<div class="container">
<h1>Security update for libapr1, libtcnative-1-0, tomcat</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:4927-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-29T08:51:54Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>critical</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1130843">bsc#1130843</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1151059">bsc#1151059</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1199170">bsc#1199170</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1260322">bsc#1260322</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282581">bsc#1282581</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282599">bsc#1282599</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282620">bsc#1282620</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282621">bsc#1282621</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282622">bsc#1282622</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282623">bsc#1282623</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282624">bsc#1282624</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282625">bsc#1282625</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282626">bsc#1282626</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282627">bsc#1282627</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282628">bsc#1282628</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282629">bsc#1282629</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282630">bsc#1282630</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282631">bsc#1282631</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282787">bsc#1282787</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286361">bsc#1286361</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286362">bsc#1286362</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286502">bsc#1286502</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286555">bsc#1286555</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286559">bsc#1286559</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286571">bsc#1286571</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286902">bsc#1286902</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2017-12613.html">CVE-2017-12613</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2023-49582.html">CVE-2023-49582</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-101296.html">CVE-2026-101296</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-101356.html">CVE-2026-101356</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-41293.html">CVE-2026-41293</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-73581.html">CVE-2026-73581</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-74048.html">CVE-2026-74048</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-74049.html">CVE-2026-74049</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-75973.html">CVE-2026-75973</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-76183.html">CVE-2026-76183</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-77756.html">CVE-2026-77756</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-77762.html">CVE-2026-77762</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-77791.html">CVE-2026-77791</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-78383.html">CVE-2026-78383</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-78437.html">CVE-2026-78437</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-79677.html">CVE-2026-79677</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-80353.html">CVE-2026-80353</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-86243.html">CVE-2026-86243</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-86246.html">CVE-2026-86246</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-86247.html">CVE-2026-86247</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-86248.html">CVE-2026-86248</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-86350.html">CVE-2026-86350</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-87022.html">CVE-2026-87022</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-88041.html">CVE-2026-88041</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-93446.html">CVE-2026-93446</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2017-12613</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.4</span>
<span class="cvss-vector">CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2017-12613</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2017-12613</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2023-49582</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2023-49582</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2023-49582</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2023-49582</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.5</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101296</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101296</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101296</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101356</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101356</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-101356</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41293</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41293</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41293</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-73581</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-73581</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-73581</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74048</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74048</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74049</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-74049</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-75973</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-75973</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-75973</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-76183</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-76183</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-76183</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77756</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77756</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77756</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77762</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77762</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77762</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77791</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77791</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-77791</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-78383</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-78383</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-78383</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-78437</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-78437</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-78437</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-79677</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-79677</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-79677</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-80353</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-80353</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.6</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86243</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86243</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86243</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86246</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86246</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86246</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86247</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86247</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86247</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86248</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86248</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86248</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86350</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86350</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-86350</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-87022</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-87022</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-87022</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-88041</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-88041</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-93446</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-93446</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5 LTSS</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP5</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 25 vulnerabilities and has one security fix can now be installed.</p>
<h2>Description:</h2>
<p>This update for libapr1, libtcnative-1-0, tomcat fixes the following issues:</p>
<ul>
<li>CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
(bsc#1282631).</li>
<li>CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502).</li>
<li>CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555).</li>
<li>CVE-2026-75973: improper authentication when Jakarta authentication is configured with <code>SimpleAuthConfigProvider</code>
(bsc#1282630).</li>
<li>CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629).</li>
<li>CVE-2026-77756: inconsistent interpretation of HTTP requests allows an attacker to cause one request from another user
to fail when Tomcat is located behind a reverse proxy (bsc#1282628).</li>
<li>CVE-2026-77762: stale HPACK emitter injects trailers fields into another HTTP/2 request (bsc#1282599).</li>
<li>CVE-2026-77791: uncontrolled resource consumption when sending WebSocket close message enabled a DoS attack
(bsc#1282627).</li>
<li>CVE-2026-78383: allocation of resources without limits or throttling allows an unauthenticated AJP request to pin an
AJP processing thread leading to denial of service (bsc#1282626).</li>
<li>CVE-2026-78437: incomplete cleanup allows a malformed request to potentially cause requests from another user to fail
(bsc#1282625).</li>
<li>CVE-2026-79677: missing release of resource after effective lifetime and comparison using wrong factors allows for
denial of service due to lost time outs for asynchronous WebSocket writes (bsc#1282624).</li>
<li>CVE-2026-80353: TOCTOU when creating unix domain sockets for the APR/Native connector allows an unauthorized local
user to access the unix domain socket (bsc#1286902).</li>
<li>CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash
(bsc#1282623).</li>
<li>CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and
ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622).</li>
<li>CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some
configurations (bsc#1282621).</li>
<li>CVE-2026-86248: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled
(bsc#1282620).</li>
<li>CVE-2026-86350: HTTP/2 requests can cause request header mix-ups and HTTP request smuggling (bsc#1282787).</li>
<li>CVE-2026-87022: WebSocket message smuggling when per-message-deflate is used (bsc#1282581).</li>
<li>CVE-2026-88041: Information disclosure via incomplete HTTP trailer cleanup (bsc#1286559).</li>
<li>CVE-2026-93446: Possible TLS 1.3 connection failures (bsc#1286571).</li>
<li>CVE-2026-101296: Authentication bypass via non-GSSAPI SASL in JNDI realm (bsc#1286361).</li>
<li>CVE-2026-101356: Information disclosure via incorrect object recycling in HTTP/2 processing (bsc#1286362).</li>
</ul>
<p>Non security issue fixed:</p>
<ul>
<li>Tomcat TLS Broken - Tomcat 9.0.14 update incompatible with tomcat-native (bsc#1130843).</li>
</ul>
<p>Changes for libapr1:</p>
<p>Update to 1.6.5:</p>
<ul>
<li>Fix Win32 build breakage in apr_os_exp_time_put() in 1.6.4</li>
<li>Fix apr_parse_addr_port() regression in scope_id parsing
introduced in 1.6.3</li>
<li>Numerous corrections to APR poll behavior</li>
<li>apr_file_trunc: Truncating a buffered file could add unexpected
data after the truncate position</li>
<li>apr_file_trunc: Fix an issue where reading from a buffered file
after truncate could return stale data from the buffer</li>
<li>apr_ipsubnet_create() now fails for an empty input string</li>
<li>Fix CVE-2017-12613, out-of-bounds read in apr_time_exp*()</li>
<li>Export build files find_apr.m4 and apr_common.m4</li>
<li>apr_proc_mutex-pthread: Refcount shared mutexes usage to avoid
destruction while still in use by some process(es)</li>
<li>New APIs: apr_allocator_align(), apr_os_proc_mutex_put_ex(),
apr_os_proc_mutex_get_ex(), apr_os_proc_mutex_set_ex(),
apr_file_pipe_create_pools(), apr_pollcb_wakeup(),
apr_pollcb_method_name(), apr_cstr_<em>(), apr_skiplist_addne</em>(),
apr_skiplist_size(), apr_skiplist_height(),
apr_skiplist_preheight(), apr_skiplist_set_preheight(),
apr_skiplist_add(), apr_sockaddr_info_copy(), apr_shm_delete(),
apr_escape_ldap() and apr_pescape_ldap()</li>
<li>Add APR_OVERLAP_TABLES_ADD, APR_SO_FREEBIND and the
APR_PERMS_SET macros</li>
<li>Add Unix domain socket support</li>
<li>New configure options --enable-allocator-guard-pages and
--enable-pool-concurrency-check</li>
</ul>
<p>Changes for libtcnative-1-0:</p>
<ul>
<li>Update to 1.3.9</li>
<li>Security fixes</li>
<li>Client certificate requirements can be down-graded
(bsc#1282621, CVE-2026-86247)
A race condition allowed client certificate verification
requirements to be down-graded for some configurations.</li>
<li>Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246)
Apache Tomcat Native enabled insecure options by default
including ALLOW_CLIENT_RENEGOTIATION,
NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and
ALLOW_NO_DHE_KEX.</li>
<li>DoS via TLS handshake (bsc#1282623, CVE-2026-86243)
A buffer over-read vulnerability in Apache Tomcat Native
during the TLS handshaking permits a malicious user to trigger
a DoS via a JVM crash.</li>
<li>Changes</li>
<li>Code: Remove call to ERR_remove_thread_state() from Windows
specific code to allow building with OpenSSL 4.0.x.
ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got
removed in OpenSSL 4</li>
<li>Fix: Fix a potential crash when negotiating ALPN</li>
<li>If ALPN negotiation fails and failure is configured to use
the last server protocol in the list, use it rather than the
last protocol offered by the client</li>
<li>Fix: Add support for the extended range of options available
from OpenSSL 3.0.x. The options flag is now a 64-bit unsigned
int (represented by a Java long) rather than a 32-bit unsigned
int (represented by a Java int)</li>
<li>Code: Remove unused code</li>
<li>Ensure that per connection changes to certificate verification
settings, e.g. to support client certificate authentication,
do not modify the certificate verification settings for other
connections</li>
<li>Fix: Fix a potential crash when configuring raw certificates</li>
<li>Fix: Avoid a potential crash with very long ALPN protocol
names</li>
<li>Fix: Make the call to a CertificateVerifier more robust</li>
<li>Fix: Avoid a potential crash when processing OCSP URLs</li>
<li>Fix: Make the processing of OCSP responses more robust</li>
<li>Fix: Stricter OCSP handling when soft-fail is disabled</li>
<li>Fix: Harden against the mis-use of Buffer.address(ByteBuffer)</li>
<li>Fix: Harden against the mis-use of Pool.destroy(long)</li>
<li>Code: The minimum supported OpenSSL version is now 3.0.x.
OpenSSL 1.1.1 support was accidentally broken in 1.3.8. As no
bug reports were receive for that failure and since both
Debian and Ubuntu versions that used OpenSSL 1.1.1 have
reached end of support, OpenSSL 1.1.1 is no longer supported</li>
<li>Update: OpenSSL 3.0.x is approaching end of support so the
recommended version of OpenSSL (and the version that windows
binaries will be built with) now follows the 3.5.x LTS branch</li>
<li>Fix: Switch to automatic configuration of DH parameters.
Manual configuration attempts will be ignored</li>
<li>Code: Make setTmpECDHByCurveName() a NO-OP</li>
<li>Fix: Refactor extraction of ECDH curve name from the
Certificate to avoid deprecated OpenSSL methods</li>
<li>Fix: Refactor the native implementation of SSL.getTime() to
avoid the Y2038 problem in SSL_SESSION_get_time() when running
on a verion of OpenSSL that includes the new
SSL_SESSION_get_time_ex() method</li>
<li>restore openssl 1.1.1 support</li>
<li>Update to 1.3.8</li>
<li>Fix a memory leak when parsing certificates</li>
<li>Fix two potential memory leaks on error paths identified by
Copilot</li>
<li>Fix post handshake authentication when Tomcat is configured
with a trust store using JSSE style configuration</li>
<li>Correct expected size of tickets when calling
SSLContext.setSessionTicketKeys</li>
<li>Update to 1.3.7: [bsc#1260322]
1.3.7</li>
<li>Code: Refactor access to ASN1_OCTET_STRING to use setters to fix
errors when building against the latest OpenSSL 4.0.x code. (markt)</li>
<li>Fix: Fix the handling of OCSP requests with multiple responder URIs.
(jfclere)</li>
<li>Fix: Fix the handling of TRY_AGAIN responses to OCSP requests when
soft fail is disabled. (jfclere)
1.3.6</li>
<li>Code: Refactor the SSL_CONF_CTX clean-up to align it with SSL and
SSL_CTX clean-up. (markt)</li>
<li>Fix: Fix unnecessarily large buffer allocation when filtering out NULL
and export ciphers. Pull requests #35 and #37 provided by chenjp.
(markt)</li>
<li>Fix: Fix a potential memory leak if an invalid OpenSSLConf is
provided. Pull request #36 provided by chenjp. (markt)</li>
<li>Fix: Refactor setting of OCSP configuration defaults as they were only
applied if the SSL_CONF_CTX was used. While one was always used with
Tomcat versions aware of the OCSP configuration options, one was not
always used with Tomcat versions unaware of the OCSP configuration
options leading to OCSP verification being enabled by default when the
expected behaviour was disabled by default. (markt)</li>
<li>Code: Improve performance for the rare case of handling large OCSP
responses. (markt)
1.3.5</li>
<li>Fix: Remove group write permissions from the files in the tar.gz
source archive. (markt)</li>
<li>Fix: Clear an additional error in OCSP processing that was preventing
OCSP soft fail working with Tomcat's APR/native connector. (markt)
1.3.4</li>
<li>Fix: Correct logic error that prevented the configuration of TLS 1.3
cipher suites. (markt)
1.3.3</li>
<li>Fix: Refactor the addition of TLS 1.3 cipher suite configuration to
avoid a regression when running a version of Tomcat that pre-dates
this change. (markt)
1.3.2</li>
<li>Update: Rename configure.in to modern autotools style configure.ac.
(rjung)</li>
<li>Update: Fix incomplete updates for autotools generated files during
"buildconf" execution. (rjung)</li>
<li>Update: Improve quoting in tcnative.m4. (rjung)</li>
<li>Update: Update the minimum version of autoconf for releasing to 2.68.</li>
<li>Fix: Fix the autoconf warnings when creating a release. (markt)</li>
<li>Update: The Windows binaries are now built with OCSP support enabled
by default. (markt)</li>
<li>Add: Include a nonce with OCSP requests and check the nonce, if any,
in the OCSP response. (markt)</li>
<li>Add: Expand verification of OCSP responses. (markt)</li>
<li>Add: Add the ability to configure the OCSP checks to soft-fail - i.e.
if the responder cannot be contacted or fails to respond in a timely
manner the OCSP check will not fail. (markt)</li>
<li>Add: Add a configurable timeout to the writing of OCSP requests and
reading of OCSP responses. (markt)</li>
<li>Add: Add the ability to control the OCSP verification flags. (markt)</li>
<li>Add: Configure TLS 1.3 connections from the provided ciphers list as
well as connections using TLS 1.2 and earlier. Pull request provided
by gastush. (markt)</li>
<li>Update: Update the Windows build environment to use Visual Studio</li>
<li>(markt)
1.3.1</li>
<li>Fix: Fix a crash on Windows when SSLContext.setCACertificate() is
invoked with a null value for caCertificateFile and a non-null value
for caCertificatePath until properly addressed with
https://github.com/openssl/openssl/issues/24416. (michaelo)</li>
<li>Add: Use ERR_error_string_n with a definite buffer length as a named
constant. (schultz)</li>
<li>Add: Ensure local reference capacity is available when creating new
arrays and Strings. (schultz)</li>
<li>Update: Update the recommended minimum version of OpenSSL to 3.0.14.
1.3.0</li>
<li>Update: Drop useless compile.optimize option. (michaelo)</li>
<li>Update: Align Java source compile configuration with Tomcat.
(michaelo)</li>
<li>Fix: Fix version set in DLL header on Windows. (michaelo)</li>
<li>Update: Remove an unreachable if condition around CRLs in
sslcontext.c. (michaelo)</li>
<li>Fix: 67818: When calling SSL.setVerify() or SSLContext.setVerify(),
the default verify paths are no longer set. Only the explicitly
configured trust store, if any, will be used. (michaelo)</li>
<li>Update: Update the minimum supported version of LibreSSL to 3.5.2.</li>
<li>Design: Remove NPN support as NPN was never standardised and browser
support was removed in 2019. (markt)</li>
<li>Update: Update the recommended minimum version of OpenSSL to 3.0.13.</li>
<li>Fix build after removal of the default %%{java_home} define</li>
<li>Update to 1.2.39:</li>
<li>Fix: 67061: If the insecure optionalNoCA certificate verification
mode is used, disable OCSP if enabled else client certificates
from unknown certificate authorities will be rejected.</li>
<li>Update: Update the recommended minimum version of OpenSSL to
3.0.11.</li>
<li>Change the hardcoded libopenssl-1_1-devel to libopenssl-devel
for distributions that have the right version</li>
<li>Version update to version 1.2.38:</li>
<li>Align default pass phrase prompt with HTTPd.</li>
<li>
<h1>66669: Fix memory leak in SNI processing.</h1>
</li>
<li>Update the recommended minimum version of OpenSSL to 1.1.1v.</li>
<li>Update the recommended minimum version of APR to 1.7.4.</li>
<li>Document the TLS rengotiation behaviour.</li>
<li>Add HOWTO-RELEASE.txt that describes the release process.</li>
<li>Refactor library initialization so it is compatible with Tomcat
10.1.x onwards where a number of Java classes have been removed.</li>
<li>Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to
allow clients to determine if the FIPS provider is being used
when Tomcat Native is compiled against OpenSSL 3.x.</li>
<li>
<h1>66035: Fix crash when attempting to read TLS session ID after</h1>
a handshake failure.</li>
<li>Enable download_deps.sh to be called from any directory.</li>
<li>Fix release script so it works with the current git layout.</li>
<li>
<h1>65441: Correct previous fix that enabled building to continue</h1>
with OpenSSL 3.x.</li>
<li>
<h1>65659: Remove remaining reference to pkg-config which is no</h1>
longer included in the Tomcat Native distribution.</li>
<li>
<h1>65181: Additional changes required to provided support for</h1>
using OpenSSL Engines that use proprietary key formats.</li>
<li>
<h1>65329: Correct handling of WINVER in make file to use correct</h1>
constant for Windows 7. Add constants for Windows 8, Windows 8.1
and Windows 10. Rename WINNT to WIN2k as it is used for Windows
2000 upwards, not Windows NT upwards.</li>
<li>Add a patch for APR that fixes an issue where some Windows
systems in some configurations would only listen on IPv6
addresses on dual stack systems even though configured to listen
on both IPv6 and IPv4 addresses.</li>
<li>Correct a regression in the fix for 65181 that prevented an
error message from being displayed if an invalid key file was
provided and no OpenSSL Engine was configured.</li>
<li>
<h1>65181: Improve support for using OpenSSL Engines that use</h1>
proprietary key formats.</li>
<li>Enable building to continue against OpenSSL 3.x and 1.1.1.</li>
<li>Incomplete name mangling fix for C++ compilers in tcn_api.h.</li>
<li>Improve OS-specific header include for native thread id.</li>
<li>Disable keylog callback support for LibreSSL.</li>
<li>Add support for SSLContext.addChainCertificateRaw() with
LibreSSL 2.9.1 and up.</li>
<li>Add support for HP-UX's _lwp_self() in our ssl_thread_id(void).</li>
<li>Remove default option passed for rpath to linker on HP-UX.</li>
<li>Add an option to allow the OCSP responder check to be bypassed.
Note that if OCSP is enabled, a missing responder is now treated
as an error.</li>
<li>
<h1>64429: Fix compilation with LibreSSL.</h1>
</li>
<li>
<h1>63671: libtcnative does not compile with OpenSSL < 1.1.0 and</h1>
APR w/o threading support.</li>
<li>Correct configure message for OpenSSL libdir.</li>
<li>
<h1>64260: Clean up install target.</h1>
</li>
<li>
<h1>64315: configure output for OpenSSL wrong/incomplete sometimes.</h1>
</li>
<li>Drop obsolete build time workarounds for HP-UX.</li>
<li>Add support for FreeBSD's pthread_getthreadid_np() in our
ssl_thread_id(void).</li>
<li>
<h1>64316: Introduce tcn_get_thread_id(void) to reduce code</h1>
duplication.</li>
<li>Fix linking against OpenSSL in non-standard locations on FreeBSD.</li>
<li>Add GPG keyring.</li>
<li>Version update to version 1.2.23:</li>
<li>See changelog.html for in-depth upstream changes</li>
<li>Version update to version 1.2.21:</li>
<li>Fix incompatibility with Tomcat (bsc#1130843)</li>
<li>Version update to version 1.2.16:</li>
<li>Fixes build breakage with newer version of openssl</li>
<li>Version update to version 1.2.4:</li>
<li>This connector to properly work requires openssl 1.0.2 or newer
so do not backport to other codestreams.</li>
<li>Remove keyring file as there is new keyring and I didn't find it
on the web</li>
<li>Update to version 1.1.32</li>
<li>Fix: 53952: Add support for TLSv1.2 and TLSv1.1.</li>
<li>Fix: 56844: Use OpenSSL 1.0.1j with Windows binaries.</li>
<li>Update: Use APR 1.5.1 with Windows binaries</li>
<li>version 1.1.30</li>
<li>Fixed double-free in ssl_ocsp_request. Patch provided by
Aristotelis.</li>
<li>Other minor bugfixes.</li>
</ul>
<p>Changes for tomcat:</p>
<p>Update to Tomcat 9.0.123</p>
<ul>
<li>Catalina</li>
<li>Fix: When starting a web application, don't try and use the web
application class loader until after the web application class loader
has started. (markt)</li>
<li>Fix: various concurrency issues around adding and removing Realms from a
CombinedRealm, in particular doing so while the CombinedRealm is in use.
Note that once a Realm instance has been removed from a CombinedRealm
instance at run-time, the removed Realm instance may not be reused apart
from re-adding it to the same CombinedRealm. (markt)</li>
<li>Update: When StoreConfig re-writes an existing server.xml or context
configuration file, preserve the layout of the existing file (comments,
blank lines and attribute order) on a best effort basis. (remm)</li>
<li>Fix: Track in StandardContext whether the context was deployed from a
Context element in server.xml. Use it to have StoreConfig save to a new
config file. (remm)</li>
<li>Fix: Improve error handling on start-up. (markt)</li>
<li>Fix: byte range responses generated by DefaultServlet so a short
resource stream read does not truncate the response. Treat a premature
end of stream as an I/O error. Based on pull request #1067 by aoto-tech.
(markt)</li>
<li>Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw
an Error when FIPS is requested but not available. (markt)</li>
<li>Fix: Ensure that, as per the documentation, a simple bind is always used
when the JNDI realm binds using the user provided name and password to
authenticate the user. (markt)</li>
<li>Update: Optimize Accept-Language header processing and use of resource
budles for localization. (remm)</li>
<li>Coyote</li>
<li>Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based
implementations of SSLEngine when the first flight of handshake messages
sent by the server is too large to fit in the buffer used by the BIO
pair. Patch submitted by Lukas Hellebrandt. (remm)</li>
<li>Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on
uploads. Submitted by Tim Burke. (remm)</li>
<li>Fix: Avoid very rare race between async write notification and
completion. Skip the write notification in these cases since it would be
useless. (remm)</li>
<li>Fix: a timing issue that could cause large non-blocking writes to stall
for AJP connections. (markt)</li>
<li>Fix: Ensure that the non-blocking write buffer is empty before sending
an AJP end response message. (markt)</li>
<li>Fix: CharChunk.indexOf(char) so that it searches from the start of the
chunk rather than from twice the chunk's start offset when the chunk
does not begin at the start of its buffer. (breken-ai)</li>
<li>Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when
part of the HTTP request body is received but not read. Based on a patch
provided by Guillaume Darmont. (markt)</li>
<li>Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it
is certain the JAR is not shared. (remm)</li>
<li>Fix: possible corruption of HTTP/1.1 chunked response bodies if a
previous write to a chunked body fails. (markt)</li>
<li>Fix: Align cipher order with the results produced by OpenSSL if the
cipher specification adds, removes and then re-adds ciphers. (markt)</li>
<li>Add: new attributes (unixDomainSocketParentPermissions and
unixDomainSocketParentOwner) to the APR/Native connector to provide
additional control over the security of Unix Domain Sockets. Additional
checks (enabled by default) have also been added for the directory where
the Unix Domain Socket will be created.(markt)</li>
<li>Fix: Correct a narrow race condition when processing HTTP/2 headers.</li>
<li>Fix: possible TLS connections failures caused by one of the flags Tomcat
uses to track TLS handshake progress not being correctly reset. (markt)</li>
<li>Fix: Allow for absolute host names in SNI checks. (markt)</li>
<li>Fix: Correct a gap in asynchronous error handling that could lead to
unexpected IllegalStateExceptions for some error conditions. (markt)</li>
<li>Add: Harden HTTP/2 against applications that do not correctly handle
asynchronous errors. (markt)</li>
<li>Jasper</li>
<li>Fix: Route JspC servlet context logging through Ant when used as an Ant
task. (sainadh777)</li>
<li>Fix: the tag plugin for the JSTL <c:redirtect> tag so that page
processing ends with the redirect. (markt)</li>
<li>Web applications</li>
<li>Add: Documentation: Explicitly state that virtual host matching via the
HTTP host header and TLS configuration matching via SNI are completely
separate processes. (markt)</li>
<li>Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the
WebSocket drawboard. (sainadh777)</li>
<li>Other</li>
<li>Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt)</li>
<li>Update: to NSIS 3.13. (markt)</li>
<li>Update: to Byte Buddy 1.18.14. (markt)</li>
<li>Update: to Bouncy Castle 1.8.6. (markt)</li>
<li>Add: Improvements to French translations. (remm)</li>
<li>Add: Improvements to Japanese translations provided by tak7iji. (markt)</li>
<li>Cluster</li>
<li>Fix: Replicate SSO session key set changes made by removeSession() and
sessionChangedId() in ClusterSingleSignOn so that SSO entries are
correctly deregistered and removed from all nodes when the last
associated session expires, even when the sessions expire on different
cluster nodes. (remm)</li>
<li>Fix: Move context attributes that were set while the web application was
still starting into the replicated attribute map when it is installed in
ReplicatedContext, so that they are replicated to the other nodes like
attributes set later on rather than remaining local to the node that
started the application. (remm)</li>
<li>Fix: a possible deadlock in DeltaSession.expire(): the final session
delta is now captured and sent to the cluster before the session monitor
is acquired, because obtaining the delta takes the delta lock and code
that runs while the delta lock is held, such as session attribute
listener notifications, may in turn wait for the session monitor. (remm)</li>
<li>Fix: Fire the documented send_message_failure lifecycle event with the
message, destination and exception when a SimpleTcpCluster message send
fails and notifyLifecycleListenerOnFailure is enabled. The event was
previously declared but never fired. (remm)</li>
<li>Fix: a possible deadlock in DeltaSession: session attribute listeners
are no longer called while the delta lock is held when attributes are
set or removed. The delta lock is only held while the change is
recorded. (markt)</li>
<li>Fix: a possible deadlock in DeltaSession: received session deltas are
now read into a separate DeltaRequest from the one the session uses to
record local changes. This avoids having to hold the delta lock while
processing received changes. (markt)</li>
<li>Fix: an issue replicating SessionListener additions and removals that
meant some modification were not replicated leading to inconsistent
listener configurations across the cluster. (markt)</li>
<li>Tribes</li>
<li>Docs: Document Tribes channel, membership, transport and replication
status available through JMX. Based on pull request #1071 by sainadh777.</li>
<li>Fix: Improve the handling of AsyncContext.dispatch() when the Context
attribute dispatchersUseEncodedPaths is set to false since the
application has no control over the path used for the
AsyncContext.dispatch(). Prior to this fix, paths containing literal '?'
characters were truncated. (markt)</li>
<li>Fix: Ensure that capture groups from a RewriteCond always reflect the
result of the current request. (markt)</li>
<li>Fix: When a PersistentManager needs to reduce the number of active
sessions, swap out the least recently used eligible sessions first. Pull
request #1045 provided by sainadh777. (markt)</li>
<li>Fix: Align web.xml logging output with the new Context attribute
urlPatternsProvidedInDecodedForm. (markt)</li>
<li>Fix: Improve robustness of DIGEST authentication to system clock jumps.</li>
<li>Add: Support multiple protocol header values (treat as a single merged
header value) in the RemoteIpFilter and RemoteIpValve. (markt)</li>
<li>Fix: potential concurrency issues when loading/saving sessions from/to a
session store. Custom Store implementations that do not extend StoreBase
must implement the new getSessionStoreLock() method of the Store
interface to ensure concurrency protection. The default method
implementation provided only provides the pre-fix functionality. (markt)</li>
<li>Fix: Ensure that PersistentManager implementations that extend
PersistentManagerBase do not swap out sessions that are associated with
a request that is currently being processed. As a result, it is now a
requirement that the system property
org.apache.catalina.session.StandardSession.ACTIVITY_CHECK is set to
true (either explicitly or via STRICT_SERVLET_COMPLIANCE) if either
minIdleSwap or maxIdleSwap are configured. (markt)</li>
<li>Fix: xreflection generated code stack overflow issue. (remm)</li>
<li>Fix: Align xreflection better with IntrospectionUtils. (remm)</li>
<li>Fix: In HTTP/2 after half closed (remote), any unexpected frame should
be a stream error. (remm)</li>
<li>Fix: incorrect initial window size calculation when upgrading to HTTP/2.
(remm)</li>
<li>Fix: Avoid HTTP/2 exceptions with invalid content-length values. (remm)</li>
<li>Fix: Only try and load the native library from the CATALINA_HOME system
property when the property is set. (markt)</li>
<li>Fix: max connections enforcement after an enpoint resume. (remm)</li>
<li>Fix: Implement stricter ALPN matching for Connectors using FFM. (markt)</li>
<li>Add: length validation for ALPN protocol names. (markt)</li>
<li>Fix: Make FFM certificate verification more robust. (markt)</li>
<li>Fix: Align FFM OCSP URL parsing with Tomcat Native and treat a parsing
failure as if no usable OCSP URLs were present. (markt)</li>
<li>Fix: Make the processing of OCSP responses more robust. (markt)</li>
<li>Fix: Stricter OCSP handling when soft-fail is disabled. (markt)</li>
<li>Fix: Cleaner handling of AJP response headers which overflow the maximum
message size. (remm)</li>
<li>Fix: Small per performance optimisation. Don't waste cycles swallowing
an AJP response body when the connection is going to be closed. (markt)</li>
<li>Fix: OpenSSL support for CRLs when using OpenSSL trust with the server
key held in a Java key store. (markt)</li>
<li>Fix: Reject HTTP/1.0 or earlier requests that send a transfer-encoding
header. (markt)</li>
<li>Fix: Ensure per request HTTP/2 bad request marker is cleared when the
request is recycled. (markt)</li>
<li>Fix: Additional clean-up after HTTP/2 stream reset to aid GC. (markt)</li>
<li>Fix: Revert earlier refactoring of HTTP/2 header field validation that
moved it earlier since the refactoring made correct handling of invalid
headers more difficult. (markt)</li>
<li>Fix: EL evaluation of some lambda expressions. (remm)</li>
<li>WebSocket</li>
<li>Fix: an exception when an automatic Pong response races with the closing
of the WebSocket session. (moritzfl)</li>
<li>Fix: Harden the WebSocket client and use a SecureRandom when generating
the Sec-WebSocket-Key header. (markt)</li>
<li>Fix: Improve robustness of client handshakes. (remm)</li>
<li>Fix: Ensure that WebSocket write timeouts apply to the complete message
and are not lost if two writes have the same timeout. (markt)</li>
<li>Fix: Reduce CPU usage while sending WebSocket close message. (markt)</li>
<li>Fix: overly broad check that prevented request URIs containing literal {
and } characters from being mapped to WebSocket end points. (markt)</li>
<li>Fix: handling of WebSocket messages with compressed payloads using per-
message-deflate that have one or more non-final blocks where the BFINAL
bit is set. (markt)</li>
<li>Fix: handling of per-message-deflate context takeover when receiving
compressed WebSocket messages. (markt)</li>
<li>Fix: Manager: Fix a potential concurrency issue when ordering sessions
prior to displaying a list of session. (markt)</li>
<li>Docs: Wrap the RewriteRule regular expression syntax reference on narrow
displays. Pull request #1044 by sainadh777. (markt)</li>
<li>Update: Easymock to 5.7.0. (markt)</li>
<li>Update: bnd to 7.4.0. (markt)</li>
<li>Update: Tomcat Native to 1.3.9. (markt)</li>
<li>Add: Improvements to Japanese translations provided by tak7iji and
Ktamura.biz.80. (markt)</li>
<li>Fix: Validate that the DeltaManager attribute sendAllSessionsSize is a
positive integer. Zero or negative values previously caused an infinite
loop or a NegativeArraySizeException during session state transfer. Pull
request #1042 provided by lihongyi87. (markt)</li>
<li>Fix: Improve robustness of cloud membership providers if an error occurs
fetching members. (remm)</li>
<li>jdbc-pool</li>
<li>Fix: DataSourceProxy.getPooledConnection(String,String) now delegates to
getConnection(String,String) rather than getConnection(). (markt)</li>
<li>Add: Log a warning if an attempt is made to obtain a connection with
credentials when alternateUsernameAllowed is set to false. (markt)</li>
<li>Fix: Ensure StatementCache interceptor resets properties of cached
statements between uses. (mark)</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 12 SP5 LTSS
<br/>
<code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-4927</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
<br/>
<code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-4927</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
<ul>
<li>libapr1-debuginfo-1.6.5-4.13.1</li>
<li>libtcnative-1-0-debuginfo-1.3.9-3.9.1</li>
<li>libtcnative-1-0-debugsource-1.3.9-3.9.1</li>
<li>libtcnative-1-0-1.3.9-3.9.1</li>
<li>libtcnative-1-0-devel-1.3.9-3.9.1</li>
<li>libapr1-devel-1.6.5-4.13.1</li>
<li>libapr1-debugsource-1.6.5-4.13.1</li>
<li>libapr1-1.6.5-4.13.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
<ul>
<li>tomcat-webapps-9.0.123-3.182.2</li>
<li>tomcat-el-3_0-api-9.0.123-3.182.2</li>
<li>tomcat-docs-webapp-9.0.123-3.182.2</li>
<li>tomcat-jsp-2_3-api-9.0.123-3.182.2</li>
<li>tomcat-admin-webapps-9.0.123-3.182.2</li>
<li>tomcat-lib-9.0.123-3.182.2</li>
<li>tomcat-9.0.123-3.182.2</li>
<li>tomcat-servlet-4_0-api-9.0.123-3.182.2</li>
<li>tomcat-javadoc-9.0.123-3.182.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
<ul>
<li>libapr1-debuginfo-1.6.5-4.13.1</li>
<li>libtcnative-1-0-debuginfo-1.3.9-3.9.1</li>
<li>libtcnative-1-0-debugsource-1.3.9-3.9.1</li>
<li>libtcnative-1-0-1.3.9-3.9.1</li>
<li>libtcnative-1-0-devel-1.3.9-3.9.1</li>
<li>libapr1-devel-1.6.5-4.13.1</li>
<li>libapr1-debugsource-1.6.5-4.13.1</li>
<li>libapr1-1.6.5-4.13.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
<ul>
<li>tomcat-webapps-9.0.123-3.182.2</li>
<li>tomcat-el-3_0-api-9.0.123-3.182.2</li>
<li>tomcat-docs-webapp-9.0.123-3.182.2</li>
<li>tomcat-jsp-2_3-api-9.0.123-3.182.2</li>
<li>tomcat-admin-webapps-9.0.123-3.182.2</li>
<li>tomcat-lib-9.0.123-3.182.2</li>
<li>tomcat-9.0.123-3.182.2</li>
<li>tomcat-servlet-4_0-api-9.0.123-3.182.2</li>
<li>tomcat-javadoc-9.0.123-3.182.2</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2017-12613.html">https://www.suse.com/security/cve/CVE-2017-12613.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2023-49582.html">https://www.suse.com/security/cve/CVE-2023-49582.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-101296.html">https://www.suse.com/security/cve/CVE-2026-101296.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-101356.html">https://www.suse.com/security/cve/CVE-2026-101356.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-41293.html">https://www.suse.com/security/cve/CVE-2026-41293.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-73581.html">https://www.suse.com/security/cve/CVE-2026-73581.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-74048.html">https://www.suse.com/security/cve/CVE-2026-74048.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-74049.html">https://www.suse.com/security/cve/CVE-2026-74049.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-75973.html">https://www.suse.com/security/cve/CVE-2026-75973.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-76183.html">https://www.suse.com/security/cve/CVE-2026-76183.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-77756.html">https://www.suse.com/security/cve/CVE-2026-77756.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-77762.html">https://www.suse.com/security/cve/CVE-2026-77762.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-77791.html">https://www.suse.com/security/cve/CVE-2026-77791.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-78383.html">https://www.suse.com/security/cve/CVE-2026-78383.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-78437.html">https://www.suse.com/security/cve/CVE-2026-78437.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-79677.html">https://www.suse.com/security/cve/CVE-2026-79677.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-80353.html">https://www.suse.com/security/cve/CVE-2026-80353.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-86243.html">https://www.suse.com/security/cve/CVE-2026-86243.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-86246.html">https://www.suse.com/security/cve/CVE-2026-86246.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-86247.html">https://www.suse.com/security/cve/CVE-2026-86247.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-86248.html">https://www.suse.com/security/cve/CVE-2026-86248.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-86350.html">https://www.suse.com/security/cve/CVE-2026-86350.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-87022.html">https://www.suse.com/security/cve/CVE-2026-87022.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-88041.html">https://www.suse.com/security/cve/CVE-2026-88041.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-93446.html">https://www.suse.com/security/cve/CVE-2026-93446.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1130843">https://bugzilla.suse.com/show_bug.cgi?id=1130843</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1151059">https://bugzilla.suse.com/show_bug.cgi?id=1151059</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1199170">https://bugzilla.suse.com/show_bug.cgi?id=1199170</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1260322">https://bugzilla.suse.com/show_bug.cgi?id=1260322</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282581">https://bugzilla.suse.com/show_bug.cgi?id=1282581</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282599">https://bugzilla.suse.com/show_bug.cgi?id=1282599</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282620">https://bugzilla.suse.com/show_bug.cgi?id=1282620</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282621">https://bugzilla.suse.com/show_bug.cgi?id=1282621</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282622">https://bugzilla.suse.com/show_bug.cgi?id=1282622</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282623">https://bugzilla.suse.com/show_bug.cgi?id=1282623</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282624">https://bugzilla.suse.com/show_bug.cgi?id=1282624</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282625">https://bugzilla.suse.com/show_bug.cgi?id=1282625</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282626">https://bugzilla.suse.com/show_bug.cgi?id=1282626</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282627">https://bugzilla.suse.com/show_bug.cgi?id=1282627</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282628">https://bugzilla.suse.com/show_bug.cgi?id=1282628</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282629">https://bugzilla.suse.com/show_bug.cgi?id=1282629</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282630">https://bugzilla.suse.com/show_bug.cgi?id=1282630</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282631">https://bugzilla.suse.com/show_bug.cgi?id=1282631</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1282787">https://bugzilla.suse.com/show_bug.cgi?id=1282787</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286361">https://bugzilla.suse.com/show_bug.cgi?id=1286361</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286362">https://bugzilla.suse.com/show_bug.cgi?id=1286362</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286502">https://bugzilla.suse.com/show_bug.cgi?id=1286502</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286555">https://bugzilla.suse.com/show_bug.cgi?id=1286555</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286559">https://bugzilla.suse.com/show_bug.cgi?id=1286559</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286571">https://bugzilla.suse.com/show_bug.cgi?id=1286571</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286902">https://bugzilla.suse.com/show_bug.cgi?id=1286902</a>
</li>
</ul>
</div>