SUSE-IU-2026:6815-1: Security update of suse/sl-micro/6.2/base-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.2/base-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:6815-1
Image Tags        : suse/sl-micro/6.2/base-os-container:2.3.1 , suse/sl-micro/6.2/base-os-container:2.3.1-8.66 , suse/sl-micro/6.2/base-os-container:latest
Image Release     : 8.66
Severity          : important
Type              : security
References        : 1262633 1263440 1267696 1268412 1276764 1277476 1277479 1277480
                        CVE-2026-10805 CVE-2026-13608 CVE-2026-19685 CVE-2026-5773 CVE-2026-7168
                        CVE-2026-80229 CVE-2026-80230 CVE-2026-8926 
-----------------------------------------------------------------

The container suse/sl-micro/6.2/base-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1622
Released:    Sun Sep  6 18:56:18 2026
Summary:     Security update for curl
Type:        security
Severity:    moderate
References:  1262633,1263440,1268412,1277476,1277479,1277480,CVE-2026-13608,CVE-2026-5773,CVE-2026-7168,CVE-2026-80229,CVE-2026-80230,CVE-2026-8926
This update for curl fixes the following issues:

- CVE-2026-5773: wrong reuse of SMB connection (bsc#1262633).
- CVE-2026-7168: cross-proxy Digest auth state leak (bsc#1263440).
- CVE-2026-8926: password leak with netrc and user in URL (bsc#1268412).
- CVE-2026-13608: OpenLDAP SASL authentication bypass (bsc#1277476).
- CVE-2026-80229: OpenSSL provider use-after-free (bsc#1277479).
- CVE-2026-80230: OpenSSL pinning bypass (bsc#1277480).

-----------------------------------------------------------------
Advisory ID: 1624
Released:    Sun Sep  6 19:07:25 2026
Summary:     Security update for NetworkManager
Type:        security
Severity:    important
References:  1267696,1276764,CVE-2026-10805,CVE-2026-19685
This update for NetworkManager fixes the following issues:

- CVE-2026-10805: local privilege escalation via malformed MUD URLs in dhclient backend (bsc#1267696).
- CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server
  certificate validation bypass (bsc#1276764).


The following package changes have been done:

- libcurl4-8.14.1-160000.9.1 updated
- libnm0-1.52.0-160000.5.1 updated
- curl-8.14.1-160000.9.1 updated
- NetworkManager-1.52.0-160000.5.1 updated