Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issue: CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset bsc1280587. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted bsc1280590. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing bsc1280589. CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves bsc1280591. CVE-2026-75805: NULL Pointer Dereference in CMP Client...

Security update for python

This update for python fixes the following issues: CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15806:...

Security update for python-tornado

This update for python-tornado fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClien...

Security update for python313

This update for python313 fixes the following issues: Security issues fixed: CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage bsc1273148. CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974...

Security update for python311

This update for python311 fixes the following issues: CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL...

Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...

Security update for python310

This update for python310 fixes the following issues: CVE-2026-9669: crafted input can cause a stack buffer overflow bsc1267974. CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression bsc1277111. CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL...

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues: CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1279252. CVE-2026-84304:...

Security update for glib2

This update for glib2 fixes the following issue: CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded SASL line buffering bsc1272206. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively y...

Security update for podofo

This update for podofo fixes the following issues: CVE-2018-8002: infinite loop vulnerability in ParseFileComplete bsc1084891. CVE-2020-18971: stack-based buffer overflow in src/base/PdfDictionary.cpp bsc1190178. CVE-2021-30470: uncontrolled recursive call of funtions in src/base/PdfTokenizer.cpp...

Security update for util-linux

This update for util-linux fixes the following issues: CVE-2026-13595: heap use-after-free in libblkid nested partition probing bsc1269583. CVE-2026-27456: TOCTOU in the mount program when setting up loop devices bsc1261606. CVE-2026-53613: Local Privilege Escalation via TOCTOU in mount8 — Target...

Security update for bind

This update for bind fixes the following issues: CVE-2026-19033: Unauthenticated IXFR deltas are applied to the live zone before TSIG verification bsc1280430. CVE-2026-19662: qpcache NOQNAME proof use-after-free crashes recursive resolver bsc1280432. CVE-2026-19666: Use-after-free in...

Security update for nodejs18

This update for nodejs18 fixes the following issues: CVE-2025-22150: undici: insufficiently random values used when defining the boundary for a multipart/form-data request bsc1236258. CVE-2025-23166: improper error handling in async cryptographic operations crashes process bsc1243218...

Security update for the Linux Kernel (Live Patch 13 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.45 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use...

Security update for the Linux Kernel (Live Patch 16 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.73 fixes various security issues: The following security issues were fixed: CVE-2026-46150: fanotify: fix false positive on permission events bsc1267388. CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device...

Security update for containerized-data-importer

This update for containerized-data-importer fixes the following issues: CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory bsc1248946. CVE-2026-25680: golang.org/x/net/html: denial of service when parsing arbitrary HTML bsc1267176. CVE-2026-25681: golang.org/x/net/html:...

Security update for gvfs

This update for gvfs fixes the following issues: CVE-2026-84267: readstring allocates buffers withouth verifying that the buffer is completely filled when communicating with a malicious SFTP server, which can lead to uninitialized heap memory leaks bsc1278157. CVE-2026-84268: readreply processes...

Security update for the Linux Kernel

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2026-46116: xfrm: defensively unhash xfrmstate lists in xfrmstatedelete bsc1267369. CVE-2026-52955: libceph: Fix potential out-of-bounds access in crushdecode...

Security update for the Linux Kernel (Live Patch 20 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.78 fixes various security issues: The following security issues were fixed: CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction bsc1275458. CVE-2026-68138: net/sched: serialize qdiscrtablist...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. CVE-2026-16243: arraycmp SIMD...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption bsc1269550. CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c bsc1272755. CVE-2026-64834: Infinite Loop Do...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. CVE-2026-16243: arraycmp SIMD...

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage...

Security update for redis

This update for redis fixes the following issue: CVE-2026-81934: TLS pending-data handling can cause use-after-free bsc1277794. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

Security update for terraform-provider-null

This update for terraform-provider-null fixes the following issues: CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1278269. CVE-2026-84304: github.com/grpc/grpc-go:...

Security update for python

This update for python fixes the following issues: Security issues fixed: CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security issue fixed: Update bundled pip wheels to pip-10.0.1-py2.py3-none-any.whl Patch Instructions: To install this SUSE upda...

Security update for php-composer2

This update for php-composer2 fixes the following issue: CVE-2026-84361: Arbitrary code execution via malicious Perforce source URL bsc1278257. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...

Security update for wget

This update for wget fixes the following issue: CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...

Security update for curl

This update for curl fixes the following issues: CVE-2026-5773: wrong reuse of SMB connection bsc1262633. CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. CVE-2026-8926: password leak with netrc and user in URL bsc1268412. CVE-2026-13608: flow in OpenLDAP SASL negotiation can cause a...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: CVE-2026-28984,CVE-2026-43804,CVE-2026-64713,CVE-2026-64719,CVE-2026-64728, CVE-2026-64730,CVE-2026-64757,CVE-2026-64783,CVE-2026-64787: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0005 bsc1275791. Changes for webkit2gtk3: Update to...

Security update for suseconnect-ng

This update for suseconnect-ng fixes the following issue: Update version to 1.23.0: Use product identifier for product migrations. bsc1268596 Switch to using go1.26-openssl as the default Go version to install to support building the package jscSCC-843, bsc1268900. Fix flag parsing so that unknow...

Security update for file-roller

This update for file-roller fixes the following issue: CVE-2026-78322: stack buffer overflow in parseprogressline for 7z and RAR handlers bsc1276442. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issue: Update to Mozilla Thunderbird 140.14. MFSA 2026-79 bsc1274867 CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74935: Privilege escalation in the DOM: Networking component CVE-2026-74936:...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.4.6. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

Security update for the Linux Kernel (Live Patch 9 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.31 fixes various security issues: The following security issues were fixed: CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024...

Security update for the Linux Kernel (Live Patch 5 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.19 fixes various security issues: The following security issues were fixed: CVE-2025-40204,CVE-2026-53224,CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIEECHO processing bsc1253437 bsc1270023 bsc1270024...

Security update for vim

This update for vim fixes the following issues: CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service bsc1275018. CVE-2026-73071: use-after-free in JSON decoding can lead to process crash bsc1275017. CVE-2026-73072: heap buffer overflow when loading a spell file...

Security update for vim

This update for vim fixes the following issues: CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service bsc1275018. CVE-2026-73071: use-after-free in JSON decoding can lead to process crash bsc1275017. CVE-2026-73072: heap buffer overflow when loading a spell file...

Security update for redis7

This update for redis7 fixes the following issue: CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending entry is referenced by more than one consumer bsc1273162. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like Ya...

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: CVE-2026-10050: ISO-8859-1 lossy encoding allows authentication bypass via character substitution bsc1272393. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 70 bsc1273223. CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIMD evaluator bsc1274275. CVE-2026-16439: using -Xtrace to trace method arguments can lead to buffer...

Security update for dracut

This update for dracut fixes the following issue: Update to version 059+suse.572.g753fdae1b. Securitys issue fixed: CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: Fixbase: sanitize message...

Security update for python3

This update for python3 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...

Security update for openssl-1_1

This update for openssl-11 fixes the following issues: HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations bsc1271712. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for rsyslog

This update for rsyslog fixes the following issues: CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite bsc1272414. Input sequence during oversize-frame recovery in imptcp can cause denial of service bsc1271910. Patch Instructions: To install this SUSE update u...