Security update for qemu

This update for qemu fixes the following issues: CVE-2024-8612: Fixed information leak in virtio devices bsc1230915. CVE-2024-7409: Fixed denial of service via improper synchronization in QEMU NBD Server during socket closure bsc1229007. CVE-2024-3447: Fixed heap buffer overflow in...

Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005565 fixes several issues. The following security issues were fixed: CVE-2024-45016: netem: fix return value if duplicate enqueue fails bsc1230998. CVE-2022-48912: Fix use-after-free in nfregisternethook bsc1229641 CVE-2022-48923: btrfs: prevent...

Security update for etcd

This update for etcd fixes the following issues: Security Update to version 3.5.18: Ensure all goroutines created by StartEtcd to exit before closing the errc mvcc: restore tombstone index if it's first revision Bump go toolchain to 1.22.11 Avoid deadlock in etcd.Close when stopping during...

Security update for the Linux Kernel (Live Patch 26 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040024119 fixes several issues. The following security issues were fixed: CVE-2024-36971: Fixed dstnegativeadvice race bsc1226324. CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans bsc1233712. CVE-2022-48956: ipv...

Security update for the Linux Kernel (Live Patch 12 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005559 fixes several issues. The following security issues were fixed: CVE-2024-41057: cachefiles: fix slab-use-after-free in cachefileswithdrawcookie bsc1229275. CVE-2024-36971: Fixed dstnegativeadvice race bsc1226324. CVE-2024-50264: vsock/virtio:...

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-48742: rtnetlink: make sure to refresh masterdev/mops in rtnlnewlink bsc1226694. CVE-2022-49033: btrfs: qgroup: fix sleep from invalid context bug in...

Security update for redis7

This update for redis7 fixes the following issues: CVE-2024-51741: Fixed a bug where malformed ACL selectors can trigger a server panic when accessed. bsc1235386 CVE-2024-46981: Fixed a bug where lua scripts can be used to manipulate the garbage collector, leading to remote code execution...

Security update for the Linux Kernel (Live Patch 44 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059161 fixes several issues. The following security issues were fixed: CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans bsc1233712. CVE-2022-48956: ipv6: avoid use-after-free in ip6fragment bsc1232637...

Security update for rsync

This update for rsync fixes the following issues: NOTE: This update was retracted as one of the fixes was broken. A new update will be issued. CVE-2024-12085: leak of uninitialized stack data on the server leading to possible ASLR bypass. bsc1234101 CVE-2024-12086: leak of a client machine's file...

Security update for rsync

This update for rsync fixes the following issues: NOTE: this update is broken and was retracted. New update will be published as followup update. CVE-2024-12084: heap buffer overflow in checksum parsing. bsc1234100 CVE-2024-12085: leak of uninitialized stack data on the server leading to possible...

Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005552 fixes several issues. The following security issues were fixed: CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans bsc1233712. CVE-2022-48956: ipv6: avoid use-after-free in ip6fragment bsc1232637...

Security update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-150600105 fixes several issues. The following security issues were fixed: CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk-trans bsc1233712. CVE-2024-43861: Fix memory leak for not ip packets bsc1229553. CVE-2024-35949:...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250108T191942 2025-01-08T19:19:42Z. Refs jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3371 GHSA-2r2v-9pf8-6342 GO-2025-3374 CVE-2025-22130 GHSA-j4jw-m6xr-fv6c Update to...

Security update for mozjs78

This update for mozjs78 fixes the following issues: CVE-2024-50602: Fixed DoS via XMLResumeParser bsc1232599 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for you...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2021-47594: mptcp: never allow the PM to close a listener subflow bsc1226560. CVE-2022-48879: efi: fix NULL-deref in init error path bsc1229556. CVE-2022-48956:...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-52524: Fixed possible corruption in nfc/llcp bsc1220927. CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core bsc1232224 CVE-2024-50089:...

Security update for buildah

This update for buildah fixes the following issues: Security issues fixed: CVE-2024-9675: cache arbitrary directory mount bsc1231499 CVE-2024-9407: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction bsc1231208 CVE-2024-9676: symlink traversal vulnerability ...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2021-47589: igbvf: fix double free in igbvfprobe bsc1226557. CVE-2022-48956: ipv6: avoid use-after-free in ip6fragment bsc1231893. CVE-2022-48960: net: hisilicon:...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2024-52304: Fixed request smuggling due to incorrect parsing of chunk extensions bsc1233447 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for postgresql15

This update for postgresql15 fixes the following issues: CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference bsc1233323. CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiatio...

Security update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop

This update for javapackages-tools, xmlgraphics-batik, xmlgraphics-commons, xmlgraphics-fop fixes the following issues: xmlgraphics-fop was updated from version 2.8 to 2.10: Security issues fixed: CVE-2024-28168: Fixed improper restriction of XML External Entity XXE reference bsc1231428 Upstream...

Security update for expat

This update for expat fixes the following issues: CVE-2024-50602: Fixed a denial of service via XMLResumeParser bsc1232579. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command...

Security update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: Security fixes on Python 3.11 interpreter: CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes bsc1229873, bsc1230059 CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path...

Security update for python39

This update for python39 fixes the following issues: CVE-2024-9287: Fixed quoted path names provided when creating a virtual environment bsc1232241. Bug fixes: Drop .pyc files from docdir for reproducible builds bsc1230906. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005562 fixes several issues. The following security issues were fixed: CVE-2024-35905: Fixed int overflow for stack access size bsc1226327. CVE-2021-47598: schcake: do not call cakedestroy from cakeinit bsc1227471. CVE-2024-35863: Fixed potential UAF i...

Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: CVE-2024-24791: Fixed denial of service due to improper 100-continue handling bsc1227314 CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973 CVE-2024-24790: Fixed unexpected behavior from Is...

Security update for the Linux Kernel (Live Patch 28 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040024125 fixes several issues. The following security issues were fixed: CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails bsc1227808 CVE-2024-41059: hfsplus: fix uninit-value in copyname bsc1228573. Patch Instructions:...

Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005552 fixes several issues. The following security issues were fixed: CVE-2024-35861: Fixed potential UAF in cifssignalcifsdforreconnect bsc1225312. CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfochangednotify bsc1225739. CVE-2024-40954:...

Security update for the Linux Kernel RT (Live Patch 14 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505001352 fixes several issues. The following security issues were fixed: CVE-2024-35861: Fixed potential UAF in cifssignalcifsdforreconnect bsc1225312. CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfochangednotify bsc1225739. CVE-2024-40954:...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 128.3.1 MFSA 2024-51, bsc1231413: CVE-2024-9680: Use-after-free in Animation timeline Update to Mozilla Thunderbird 128.3 MFSA 2024-49, bsc1230979: CVE-2024-9392: Compromised content process can bypass si...

Security update for wireshark

This update for wireshark fixes the following issues: Update to Wireshark 4.2.8: CVE-2024-9781: Fixed AppleTalk and RELOAD Framing dissector crash bsc1231476. Further features, bug fixes and updated protocol support as listed in: https://www.wireshark.org/docs/relnotes/wireshark-4.2.8.html Patch...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-48901: btrfs: do not start relocation until in progress drops are done bsc1229607. CVE-2022-48911: kabi: add nfqueuegetrefs for kabi compliance. bsc1229633...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 CoCo kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-52752: smb: client: fix use-after-free bug in cifsdebugdataprocshow bsc1225487. CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900...

Security update for alloy

This update for alloy fixes the following issues: CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST request...

Security update for redis7

This update for redis7 fixes the following issue: CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read bsc1281417. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer over-write in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62363: heap buffer over-write in fx operation bsc1272582. CVE-2026-62946: integer overflow in JNX decoder causes heap buff...

Security update for redis

This update for redis fixes the following issue: CVE-2026-92925: failure to properly validate string-carrying extensions for null-termination in the cluster bus packet parser can lead to an out-of-bounds read bsc1281417. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for nodejs16

This update for nodejs16 fixes the following issues: CVE-2025-23085: memory leak when remote peer abruptly closes socket without sending GOAWAY notification bsc1236250. CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218. CVE-2025-23167: llhttp:...

Security update for the Linux Kernel (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.60 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use...

Security update for glib2

This update for glib2 fixes the following issue: CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206. Changes for glib2: Fix segfault when monitoring hard links bsc1281419. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for gvfs

This update for gvfs fixes the following issues: CVE-2026-84267: readstring allocates buffers withouth verifying that the buffer is completely filled when communicating with a malicious SFTP server, which can lead to uninitialized heap memory leaks bsc1278157. CVE-2026-84268: readreply processes...

Security update for the Linux Kernel (Live Patch 32 for SUSE Linux Enterprise 15 SP5)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.127 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on devic...

Security update for the Linux Kernel (Live Patch 58 for SUSE Linux Enterprise 15 SP4)

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.235 fixes various security issues: The following security issues were fixed: CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. CVE-2026-68138: net/sched: serialize qdiscrtablist...

Security update for clamav

This update for clamav fixes the following issues: CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records bsc1274598. CVE-2026-20339: integer overflow in the PESpin unpack...

Security update for the Linux Kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.59 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use...

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue: CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle bsc1271431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276733. CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issu...

Security update for xen

This update for xen fixes the following issues: CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding bsc1276838. CVE-2026-79602: x86: improper handling of HVM emulation return codes bsc1276839. CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing bsc1276841. Special...

Security update for python-h2

This update for python-h2 fixes the following issue: CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, which can lead to request smuggling bsc1274386. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...