SUSE-SU-2026:4893-1 Security update for emacs

This update for emacs fixes the following issues: - CVE-2026-79992: zero-click local command execution via TRAMP bsc1275927. - CVE-2026-108976: flawed username input regex validation in TRAMP can cause arbitrary OS command injection bsc1284345, bsc1284990...

SUSE-SU-2026:4892-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2023-54158: btrfs: don't free qgroup space unless specified bsc1256076. - CVE-2023-54180: btrfs: handle case when repair happens with dev-replace bsc1255995. -...

SUSE-SU-2026:4891-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input bsc1272130. - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes bsc1285302. Chang...

SUSE-SU-2026:4890-1 Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open bsc1278335. Changes for cpupower: - Release to latest kernel-source including: intel-speed-select: Harden daemon pidfile open CVE-2026-80663 bsc1278335 cpupower: Fi...

SUSE-SU-2026:24410-1 Security update for docker

This update for docker fixes the following issues: Security issues fixed: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265782. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allow...

SUSE-SU-2026:24381-1 Security update for containerd

This update for containerd fixes the following issues: - CVE-2026-39882: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp: Memory exhaustion via uncapped HTTP response body reading bsc1274214. - CVE-2026-47262: Denial of Service DoS condition via a maliciously crafted image...

SUSE-SU-2026:4889-1 Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.78 fixes various security issues: The following security issues were fixed: - CVE-2026-63887: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf bsc1272386. - CVE-2026-68158: libceph: Fix multiplication overflow in...

SUSE-SU-2026:24372-1 Security update for cifs-utils

This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc1284932...

SUSE-SU-2026:4888-1 Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130 fixes various security issues: The following security issues were fixed: - CVE-2026-63795: 9p: avoid putting oldfid in p9clientwalk error path bsc1272136. - CVE-2026-63887: scsi: target: iscsi: Bound iscsiencodetextoutput append...

SUSE-SU-2026:4870-1 Security update for php74

This update for php74 fixes the following issues: Fixed two security issues: - CVE-2026-109618: memory corruption leading to RCE - CVE-2026-109619: memory corruption leading to RCE...

SUSE-SU-2026:24362-1 Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open bsc1278335. Changes for cpupower: - intel-speed-select: Harden daemon pidfile open git-fixes, bsc1278335, CVE-2026-80663 - turbostat: Fix microcode patch level outp...

SUSE-SU-2026:24408-1 Security update for cpupower

This update for cpupower fixes the following issue: - CVE-2026-80663: tools/power/x86/intel-speed-select: Harden daemon pidfile open bsc1278335. Changes for cpupower: - intel-speed-select: Harden daemon pidfile open git-fixes, bsc1278335, CVE-2026-80663 - turbostat: Fix microcode patch level outp...

SUSE-SU-2026:4868-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: - CVE-2026-64718: webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash bsc1277001. - CVE-2026-65335: webkitgtk: Processing maliciously crafted web content may lead to an unexpect...

SUSE-SU-2026:4867-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.10 bsc1255111, jscSLE-18320: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT...

SUSE-SU-2026:4866-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to version 1.26.10 bsc1255111, jscSLE-18320: - CVE-2026-56857: os: Root.MkdirAll can follow junctions out of the root on Windows bsc1284766. - CVE-2026-56866: net/http: HTTP/1 client connection desynchronization after CONNECT...

SUSE-SU-2026:4864-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. - CVE-2026-111943:...

SUSE-SU-2026:4863-1 Security update for go1.27

This update for go1.27 fixes the following issues: Update to go 1.27.3 bsc1272545: - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority bsc1286317, bsc1286261...

SUSE-SU-2026:4861-1 Security update for distribution

This update for distribution rebuilds it against the current go security release...

SUSE-SU-2026:4858-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issues fixed: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 bsc1284619: - CVE-2024-1283: Heap buffer overflow in Skia in Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...

SUSE-SU-2026:4853-1 Security update for php7

This update for php7 fixes the following issues: - CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. - CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing bsc1283216. - CVE-2026-6103: Archive entry injection via...

SUSE-SU-2026:4852-1 Security update for php8

This update for php8 fixes the following issue: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE bsc1286027...

SUSE-SU-2026:24380-1 Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issues: Security issue fixed: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl addtochallenge allows malicious server to crash or compromise DIGEST-MD5 clients bsc1284687. Non security issues fixed: - Fix cyrus-sasl package failing to build with...

SUSE-SU-2026:24360-1 Security update for go1.27

This update for go1.27 fixes the following issues: Update to go 1.27.3 bsc1272545: - CVE-2026-111943: crypto/x509: mitigation for security concerns with a specific Certificate Authority bsc1286317, bsc1286261...

SUSE-SU-2026:24359-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go 1.26.10 bsc1255111: - CVE-2026-78663: net/http: double flow control refund on HTTP/2 server streams bsc1284770. - CVE-2026-78669: net/http: excessive CPU consumption from repeated initial window changes bsc1284772. - CVE-2026-111943:...

SUSE-SU-2026:24271-1 Security update for php8

This update for php8 fixes the following issue: Update to php 8.4.27: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE bsc1286027...

SUSE-SU-2026:4845-1 Security update for tiff

This update for tiff fixes the following issue: - CVE-2026-18495: libtiff: heap-buffer overflow via numeric truncation in the JPEG raw passthrough bsc1280164...

SUSE-SU-2026:4844-1 Security update for php8

This update for php8 fixes the following issue: Update to php 8.3.36: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE bsc1286027...

SUSE-SU-2026:4843-1 Security update for php8

This update for php8 fixes the following issue: - CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE bsc1286027...

SUSE-SU-2026:4837-1 Security update for buildah

This update for buildah rebuilds it against the current go security release...

SUSE-SU-2026:4836-1 Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issue: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl addtochallenge allows malicious server to crash or compromise DIGEST-MD5 clients bsc1284687...

SUSE-SU-2026:4835-1 Security update for xwayland

This update for xwayland fixes the following issues: - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free bsc1281213. - CVE-2026-93515: X.Org Server Present Extension Use-After-Free bsc1281218. - CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free bsc1281220. - CVE-2026-93517: GLX...

SUSE-SU-2026:4834-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR MFSA 2026-108, bsc1284493: - CVE-2026-109704: Privilege escalation in the Application Update component. - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary...

SUSE-SU-2026:4832-1 Security update for python-hpack

This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime bsc1283035...

SUSE-SU-2026:24371-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns...

SUSE-SU-2026:24379-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. - CVE-2026-43091: xfrm: Wait for RCU readers during policy netns...

SUSE-SU-2026:24368-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. -...

SUSE-SU-2026:24268-1 Security update for coreutils

This update for coreutils fixes the following issue: - CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds read with multibyte input bsc1272698...

SUSE-SU-2026:24406-1 Security update for coreutils

This update for coreutils fixes the following issue: - CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds read with multibyte input bsc1272698...

SUSE-SU-2026:24267-1 Security update for python-soupsieve

This update for python-soupsieve fixes the following issues: - CVE-2026-85999: quadratic complexity when running the whitespace/comment trimming regex REWSEND can lead to DoS bsc1281119. - CVE-2026-86000: quadratic complexity when running the IDENTIFIER / VALUE selector sub-patterns can lead to a...

SUSE-SU-2026:24405-1 Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issues: Security issue fixed: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl addtochallenge allows malicious server to crash or compromise DIGEST-MD5 clients bsc1284687. Non security issues fixed: - Fix cyrus-sasl package failing to build with...

SUSE-SU-2026:24266-1 Security update for cyrus-sasl

This update for cyrus-sasl fixes the following issues: Security issue fixed: - CVE-2026-107161: Heap buffer overflow in cyrus-sasl addtochallenge allows malicious server to crash or compromise DIGEST-MD5 clients bsc1284687. Non security issues fixed: - Fix cyrus-sasl package failing to build with...

SUSE-SU-2026:4776-1 Security update for the Linux Kernel (Live Patch 86 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.323 fixes various security issues: The following security issues were fixed: - CVE-2026-63887: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf bsc1272386. - CVE-2026-68158: libceph: Fix multiplication overflow in...

SUSE-SU-2026:4773-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message bsc1282575. - CVE-2026-88831: httpd silently fails open when IP...

SUSE-SU-2026:4772-1 Security update for bind

This update for bind fixes the following issues: - CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. - CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. - CVE-2026-19666: Use-after-free in...

SUSE-SU-2026:4768-1 Security update for the Linux Kernel (Live Patch 39 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.163 fixes various security issues: The following security issues were fixed: - CVE-2026-53131: netfilter: require Ethernet MAC header before using ethhdr bsc1269775. - CVE-2026-63794: KVM: SVM: Fix page overflow in sevdbgcrypt for...

SUSE-SU-2026:24265-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers bsc1279042. - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream...

SUSE-SU-2026:24378-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container bsc1269471...

SUSE-SU-2026:24377-1 Security update for python-PyJWT

This update for python-PyJWT fixes the following issues: - CVE-2026-101917: attacker traffic can amplify outbound requests to the configured JWKS endpoint bsc1283060. - CVE-2026-101918: unauthenticated request can raise an exception that may produce an HTTP 500 response bsc1283061. -...

SUSE-SU-2026:4765-1 Security update for python-WebOb

This update for python-WebOb fixes the following issues: - CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft bsc1275917...

SUSE-SU-2026:4764-1 Security update for ntfs-3g_ntfsprogs

This update for ntfs-3gntfsprogs fixes the following issues: - Denial-of-service in ntfsinodeattachallextents bsc1281758. - Heap buffer overflow in ntfsaclowner bsc1281756. - Heap buffer overflow in ntfscheckrestartarea bsc1281759. - Heap buffer overflow in ntfseacheckwsldev bsc1281760. - Heap...