SUSE-CU-2026:12393-1: Security update of elemental/elemental-lifecycle-manager
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Sat Oct 17 07:31:16 UTC 2026
SUSE Container Update Advisory: elemental/elemental-lifecycle-manager
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12393-1
Container Tags : elemental/elemental-lifecycle-manager:0 , elemental/elemental-lifecycle-manager:0.1.1 , elemental/elemental-lifecycle-manager:0.1.1-5.7 , elemental/elemental-lifecycle-manager:latest
Container Release : 5.7
Severity : critical
Type : security
References : 1205770 1211886 1216378 1218459 1222465 1228081 1228659 1228728
1229587 1231354 1231986 1232226 1232226 1232234 1233358 1234765
1235731 1236193 1236282 1237375 1237515 1238137 1239177 1240883
1241964 1242096 1242998 1243148 1243708 1244449 1244459 1244573
1244573 1245470 1245524 1245551 1246080 1246559 1247286 1247495
1247875 1248158 1248261 1248356 1248501 1248586 1248842 1249052
1249370 1249435 1249584 1249686 1249964 1250232 1250233 1250234
1250513 1250661 1250696 1250974 1251227 1251789 1251793 1251862
1251923 1251931 1251948 1251952 1251981 1252095 1252217 1252306
1252431 1252696 1252992 1252993 1253025 1253043 1253098 1253139
1253389 1253682 1254395 1254563 1254666 1254670 1254889 1254924
1254924 1255024 1255024 1255326 1255326 1255678 1255725 1256341
1256427 1256436 1256766 1256822 1256829 1256830 1256831 1256832
1256833 1256834 1256835 1256836 1256837 1256838 1256839 1256840
1257005 1257101 1257144 1257274 1257463 1257463 1257496 1257527
1257875 1258002 1258311 1258319 1258344 1258392 1258423 1258859
1259071 1259215 1259418 1259418 1259438 1259619 1259650 1259650
1259652 1259652 1259697 1259704 1259711 1259726 1259729 1259825
1259867 1259924 1260078 1260082 1260357 1260441 1260442 1260443
1260444 1260445 1261206 1261280 1261400 1261535 1261606 1261606
1261639 1261678 1261809 1261822 1261982 1261983 1262083 1262134
1262144 1262263 1262305 1262315 1262464 1262465 1262684 1262693
1262711 1263078 1263084 1263098 1263117 1263656 1263658 1264713
1265386 1265400 1266226 1266328 1266340 1266341 1266342 1266343
1266344 1266345 1266347 1266349 1266350 1266351 1266352 1266353
1266355 1266356 1266357 1266385 1266786 1267423 1267631 1267644
1267647 1268012 1268013 1268290 1268572 1268573 1268747 1268867
1268886 1269150 1269571 1269583 1269584 1269664 1270219 1270439
1270534 1271351 1271352 1271354 1271444 1271645 1271712 1272616
1273901 1274723 1274726 1274774 1274777 1274788 1274790 1274791
1274792 1274795 1274796 1274797 1274798 1274861 1275096 1275219
1275441 1275441 1275492 1275594 1275732 1275837 1275859 1275860
1275915 1276892 1276946 1277247 1277262 1277707 1277708 1277709
1277710 1277711 1277712 1277713 1277919 1277921 1277922 1278135
1278347 1278348 1278349 1279051 1279565 1279893 1279961 1280049
1280050 1280051 1280052 1280053 1280054 1280587 1280589 1280590
1280591 1280592 1280594 1280595 1280596 1280597 1280598 1280599
1280702 1281297 1282301 1282303 1282509 1282745 822653 CVE-2023-45853
CVE-2024-10041 CVE-2024-2236 CVE-2025-0395 CVE-2025-11187 CVE-2025-13151
CVE-2025-14104 CVE-2025-15281 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469
CVE-2025-58050 CVE-2025-59375 CVE-2025-66199 CVE-2025-68160 CVE-2025-69418
CVE-2025-69419 CVE-2025-69420 CVE-2025-69421 CVE-2025-69720 CVE-2025-70873
CVE-2025-7709 CVE-2025-9230 CVE-2025-9231 CVE-2025-9232 CVE-2026-0861
CVE-2026-0915 CVE-2026-11822 CVE-2026-11824 CVE-2026-13595 CVE-2026-13757
CVE-2026-14456 CVE-2026-14457 CVE-2026-16742 CVE-2026-18374 CVE-2026-18798
CVE-2026-18938 CVE-2026-19499 CVE-2026-19542 CVE-2026-22795 CVE-2026-22796
CVE-2026-24515 CVE-2026-25210 CVE-2026-2673 CVE-2026-2673 CVE-2026-27171
CVE-2026-27456 CVE-2026-27456 CVE-2026-28387 CVE-2026-28388 CVE-2026-28389
CVE-2026-28390 CVE-2026-29111 CVE-2026-29111 CVE-2026-31789 CVE-2026-31790
CVE-2026-3184 CVE-2026-32776 CVE-2026-32777 CVE-2026-32778 CVE-2026-34180
CVE-2026-34181 CVE-2026-34182 CVE-2026-34183 CVE-2026-34743 CVE-2026-35189
CVE-2026-35191 CVE-2026-40226 CVE-2026-4046 CVE-2026-40467 CVE-2026-40468
CVE-2026-40553 CVE-2026-4105 CVE-2026-4105 CVE-2026-41080 CVE-2026-41989
CVE-2026-41990 CVE-2026-42250 CVE-2026-42764 CVE-2026-42766 CVE-2026-42767
CVE-2026-42768 CVE-2026-42769 CVE-2026-42770 CVE-2026-4437 CVE-2026-4438
CVE-2026-44604 CVE-2026-44605 CVE-2026-45186 CVE-2026-45445 CVE-2026-45446
CVE-2026-45447 CVE-2026-4878 CVE-2026-50219 CVE-2026-53612 CVE-2026-53613
CVE-2026-53614 CVE-2026-5435 CVE-2026-54369 CVE-2026-54370 CVE-2026-54371
CVE-2026-54411 CVE-2026-5450 CVE-2026-54872 CVE-2026-54874 CVE-2026-54875
CVE-2026-56131 CVE-2026-56132 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405
CVE-2026-56406 CVE-2026-56407 CVE-2026-56408 CVE-2026-56409 CVE-2026-56410
CVE-2026-56411 CVE-2026-56412 CVE-2026-5928 CVE-2026-5958 CVE-2026-6238
CVE-2026-63072 CVE-2026-63073 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076
CVE-2026-6368 CVE-2026-66046 CVE-2026-6791 CVE-2026-72522 CVE-2026-72693
CVE-2026-72897 CVE-2026-7383 CVE-2026-75803 CVE-2026-75804 CVE-2026-75805
CVE-2026-75806 CVE-2026-76641 CVE-2026-76642 CVE-2026-76956 CVE-2026-76957
CVE-2026-77117 CVE-2026-77696 CVE-2026-78408 CVE-2026-78410 CVE-2026-80489
CVE-2026-84782 CVE-2026-84784 CVE-2026-86145 CVE-2026-8674 CVE-2026-86805
CVE-2026-89156 CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161
CVE-2026-89162 CVE-2026-9076
-----------------------------------------------------------------
The container elemental/elemental-lifecycle-manager was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 20
Released: Mon Nov 17 16:06:01 2025
Summary: Recommended update for selinux-policy
Type: recommended
Severity: critical
References: 1205770,1229587,1232226,1235731,1238137,1240883,1242998,1244573,1245470,1247875,1249052,1249370,1249435,1250661,1250696,1250974,1251227,1251793,1251862,1251923,1251952
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git239.fcbf2d509:
* fail2ban: bump module version
* fail2ban: allow fail2ban to watch all log files and dirs (bsc#1251952)
* fail2ban: fix typos in interface descriptions
* fail2ban: tweak file context regex for /run/fail2ban
* fail2ban: drop file context for old rc.d file
* Allow wicket to manage its proc directories (bsc#1235731)
* Allow NM to manage wicked pid files (bsc#1235731)
* Allow NM to reach systemd unit files (bsc#1235731)
* Make wicked script backwards compatible (bsc#1251923)
* Allow snapper grub plugin to domtrans to bootloader_t (bsc#1251862)
* Allow salt_t transition to rpm_script_t (bsc#1250696)
* grub snapper plugin is now named 00-grub (bsc#1251793)
* Assign alts_exec_t exec_file attribute (bsc#1250974)
* Add equivalency between /srv/tomcat and /var/lib/tomcat (bsc#1251227)
* Allow sshd_session_t write to wtmpdb
* Support /usr/libexec/ssh as well as openssh folder
* Set xenstored_use_store_type_domain boolean true(bsc#1247875)
* Adjust guest and xguest users policy for sshd-session
* Allow valkey-server create and use netlink_rdma_socket
* Allow blueman get attributes of filesystems with extended attributes
* Update files_search_base_file_types()
* Introduce unconfined wicked_script_t (bsc#1205770, bsc#1250661)
* Allow geoclue get attributes of the /dev/shm filesystem
* Allow apcupsd get attributes of the /dev/shm filesystem
* Allow sshd-session read cockpit pid files
* Add /opt/.snapshots to the snapper file context (bsc#1232226)
* Allow nfs generator create and use netlink sockets
* Conditionally allow virt guests to read certificates in user home directories
* xenstored_t needs CAP_SYS_ADMIN for XENSTORETYPE=domain (bsc#1247875)
* Allow nfs-generator create and use udp sockets
* Allow kdump search kdumpctl_tmp_t directories
* Allow init open and read user tmp files
* Fix the systemd_logind_stream_connect() interface
* Allow staff and sysadm execute iotop using sudo
* Allow sudodomains connect to systemd-logind over a unix socket
* /boot/efi is dosfs_t and kdump needs to access it (bsc#1249370)
* Add default contexts for sshd-seesion
* Define types for new openssh executables
* Fix systemd_manage_unit_symlinks() interface definition
* Support coreos installation methods
* Add a new type for systemd-ssh-issue PID files
* Allow gnome-remote-desktop connect to unreserved ports
* Zypper moves files in /var/tmp to /var/cache (bsc#1249052, bsc#1249435)
* Allow mdadm the CAP_SYS_PTRACE capability
* Allow iptables manage its private fifo_files in /tmp
* Allow auditd manage its private run dirs
* Revert 'Allow virt_domain write to virt_image_t files'
* Allow gdm create /etc/.pwd.lock with a file transition
* Allow gdm bind a socket in the /run/systemd/userdbd directory
* Allow nsswitch_domain connect to xdm over a unix domain socket
* Allow systemd homed getattr all tmpfs files (bsc#1240883)
* Allow systemd (PID 1) create lastlog entries
* Allow systemd_homework_t transition pid files to lvm_var_run_t (bsc#1240883)
* Allow gnome-remote-desktop speak with tabrmd over dbus (bsc#1244573)
* Allow nm-dispatcher iscsi and sendmail plugins get pidfs attributes
* Allow systemd-oomd watch tmpfs dirs
* Allow chronyc the setgid and setuid capabilities
* Label /usr/lib/systemd/systemd-ssh-issue with systemd_ssh_issue_exec_t
* Allow stalld map sysfs files
* Allow NetworkManager-dispatcher-winbind get pidfs attributes
* Allow openvpn create and use generic netlink socket
* policy_capabilities: remove estimated from released versions
* policy_capabilities: add stub for userspace_initial_context
* add netlink_xperm policy capability and nlmsg permission definitions
* policy_capabilities: add ioctl_skip_cloexec
* selinux-policy: add allow rule for tuned_ppd_t
* selinux-policy: add allow rule for switcheroo_control_t
* Label /run/audit with auditd_var_run_t
* Allow virtqemud start a vm which uses nbdkit
* Add nbdkit_signal() and nbdkit_signull() interfaces
* Fix insights_client interfaces names
* Add insights_core and insights_client interfaces
* Fix selinux-autorelabel-generator label after upstream changes
* Revert 'Remove the mysql module sources'
* Revert 'Allow rasdaemon write access to sysfs (bsc#1229587)'
* Reset postfix.fc to upstream, add alias instead
* dist/targeted/modules.conf: enable slrnpull module
* Allow bootupd delete symlinks in the /boot directory
* Allow systemd-coredumpd capabilities in the user namespace
* Allow openvswitch read virtqemud process state
* Allow systemd-networkd to create leases directory
* Apply generator template to selinux-autorelabel generator
* Support virtqemud handle hotplug hostdev devices
* Allow virtstoraged create qemu /var/run files
* Allow unconfined_domain_type cap2_userns capabilities
* Label /usr/libexec/postfix/tlsproxy with postfix_smtp_exec_t
* Remove the mysql module sources
* dist/targeted/modules.conf: Enable kmscon module (bsc#1238137)
* Update kmscon policy module to kmscon version 9 (bsc#1238137)
* Allow login to getattr pidfs
* Allow systemd to map files under /sys
* systemd: drop duplicate init_nnp_daemon_domain lines
* Fix typo
* Allow logwatch stream connect to opensmtpd
* Allow geoclue read NetworkManager pid files
* Allow unconfined user a file transition for creating sudo log directory
* Allow virtqemud read/write inherited dri devices
* Allow xdm_t create user namespaces
* Update policy for login_userdomain
* Add ppd_base_profile to file transition to get tuned_rw_etc_t type
* Update policy for bootupd
* Allow logwatch work with opensmtpd
* Update dovecot policy for dovecot 2.4.1
* Allow ras-mc-ctl write to sysfs files
* Allow anaconda-generator get attributes of all filesystems
* Add the rhcd_rw_fifo_files() interface
* Allow systemd-coredump the sys_chroot capability
* Allow hostapd write to socket files in /tmp
* Recognize /var/home as an alternate path for /home
* Label /var/lib/lastlog with lastlog_t
* Allow virtqemud write to sysfs files
* Allow irqbalance search sssd lib directories
* Allow samba-dcerpcd send sigkills to passwd
* Allow systemd-oomd watch dbus pid sock files
* Allow some confined users read and map generic log files
* Allow login_userdomain watch the /run/log/journal directory
* Allow login_userdomain dbus chat with tuned-ppd
* Allow login_userdomain dbus chat with switcheroo-control
* Allow userdomain to connect to systemd-oomd over a unix socket
* Add insights_client_delete_lib_dirs() interface
* Allow virtqemud_t use its private tmpfs files (bsc#1242998)
* Allow virtqemud_t setattr to /dev/userfaultfd (bsc#1242998)
* Allow virtqemud_t read and write /dev/ptmx (bsc#1242998)
* Extend virtqemud_t tcp_socket permissions (bsc#1242998)
* Allow virtqemud_t to read and write generic pty (bsc#1242998)
* Allow systemd-importd create and unlink init pid socket
* Allow virtqemud handle virt_content_t chr files
* Allow svirt read virtqemud fifo files
* All sblim-sfcbd the dac_read_search capability
* Allow sblim domain read systemd session files
* Allow sblim-sfcbd execute dnsdomainname
* Confine nfs-server generator
* Allow systemd-timedated start/stop timemaster services
* Allow 'hostapd_cli ping' run as a systemd service
* Allow power-profiles-daemon get attributes of filesystems with extended attributes
* Allow 'oomctl dump' to interact with systemd-oomd
* Basic functionality for systemd-oomd
* Basic enablement for systemd-oomd
* Allow samba-bgqd send to smbd over a unix datagram socket
* Update kernel_secretmem_use()
* Add the file/watch_mountns permission
* Update systemd-generators policy
* Allow plymouthd_t read proc files of systemd_passwd_agent (bsc#1245470)
* Allow insights-client file transition for files in /var/tmp
* Allow tuned-ppd manage tuned log files
* Allow systemd-coredump mount on tmpfs filesystems
* Update sssd_dontaudit_read_public_files()
* Allow zram-generator raw read fixed disk device
* Add fs_write_cgroup_dirs() and fs_setattr_cgroup_dirs() interfaces
-----------------------------------------------------------------
Advisory ID: 29
Released: Wed Nov 19 10:37:50 2025
Summary: Security update for expat
Type: security
Severity: important
References: 1249584,CVE-2025-59375
This update for expat fixes the following issues:
- CVE-2025-59375: Fixed large dynamic memory allocations via a small document submitted for parsing (bsc#1249584)
-----------------------------------------------------------------
Advisory ID: 107
Released: Mon Dec 15 19:16:15 2025
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1250232,1250233,1250234,CVE-2025-9230,CVE-2025-9231,CVE-2025-9232
This update for openssl-3 fixes the following issues:
- CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232)
- CVE-2025-9231: Fixedk timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
- CVE-2025-9232: Fixed out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
-----------------------------------------------------------------
Advisory ID: 154
Released: Mon Jan 19 15:46:34 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: critical
References: 1231354,1233358,1241964,1244459,1244573,1246080,1246559,1251789,1251931,1252095,1252431,1252992,1252993,1253098,1253389,1254395,1254889,1255024
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git345.3965b24b0:
* Allow 'mysql-systemd-helper upgrade' to work correctly (bsc#1255024)
Update to version 20250627+git343.b66ec7135:
* Allow snapper_tu_etc_plugin_t to connect to machined varlink socket (bsc#1254889)
Update to version 20250627+git341.4beeb2d65:
* Allow virtlogd_t dac_override (bsc#1253389)
* Introduce systemd_cryptsetup_generator_var_run_t file type (bsc#1244459)
* Allow virtqemud_t to read/write device_t (bsc#1251789)
* update support for polkit agent helper (bsc#1251931)
* Allow system_mail_t read apache system content conditionally
* Allow login_userdomain read lastlog
* Allow sshd-net read and write to sshd vsock socket
* Update ktls policy
* Add comprehensive SELinux policy module for bwrap thumbnail generation
* Revert 'Allow thumb_t create permission in the user namespace'
* Allow systemd-machined read svirt process state
* Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
* Allow sysadm access to TPM
* Allow tlp get the attributes of the pidfs filesystem
* Allow kmscon to read netlink_kobject_uevent_socket
* Allow systemd-ssh-issue read kernel sysctls
* fix: bz2279215 Allow speech-dispatcher access to user home/cache files
* Allow create kerberos files in postgresql db home
* Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
* Allow shell comamnds in locate systemd service (bsc#1246559)
* Introduce initrc_nnp_daemon_domain interface
* Label /var/lib/cosmic-greeter with xdm_var_lib_t
* Allow setroubleshoot-fixit get attributes of xattr fs
* Allow insights-client manage /etc symlinks
* Allow insights-client get attributes of the rpm executable
* Allow nfsidmapd search virt lib directories
* Allow iotop stream connect to systemd-userdbd
* Allow snapper_sdbootutil_plugin_t manage unlabeled_t files,dirs,symlinks (bsc#1252993)
* Allow gnome-remote-desktop read sssd public files
* Allow thumb_t stream connect to systemd-userdbd
* Add auth_nnp_domtrans_chkpwd()
* Allow sshd_auth_t getopt/setopt on tcp_socket (bsc#1252992)
* Allow bluez dbus API passing unix domain sockets
* Allow bluez dbus api pass sockets over dbus
* Dontaudit systemd-generator connect to sssd over a unix stream socket
* Allow init watch/watch_reads systemd-machined user ptys
* Introduce sap_service_transition_to_unconfined_user boolean
* allow init to read sap symlinks
* Allow SAP domain to relocation text in all files
- Fix macros.selinux-policy to allow changing booleans when policy
is not loaded. Previous logic was broken (bsc#1254395)
Update to version 20250627+git293.3432d4834:
* Allow pcscd_t to search cgroup (bsc#1253098)
* Fix syntax error in userdomain.if
* Allow nnp_transition for OpenSMTPD (bsc#1252431)
* Allow ras-mc-ctl get attributes of the kmod executable
* Define file equivalency for /var/opt
* Allow virtnodedev_t the perfmon capability
* Allow nut_upsdrvctl_t the sys_ptrace capability
* Label /usr/lib/systemd/user/graphical-session-pre.target with xdm_unit_file_t
* Allow snapper sdbootutil plugin read emmc devices (bsc#1231354)
* Allow pcrlock to delete pid entries
* Allow systemd_pcrlock_t to manage its pid files
* Mark snapper_sdbootutil_plugin_t as permissive
* Drop unnamed filetrans, should be done upstream (bsc#1241964)
* Label pcrlock pid file correctly (bsc#1241964)
* Allow snapper sdbootutil plugin send msg to system bus (bsc#1241964)
* snapper takes output from stdout/err, allow pcrlock to write
* Add tpm2_getcap permissions to snapper sdbootutil (bsc#1244573)
* Allow snapper sdbootutil plugin to read snapper data and conf
* Allow snapper sdbootutil plugin to grep /proc/stat (bsc#1241964)
* Replace snapper tmp file access for pcrlock (bsc#1241964)
* Allow snapper sdbootutil read kernel module dirs (bsc#1241964)
* Allow snapper sdbootutil plugin use bootctl (bsc#1241964)
* Allow snapper sdbootutil plugin to list and read sysfs (bsc#1241964)
* Allow snapper sdbootutil sys_admin (bsc#1241964)
* Allow snapper sdbootutils plugin to findmnt (bsc#1241964)
* Allow snapper sdbootutil plugin rw tpm (bsc#1233358)
* Move manage dos permissions and dontaudit execmem to snapper sdbootutils plugin (bsc#1241964)
* Move snapper domtrans to sdbootutil to plugin (bsc#1241964)
* Revert snapper access to keys, move to sdbootutils plugin policy (bsc#1241964)
* Add initial seperate policy for sdbootutil called by snapper (bsc#1233358)
* Allow sort in snapper_grub_plugin_t read cpu.max (bsc#1252095)
* systemd-sysctl: allow rw on binfm_misc_fs_t to set binfmt_misc status
* Allow cupsd to manage cupsd_rw_etc_t lnk_files
* Set temporary no-stub resolv.conf file from NetworkManager as net_conf_t
* Allow spamc read aliases file
* Mark configfs_t as mountpoint (bsc#1246080)
* Allow systemd-machined watch cgroup files
* Allow sshd-auth read generic proc files
* Allow sshd-auth read and write user domain ptys
* Allow logwatch read and write sendmail unix stream sockets
* Allow logwatch domain transition on rpm execution
* Allow thumb_t mounton its private tmpfs files
* Allow thumb_t create permission in the user namespace
* Allow corenet_unconfined_type name_bind to icmp_socket
* Allow systemd-networkd to manage systemd_networkd_var_lib_t files
* Allow sshd-session get attributes of sshd vsock socket
-----------------------------------------------------------------
Advisory ID: 218
Released: Thu Jan 29 18:44:57 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1236282,1256436,1256766,1256822,1257005,CVE-2025-0395,CVE-2025-15281,CVE-2026-0861,CVE-2026-0915
This update for glibc fixes the following issues:
Security fixes:
- CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282).
- CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766).
- CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822).
- CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005).
Other fixes:
- NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)
-----------------------------------------------------------------
Advisory ID: 237
Released: Mon Feb 2 14:00:02 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1256829,1256830,1256831,1256832,1256833,1256834,1256835,1256836,1256837,1256838,1256839,1256840,1257274,CVE-2025-11187,CVE-2025-15467,CVE-2025-15468,CVE-2025-15469,CVE-2025-66199,CVE-2025-68160,CVE-2025-69418,CVE-2025-69419,CVE-2025-69420,CVE-2025-69421,CVE-2026-22795,CVE-2026-22796
This update for openssl-3 fixes the following issues:
Security fixes:
- CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829).
- CVE-2025-15467: Stack buffer overflow in CMS AuthEnvelopedData parsing (bsc#1256830).
- CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831).
- CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs >16MB (bsc#1256832).
- CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833).
- CVE-2025-68160: Heap out-of-bounds write in BIO_f_linebuffer on short writes (bsc#1256834).
- CVE-2025-69418: Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (bsc#1256835).
- CVE-2025-69419: Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (bsc#1256836).
- CVE-2025-69420: Missing ASN1_TYPE validation in TS_RESP_verify_response() function (bsc#1256837).
- CVE-2025-69421: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (bsc#1256838).
- CVE-2026-22795: Missing ASN1_TYPE validation in PKCS#12 parsing (bsc#1256839).
- CVE-2026-22796: ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (bsc#1256840).
Other fixes:
- Enable livepatching support for ppc64le (bsc#1257274).
-----------------------------------------------------------------
Advisory ID: 252
Released: Wed Feb 11 12:13:17 2026
Summary: Recommended update for systemd
Type: recommended
Severity: important
References: 1228081,1228659,1228728,1231986,1234765,1244449,1248356,1248501,1251981,1254563,1255326,1256427
This update for systemd fixes the following issues:
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
- core/dbus-manager: propagate meaningful dbus errors from EnqueueMarkedJobs
- Name libsystemd-{shared,core} based on the major version of systemd and the
package release number (bsc#1228081, bsc#1256427)
- systemd-update-helper: clean up the flags immediately after they have been consumed.
- systemd.spec: don't reexecute PID1 on transactional updates.
- Drop most of the workarounds contained in the fixlets.
- Drop %filetriggers build flag. It was introduced to ease backport of Base:System to SLE distros
where file-triggers were unreliable but that is no longer the case on the latest SLE distros.
- Fix: systemd Tainted: unmerged-bin (bsc#1228728, bsc#1251981)
- timer: rebase last_trigger timestamp if needed
- timer: rebase the next elapse timestamp only if timer didn't already run
- main: switch explicitly to tty1 on soft-reboot (bsc#1231986)
- terminal-util: modernize vtnr_from_tty() a bit
- units: don't force the loading of the loop and dm_mod modules in systemd-repart.service (bsc#1248356)
- systemd.spec: use %sysusers_generate_pre so that some systemd users are
already available in %pre (bsc#1248501)
- core/cgroup: Properly handle aborting a pending freeze operation
- detect-virt: add bare-metal support for GCE (bsc#1244449)
- uki.conf is used by the ukify tool to create an Unified Kernel Image[...]
- Make sure that the ordering trick used to update the udev package as close as
as possible to the update of the systemd package also works with zypper.
- Fix: Snapshot 20240730 - unbootable after transactional-update dup (bsc#1228659)
* We also need to add 'Suggests: udev', which serves the same purpose as
'OrderWithRequires: udev' but is part of the repository metadata.
It should therefore hint zypper to install systemd and udev as close together as possible
- Fix systemd-network recommending libidn2-devel (bsc#1234765)
-----------------------------------------------------------------
Advisory ID: 310
Released: Thu Feb 26 08:38:22 2026
Summary: Recommended update for openssl-3
Type: recommended
Severity: low
References:
This update for openssl-3 fixes the following issues:
- removed test patches because they are not needed.
-----------------------------------------------------------------
Advisory ID: 314
Released: Thu Feb 26 17:51:31 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References:
This update for gcc15 fixes the following issues:
Update to GCC 15.2 release
* the GCC 15.2 release contains regression fixes accumulated since
the GCC 15.1 release
- Fixes PR120714, RISC-V: incorrect frame pointer CFA address for
stack-clash protection loops
-----------------------------------------------------------------
Advisory ID: 327
Released: Fri Feb 27 11:34:41 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: important
References: 1247286,1247495,1248158,1249686,1250513,1257875
This update for aaa_base fixes the following issues:
- Update to version 84.87+git20260210.ecce285:
* For boo#1257875 get intrinsic DEFAULT_WM back
* DIR_COLORS: add vt220 and .jxl
- Update to version 84.87+git20260112.8f614f3:
* add ghost entries for the removed dirs
* Revert list directories above all normal files.
- Update to version 84.87+git20251217.34fd7bc:
* add tmpfiles template adm-backup.conf (jsc#PED-14803)
* Fix old script to support copy mode as well
* Support for XDG environment variables for the su,
* adapted sugggestions
* Patching nsswitch.conf only if it has not been generated by nsswitch-config (jsc#PED-13807).
* Avoid nasty exceptions running tput
- Update to version 84.87+git20251111.509a363:
* Avoid escape sequences on dump terminal of s390
- Update to version 84.87+git20251111.16d9d43:
* Set XDG environment variables consistently without trailing slash
- Update to version 84.87+git20251110.af063e6:
* Avoid escape sequences on dump terminal of s390
* Set erase character from kbs entry of terminfo
- Update to version 84.87+git20251030.441f926:
* Add systemd to /etc/nsswitch.conf (bsc#1250513)
* Add group-directories-first option
* prevent normal users from accessing dmesg (bsc#1249686)
* Use explicit defaults for XDG environment variables
- Update to version 84.87+git20250903.33e5ba4:
* Correct fix for (bsc#1247495, bsc#1248158)
- Update to version 84.87+git20250805.3069494:
* Remove initviocons for tcsh as well and
* Update csh.login
* Add missing quoting and remove unneeded uses of eval
- Update to version 84.87+git20250801.f305627:
* Remove sysconfig.language (bsc#1247286)
- Update to version 84.87+git20250801.b2fa3fe:
* Allow /etc/locale.conf to have no newline
-----------------------------------------------------------------
Advisory ID: 344
Released: Tue Mar 3 17:13:34 2026
Summary: Security update for expat
Type: security
Severity: moderate
References: 1257144,1257496,CVE-2026-24515,CVE-2026-25210
This update for expat fixes the following issues:
- CVE-2026-24515: failure to copy the encoding handler data passed to XML_SetUnknownEncodingHandler may cause a NULL
dereference (bsc#1257144).
- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
-----------------------------------------------------------------
Advisory ID: 407
Released: Wed Mar 18 23:55:39 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Fixed bogus expression simplification (bsc#1257463)
-----------------------------------------------------------------
Advisory ID: 466
Released: Mon Mar 30 16:59:16 2026
Summary: Security update for expat
Type: security
Severity: important
References: 1259711,1259726,1259729,CVE-2026-32776,CVE-2026-32777,CVE-2026-32778
This update for expat fixes the following issues:
- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity
declaration value (bsc#1259726).
- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition
(bsc#1259729).
-----------------------------------------------------------------
Advisory ID: 472
Released: Wed Apr 1 16:56:43 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: important
References: 1237375,1255024,1255725,1259438,1259704
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git355.5249ba7d5:
* Revert 'Define file equivalency for /var/opt' (bsc#1259704)
* Make stalld stalld_var_run_t labeling rules more generic (bsc#1259438)
Update to version 20250627+git351.529352149:
* Allow syslog_t access ISC dhcpd /dev/log socket (bsc#1255725)
* privoxy: account for openSUSE chroot configuration (bsc#1237375)
Update to version 20250627+git347.b8926451e:
* Add support for 'mariadb at .service' (bsc#1255024).
-----------------------------------------------------------------
Advisory ID: 484
Released: Tue Apr 7 16:33:05 2026
Summary: Security update for libtasn1
Type: security
Severity: moderate
References: 1256341,CVE-2025-13151
This update for libtasn1 fixes the following issues:
- CVE-2025-13151: lack of validation of input data size leads to stack-based buffer overflow in
`asn1_expend_octet_string` (bsc#1256341).
-----------------------------------------------------------------
Advisory ID: 485
Released: Tue Apr 7 17:17:05 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1255326,1258344,1259418,1259650,1259697,CVE-2026-29111,CVE-2026-4105
This update for systemd fixes the following issues:
Update to systemd v257.13:
Security issues:
- CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650).
- CVE-2026-29111: local unprivileged user can trigger an assert in systemd (bsc#1259418).
- udev: local root execution via malicious hardware devices and unsanitized kernel output (bsc#1259697).
Non security issues:
- Avoid shipping (empty) directories and ghost files in /var (jsc#PED-14853).
- Sign systemd-boot EFI binary on aarch64 (bsc#1258344)
- terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
Changelog:
- 6941d92dc2 machined: reject invalid class types when registering machines (bsc#1259650 CVE-2026-4105)
- 03bb697b8d udev: check for invalid chars in various fields received from the kernel (bsc#1259697)
- 54588d2ded core: validate input cgroup path more prudently (bsc#1259418 CVE-2026-29111)
- fb9d92682b terminal-util: stop doing 0/upper bound check in tty_is_vc() (bsc#1255326)
For a complete list of changes, visit:
https://github.com/openSUSE/systemd/compare/3c53ef3ea20bd43ef587cbdfa7107aeb1ef55654...d349fc5cd4f9ee2b7884c2610647e92806d14b28
-----------------------------------------------------------------
Advisory ID: 500
Released: Thu Apr 9 13:14:21 2026
Summary: Recommended update for patterns-base
Type: recommended
Severity: moderate
References:
This update for patterns-base fixes the following issues:
Changes in patterns-base:
- Drop biosdevname, this is being replaced by systemd predictable
network interface naming (jsc#PED-262).
-----------------------------------------------------------------
Advisory ID: 502
Released: Thu Apr 9 13:18:30 2026
Summary: Security update for zlib
Type: security
Severity: moderate
References: 1216378,1258392,CVE-2023-45853,CVE-2026-27171
This update for zlib fixes the following issues:
- CVE-2026-27171: Fixed an infinite loop via the crc32_combine64 and crc32_combine_gen64 functions due to missing checks for negative lengths. (bsc#1258392)
- CVE-2023-45853: Fixed an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6. (bsc#1216378)
-----------------------------------------------------------------
Advisory ID: 510
Released: Thu Apr 9 15:00:19 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1222465,1254666,1258859,CVE-2025-14104,CVE-2026-3184
This update for util-linux fixes the following issues:
Security issues:
- CVE-2025-14104: heap buffer overread in setpwnam() when processing 256-byte usernames (bsc#1254666).
- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).
Non security issues:
- fdisk: Fix possible partition overlay and data corruption if EBR gap is missing (bsc#1222465).
- lscpu: Add support for NVIDIA Olympus arm64 core (jsc#PED-13682).
-----------------------------------------------------------------
Advisory ID: 516
Released: Fri Apr 10 08:36:43 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1258319,1260078,1260082,CVE-2026-4437,CVE-2026-4438
This update for glibc fixes the following issues:
Security fixes:
- CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
- CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).
Other fixes:
- nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).
-----------------------------------------------------------------
Advisory ID: 528
Released: Fri Apr 10 20:29:30 2026
Summary: Security update for pcre2
Type: security
Severity: moderate
References: 1248842,CVE-2025-58050
This update for pcre2 fixes the following issue:
- CVE-2025-58050: integer overflow leads to heap buffer overread in match_ref due to missing boundary restoration in SCS
(bsc#1248842).
-----------------------------------------------------------------
Advisory ID: 529
Released: Fri Apr 10 20:56:55 2026
Summary: Security update for sqlite3
Type: security
Severity: moderate
References: 1248586,1252217,1254670,1259619,CVE-2025-70873,CVE-2025-7709
This update for sqlite3 fixes the following issues:
Update sqlite3 to version 3.51.3:
Security issues:
- CVE-2025-7709: Integer Overflow in FTS5 Extension (bsc#1254670).
- CVE-2025-70873: SQLite zipfile extension may disclose uninitialized heap memory during inflation (bsc#1259619).
Non security issue:
- sqlite3 won't build when using --with icu (bsc#1248586).
Changelog:
Update to version 3.51.3:
* Fix the WAL-reset database corruption bug:
https://sqlite.org/wal.html#walresetbug
* Other minor bug fixes.
Update to version 3.51.2:
* Fix an obscure deadlock in the new broken-posix-lock detection
logic.
* Fix multiple problems in the EXISTS-to-JOIN optimization.
Update to version 3.51.1:
* Fix incorrect results from nested EXISTS queries caused by the
optimization in item 6b in the 3.51.0 release.
* Fix a latent bug in fts5vocab virtual table, exposed by new
optimizations in the 3.51.0 release
Update to version 3.51.0:
* New macros in sqlite3.h:
- SQLITE_SCM_BRANCH -> the name of the branch from which the
source code is taken.
- SQLITE_SCM_TAGS -> space-separated list of tags on the source
code check-in.
- SQLITE_SCM_DATETIME -> ISO-8601 date and time of the source
* Two new JSON functions, jsonb_each() and jsonb_tree() work the
same as the existing json_each() and json_tree() functions
except that they return JSONB for the 'value' column when the
'type' is 'array' or 'object'.
* The carray and percentile extensions are now built into the
amalgamation, though they are disabled by default and must be
activated at compile-time using the -DSQLITE_ENABLE_CARRAY
and/or -DSQLITE_ENABLE_PERCENTILE options, respectively.
* Enhancements to TCL Interface:
- Add the -asdict flag to the eval command to have it set the
row data as a dict instead of an array.
- User-defined functions may now break to return an SQL NULL.
* CLI enhancements:
- Increase the precision of '.timer' to microseconds.
- Enhance the 'box' and 'column' formatting modes to deal with
double-wide characters.
- The '.imposter' command provides read-only imposter tables
that work with VACUUM and do not require the --unsafe-testing
option.
- Add the --ifexists option to the CLI command-line option and
to the .open command.
- Limit columns widths set by the '.width' command to 30,000 or
less, as there is not good reason to have wider columns, but
supporting wider columns provides opportunity to malefactors.
* Performance enhancements:
- Use fewer CPU cycles to commit a read transaction.
- Early detection of joins that return no rows due to one or
more of the tables containing no rows.
- Avoid evaluation of scalar subqueries if the result of the
subquery does not change the result of the overall expression.
- Faster window function queries when using
'BETWEEN :x FOLLOWING AND :y FOLLOWING' with a large :y.
* Add the PRAGMA wal_checkpoint=NOOP; command and the
SQLITE_CHECKPOINT_NOOP argument for sqlite3_wal_checkpoint_v2().
* Add the sqlite3_set_errmsg() API for use by extensions.
* Add the sqlite3_db_status64() API, which works just like the
existing sqlite3_db_status() API except that it returns 64-bit
results.
* Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the
sqlite3_db_status() and sqlite3_db_status64() interfaces.
* In the session extension add the sqlite3changeset_apply_v3()
interface.
* For the built-in printf() and the format() SQL function, omit
the leading '-' from negative floating point numbers if the '+'
flag is omitted and the '#' flag is present and all displayed
digits are '0'. Use '%#f' or similar to avoid outputs like
'-0.00' and instead show just '0.00'.
* Improved error messages generated by FTS5.
* Enforce STRICT typing on computed columns.
* Improved support for VxWorks
* JavaScript/WASM now supports 64-bit WASM. The canonical builds
continue to be 32-bit but creating one's own 64-bit build is
now as simple as running 'make'.
* Improved resistance to database corruption caused by an
application breaking Posix advisory locks using close().
-----------------------------------------------------------------
Advisory ID: 531
Released: Sat Apr 11 10:22:09 2026
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1258002
This update for ca-certificates-mozilla fixes the following issues:
- Updated to 2.84 state (bsc#1258002):
* Removed:
+ Baltimore CyberTrust Root
+ CommScope Public Trust ECC Root-01
+ CommScope Public Trust ECC Root-02
+ CommScope Public Trust RSA Root-01
+ CommScope Public Trust RSA Root-02
+ DigiNotar Root CA
* Added:
+ e-Szigno TLS Root CA 2023
+ OISTE Client Root ECC G1
+ OISTE Client Root RSA G1
+ OISTE Server Root ECC G1
+ OISTE Server Root RSA G1
+ SwissSign RSA SMIME Root CA 2022 - 1
+ SwissSign RSA TLS Root CA 2022 - 1
+ TrustAsia SMIME ECC Root CA
+ TrustAsia SMIME RSA Root CA
+ TrustAsia TLS ECC Root CA
+ TrustAsia TLS RSA Root CA
-----------------------------------------------------------------
Advisory ID: 535
Released: Mon Apr 13 09:31:28 2026
Summary: Recommended update for suse-build-key
Type: recommended
Severity: moderate
References:
This update for suse-build-key fixes the following issues:
Changes in suse-build-key:
- Add the auto import framework, that imports updated gpg keys into the RPM database.
- Added post quantum cryptographic keys for SLES 15 and SLES 16 to be
used for repository verification. (jsc#PED-11925)
- build-pqc-15.pem
- build-pqc-16.pem
-----------------------------------------------------------------
Advisory ID: 537
Released: Mon Apr 13 10:18:45 2026
Summary: Recommended update for systemd-presets-branding-SLE
Type: recommended
Severity: important
References: 1258423
This update for systemd-presets-branding-SLE fixes the following issues:
Changes in systemd-presets-branding-SLE:
- Disable firewalld during migration if it was disabled before (bsc#1258423).
-----------------------------------------------------------------
Advisory ID: 544
Released: Mon Apr 13 15:10:32 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: moderate
References: 1252696,1253025
This update for crypto-policies fixes the following issues:
- Fix the testsuite:
* Port all the policy changes to the config files in the test suite.
* Use the newly introduced SKIP_LINTING=1 option.
- Adapt the manpages to SUSE/openSUSE:
* Add crypto policies SUSE manpages
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: (bsc#1253025, bsc#1252696)
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH and MLKEM768-X25519 and SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add crypto policies FIPS output
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
-----------------------------------------------------------------
Advisory ID: 547
Released: Mon Apr 13 17:48:00 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1260441,1260442,1260443,1260444,1260445,1261678,CVE-2026-2673,CVE-2026-28387,CVE-2026-28388,CVE-2026-28389,CVE-2026-28390,CVE-2026-31789,CVE-2026-31790
This update for openssl-3 fixes the following issues:
Security issues fixed:
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441).
- CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442).
- CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443).
- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with
KeyTransportRecipientInfo (bsc#1261678).
- CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444).
- CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445).
Other updates and bugfixes:
- Enable MD2 in legacy provider (jsc#PED-15724).
-----------------------------------------------------------------
Advisory ID: 556
Released: Tue Apr 14 16:33:17 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1232234,CVE-2024-10041
This update for pam fixes the following issue:
- CVE-2024-10041: libpam: vulnerable to read hashed password (bsc#1232234).
-----------------------------------------------------------------
Advisory ID: 585
Released: Fri Apr 17 12:37:59 2026
Summary: Feature update for libgcrypt, libgpg-error
Type: feature
Severity: moderate
References: CVE-2024-2236
This update for libgcrypt, libgpg-error fixes the following issues:
Update libgcrypt to 1.12.1 (jsc#PED-15059):
* New and extended interfaces:
- Allow access to the FIPS service indicator via the new
GCRYCTL_FIPS_SERVICE_INDICATOR control code.
- Make SHA-1 non-FIPS internally for the 1.12 API
- Add Dilithium (ML-DSA) support
- Support optional random-override and support byte string data
* Bug fixes:
- Use secure MPI in _gcry_mpi_assign_limb_space.
- Use CSIDL_COMMON_APPDATA instead of /etc on Windows.
- Apply a Kyber patch from upstream.
- Fix an edge case in Jent initialization.
- mceliece6688128f: Fix stack overflow crash on win64/wine
* Performance:
- Many performance improvements, new AVX512 implementations for modern CPUs.
- Add RISC-V Zbb+Zbc implementation of CRC.
- Add RISC-V vector cryptography implementation of GHASH, AES, SHA256 and SHA512
- Add AVX2 and AVX512 code paths to improve CRC.
For a full changelog, see:
https://dev.gnupg.org/source/libgcrypt/history/master/;libgcrypt-1.12.0
Update libgpg-error to 1.58:
* New src/gpg-error.c (main): New command 'fconcat'.
* Rename src/spawn-posix.c (struct gpgrt_spawn_actions): Rename the field to
ENVP.
* argparse: Use SYSCONFDIR for /etc.
* Update translations for Portugese, German
* src/estream.c (parse_mode): Fix parsing of 'share'. Set sysopen
flag.
* syscfg: Add 64-bit Android arch.
-----------------------------------------------------------------
Advisory ID: 586
Released: Fri Apr 17 16:33:24 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1239177,1253682,1259867,1261535,1262083
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
- Move %postInstall to %post as fix until zypper moves to
rpm single transaction backend by default (bsc#1262083)
Update to version 20250627+git363.7b84cc7fb:
* Add missing Nextcloud file contexts (bsc#1261535)
* openSUSE uses /var/lib/php8 (bsc#1239177)
* /srv/www/htdocs is DocumentRoot of apache (bsc#1261535)
* Allow snapper sdbootutil plugin read kernel modules (bsc#1259867)
* Allow named_filetrans_domain filetrans flatpak homedir (bsc#1253682)
-----------------------------------------------------------------
Advisory ID: 625
Released: Wed Apr 22 12:22:37 2026
Summary: Security update for libcap
Type: security
Severity: important
References: 1261809,CVE-2026-4878
This update for libcap fixes the following issues:
- CVE-2026-4878: local privilege escalation through file capability injection due to TOCTOU race condition in
`cap_set_file()` (bsc#1261809).
-----------------------------------------------------------------
Advisory ID: 708
Released: Wed May 6 12:44:56 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1261639
This update for libselinux fixes the following issues:
- Backport commit 'libselinux: retain LIFO order for path substitutions' (bsc#1261639)
* otherwise we can not add equivalencies that overload each other in the policy
* libselinux: retain LIFO order for path substitutions
-----------------------------------------------------------------
Advisory ID: 741
Released: Wed May 13 11:32:25 2026
Summary: Recommended update for systemd-presets-branding-SLE
Type: recommended
Severity: important
References: 1261822,1262134
This update for systemd-presets-branding-SLE fixes the following issues:
- change %pretrans script from shell to lua, as we cannot guarantee a shell on %pretrans at all (bsc#1261822)
- fix escaping for migration_flag (bsc#1262134)
- unify the presets between traditional and immutable modes (with some exceptions) (jsc#PED-16082)
-----------------------------------------------------------------
Advisory ID: 761
Released: Mon May 18 07:38:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1261206,1262464,1262465,CVE-2026-4046,CVE-2026-5450,CVE-2026-5928
This update for glibc fixes the following issues
- CVE-2026-4046: assertion failure when converting inputs may be used to remotely crash an application (bsc#1261206).
- CVE-2026-5450: stdio-common: scanf %mc pattern will cause heap overflow when width > 1024 (bsc#1262465).
- CVE-2026-5928: libio: ungetwc could be used to leak data on special conditions (bsc#1262464).
-----------------------------------------------------------------
Advisory ID: 803
Released: Tue May 26 14:14:16 2026
Summary: Security update for xz
Type: security
Severity: important
References: 1261280,CVE-2026-34743
This update for xz fixes the following issue
- CVE-2026-34743: buffer overflow in lzma_index_append() (bsc#1261280).
-----------------------------------------------------------------
Advisory ID: 808
Released: Wed May 27 18:43:58 2026
Summary: Recommended update for dbus-broker
Type: recommended
Severity: moderate
References: 1255678
This update for dbus-broker fixes the following issues:
- Fix timeout on ssh due to not handling ESRCH (bsc#1255678)
-----------------------------------------------------------------
Advisory ID: 824
Released: Fri May 29 11:59:18 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1258311,1259825,1262315
This update for crypto-policies fixes the following issues:
Changes in crypto-policies:
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy again. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
-----------------------------------------------------------------
Advisory ID: 861
Released: Tue Jun 2 09:22:47 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References:
This update for aaa_base fixes the following issues:
- Update to version 84.87+git20260529.c4391e5:
* $status to $?
* Simplifying the sh part too
* Addressing review comments and simplifying a bit
* Handle javas managed by libalternatives and by update-alternatives alike
-----------------------------------------------------------------
Advisory ID: 860
Released: Tue Jun 2 09:28:48 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1249964,1257527,1262711,1266328
This update for selinux-policy fixes the following issues:
- Update to version 20250627+git378.e27ad25be:
* Allow systemd-tmpfiles to adjust resource limits (bsc#1266328)
- Update to version 20250627+git376.3e51f6aea:
* Vibecode Gitlab CI smoke test for Leap 16.0+
* Add diffutils explicitly to .gitlab-ci
* Fix gitlab CI
* Allow virtqemud_t to call and transition into udev
* Dontaudit ps to read proc (bsc#1257527)
* Dontaudit ps permissions that tlp_t does not need (bsc#1257527)
* TLP uses ps aux to check for different services (bsc#1257527)
- Update to version 20250627+git368.7e5f975a1:
* Add boolean ntp_refclock_access (bsc#1262711)
* Add /var/log/ntp in ntp named filetrans interface (bsc#1262711)
* Allow cloud init to domtrans into ssh keygen (bsc#1249964)
-----------------------------------------------------------------
Advisory ID: 885
Released: Wed Jun 3 11:47:33 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References:
This update for aaa_base fixes the following issues:
- Fix a typo and follow symlinks in alljava
-----------------------------------------------------------------
Advisory ID: 921
Released: Thu Jun 11 17:29:49 2026
Summary: Recommended update for policycoreutils
Type: recommended
Severity: moderate
References: 1236193,1242096,1266226
This update for policycoreutils fixes the following issues:
- Reintroduce sandbox package and a couple quality of life improvements (bsc#1266226)
- Remove misleading comment from spec file about reuqires for policycoreutils-devel
- Improve policycoreutils-devel package dependencies (bsc#1236193).
- Change Recommends for policycoreutils-devel to the gui package to Requires.
This causees some system bloat for people that only want to use
the config GUI, but prevents errors when building policy packages
- Properly exclude gui.py file (bsc#1242096)
- Added Recommends for policycoreutils-devel to the gui package
- Move gui.py file to gui sub-package to prevent policycoreutil python
packages from having excessive requirements
-----------------------------------------------------------------
Advisory ID: 925
Released: Fri Jun 12 14:46:46 2026
Summary: Recommended update for aaa_base
Type: recommended
Severity: moderate
References: 1267423
This update for aaa_base fixes the following issues:
- Add missing '=' in alljava.csh (bsc#1267423)
-----------------------------------------------------------------
Advisory ID: 955
Released: Thu Jun 18 23:01:36 2026
Summary: Security update for sqlite3
Type: security
Severity: important
References: 1268012,1268013,CVE-2026-11822,CVE-2026-11824
This update for sqlite3 fixes the following issues
Update to 3.53.2:
- CVE-2026-11822: memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause
process crashes, memory exhaustion, or arbitrary code execution (bsc#1268012).
- CVE-2026-11824: heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers
to cause a crash or execute arbitrary code (bsc#1268013).
Changes:
* Add the Query Result Formatter (QRF) library for formatting the
results of SQL queries for human readability on a fixed-pitch
font screen.
* Enhance ALTER TABLE to permit adding and removing NOT NULL and
CHECK constraints.
* The REINDEX EXPRESSIONS statement rebuilds expression indexes.
* The body of TEMP triggers may now modify and/or query tables
in the main schema.
* Enhance VACUUM INTO so that if a URI filename is used as the
target and that filename has a reserve=N query parameter with
N between 0 and 255, then the reserve amount for the generated
database copy is set to N.
* New SQL functions json_array_insert() and jsonb_array_insert().
* Renovations to the CLI.
* New C-language interfaces: sqlite3_str_truncate(),
sqlite3_str_free(), sqlite3_carray_bind_v2().
* Add the SQLITE_PREPARE_FROM_DDL option to sqlite3_prepare_v3().
* Added the SQLITE_UTF8_ZT constant which can be used as the
encoding parameter to sqlite3_result_text64() or
sqlite3_bind_text64() to indicate that the value is UTF-8
encoded and zero terminated.
* The SQLITE_LIMIT_PARSER_DEPTH option is added to
sqlite3_limit().
* The SQLITE_DBCONFIG_FP_DIGITS option is added to
sqlite3_db_config().
* Query planner improvements.
* Add new interfaces to the session extension that enable an
application to add changes one at a time to the
sqlite3_changegroup object.
* Improvements to floating-point <-> text conversions.
* Added the self-healing index feature to deal with the stale
expression index problem.
* Add the '-p|--port' option to sqlite3_rsync.
* Add the 'opfs-wl' VFS, functionally identical to the 'opfs' VFS
but using Web Locks for locking, which can promise fairer lock
sharing than the 'opfs' bespoke protocol can. 'opfs-wl'
requires Atomics.waitAsync(), so requires newer browsers than
'opfs' does.
* Fixes for problems in 3.53.0 and 3.53.1 reported by users.
* See the check-in timeline for details:
https://sqlite.org/src/timeline?from=version-3.53.0&to=version-3.53.2
* https://sqlite.org/releaselog/3_53_0.html
-----------------------------------------------------------------
Advisory ID: 959
Released: Fri Jun 19 07:10:33 2026
Summary: Recommended update for libsemanage
Type: recommended
Severity: important
References: 1266385
This update for libsemanage fixes the following issues:
- Depend on libso before make pywrap is executed to avoid race conditions (bsc#1266385)
- Add CFLAGS to %make_install call for consistency with %make_build
-----------------------------------------------------------------
Advisory ID: 964
Released: Fri Jun 19 16:14:03 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: important
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
Changes in gcc15:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions from time_t to/from uint32_t.
Filter out -Wtime_t-conversion from flags to build D target library files.
- SUSE-local -Wtime_t-conversion patch added. [jsc#PED-15601]
- Fix for bogus expression simplification [bsc#1257463]
- Enable the use of _dl_find_object even when not available at build time.
[bsc#1253043]
- Fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Fixes PR110812, Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: 1004
Released: Sat Jun 20 20:11:34 2026
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1259924,CVE-2025-69720
This update for ncurses fixes the following issue:
- CVE-2025-69720: buffer overflow in function `analyze_string()`of `progs/infocmp.c` (bsc#1259924).
-----------------------------------------------------------------
Advisory ID: 1000
Released: Sat Jun 20 20:12:39 2026
Summary: Recommended update for netcfg
Type: recommended
Severity: moderate
References:
This update for netcfg fixes the following issues:
- Clarify /etc/services removal message
-----------------------------------------------------------------
Advisory ID: 996
Released: Sat Jun 20 20:17:58 2026
Summary: Recommended update for libselinux
Type: recommended
Severity: moderate
References: 1232226
This update for libselinux fixes the following issues:
- Backport patch for restorecon to log error on readonly fs (bsc#1232226)
-----------------------------------------------------------------
Advisory ID: 1008
Released: Sun Jun 21 04:17:53 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1243148,1265386
This update for selinux-policy fixes the following issues:
- Allow wireguard to setup DNS using dns_hatchet (bsc#1243148)
- Add fs_dontaudit_relabelfrom_tmpfs_files() interface
- Add sysnet_mount_file() interface
- Add sysnet_dontaudit_file_relabelto() interface
- Dontaudit tlp_t requesting dac_read_search (bsc#1265386)
-----------------------------------------------------------------
Advisory ID: 1017
Released: Mon Jun 22 14:26:17 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1259652,1266340,1266341,1266342,1266344,1266345,1266347,1266349,1266350,1266351,1266352,1266353,1266355,1266356,1266357,CVE-2026-2673,CVE-2026-34180,CVE-2026-34182,CVE-2026-34183,CVE-2026-42764,CVE-2026-42766,CVE-2026-42767,CVE-2026-42768,CVE-2026-42769,CVE-2026-42770,CVE-2026-45445,CVE-2026-45446,CVE-2026-45447,CVE-2026-7383,CVE-2026-9076
This update for openssl-3 fixes the following issues
- CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652).
- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).
- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).
- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).
- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
- CVE-2026-34183: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (bsc#1266345).
- CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347).
- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).
- CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).
- CVE-2026-42768: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (bsc#1266351).
- CVE-2026-42769: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (bsc#1266352).
- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).
- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).
- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).
- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).
-----------------------------------------------------------------
Advisory ID: 1036
Released: Mon Jun 22 16:30:37 2026
Summary: Security update for sed
Type: security
Severity: moderate
References: 1262144,CVE-2026-5958
This update for sed fixes the following issue
- CVE-2026-5958: a TOCTOU race can allow to read attacker-controlled content and write it to an unintended file
(bsc#1262144).
-----------------------------------------------------------------
Advisory ID: 1040
Released: Mon Jun 22 16:34:40 2026
Summary: Security update for util-linux
Type: security
Severity: moderate
References: 1261606,CVE-2026-27456
This update for util-linux fixes the following issue
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
-----------------------------------------------------------------
Advisory ID: 1060
Released: Wed Jun 24 23:36:29 2026
Summary: Security update for libgcrypt
Type: security
Severity: low
References: 1262693,CVE-2026-41990
This update for libgcrypt fixes the following issue
- CVE-2026-41990: lack of bound check can lead to mishandling of Dilithium signing (bsc#1262693).
-----------------------------------------------------------------
Advisory ID: 1064
Released: Wed Jun 24 23:38:49 2026
Summary: Recommended update for pam
Type: recommended
Severity: moderate
References: 1245524
This update for pam fixes the following issues:
- pam_mkhomedir: building with vendordir option allows fetching skeleton directory
from the vendor directory when creating the user home directory (bsc#1245524)
- disable unix_chkpwd by default, only used as fallback again
- pam_modutil_get*: overwrite password at free
-----------------------------------------------------------------
Advisory ID: 1126
Released: Wed Jul 1 14:14:45 2026
Summary: Recommended update for patterns-base
Type: recommended
Severity: moderate
References: 1263084
This update for patterns-base fixes the following issues:
- make kernel_livepatching pattern visible (bsc#1263084)
- add fwupd to enhanced base pattern (jsc#PED-15697)
-----------------------------------------------------------------
Advisory ID: 1151
Released: Fri Jul 3 10:55:00 2026
Summary: Security update for systemd
Type: security
Severity: important
References: 1245551,1248261,1251948,1254924,1259071,1260357,1261982,1261983,1262305,1263117,1267644,1267647
This update for systemd fixes the following issues:
Changes in systemd:
- Better handle TLS allocation failure (bsc#1254924).
- Disable mounting `debugfs` by default (jsc#PED-8812).
- Import commit 9e8b5afe0fb2061f4a17a3022469dd62f2683960 (bsc#1267647 bsc#1267644 bsc#1262305 bsc#1263117).
- Move `systemd-pcrlock` out from the experimental sub-package to `udev` (bsc#1248261 jsc#PED-15946).
- Add a weak runtime dependency on `libtss2-tcti-device0` (bsc#1260357).
- Import commit 59336000ef7850eba0963c6a690ff3371c425929 (bsc#1261982 bsc#1261983).
- Add a weak runtime dependency on `polkit` (bsc#1259071).
- systemd-update-helper: fix the clean-state command only removing `$STATE_DIR/system` instead of `$STATE_DIR/`.
- systemd-update-helper: add `--root` option for testing convenience.
- systemd-update-helper: fix incorrect skipping of `systemctl disable` during package removal (bsc#1245551).
- systemd-update-helper: fix `do_install_units()` incorrectly returning 1 when no units need preset.
- systemd.spec: introduce `%bcond_without` docs to allow skipping man pages and `devel-doc`.
- systemd.spec: drop the `%{release}` number from the SBAT version (bsc#1251948).
-----------------------------------------------------------------
Advisory ID: 1157
Released: Fri Jul 3 15:19:16 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: 1191
Released: Thu Jul 9 14:39:23 2026
Summary: Recommended update for systemd
Type: recommended
Severity: moderate
References: 1270439
This update for systemd fixes the following issues:
Changes in systemd:
- do not make mounting of debugfs optional yet.
-----------------------------------------------------------------
Advisory ID: 1224
Released: Mon Jul 13 15:54:55 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the `pam_userdb` module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: 1241
Released: Tue Jul 14 12:09:24 2026
Summary: Recommended update for policycoreutils
Type: recommended
Severity: moderate
References: 1270534
This update for policycoreutils fixes the following issues:
Changes in policycoreutils:
- Remove sandbox package as it will be provided as a separate package:
selinux-sandbox (bsc#1270534)
-----------------------------------------------------------------
Advisory ID: 1294
Released: Mon Jul 20 11:26:51 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: crafted ECDH ciphertext can lead denial of service (bsc#1262684).
-----------------------------------------------------------------
Advisory ID: 1303
Released: Mon Jul 20 15:44:04 2026
Summary: Security update for gawk
Type: security
Severity: moderate
References: 1271351,1271352,1271354,CVE-2026-40467,CVE-2026-40468,CVE-2026-40553
This update for gawk fixes the following issues:
- CVE-2026-40467: use-after-free vulnerability within the do_getline_redir() routine could lead to a program crash
(bsc#1271351).
- CVE-2026-40468: use-after-free vulnerability in gawk's 'io.c' file could permit heap metadata manipulation and host
memory exhaustion (bsc#1271352).
- CVE-2026-40553: buffer overflow in the ftype() routine of the readdir extension could trigger a program crash
(bsc#1271354).
-----------------------------------------------------------------
Advisory ID: 1348
Released: Sat Jul 25 18:36:55 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1271712
This update for openssl-3 fixes the following issue:
- 'HollowByte' DoS via attacker-controlled memory allocation (bsc#1271712).
-----------------------------------------------------------------
Advisory ID: 1350
Released: Mon Jul 27 11:30:50 2026
Summary: Recommended update for policycoreutils
Type: recommended
Severity: moderate
References: 1271645
This update for policycoreutils fixes the following issues:
Changes in policycoreutils:
- Drop /tmp cleanup to avoid TOCTOU issues (bsc#1271645)
- can be dropped once 'policycoreutils/scripts/fixfiles: drop /tmp cleanup' is
in the upstream release
-----------------------------------------------------------------
Advisory ID: 1562
Released: Mon Aug 31 07:56:37 2026
Summary: Security update for libgpg-error
Type: security
Severity: moderate
References: 1263078
This update for libgpg-error fixes the following issue:
- Out-of-bounds read in `_gpgrt_vfnameconcat` of `stringutils.c` when the `GPGRT_FCONCAT_SYSCONF` flag is used
(bsc#1263078).
-----------------------------------------------------------------
Advisory ID: 1573
Released: Mon Aug 31 22:36:28 2026
Summary: Recommended update for gcc16
Type: recommended
Severity: moderate
References: 1272616
This update for gcc16 fixes the following issues:
gcc16 is shipped as new package.
This update ships the GNU Compiler Collection GCC 16.2.
The compiler runtime libraries are provided for SUSE Linux Enterprise 16.0
versions and replace the same named GCC 14 ones.
The new compilers are provided in the PackageHub 16.0 only.
To use gcc16 compilers use:
- install 'gcc16' or 'gcc16-c++' or one of the other 'gcc16-COMPILER' frontend packages.
- override your Makefile to use CC=gcc16, CXX=g++16 and similar overrides for the other languages.
For a full changelog with all new GCC16 features, check out
https://gcc.gnu.org/gcc-16/changes.html
- Update to GCC 16.2 release (gcc-16.2.0+git9497)
* accumulated bugfixes from the gcc-16 release branch
- Disable multilibs for cross-x86_64-gcc
-----------------------------------------------------------------
Advisory ID: 1592
Released: Wed Sep 2 17:55:21 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: 1602
Released: Thu Sep 3 22:41:28 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1237515,1254924,1259418,1259650,1261400,1271444,CVE-2026-16742,CVE-2026-29111,CVE-2026-40226,CVE-2026-4105
This update for systemd fixes the following issue:
Security issue fixed:
- CVE-2026-16742: `systemd-homed`: local privilege escalation due to missing home record signature verification on
the authentication path (bsc#1271444).
Non security issue fixed:
- `systemd-resolved` fails to start due to write access to `tmpfs` denied (bsc#1237515).
-----------------------------------------------------------------
Advisory ID: 1608
Released: Fri Sep 4 14:36:16 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1265400,1273901,1274861
This update for selinux-policy fixes the following issues:
- Update to version 20250627+git392.40ceb80be:
* Label the postgresql executables correctly (bsc#1274861)
- Update to version 20250627+git390.01f688865:
* (open)SUSE only sendmail fixes (bsc#1273901)
- Update to version 20250627+git388.83e19dbcd:
* Support vfs_snapper to work with samba_share_t (bsc#1265400)
* vfs_samba uses dbus to communicate with snapper (bsc#1265400)
-----------------------------------------------------------------
Advisory ID: 1610
Released: Fri Sep 4 15:48:44 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: 1650
Released: Wed Sep 9 16:07:45 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1275219,1275492
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
- Fix: SELinux denials during bees service startup / stop (bsc#1275219):
* named filetrans for netconfig
* Fix regression that was introduced with fix_unconfined patch
- Fix: [SELinux] kanidm_ssh_authorizedkeys unable to access user's ssh key,
denying ssh access (bsc#1275492):
* sshd_session_t needs to access kanidm sshkeys
* Fix broken kanidm_sshkeys_t security context
-----------------------------------------------------------------
Advisory ID: 1661
Released: Fri Sep 11 13:45:57 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
-----------------------------------------------------------------
Advisory ID: 1688
Released: Wed Sep 16 16:28:22 2026
Summary: Security update for rpm
Type: security
Severity: important
References: 1218459,1253139,1259215,1268747,1269150,1269571,1269584,CVE-2026-44604,CVE-2026-44605
This update for rpm fixes the following issues:
Changes in rpm:
- split imaevmsign plugin into a multibuild flavor
Changes in rpm:
- Add Requires: (rpm-plugin-selinux if selinux-policy)
- harden ndb code [bsc#1269584] [CVE-2026-44605]
- split all plugins into subpackages
* this allows for an easy way to get rid of a plugin, it's also
what other distributions do
- make the imaevmsign plugin build in a multibuild flavor
- rpm2archive: use size 0 for hardlinked files as bnew versions of
gnu tar reject non-zero sizes [bsc#1269150]
- backport fix for add_sysuser macro [bsc#1269571]
- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]
- switch from rpmpgp_legacy to libpgpr
* multiple bug fixes, support for v5 and v6 signatures
- turn on imaevm file signature support and move the imaevm code
that needs the libimaevm library into a plugin. Put this
plugin into a new 'rpm-imaevmsign' subpackage. [jsc#PED-7246]
- Fix 'unexpected EOF' when using rpmbuild to install ELF binaries
due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)
- Remove /var/lib/rpm migration scripting, retain an error if old
location is found
- Use systemd-tmpfiles to create & maintain /var/lib/rpm symlink
(boo#1253139)
- flush scriptlet notification messages in --runposttrans
* needed to fix leaking tmp files [bsc#1218459]
* added 'rpm_flushes_runposttrans' provides for libzypp
-----------------------------------------------------------------
Advisory ID: 1707
Released: Fri Sep 18 18:31:02 2026
Summary: Recommended update for gcc15, gcc16
Type: recommended
Severity: critical
References: 1277919
This update for gcc15, gcc16 fixes the following issues:
Changes in gcc15:
- Rebuild to rename library packages after the switch to gcc16
libraries.
Changes in gcc16:
- Fix build reproducability when PCH is used.
- Fix auto-detection of Zen6 [bsc#1277919]
- Remove support for s390 (32bit), make sure to configure s390x with
--disable-multilib to avoid configury error without explicit
disable of multilibs. Support for s390 is officially deprecated.
-----------------------------------------------------------------
Advisory ID: 1733
Released: Tue Sep 22 09:23:33 2026
Summary: Security update for util-linux
Type: security
Severity: important
References: 1261606,1268886,1269583,1270219,1275441,1278347,1278348,1278349,CVE-2026-13595,CVE-2026-27456,CVE-2026-53612,CVE-2026-53613,CVE-2026-53614,CVE-2026-76642,CVE-2026-78408,CVE-2026-78410
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).
- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).
- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec
Bypass in SUID mount(8) (bsc#1268886).
- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege
escalation (bsc#1278349).
- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or
termination of root processes (bsc#1278348).
- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`
redirection (bsc#1278347).
Changes for util-linux:
- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)
- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
- lib/fileutils: fix unused parameter warnings without SYS_openat2
- libmount: add missing fileutils.h include to hook_idmap.c
- libmount: add mnt_open_tree() helper for safe tree opening
- libmount: pin source path with openat2() for restricted users
(bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: restrict source path canonicalization for non-root
users (bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: skip post-mount hooks after failed mount helper
(bsc#1275441, bsc#1278349, CVE-2026-76642)
- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
- nsenter: close cgroup.procs fd after join to prevent authority
leak (bsc#1275441, bsc#1278348, CVE-2026-78408)
- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,
bsc#1278348, CVE-2026-78408)
- wall, write: sanitize hostname in banner header (bsc#1275441)
- Add missing function. (bsc#1275441)
- ipcutils: Prevent using uninitialized variable (bsc#1268886)
- BREAKING CHANGE:
Paths must always be canonicalized for unprivileged users to
ensure safe target resolution. X-mount.nocanonicalize is ignored
for them.
- INCOMAPTIBLE CHANGE (linux < 6.15):
X-mount.subdir: The safe detached subdirectory is no more
supported for unprivileged users for safety reasons.
- liblastlog2: Wait on busy SQLite connections (bsc#1268886).
- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root
(bsc#1268886).
- libblkid: Fix use-after-free in nested partition probing
(bsc#1269583, bsc#1268886, CVE-2026-13595)
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy
mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).
- fileutils: add ul_open_no_symlinks() needed by other patches
(bsc#1268886).
- libmount: add fd_target to context for TOCTOU race condition
prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).
- libmount: ignore X-mount.nocanonicalize for restricted users
- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,
CVE-2026-53612, GHSA-g8wm-75wr-g2vh).
- libmount: restrict X-mount.subdir for non-root (bsc#1268886).
- libmount: use fd_target in hook_idmap for move_mount()
- libmount: add mount ID verification and man page TOCTOU note
- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
(bsc#1268886#c2, bsc#1261606).
- Ignore pam-config error that prevents update failure if common*
pam configuration is not symlink to common-*-pc (bsc#1270219).
-----------------------------------------------------------------
Advisory ID: 1747
Released: Wed Sep 23 21:42:24 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).
-----------------------------------------------------------------
Advisory ID: 1748
Released: Wed Sep 23 21:47:23 2026
Summary: Security update for kbd
Type: security
Severity: important
References: 1275441,CVE-2026-72693
This update for kbd fixes the following issue:
- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows
`passwordless` root login (bsc#1275441).
-----------------------------------------------------------------
Advisory ID: 1754
Released: Thu Sep 24 09:07:13 2026
Summary: Security update for expat
Type: security
Severity: important
References: 1262263,1264713,1267631,1268572,1268573,1275096,1275594,1275732,1275859,1275860,1275915,CVE-2026-41080,CVE-2026-45186,CVE-2026-50219,CVE-2026-56131,CVE-2026-56132,CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,CVE-2026-56411,CVE-2026-56412,CVE-2026-66046,CVE-2026-72522,CVE-2026-76641,CVE-2026-76956,CVE-2026-76957
This update for expat fixes the following issues:
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a
denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,
XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).
- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within
handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer
overflows (bsc#1268573).
- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code
execution (bsc#1275096).
- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory
corruption, and application crashes (bsc#1275096).
- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary
code execution (bsc#1275096).
- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and
application crashes (bsc#1275096).
- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial
of service (bsc#1275096).
- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes
(bsc#1275096).
- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and
arbitrary file write conditions (bsc#1275096).
- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information
disclosure, and potential code execution (bsc#1275096).
- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and
denial of service (bsc#1275096).
- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free
conditions and arbitrary code execution (bsc#1275096).
- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the
storeAtts() function in xmlparse.c (bsc#1275732).
- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger
memory corruption (bsc#1275915).
- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via
crafted X (bsc#1275860).
- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).
Changes for expat:
- Updated to version 2.8.4
-----------------------------------------------------------------
Advisory ID: 1767
Released: Tue Sep 29 10:27:00 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1279051,1282303
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
Update to version 20250627+git405.e266baf49:
* Add common criteria banner labels (bsc#1282303)
* Fix corrupted formatting in files.if
* Allow rsync to getattr pipes and sockes if rsync_export_all_ro is set (bsc#1279051)
* Introduce files_getattr_non_auth_sockets
* Introduce files_getattr_non_auth_pipes interface
-----------------------------------------------------------------
Advisory ID: 1769
Released: Tue Sep 29 14:25:10 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
(bsc#1282509).
Other changes:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: 1790
Released: Wed Sep 30 11:29:23 2026
Summary: Recommended update for ca-certificates-mozilla
Type: recommended
Severity: moderate
References: 1279961
This update for ca-certificates-mozilla fixes the following issues:
Changes in ca-certificates-mozilla:
- Updated to 2.90 state (bsc#1279961):
* Removed:
+ AffirmTrust Commercial
+ AffirmTrust Networking
+ AffirmTrust Premium
+ AffirmTrust Premium ECC
+ certSIGN ROOT CA
+ Entrust Root Certification Authority
+ PKI Root Certification Authority
+ FIRMAPROFESIONAL CA ROOT-A WEB
+ GLOBALTRUST 2020
+ Secure Global CA
+ SecureSign Root CA12
+ SecureTrust CA
+ TeliaSonera Root CA v1
+ Trustwave Global Certification Authority
+ Trustwave Global ECC P256 Certification Authority
+ Trustwave Global ECC P384 Certification Authority
+ XRamp Global Certification Authority
* Added:
+ SECOM SMIME RSA Root CA 2024
+ SECOM TLS ECC Root CA 2024
+ SECOM TLS RSA Root CA 2024
+ SecureSign Root CA16
+ Telia EC Email Root CA v3
+ Telia EC TLS Root CA v3
+ Telia RSA Email Root CA v3
+ Telia RSA TLS Root CA v3
-----------------------------------------------------------------
Advisory ID: 1792
Released: Wed Sep 30 17:02:45 2026
Summary: Recommended update for jitterentropy
Type: recommended
Severity: moderate
References: 1282301
This update for jitterentropy fixes the following issues:
Changes in jitterentropy:
- OSR has to be at least 5 according to current reviews. (bsc#1282301)
-----------------------------------------------------------------
Advisory ID: 1899
Released: Mon Oct 12 10:05:58 2026
Summary: Recommended update for netcfg
Type: recommended
Severity: important
References: 1211886,1243708,1263098,1282745,822653
This update for netcfg fixes the following issues:
Changes in netcfg:
- Don't replace /etc/services on updates (bsc#1282745)
- Add missing changes from factory:
* Add missing %verify(not mode) (bsc#1263098)
* services: remove invalid SIEVE entry (bsc#1243708, bsc#822653)
* Add krb-prop entry (bsc#1211886)
-----------------------------------------------------------------
Advisory ID: 1900
Released: Mon Oct 12 10:48:41 2026
Summary: Recommended update for selinux-policy
Type: recommended
Severity: moderate
References: 1257101,1278135,1279565
This update for selinux-policy fixes the following issues:
Changes in selinux-policy:
- Update to version 20250627+git412.dbf877ab7:
* Fix typo in screen.fc
* Allow cscreend to start screen as unconfined domain (bsc#1257101)
* Label charon-nm as ipsec_exec_t (bsc#1278135)
- Update to version 20250627+git407.e864ced8f:
* Allow rsync to read var_t (bsc#1279565)
-----------------------------------------------------------------
Advisory ID: 1909
Released: Tue Oct 13 17:13:54 2026
Summary: Recommended update for rpm
Type: recommended
Severity: moderate
References:
This update for rpm fixes the following issues:
Changes in rpm:
- Do not dependent on python3-base, it is perfectly OK to use
any Python interpreter for python-rpm-packaging.
- Remove obsolete Python2-based removal of Python directories.
-----------------------------------------------------------------
Advisory ID: 1916
Released: Wed Oct 14 17:16:30 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
-----------------------------------------------------------------
Advisory ID: 1919
Released: Thu Oct 15 14:13:14 2026
Summary: Security update for p11-kit
Type: security
Severity: moderate
References: 1269664,1280702,CVE-2026-13757,CVE-2026-18938
This update for p11-kit fixes the following issues:
- CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
- CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage
on 32 bit systems (bsc#1280702).
The following package changes have been done:
- elemental-lifecycle-manager-0.1.1.20260729+39103b7-160000.1.4 updated
- netcfg-11.6-160000.4.1 updated
- libp11-kit0-0.25.5-160000.3.1 updated
- p11-kit-0.25.5-160000.3.1 updated
- p11-kit-tools-0.25.5-160000.3.1 updated
- rpm-plugin-selinux-4.20.1-160000.4.1 updated
- rpm-4.20.1-160000.4.1 updated
- libopenssl3-3.5.0-160000.11.1 updated
- selinux-policy-20250627+git412.dbf877ab7-160000.1.1 updated
- selinux-policy-targeted-20250627+git412.dbf877ab7-160000.1.1 updated
More information about the sle-container-updates
mailing list