SUSE-CU-2026:10655-1: Security update of suse/sl-micro/6.0/toolbox

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sl-micro/6.0/toolbox
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:10655-1
Container Tags        : suse/sl-micro/6.0/toolbox:13.2 , suse/sl-micro/6.0/toolbox:13.2-9.167 , suse/sl-micro/6.0/toolbox:latest
Container Release     : 9.167
Severity              : important
Type                  : security
References            : 1267974 1275441 1276223 1276226 CVE-2026-15806 CVE-2026-17084
                        CVE-2026-72693 CVE-2026-9669 
-----------------------------------------------------------------

The container suse/sl-micro/6.0/toolbox was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 903
Released:    Wed Sep 16 11:12:51 2026
Summary:     Security update for kbd
Type:        security
Severity:    important
References:  1275441,CVE-2026-72693
This update for kbd fixes the following issue:

- CVE-2026-72693: local privilege escalation in `openvt` due to incorrect process owner verification that allows
  `passwordless` root login (bsc#1275441).

-----------------------------------------------------------------
Advisory ID: 902
Released:    Wed Sep 16 11:46:06 2026
Summary:     Security update for python311
Type:        security
Severity:    moderate
References:  1267974,1276223,1276226,CVE-2026-15806,CVE-2026-17084,CVE-2026-9669
This update for python311 fixes the following issues:

- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another
  scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside 
  Unicode 3.2.0 (bsc#1276226).

Changes for python311:

- Updated to version 3.11.16


The following package changes have been done:

- SL-Micro-release-6.0-25.133 updated
- kbd-legacy-2.6.4-2.1 updated
- kbd-2.6.4-2.1 updated
- libpython3_11-1_0-3.11.16-1.1 updated
- python311-base-3.11.16-1.1 updated
- skelcd-EULA-SL-Micro-2024.01.19-8.132 updated