- SQLITE_SCM_BRANCH -> the name of the branch from which the
source code is taken.
- SQLITE_SCM_TAGS -> space-separated list of tags on the source
code check-in.
- SQLITE_SCM_DATETIME -> ISO-8601 date and time of the source
* Two new JSON functions, jsonb_each() and jsonb_tree() work the
same as the existing json_each() and json_tree() functions
except that they return JSONB for the 'value' column when the
'type' is 'array' or 'object'.
* The carray and percentile extensions are now built into the
amalgamation, though they are disabled by default and must be
activated at compile-time using the -DSQLITE_ENABLE_CARRAY
and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.
* Enhancements to TCL Interface:
- Add the -asdict flag to the eval command to have it set the
row data as a dict instead of an array.
- User-defined functions may now break to return an SQL NULL.
* CLI enhancements:
- Increase the precision of '.timer' to microseconds.
- Enhance the 'box' and 'column' formatting modes to deal with
double-wide characters.
- The '.imposter' command provides read-only imposter tables
that work with VACUUM and do not require the --unsafe-testing
option.
- Add the --ifexists option to the CLI command-line option and
to the .open command.
- Limit columns widths set by the '.width' command to 30,000 or
less, as there is not good reason to have wider columns, but
supporting wider columns provides opportunity to malefactors.
* Performance enhancements:
- Use fewer CPU cycles to commit a read transaction.
- Early detection of joins that return no rows due to one or
more of the tables containing no rows.
- Avoid evaluation of scalar subqueries if the result of the
subquery does not change the result of the overall expression.
- Faster window function queries when using
'BETWEEN :x FOLLOWING AND :y FOLLOWING' with a large :y.
* Add the PRAGMA wal_checkpoint=NOOP; command and the
SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().
* Add the sqlite3_set_errmsg() API for use by extensions.
* Add the sqlite3_db_status64() API, which works just like the
existing sqlite3_db_status() API except that it returns 64-bit
results.
* Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the
sqlite3_db_status() and sqlite3_db_status64() interfaces.
* In the session extension add the sqlite3changeset_apply_v3()
interface.
* For the built-in printf() and the format() SQL function, omit
the leading '-' from negative floating point numbers if the '+'
flag is omitted and the '#' flag is present and all displayed
digits are '0'. Use '%#f' or similar to avoid outputs like
'-0.00' and instead show just '0.00'.
* Improved error messages generated by FTS5.
* Enforce STRICT typing on computed columns.
* Improved support for VxWorks
* JavaScript/WASM now supports 64-bit WASM. The canonical builds
continue to be 32-bit but creating one's own 64-bit build is
now as simple as running 'make'.
* Improved resistance to database corruption caused by an
application breaking Posix advisory locks using close().
-----------------------------------------------------------------
Advisory ID: 531
Released: Sat Apr 11 10:22:09 2026
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1258002
This update for ca-certificates-mozilla fixes the following issues:
- Updated to 2.84 state (bsc#1258002):
* Removed:
+ Baltimore CyberTrust Root
+ CommScope Public Trust ECC Root-01
+ CommScope Public Trust ECC Root-02
+ CommScope Public Trust RSA Root-01
+ CommScope Public Trust RSA Root-02
+ DigiNotar Root CA
* Added:
+ e-Szigno TLS Root CA 2023
+ OISTE Client Root ECC G1
+ OISTE Client Root RSA G1
+ OISTE Server Root ECC G1
+ OISTE Server Root RSA G1
+ SwissSign RSA SMIME Root CA 2022 - 1
+ SwissSign RSA TLS Root CA 2022 - 1
+ TrustAsia SMIME ECC Root CA
+ TrustAsia SMIME RSA Root CA
+ TrustAsia TLS ECC Root CA
+ TrustAsia TLS RSA Root CA
-----------------------------------------------------------------
Advisory ID: 535
Released: Mon Apr 13 09:31:28 2026
Summary: Recommended update for suse-build-key
Type: recommended
Severity: moderate
References:
This update for suse-build-key fixes the following issues:
Changes in suse-build-key:
- Add the auto import framework, that imports updated gpg keys into the RPM database.
- Added post quantum cryptographic keys for SLES 15 and SLES 16 to be
used for repository verification. (jsc#PED-11925)
- build-pqc-15.pem
- build-pqc-16.pem
-----------------------------------------------------------------
Advisory ID: 537
Released: Mon Apr 13 10:18:45 2026
Summary: Recommended update for systemd-presets-branding-SLE
Type: recommended
Severity: important
References: 1258423
This update for systemd-presets-branding-SLE fixes the following issues:
Changes in systemd-presets-branding-SLE:
- Disable firewalld during migration if it was disabled before (bsc#1258423).
-----------------------------------------------------------------
Advisory ID: 544
Released: Mon Apr 13 15:10:32 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: moderate
References: 1252696,1253025
This update for crypto-policies fixes the following issues:
- Fix the testsuite:
* Port all the policy changes to the config files in the test suite.
* Use the newly introduced SKIP_LINTING=1 option.
- Adapt the manpages to SUSE/openSUSE:
* Add crypto policies SUSE manpages
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: (bsc#1253025, bsc#1252696)
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH and MLKEM768-X25519 and SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add crypto policies FIPS output
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
-----------------------------------------------------------------
Advisory ID: 547
Released: Mon Apr 13 17:48:00 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1260441,1260442,1260443,1260444,1260445,1261678,CVE-2026-2673,CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390,CVE-2026-31789,CVE-2026-31790
This update for openssl-3 fixes the following issues:
Security issues fixed:
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).
- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).
- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).
- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with
KeyTransportRecipientInfo (bsc#1261678).
- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).
- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).
Other updates and bugfixes:
- Enable MD2 in legacy provider (jsc#PED-15724).
-----------------------------------------------------------------
Advisory ID: 556
Released: Tue Apr 14 16:33:17 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1232234,CVE-2024-10041
This update for pam fixes the following issue:
- CVE-2024-10041: libpam: vulnerable to read hashed password (bsc#1232234).
-----------------------------------------------------------------
Advisory ID: 585
Released: Fri Apr 17 12:37:59 2026
Summary: Feature update for libgcrypt, libgpg-error
Type: feature
Severity: moderate
References: CVE-2024-2236
This update for libgcrypt, libgpg-error fixes the following issues:
Update libgcrypt to 1.12.1 (jsc#PED-15059):
* New and extended interfaces:
- Allow access to the FIPS service indicator via the new
GCRYCTL_FIPS_SERVICE_INDICATOR control code.
- Make SHA-1 non-FIPS internally for the 1.12 API
- Add Dilithium (ML-DSA) support
- Support optional random-override and support byte string data
* Bug fixes:
- Use secure MPI in _gcry_mpi_assign_limb_space.
- Use CSIDL_COMMON_APPDATA instead of /etc on Windows.
- Apply a Kyber patch from upstream.
- Fix an edge case in Jent initialization.
- mceliece6688128f: Fix stack overflow crash on win64/wine
* Performance:
- Many performance improvements, new AVX512 implementations for modern CPUs.
- Add RISC-V Zbb+Zbc implementation of CRC.
- Add RISC-V vector cryptography implementation of GHASH, AES, SHA256 and SHA512
- Add AVX2 and AVX512 code paths to improve CRC.
For a full changelog, see:
https://dev.gnupg.org/source/libgcrypt/history/master/;libgcrypt-1.12.0
Update libgpg-error to 1.58:
* New src/gpg-error.c (main): New command 'fconcat'.
* Rename src/spawn-posix.c (struct gpgrt_spawn_actions): Rename the field to
ENVP.
* argparse: Use SYSCONFDIR for /etc.
* Update translations for Portugese, German
* src/estream.c (parse_mode): Fix parsing of 'share'. Set sysopen
flag.
* syscfg: Add 64-bit Android arch.
-----------------------------------------------------------------
Advisory ID: 586
Released: Fri Apr 17 16:33:24 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1239177,1253682,1259867,1261535,1262083
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
- Move %postInstall to %post as fix until zypper moves to
rpm single transaction backend by default (bsc#1262083)
Update to version 20250627+git363.7b84cc7fb:
* Add missing Nextcloud file contexts (bsc#1261535)
* openSUSE uses /var/lib/php8 (bsc#1239177)
* /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
* Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
* Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
-----------------------------------------------------------------
Advisory ID: 603
Released: Tue Apr 21 11:59:18 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1261957,CVE-2026-34757
This update for libpng16 fixes the following issue:
- CVE-2026-34757: libpng: Information disclosure and data corruption via use-after-free vulnerability (bsc#1261957).
-----------------------------------------------------------------
Advisory ID: 625
Released: Wed Apr 22 12:22:37 2026
Summary: Security update for libcap
Type: security
Severity: important
References: 1261809,CVE-2026-4878
This update for libcap fixes the following issues:
- CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in
`cap_set_file()` (bsc#1261809).
-----------------------------------------------------------------
Advisory ID: 637
Released: Fri Apr 24 12:00:57 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1221126,1259543
This update for grub2 fixes the following issues:
- Fix missing install device check in grub2-install on PowerPC which could lead
to bootlist corruption (bsc#1221126)
* add mandatoryminstallmdevicemcheckmformPowerPC
- Fix double free in xen booting if root filesystem is Btrfs (bsc#1259543)
* btrfs: add ability to boot from subvolumes
* btrfs: get default subvolume
-----------------------------------------------------------------
Advisory ID: 642
Released: Fri Apr 24 12:10:11 2026
Summary: Recommended update for cryptsetup, s390-tools
Type: recommended
Severity: important
References: 1241612,1258506,1261772,1261824,1262221
This update for cryptsetup, s390-tools fixes the following issues:
Changes in cryptsetup:
- Update to 2.8.4: (jsc#PED-15889)
* Fix integritysetup resize (grow) of the device if integrity bitmap
mode is used. Increasing the integrity device in bitmap mode did
not work as integritysetup incorrectly used journal settings that
were not applicable.
* Fix device size status reports in cryptsetup and integritysetup.
If the device uses a sector size larger than 512 bytes, the newly
reported byte sizes (introduced in 2.8.0) in the status report
were incorrectly displayed.
* BITLK: Fix unlocking BitLocker device with recovery passphrase.
If the recovery passphrase was present in the first keyslot, the
device failed to unlock. This bug was introduced in 2.8.2 with
Clear Key support.
- Update to 2.8.3:
* Stable bug-fix release with minor extensions.
- Update to 2.8.2:
* BITLK: Fix for BitLocker metadata validation on big-endian systems.
- Update to 2.8.1:
* Fix status and deactivation of TCRYPT (VeraCrypt compatible) devices that use chained ciphers.
* Fix unlocking BITLK (BitLocker compatible) devices with multibyte UTF8 characters in the passphrase.
* Do not allow activation of the LUKS2 device if the used keyslot is not encrypted (it uses a null cipher).
- Such a configuration cannot be created by cryptsetup, but can be crafted outside of it.
- Null cipher is sometimes used to create an empty container for later reencryption.
- Only an empty passphrase can activate such a container (the same as in LUKS1).
* Do not silently decrease PBKDF parallel cost (threads) if set by an option.
- The maximum parallel cost is limited to 4 threads.
* Fixes to configuration and installation scripts.
- Meson and autoconf tools now properly support --prefix option for temporary directory installation.
- Multiple fixes and cleanups to config.h for compatibility between Meson and autoconf.
- Fix the luks2-external-tokens-path Meson option to work the same as in autoconf.
- Fix Meson install for tool binaries, install fvault2Open man page and include test/fuzz/meson.build in release.
* Major update to manual pages.
- Try to explain the PBKDF hardcoded limits.
- Add a better explanation for automatic integrity tag recalculation.
- Mention crypt/verity/integritytab.
- Remove or reformulate some misleading warnings present only with old and no longer supported kernels.
- Clarify that some commands do not wipe data and unify OPAL reset wording.
- Clarify the --label option.
- There are also many other grammar and stylistic fixes to unify the man-page style.
* Fixes for false-positive and annoying (optional) warnings added in recent compilers.
- Update to 2.8.0:
* Full release notes in:
- https://cdn.kernel.org/pub/linux/utils/cryptsetup/v2.8/v2.8.0-ReleaseNotes
* Introduce support for inline mode (use HW sectors with additional hardware
metadata space).
* Finalize use of keyslot context API.
* Make all keyslot context types fully self-contained.
* Add --key-description and --new-key-description cryptsetup options.
* Support more precise keyslot selection in reencryption initialization.
* Allow reencryption to resume using token and volume keys.
* Cryptsetup repair command now tries to check LUKS keyslot areas for corruption.
* Opal2 SED: PSID keyfile is now expected to be 32 alphanumeric characters.
* Opal2: Avoid the Erase method and use Secure Erase for locking range.
* Opal2: Fix some error description (in debug only).
* Opal2: Do not allow deferred deactivation.
* Allow --reduce-device-size and --device-size combination for reencryption
(encrypt) action.
* Fix the userspace storage backend to support kernel 'capi:' cipher specification format.
* Disallow conversion from LUKS2 to LUKS1 if kernel 'capi:' cipher specification is used.
* Explicitly disallow kernel 'capi:' cipher specification format for LUKS2
keyslot encryption.
* Do not allow conversion of LUKS2 to LUKS1 if an unbound keyslot is present.
* cryptsetup: Adjust the XTS key size for kernel 'capi:' cipher specification.
* Remove keyslot warning about possible failure due to low memory.
* Do not limit Argon2 KDF memory cost on systems with more than 4GB of available memory.
* Properly report out of memory error for cryptographic backends implementing Argon2.
* Avoid KDF2 memory cost overflow on 32-bit platforms.
* Do not use page size as a fallback for device block size.
* veritysetup: Check hash device size in advance.
* Print a better error message for unsupported LUKS2 AEAD device resize.
* Optimize LUKS2 metadata writes.
* veritysetup: support --error-as-corruption option.
* Report all sizes in status and dump command output in the correct units.
* Add --integrity-key-size option to cryptsetup.
* Support trusted and encrypted keyrings for plain devices.
* Support plain format resize with a keyring key.
* TCRYPT: Clear mapping of system-encrypted partitions.
* TCRYPT: Print all information from the decrypted metadata header in
the tcryptDump command.
* Always lock the volume key structure in memory.
* Do not run direct-io read check on block devices.
* Fix a possible segfault in deferred deactivation.
* Exclude cipher allocation time from the cryptsetup benchmark.
* Add Mbed-TLS optional crypto backend.
* Fix the wrong preprocessor use of #ifdef for config.h processed by Meson.
* Reorganize license files. The license text files are now in docs/licenses.
The COPYING file in the root directory is the default license.
* Remove cc-by-sa-4.0.txt as already shipped now in docs/licenses
and named as COPYING.CC-BY-SA-4.0.
* Libcryptsetup API extensions. The libcryptsetup API is backward compatible
with all existing symbols. Due to the self-contained memory allocation,
these symbols have the new version:
- crypt_keyslot_context_init_by_passphrase;
- crypt_keyslot_context_init_by_keyfile;
- crypt_keyslot_context_init_by_token;
- crypt_keyslot_context_init_by_volume_key;
- crypt_keyslot_context_init_by_signed_key;
- crypt_keyslot_context_init_by_keyring;
- crypt_keyslot_context_init_by_vk_in_keyring;
* New symbols:
- crypt_format_inline
- crypt_get_old_volume_key_size
- crypt_reencrypt_init_by_keyslot_context
- crypt_safe_memcpy
* New defines:
- CRYPT_ACTIVATE_HIGH_PRIORITY
- CRYPT_ACTIVATE_ERROR_AS_CORRUPTION
- CRYPT_ACTIVATE_INLINE_MODE
- CRYPT_REENCRYPT_CREATE_NEW_DIGEST
* New requirement flag:
- CRYPT_REQUIREMENT_INLINE_HW_TAGS
- Add a dependency on device-mapper to libcryptsetup12 to install
the required device-mapper udev rules. [bsc#1241612]
Changes in s390-tools:
- Applied a patch to remove phmac_s390 kernel module load from dracut
- Applied tools-combined modified patch (bsc#1262221)
- Amended SUSE's 'pkey.conf'
- Re-vendor-ed vendor.tar.zst
- Applied patches (bsc#1261824, bsc#1261772)
* Replace sort_field option with sort
* hyptop opts Fix long command line option abbreviations
- Refactored the spec file for transactional and immutable OS
* Modernized the .spec file for transactional and immutable OS environments.
* Removed legacy suse_version and sle_version conditionals, standardizing on UsrMerge paths.
* Replaced manual %pre group creations with systemd-sysusers configuration for ts-shell, zkeyadm, and cpacfstats.
* Replaced hardcoded /var/log directory management with systemd-tmpfiles configuration.
* Removed obsolete systemctl daemon-reload calls and consolidate standard %service_* systemd macros.
* Dropped brittle dynamic file list generation (find/grep) in favor of explicit and deterministic %files declarations.
* Resolved 'File listed twice' conflicts between the main package and chreipl-fcp-mpath subpackage.
* Added missing BuildRequires for systemd-rpm-macros and sysuser-tools.
* Fixed unpackaged files errors for mdevctl callouts, shell completions, and root /lib helpers.
* Changed BuildArch to noarch for the chreipl-fcp-mpath subpackage.
- Added files (renamed from *.opensuse)
* 59-graf.rules
* dasd_configure
* dasd_reload
* detach_disks.sh
* iucv_configure
* killcdl
* mkdump.pl
* README.SUSE
* virtsetup.sh
* vmlogrdr.service
- Removed obolete files
* 59-graf.rules.opensuse
* 59-graf.rules.suse
* dasd_configure.opensuse
* dasd_configure.suse
* dasd_reload.opensuse
* dasd_reload.suse
* detach_disks.sh.opensuse
* detach_disks.sh.suse
* iucv_configure.opensuse
* iucv_configure.suse
* killcdl.opensuse
* killcdl.suse
* mkdump.pl.opensuse
* mkdump.pl.suse
* README.SUSE.opensuse
* README.SUSE.suse
* virtsetup.sh.opensuse
* virtsetup.sh.suse
* vmlogrdr.service.opensuse
* vmlogrdr.service.suse
- Upgrade s390-tools to version 2.41.0 (jsc#PED-14586, jsc#PED-15488)
- Changes of existing tools:
* chreipl: Make --bootparms work for ECKD re-IPL
* cpacfstats: Add 'unauthorized' state to CPU-MF counters
* cpictl: Detect RHCOS using VARIANT_ID
* hsci: Automatically set appropriate MTU for HSCI
* libutil: Add util_readlink() and util_readlinkat() helpers
* libutil: Add util_startswith() to util_str
* libutil: Add utility parsing functions
* lschp: Add support for structured output (--format)
* lsreipl: Suppress 'clear' output if not supported
* pvimg: Add '--format text' support to 'pvimg info'
* pvimg: Add '--print-schema ' option to 'pvimg info'
* pvimg: Add '--show-secrets' flag to 'pvimg info'
* pvimg: Provide improved JSON output to 'pvimg info --format json'
* pvinfo: Improve User experience on non-SE enabled systems
* zipl/ngdump: Ensure ext4 file system is used on dump partition
* zkey: Add support for integrity protected disks using HMAC keys
- Bug Fixes:
* cpumf/pai: Handle different size of perf_event_attr
* lscss: Fix memory leak
* zipl: Fix dump job on tape devices
- Amended the .spec file (bsc#1258506)
* 'Installing' all shipped rules from etc/udev/rules.d to /usr/lib/udev/rules.d
* BuildRequires: cryptsetup-devel >= 2.8.2
- Updated the code for IBM z17 machine type 9176:
* read_values.c
* cputype
* Renamed cputype.1 to cputype.8 and amended
* Amended read_values.8
- 'Improved' the read_values.c:
* Added functionalities for '-a' and '-L attributes'
- Reworked and combined all s390-tools patches (jsc#PED-14586)
- Applied new combined patches
- Removed obsolete patches
-----------------------------------------------------------------
Advisory ID: 708
Released: Wed May 6 12:44:56 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1261639
This update for libselinux fixes the following issues:
- Backport commit 'libselinux: retain LIFO order for path substitutions' (bsc#1261639)
* otherwise we can not add equivalencies that overload each other in the policy
* libselinux: retain LIFO order for path substitutions
-----------------------------------------------------------------
Advisory ID: 741
Released: Wed May 13 11:32:25 2026
Summary: Recommended update for systemd-presets-branding-SLE
Type: recommended
Severity: important
References: 1261822,1262134
This update for systemd-presets-branding-SLE fixes the following issues:
- change %pretrans script from shell to lua, as we cannot guarantee a shell on %pretrans at all (bsc#1261822)
- fix escaping for migration_flag (bsc#1262134)
- unify the presets between traditional and immutable modes (with some exceptions) (jsc#PED-16082)
-----------------------------------------------------------------
Advisory ID: 749
Released: Thu May 14 18:43:27 2026
Summary: Security update for rsync
Type: security
Severity: important
References: 1254441,1262223,CVE-2025-10158,CVE-2026-41035
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
-----------------------------------------------------------------
Advisory ID: 761
Released: Mon May 18 07:38:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1261206,1262464,1262465,CVE-2026-4046,CVE-2026-5450,CVE-2026-5928
This update for glibc fixes the following issues
- CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
- CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
- CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).
-----------------------------------------------------------------
Advisory ID: 803
Released: Tue May 26 14:14:16 2026
Summary: Security update for xz
Type: security
Severity: important
References: 1261280,CVE-2026-34743
This update for xz fixes the following issue
- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
-----------------------------------------------------------------
Advisory ID: 808
Released: Wed May 27 18:43:58 2026
Summary: Recommended update for dbus-broker
Type: recommended
Severity: moderate
References: 1255678
This update for dbus-broker fixes the following issues:
- Fix timeout on ssh due to not handling ESRCH (bsc#1255678)
-----------------------------------------------------------------
Advisory ID: 824
Released: Fri May 29 11:59:18 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1258311,1259825,1262315
This update for crypto-policies fixes the following issues:
Changes in crypto-policies:
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy again. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
-----------------------------------------------------------------
Advisory ID: 861
Released: Tue Jun 2 09:22:47 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References:
This update for aaa_base fixes the following issues:
- Update to version 84.87+git20260529.c4391e5:
* $status to $?
* Simplifying the sh part too
* Addressing review comments and simplifying a bit
* Handle javas managed by libalternatives and by update-alternatives alike
-----------------------------------------------------------------
Advisory ID: 860
Released: Tue Jun 2 09:28:48 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1249964,1257527,1262711,1266328
This update for selinux-policy fixes the following issues:
- Update to version 20250627+git378.e27ad25be:
* Allow systemd-tmpfiles to adjust resource limits (bsc#1266328)
- Update to version 20250627+git376.3e51f6aea:
* Vibecode Gitlab CI smoke test for Leap 16.0+
* Add diffutils explicitly to .gitlab-ci
* Fix gitlab CI
* Allow virtqemud_t to call and transition into udev
* Dontaudit ps to read proc (bsc#1257527)
* Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
* TLP uses ps aux to check for different services (bsc#1257527)
- Update to version 20250627+git368.7e5f975a1:
* Add boolean ntp_refclock_access (bsc#1262711)
* Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
* Allow cloud init to domtrans into ssh keygen (bsc#1249964)
-----------------------------------------------------------------
Advisory ID: 867
Released: Tue Jun 2 11:13:41 2026
Summary: Security update for rsync
Type: security
Severity: important
References: 1254441,1262223,1264511,1264512,1264513,1264514,1264515,1265296,CVE-2025-10158,CVE-2026-29518,CVE-2026-41035,CVE-2026-43617,CVE-2026-43618,CVE-2026-43619,CVE-2026-43620,CVE-2026-45232
This update for rsync fixes the following issues
- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).
- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).
- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).
- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).
- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).
- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).
- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).
- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).
-----------------------------------------------------------------
Advisory ID: 885
Released: Wed Jun 3 11:47:33 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References:
This update for aaa_base fixes the following issues:
- Fix a typo and follow symlinks in alljava
-----------------------------------------------------------------
Advisory ID: 921
Released: Thu Jun 11 17:29:49 2026
Summary: Recommended update for policycoreutils
Type: recommended
Severity: moderate
References: 1236193,1242096,1266226
This update for policycoreutils fixes the following issues:
- Reintroduce sandbox package and a couple quality of life improvements (bsc#1266226)
- Remove misleading comment from spec file about reuqires for policycoreutils-devel
- Improve policycoreutils-devel package dependencies (bsc#1236193).
- Change Recommends for policycoreutils-devel to the gui package to Requires.
This causees some system bloat for people that only want to use
the config GUI, but prevents errors when building policy packages
- Properly exclude gui.py file (bsc#1242096)
- Added Recommends for policycoreutils-devel to the gui package
- Move gui.py file to gui sub-package to prevent policycoreutil python
packages from having excessive requirements
-----------------------------------------------------------------
Advisory ID: 925
Released: Fri Jun 12 14:46:46 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1267423
This update for aaa_base fixes the following issues:
- Add missing '=' in alljava.csh (bsc#1267423)
-----------------------------------------------------------------
Advisory ID: 955
Released: Thu Jun 18 23:01:36 2026
Summary: Security update for sqlite3
Type: security
Severity: important
References: 1268012,1268013,CVE-2026-11822,CVE-2026-11824
This update for sqlite3 fixes the following issues
Update to 3.53.2:
- CVE-2026-11822: memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause
process crashes, memory exhaustion, or arbitrary code execution (bsc#1268012).
- CVE-2026-11824: heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers
to cause a crash or execute arbitrary code (bsc#1268013).
Changes:
* Add the Query Result Formatter (QRF) library for formatting the
results of SQL queries for human readability on a fixed-pitch
font screen.
* Enhance ALTER TABLE to permit adding and removing NOT NULL and
CHECK constraints.
* The REINDEX EXPRESSIONS statement rebuilds expression indexes.
* The body of TEMP triggers may now modify and/or query tables
in the main schema.
* Enhance VACUUM INTO so that if a URI filename is used as the
target and that filename has a reserve=N query parameter with
N between 0 and 255, then the reserve amount for the generated
database copy is set to N.
* New SQL functions json_array_insert() and jsonb_array_insert().
* Renovations to the CLI.
* New C-language interfaces: sqlite3_str_truncate(),
sqlite3_str_free(), sqlite3_carray_bind_v2().
* Add the SQLITE_PREPARE_FROM_DDL option to sqlite3_prepare_v3().
* Added the SQLITE_UTF8_ZT constant which can be used as the
encoding parameter to sqlite3_result_text64() or
sqlite3_bind_text64() to indicate that the value is UTF-8
encoded and zero terminated.
* The SQLITE_LIMIT_PARSER_DEPTH option is added to
sqlite3_limit().
* The SQLITE_DBCONFIG_FP_DIGITS option is added to
sqlite3_db_config().
* Query planner improvements.
* Add new interfaces to the session extension that enable an
application to add changes one at a time to the
sqlite3_changegroup object.
* Improvements to floating-point <-> text conversions.
* Added the self-healing index feature to deal with the stale
expression index problem.
* Add the '-p|--port' option to sqlite3_rsync.
* Add the 'opfs-wl' VFS, functionally identical to the 'opfs' VFS
but using Web Locks for locking, which can promise fairer lock
sharing than the 'opfs' bespoke protocol can. 'opfs-wl'
requires Atomics.waitAsync(), so requires newer browsers than
'opfs' does.
* Fixes for problems in 3.53.0 and 3.53.1 reported by users.
* See the check-in timeline for details:
https://sqlite.org/src/timeline?from=version-3.53.0&to=version-3.53.2
* https://sqlite.org/releaselog/3_53_0.html
-----------------------------------------------------------------
Advisory ID: 959
Released: Fri Jun 19 07:10:33 2026
Summary: Recommended update for libsemanage
Type: recommended
Severity: important
References: 1266385
This update for libsemanage fixes the following issues:
- Depend on libso before make pywrap is executed to avoid race conditions (bsc#1266385)
- Add CFLAGS to %make_install call for consistency with %make_build
-----------------------------------------------------------------
Advisory ID: 964
Released: Fri Jun 19 16:14:03 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions from time_t to/from uint32_t.
Filter out -Wtime_t-conversion from flags to build D target library files.
- SUSE-local -Wtime_t-conversion patch added. [jsc#PED-15601]
- Fix for bogus expression simplification [bsc#1257463]
- Enable the use of _dl_find_object even when not available at build time.
[bsc#1253043]
- Fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Fixes PR110812, Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: 1004
Released: Sat Jun 20 20:11:34 2026
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1259924,CVE-2025-69720
This update for ncurses fixes the following issue:
- CVE-2025-69720: buffer overflow in function `analyze_string()`of `progs/infocmp.c` (bsc#1259924).
-----------------------------------------------------------------
Advisory ID: 1000
Released: Sat Jun 20 20:12:39 2026
Summary: Recommended update for netcfg
Type: recommended
Severity: moderate
References:
This update for netcfg fixes the following issues:
- Clarify /etc/services removal message
-----------------------------------------------------------------
Advisory ID: 996
Released: Sat Jun 20 20:17:58 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1232226
This update for libselinux fixes the following issues:
- Backport patch for restorecon to log error on readonly fs (bsc#1232226)
-----------------------------------------------------------------
Advisory ID: 1008
Released: Sun Jun 21 04:17:53 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1243148,1265386
This update for selinux-policy fixes the following issues:
- Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
- Add fs_dontaudit_relabelfrom_tmpfs_files() interface
- Add sysnet_mount_file() interface
- Add sysnet_dontaudit_file_relabelto() interface
- Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
-----------------------------------------------------------------
Advisory ID: 1017
Released: Mon Jun 22 14:26:17 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1266340,1266341,1266342,1266344,1266345,1266347,1266349,1266350,1266351,1266352,1266353,1266355,1266356,1266357,CVE-2026-2673,CVE-2026-34180,CVE-2026-34182,CVE-2026-34183,CVE-2026-42764,CVE-2026-42766,CVE-2026-42767,CVE-2026-42768,CVE-2026-42769,CVE-2026-42770,CVE-2026-45445,CVE-2026-45446,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076
This update for openssl-3 fixes the following issues
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
-----------------------------------------------------------------
Advisory ID: 1036
Released: Mon Jun 22 16:30:37 2026
Summary: Security update for sed
Type: security
Severity: moderate
References: 1262144,CVE-2026-5958
This update for sed fixes the following issue
- CVE-2026-5958: a TOCTOU race can allow to read attacker-controlled content and write it to an unintended file
(bsc#1262144).
-----------------------------------------------------------------
Advisory ID: 1040
Released: Mon Jun 22 16:34:40 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1261606,CVE-2026-27456
This update for util-linux fixes the following issue
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
-----------------------------------------------------------------
Advisory ID: 1047
Released: Mon Jun 22 17:08:34 2026
Summary: Recommended update for suse-module-tools
Type: recommended
Severity: moderate
References: 1257055
This update for suse-module-tools fixes the following issues:
- Update to version 16.0.65:
* Remove erofs from the list of blacklisted file systems (jsc#PED-14573)
* weak-modules2: don't remove symlinks in the rpm --reinstall case (bsc#1257055)
-----------------------------------------------------------------
Advisory ID: 1060
Released: Wed Jun 24 23:36:29 2026
Summary: Security update for libgcrypt
Type: security
Severity: low
References: 1262693,CVE-2026-41990
This update for libgcrypt fixes the following issue
- CVE-2026-41990: lack of bound check can lead to mishandling of Dilithium signing (bsc#1262693).
-----------------------------------------------------------------
Advisory ID: 1064
Released: Wed Jun 24 23:38:49 2026
Summary: Recommended update for pam
Type: recommended
Severity: moderate
References: 1245524
This update for pam fixes the following issues:
- pam_mkhomedir: building with vendordir option allows fetching skeleton directory
from the vendor directory when creating the user home directory (bsc#1245524)
- disable unix_chkpwd by default, only used as fallback again
- pam_modutil_get*: overwrite password at free
-----------------------------------------------------------------
Advisory ID: 1085
Released: Fri Jun 26 10:11:56 2026
Summary: Recommended update for rsync
Type: recommended
Severity: moderate
References:
This update for rsync fixes the following issue:
- Remove unused patch from package
-----------------------------------------------------------------
Advisory ID: 1103
Released: Mon Jun 29 10:05:18 2026
Summary: Recommended update for fuse3
Type: recommended
Severity: moderate
References: 1256466
This update for fuse3 fixes the following issues:
- Add dependency from libfuse3-4 to fusermount3 program (bsc#1256466)
-----------------------------------------------------------------
Advisory ID: 1126
Released: Wed Jul 1 14:14:45 2026
Summary: Recommended update for patterns-base
Type: recommended
Severity: moderate
References: 1263084
This update for patterns-base fixes the following issues:
- make kernel_livepatching pattern visible (bsc#1263084)
- add fwupd to enhanced base pattern (jsc#PED-15697)
-----------------------------------------------------------------
Advisory ID: 1151
Released: Fri Jul 3 10:55:00 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1245551,1248261,1251948,1254924,1259071,1260357,1261982,1261983,1262305,1263117,1267644,1267647
This update for systemd fixes the following issues:
Changes in systemd:
- Better handle TLS allocation failure (bsc#1254924).
- Disable mounting `debugfs` by default (jsc#PED-8812).
- Import commit 9e8b5afe0fb2061f4a17a3022469dd62f2683960 (bsc#1267647 bsc#1267644 bsc#1262305 bsc#1263117).
- Move `systemd-pcrlock` out from the experimental sub-package to `udev` (bsc#1248261 jsc#PED-15946).
- Add a weak runtime dependency on `libtss2-tcti-device0` (bsc#1260357).
- Import commit 59336000ef7850eba0963c6a690ff3371c425929 (bsc#1261982 bsc#1261983).
- Add a weak runtime dependency on `polkit` (bsc#1259071).
- systemd-update-helper: fix the clean-state command only removing `$STATE_DIR/system` instead of `$STATE_DIR/`.
- systemd-update-helper: add `--root` option for testing convenience.
- systemd-update-helper: fix incorrect skipping of `systemctl disable` during package removal (bsc#1245551).
- systemd-update-helper: fix `do_install_units()` incorrectly returning 1 when no units need preset.
- systemd.spec: introduce `%bcond_without` docs to allow skipping man pages and `devel-doc`.
- systemd.spec: drop the `%{release}` number from the SBAT version (bsc#1251948).
-----------------------------------------------------------------
Advisory ID: 1157
Released: Fri Jul 3 15:19:16 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: 1191
Released: Thu Jul 9 14:39:23 2026
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1270439
This update for systemd fixes the following issues:
Changes in systemd:
- do not make mounting of debugfs optional yet.
-----------------------------------------------------------------
Advisory ID: 1220
Released: Mon Jul 13 09:51:58 2026
Summary: Security update for libxml2
Type: security
Severity: important
References: 1262719,1269790,CVE-2026-11979,CVE-2026-6732
This update for libxml2 fixes the following issues
- CVE-2026-6732: crafted XSD-validated document can cause a denial of service (bsc#1262719).
- CVE-2026-11979: stack-based buffer overflows in the `xmlcatalog` utility when running in `--shell` mode (bsc#1269790).
-----------------------------------------------------------------
Advisory ID: 1224
Released: Mon Jul 13 15:54:55 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: 1229
Released: Mon Jul 13 18:23:19 2026
Summary: Security update for cryptsetup
Type: security
Severity: moderate
References: 1270252,1270254
This update for cryptsetup fixes the following issues:
Changes in cryptsetup:
- Fix for (bsc#1270254) to avoid undesired pinning of all volume
keys (via the thread keyring) through the caller's credentials
when the kernel opens a file. This is due to the refactoring in
kernel commit a28d893eb327 ('md: port block device access to file')
that accidentally causes the caller's thread keyring to be kept
alive long beyond the caller's lifetime, the kernel part is tracked
in (bsc#1270252).
* Add keyring key type. [b6fb6fc0]
* Load volume keys in intermediary keyring linked in thread
keyring. [413a3dd0]
* Use unique intermediary keyring name per device. [04ef07a7]
* Add regression tests. [bfcb0c38, bb5e8e9f, e6573494, aa214c09]
-----------------------------------------------------------------
Advisory ID: 1241
Released: Tue Jul 14 12:09:24 2026
Summary: Recommended update for policycoreutils
Type: recommended
Severity: moderate
References: 1270534
This update for policycoreutils fixes the following issues:
Changes in policycoreutils:
- Remove sandbox package as it will be provided as a separate package:
selinux-sandbox (bsc#1270534)
-----------------------------------------------------------------
Advisory ID: 1276
Released: Thu Jul 16 20:48:33 2026
Summary: Security update for freetype2
Type: security
Severity: moderate
References: 1252148,1259118,1271045,CVE-2026-23865,CVE-2026-50811
This update for freetype2 fixes the following issues
- Update to version 2.14.3
- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).
- CVE-2026-50811: out-of-bounds read vulnerabilityin src/truetype/ttgxvar.c in the TT_Get_Var_Design implementation used by FT_Get_Var_Design_Coordinates (bsc#1271045).
-----------------------------------------------------------------
Advisory ID: 1280
Released: Sat Jul 18 10:12:44 2026
Summary: Security update for gzip
Type: security
Severity: important
References: 1269622,CVE-2026-41991
This update for gzip fixes the following issue
- CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the
user's PATH (bsc#1269622).
-----------------------------------------------------------------
Advisory ID: 1294
Released: Mon Jul 20 11:26:51 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).
-----------------------------------------------------------------
Advisory ID: 1303
Released: Mon Jul 20 15:44:04 2026
Summary: Security update for gawk
Type: security
Severity: moderate
References: 1271351,1271352,1271354,CVE-2026-40467,CVE-2026-40468,CVE-2026-40553
This update for gawk fixes the following issues:
- CVE-2026-40467: use-after-free vulnerability within the do_getline_redir() routine could lead to a program crash
(bsc#1271351).
- CVE-2026-40468: use-after-free vulnerability in gawk's 'io.c' file could permit heap metadata manipulation and host
memory exhaustion (bsc#1271352).
- CVE-2026-40553: buffer overflow in the ftype() routine of the readdir extension could trigger a program crash
(bsc#1271354).
-----------------------------------------------------------------
Advisory ID: 1321
Released: Wed Jul 22 10:44:23 2026
Summary: Security update for perl
Type: security
Severity: important
References: 1266304,1266361,1268349,1271372,1271386,CVE-2025-15649,CVE-2026-12087,CVE-2026-13221,CVE-2026-57432,CVE-2026-8376
This update for perl fixes the following issues:
- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date
(bsc#1266361).
- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
(bsc#1266304).
- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure
(bsc#1268349).
- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`
(bsc#1271372).
- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching
(bsc#1271386).
-----------------------------------------------------------------
Advisory ID: 1348
Released: Sat Jul 25 18:36:55 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1271712
This update for openssl-3 fixes the following issue:
- 'HollowByte' DoS via attacker-controlled memory allocation (bsc#1271712).
-----------------------------------------------------------------
Advisory ID: 1350
Released: Mon Jul 27 11:30:50 2026
Summary: Recommended update for policycoreutils
Type: recommended
Severity: moderate
References: 1271645
This update for policycoreutils fixes the following issues:
Changes in policycoreutils:
- Drop /tmp cleanup to avoid TOCTOU issues (bsc#1271645)
- can be dropped once 'policycoreutils/scripts/fixfiles: drop /tmp cleanup' is
in the upstream release
-----------------------------------------------------------------
Advisory ID: 1390
Released: Wed Jul 29 17:46:03 2026
Summary: Security update for libpng16
Type: security
Severity: important
References:
This update for libpng16 fixes the following issues:
Changes in libpng16:
Version update to 1.6.58 [jsc#PED-16190]
* see CHANGES for other upstream changes
-----------------------------------------------------------------
Advisory ID: 1451
Released: Tue Aug 11 12:14:12 2026
Summary: Recommended update for grub2
Type: recommended
Severity: important
References: 1259132,1271980
This update for grub2 fixes the following issues:
- Fix crash in booting kernel on some AMD systems (bsc#1271980)
- Add python-base BR
- Fix broken bash completion on arm64 images when the bash-completion package
is not installed (bsc#1259132)
-----------------------------------------------------------------
Advisory ID: 1519
Released: Wed Aug 26 14:30:55 2026
Summary: Security update for rsync
Type: security
Severity: important
References: 1269039,1269040,1269041,1269042,1269043,1269044,1269045,1269046,1269047,1269048,1269049,1269050,1269051,1269052,1269053,1269054,1269055,1269056,1269057,1269058,1269060,1271931,1271932,1271933,1271934,1273429,1273430,1273431,1273432,1273433,1273434,1273435,1273436,1273437,1273438,1273439,1273440,1273441,CVE-2026-43617,CVE-2026-43618,CVE-2026-43619,CVE-2026-43620,CVE-2026-44507,CVE-2026-44508,CVE-2026-44509,CVE-2026-44510,CVE-2026-53783,CVE-2026-53784,CVE-2026-53785,CVE-2026-53786,CVE-2026-53788,CVE-2026-53789,CVE-2026-53790,CVE-2026-53791,CVE-2026-53792,CVE-2026-53793,CVE-2026-53794,CVE-2026-53795,CVE-2026-53796,CVE-2026-53797,CVE-2026-53798,CVE-2026-53799,CVE-2026-53800,CVE-2026-53801,CVE-2026-53802,CVE-2026-53803,CVE-2026-70452,CVE-2026-70453,CVE-2026-70454,CVE-2026-70455,CVE-2026-70456,CVE-2026-70457,CVE-2026-70458,CVE-2026-70459,CVE-2026-70460,CVE-2026-70461,CVE-2026-70462,CVE-2026-70463,CVE-2026-70464
This update for rsync fixes the following issues:
- CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) (bsc#1269041).
- CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
- CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
- CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
- CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol (bsc#1269046).
- CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent (bsc#1269047).
- CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
- CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address (bsc#1269049).
- CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative (bsc#1269050).
- CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
- CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
- CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement
(bsc#1269053).
- CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
- CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure (bsc#1269055).
- CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
- CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (bsc#1269056).
- CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion
outside the source tree (bsc#1269057).
- CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure
(bsc#1269058).
- CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files (bsc#1269039).
- CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths
(bsc#1269040).
- CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant
to block (bsc#1273441).
- CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain (bsc#1273440).
- CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
- CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
- CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs
(bsc#1273437).
- CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
- CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
- CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-directory
transfer root (bsc#1273434).
- CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-
module symlink (bsc#1273433).
- CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
- CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
- CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only rule
(bsc#1273430).
- CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module (bsc#1273429).
-----------------------------------------------------------------
Advisory ID: 1529
Released: Thu Aug 27 14:47:41 2026
Summary: Security update for gzip
Type: security
Severity: moderate
References: 1269623,1272554,CVE-2026-41992
This update for gzip fixes the following issues:
- CVE-2026-41992: global buffer overflow in the LZH decompression logic due to improper reuse of shared global state
between different decompression formats within a single execution (bsc#1269623, bsc#1272554).
-----------------------------------------------------------------
Advisory ID: 1562
Released: Mon Aug 31 07:56:37 2026
Summary: Security update for libgpg-error
Type: security
Severity: moderate
References: 1263078
This update for libgpg-error fixes the following issue:
- Out-of-bounds read in `_gpgrt_vfnameconcat` of `stringutils.c` when the `GPGRT_FCONCAT_SYSCONF` flag is used
(bsc#1263078).
-----------------------------------------------------------------
Advisory ID: 1573
Released: Mon Aug 31 22:36:28 2026
Summary: Recommended update for gcc16
Type: recommended
Severity: moderate
References: 1272616
This update for gcc16 fixes the following issues:
gcc16 is shipped as new package.
This update ships the GNU Compiler Collection GCC 16.2.
The compiler runtime libraries are provided for SUSE Linux Enterprise 16.0
versions and replace the same named GCC 14 ones.
The new compilers are provided in the PackageHub 16.0 only.
To use gcc16 compilers use:
- install 'gcc16' or 'gcc16-c++' or one of the other 'gcc16-COMPILER' frontend packages.
- override your Makefile to use CC=gcc16, CXX=g++16 and similar overrides for the other languages.
For a full changelog with all new GCC16 features, check out
https://gcc.gnu.org/gcc-16/changes.html
- Update to GCC 16.2 release (gcc-16.2.0+git9497)
* accumulated bugfixes from the gcc-16 release branch
- Disable multilibs for cross-x86_64-gcc
-----------------------------------------------------------------
Advisory ID: 1592
Released: Wed Sep 2 17:55:21 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: 1602
Released: Thu Sep 3 22:41:28 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1237515,1254924,1259418,1259650,1261400,1271444,CVE-2026-16742,CVE-2026-29111,CVE-2026-40226,CVE-2026-4105
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742: `systemd-homed`: local privilege escalation due to missing home record signature verification on
the authentication path (bsc#1271444).
Non security issue fixed:
- `systemd-resolved` fails to start due to write access to `tmpfs` denied (bsc#1237515).
-----------------------------------------------------------------
Advisory ID: 1608
Released: Fri Sep 4 14:36:16 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1265400,1273901,1274861
This update for selinux-policy fixes the following issues:
- Update to version 20250627+git392.40ceb80be:
* Label the postgresql executables correctly (bsc#1274861)
- Update to version 20250627+git390.01f688865:
* (open)SUSE only sendmail fixes (bsc#1273901)
- Update to version 20250627+git388.83e19dbcd:
* Support vfs_snapper to work with samba_share_t (bsc#1265400)
* vfs_samba uses dbus to communicate with snapper (bsc#1265400)
-----------------------------------------------------------------
Advisory ID: 1610
Released: Fri Sep 4 15:48:44 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: 1650
Released: Wed Sep 9 16:07:45 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1275219,1275492
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
- Fix: SELinux denials during bees service startup / stop (bsc#1275219):
* named filetrans for netconfig
* Fix regression that was introduced with fix_unconfined patch
- Fix: [SELinux] kanidm_ssh_authorizedkeys unable to access user's ssh key,
denying ssh access (bsc#1275492):
* sshd_session_t needs to access kanidm sshkeys
* Fix broken kanidm_sshkeys_t security context
-----------------------------------------------------------------
Advisory ID: 1661
Released: Fri Sep 11 13:45:57 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
-----------------------------------------------------------------
Advisory ID: 1688
Released: Wed Sep 16 16:28:22 2026
Summary: Security update for rpm
Type: security
Severity: important
References: 1218459,1253139,1259215,1268747,1269150,1269571,1269584,CVE-2026-44604,CVE-2026-44605
This update for rpm fixes the following issues:
Changes in rpm:
- split imaevmsign plugin into a multibuild flavor
Changes in rpm:
- Add Requires: (rpm-plugin-selinux if selinux-policy)
- harden ndb code [bsc#1269584] [CVE-2026-44605]
- split all plugins into subpackages
* this allows for an easy way to get rid of a plugin, it's also
what other distributions do
- make the imaevmsign plugin build in a multibuild flavor
- rpm2archive: use size 0 for hardlinked files as bnew versions of
gnu tar reject non-zero sizes [bsc#1269150]
- backport fix for add_sysuser macro [bsc#1269571]
- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]
- switch from rpmpgp_legacy to libpgpr
* multiple bug fixes, support for v5 and v6 signatures
- turn on imaevm file signature support and move the imaevm code
that needs the libimaevm library into a plugin. Put this
plugin into a new 'rpm-imaevmsign' subpackage. [jsc#PED-7246]
- Fix 'unexpected EOF' when using rpmbuild to install ELF binaries
due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)
- Remove /var/lib/rpm migration scripting, retain an error if old
location is found
- Use systemd-tmpfiles to create & maintain /var/lib/rpm symlink
(boo#1253139)
- flush scriptlet notification messages in --runposttrans
* needed to fix leaking tmp files [bsc#1218459]
* added 'rpm_flushes_runposttrans' provides for libzypp
-----------------------------------------------------------------
Advisory ID: 1707
Released: Fri Sep 18 18:31:02 2026
Summary: Recommended update for gcc15, gcc16
Type: recommended
Severity: critical
References: 1277919
This update for gcc15, gcc16 fixes the following issues:
Changes in gcc15:
- Rebuild to rename library packages after the switch to gcc16
libraries.
Changes in gcc16:
- Fix build reproducability when PCH is used.
- Fix auto-detection of Zen6 [bsc#1277919]
- Remove support for s390 (32bit), make sure to configure s390x with
--disable-multilib to avoid configury error without explicit
disable of multilibs. Support for s390 is officially deprecated.
-----------------------------------------------------------------
Advisory ID: 1733
Released: Tue Sep 22 09:23:33 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1261606,1268886,1269583,1270219,1275441,1278347,1278348,1278349,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614,CVE-2026-76642,CVE-2026-78408,CVE-2026-78410
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).
- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).
- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec
Bypass in SUID mount(8) (bsc#1268886).
- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege
escalation (bsc#1278349).
- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or
termination of root processes (bsc#1278348).
- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`
redirection (bsc#1278347).
Changes for util-linux:
- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)
- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
- lib/fileutils: fix unused parameter warnings without SYS_openat2
- libmount: add missing fileutils.h include to hook_idmap.c
- libmount: add mnt_open_tree() helper for safe tree opening
- libmount: pin source path with openat2() for restricted users
(bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: restrict source path canonicalization for non-root
users (bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: skip post-mount hooks after failed mount helper
(bsc#1275441, bsc#1278349, CVE-2026-76642)
- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
- nsenter: close cgroup.procs fd after join to prevent authority
leak (bsc#1275441, bsc#1278348, CVE-2026-78408)
- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,
bsc#1278348, CVE-2026-78408)
- wall, write: sanitize hostname in banner header (bsc#1275441)
- Add missing function. (bsc#1275441)
- ipcutils: Prevent using uninitialized variable (bsc#1268886)
- BREAKING CHANGE:
Paths must always be canonicalized for unprivileged users to
ensure safe target resolution. X-mount.nocanonicalize is ignored
for them.
- INCOMAPTIBLE CHANGE (linux < 6.15):
X-mount.subdir: The safe detached subdirectory is no more
supported for unprivileged users for safety reasons.
- liblastlog2: Wait on busy SQLite connections (bsc#1268886).
- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root
(bsc#1268886).
- libblkid: Fix use-after-free in nested partition probing
(bsc#1269583, bsc#1268886, CVE-2026-13595)
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy
mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).
- fileutils: add ul_open_no_symlinks() needed by other patches
(bsc#1268886).
- libmount: add fd_target to context for TOCTOU race condition
prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).
- libmount: ignore X-mount.nocanonicalize for restricted users
- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,
CVE-2026-53612, GHSA-g8wm-75wr-g2vh).
- libmount: restrict X-mount.subdir for non-root (bsc#1268886).
- libmount: use fd_target in hook_idmap for move_mount()
- libmount: add mount ID verification and man page TOCTOU note
- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
(bsc#1268886#c2, bsc#1261606).
- Ignore pam-config error that prevents update failure if common*
pam configuration is not symlink to common-*-pc (bsc#1270219).
-----------------------------------------------------------------
Advisory ID: 1747
Released: Wed Sep 23 21:42:24 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).
-----------------------------------------------------------------
Advisory ID: 1748
Released: Wed Sep 23 21:47:23 2026
Summary: Security update for kbd
Type: security
Severity: important
References: 1275441,CVE-2026-72693
This update for kbd fixes the following issue:
- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows
`passwordless` root login (bsc#1275441).
-----------------------------------------------------------------
Advisory ID: 1754
Released: Thu Sep 24 09:07:13 2026
Summary: Security update for expat
Type: security
Severity: important
References: 1262263,1264713,1267631,1268572,1268573,1275096,1275594,1275732,1275859,1275860,1275915,CVE-2026-41080,CVE-2026-45186,CVE-2026-50219,CVE-2026-56131,CVE-2026-56132,CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,CVE-2026-56411,CVE-2026-56412,CVE-2026-66046,CVE-2026-72522,CVE-2026-76641,CVE-2026-76956,CVE-2026-76957
This update for expat fixes the following issues:
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a
denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,
XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).
- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within
handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer
overflows (bsc#1268573).
- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code
execution (bsc#1275096).
- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory
corruption, and application crashes (bsc#1275096).
- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary
code execution (bsc#1275096).
- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and
application crashes (bsc#1275096).
- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial
of service (bsc#1275096).
- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes
(bsc#1275096).
- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and
arbitrary file write conditions (bsc#1275096).
- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information
disclosure, and potential code execution (bsc#1275096).
- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and
denial of service (bsc#1275096).
- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free
conditions and arbitrary code execution (bsc#1275096).
- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the
storeAtts() function in xmlparse.c (bsc#1275732).
- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger
memory corruption (bsc#1275915).
- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via
crafted X (bsc#1275860).
- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).
Changes for expat:
- Updated to version 2.8.4
-----------------------------------------------------------------
Advisory ID: 1767
Released: Tue Sep 29 10:27:00 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1279051,1282303
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git405.e266baf49:
* Add common criteria banner labels (bsc#1282303)
* Fix corrupted formatting in files.if
* Allow rsync to getattr pipes and sockes if rsync_export_all_ro is set (bsc#1279051)
* Introduce files_getattr_non_auth_sockets
* Introduce files_getattr_non_auth_pipes interface
-----------------------------------------------------------------
Advisory ID: 1769
Released: Tue Sep 29 14:25:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
(bsc#1282509).
Other changes:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: 1790
Released: Wed Sep 30 11:29:23 2026
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1279961
This update for ca-certificates-mozilla fixes the following issues:
Changes in ca-certificates-mozilla:
- Updated to 2.90 state (bsc#1279961):
* Removed:
+ AffirmTrust Commercial
+ AffirmTrust Networking
+ AffirmTrust Premium
+ AffirmTrust Premium ECC
+ certSIGN ROOT CA
+ Entrust Root Certification Authority
+ PKI Root Certification Authority
+ FIRMAPROFESIONAL CA ROOT-A WEB
+ GLOBALTRUST 2020
+ Secure Global CA
+ SecureSign Root CA12
+ SecureTrust CA
+ TeliaSonera Root CA v1
+ Trustwave Global Certification Authority
+ Trustwave Global ECC P256 Certification Authority
+ Trustwave Global ECC P384 Certification Authority
+ XRamp Global Certification Authority
* Added:
+ SECOM SMIME RSA Root CA 2024
+ SECOM TLS ECC Root CA 2024
+ SECOM TLS RSA Root CA 2024
+ SecureSign Root CA16
+ Telia EC Email Root CA v3
+ Telia EC TLS Root CA v3
+ Telia RSA Email Root CA v3
+ Telia RSA TLS Root CA v3
-----------------------------------------------------------------
Advisory ID: 1792
Released: Wed Sep 30 17:02:45 2026
Summary: Recommended update for jitterentropy
Type: recommended
Severity: moderate
References: 1282301
This update for jitterentropy fixes the following issues:
Changes in jitterentropy:
- OSR has to be at least 5 according to current reviews. (bsc#1282301)
-----------------------------------------------------------------
Advisory ID: 1849
Released: Tue Oct 6 15:07:44 2026
Summary: Recommended update for grub2
Type: recommended
Severity: moderate
References: 1278729
This update for grub2 fixes the following issues:
Changes in grub2:
- Add SBAT Provides to support shim SBAT dependency checks (bsc#1278729)
-----------------------------------------------------------------
Advisory ID: 1897
Released: Sat Oct 10 13:21:45 2026
Summary: Security update for libpng16
Type: security
Severity: moderate
References: 1283183,CVE-2026-46675
This update for libpng16 fixes the following issue:
- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression
(bsc#1283183).
Changes for libpng16:
- version update to 1.6.59:
* Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<JasonHonKL at users.noreply.github.com>.)
* Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
* Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
* Applied fixes and updates to the CMake build.
* Adopted the REUSE Specification for licensing the CI files.
-----------------------------------------------------------------
Advisory ID: 1899
Released: Mon Oct 12 10:05:58 2026
Summary: Recommended update for netcfg
Type: recommended
Severity: important
References: 1211886,1243708,1263098,1282745,822653
This update for netcfg fixes the following issues:
Changes in netcfg:
- Don't replace /etc/services on updates (bsc#1282745)
- Add missing changes from factory:
* Add missing %verify(not mode) (bsc#1263098)
* services: remove invalid SIEVE entry (bsc#1243708, bsc#822653)
* Add krb-prop entry (bsc#1211886)
-----------------------------------------------------------------
Advisory ID: 1900
Released: Mon Oct 12 10:48:41 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1257101,1278135,1279565
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
- Update to version 20250627+git412.dbf877ab7:
* Fix typo in screen.fc
* Allow cscreend to start screen as unconfined domain (bsc#1257101)
* Label charon-nm as ipsec_exec_t (bsc#1278135)
- Update to version 20250627+git407.e864ced8f:
* Allow rsync to read var_t (bsc#1279565)
-----------------------------------------------------------------
Advisory ID: 1909
Released: Tue Oct 13 17:13:54 2026
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References:
This update for rpm fixes the following issues:
Changes in rpm:
- Do not dependent on python3-base, it is perfectly OK to use
any Python interpreter for python-rpm-packaging.
- Remove obsolete Python2-based removal of Python directories.
-----------------------------------------------------------------
Advisory ID: 1916
Released: Wed Oct 14 17:16:30 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
-----------------------------------------------------------------
Advisory ID: 1919
Released: Thu Oct 15 14:13:14 2026
Summary: Security update for p11-kit
Type: security
Severity: moderate
References: 1269664,1280702,CVE-2026-13757,CVE-2026-18938
This update for p11-kit fixes the following issues:
- CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
- CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage
on 32 bit systems (bsc#1280702).
The following package changes have been done:
- libpng16-16-1.6.59-160000.1.1 updated
- netcfg-11.6-160000.4.1 updated
- libp11-kit0-0.25.5-160000.3.1 updated
- p11-kit-0.25.5-160000.3.1 updated
- p11-kit-tools-0.25.5-160000.3.1 updated
- rpm-plugin-selinux-4.20.1-160000.4.1 updated
- rpm-4.20.1-160000.4.1 updated
- libopenssl3-3.5.0-160000.11.1 updated
- grub2-common-2.12-160000.8.1 updated
- elemental3-3.0.3.20260908+2033a23-160000.2.4 updated
- selinux-policy-20250627+git412.dbf877ab7-160000.1.1 updated
- selinux-policy-targeted-20250627+git412.dbf877ab7-160000.1.1 updated
More information about the sle-container-updates
mailing list