Security update for bind

This update for bind fixes the following issues: CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge authenticated NXDOMAIN responses for sibling zones bsc1271982. CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm...

Security update for rrdtool

This update for rrdtool fixes the following issue CVE-2026-43958: stack buffer overflow in rrdcached handlerequestcreate can lead to local privilege escalation via unbounded DS/RRA arguments bsc1267243. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input...

Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: Version 1.3.6: When masking directories with maskPaths, runc will now re- use a...

Security update for bind

This update for bind fixes the following issues: Upgrade to release 9.20.26. Security issues fixed: CVE-2026-10723: incorrect acceptance of NSEC3 records bsc1271982. CVE-2026-10822: key record using PRIVATEDNS algorithm may lead to unexpected exit bsc1271983. CVE-2026-11331: potential wildcard...

Security update for python3-pyOpenSSL

This update for python3-pyOpenSSL fixes the following issue: CVE-2026-27448: unhandled exception in settlsextservernamecallback callback can result in connection not being cancelled and allows for possible security measure bypassing bsc1259804. Patch Instructions: To install this SUSE update use...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument bsc1272582. CVE-2026-62946: integer overflo...

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit...

Security update for java-17-openjdk

This update for java-17-openjdk fixes the following issues: Upgrade to upstream tag jdk-17.0.20+8 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

Security update for gimp

This update for gimp fixes the following issues CVE-2026-58379: Heap buffer overflow in readchanneldata bsc1270299. CVE-2026-58380: Stack buffer overflow in pnmscannergettoken bsc1270444. CVE-2026-58381: double-free in readlayerblock bsc1270239. Patch Instructions: To install this SUSE update use...

Security update for sssd

This update for sssd fixes the following issue: CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free bsc1269807. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. CVE-2026-52720: invalid check of total area instead of individual dimensions could trigger a heap out-of-bounds write bsc1268406...

Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues Upgrade to upstream tag jdk-11.0.32+9 July 2026 CPU. Security issues fixed: CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize bsc1264994. CVE-2026-46917: unauthenticated attacker with...

Security update for perl-DBI

This update for perl-DBI fixes the following issues CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process...

Security update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.34 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060...

Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo bsc1261678. Changes for openssl-100: Security fix: Fix NULL pointer dereference when processing an OCSP response...

Security update for gzip

This update for gzip fixes the following issue: CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the user's PATH bsc1269622. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for ignition

This update for ignition fixes the following issues CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266606. CVE-2026-56852: golang.org/x/text/unicode/norm: handling of input containing invalid...

Security update for SVT-AV1, libyuv0, libaom3

This update for SVT-AV1, libyuv0, libaom3 fixes the following issues: CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash bsc1268650. CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary...

Security update for nmap

This update for nmap fixes the following issue: CVE-2026-58058: crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash bsc1269570. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for avahi

This update for avahi fixes the following issue: CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...

Security update for avahi

This update for avahi fixes the following issue: CVE-2025-59529: local DoS due to simple protocol server ignoring client limit CLIENTSMAX bsc1255451. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...

Security update for ntfs-3g_ntfsprogs

This update for ntfs-3gntfsprogs fixes the following issues CVE-2026-42616: heap buffer overflow in cat in cat.c bsc1271102. CVE-2026-42617: heap buffer overflow in ntfsirtoib in index.c bsc1271103. CVE-2026-42618: heap buffer overflow in ntfsdecompress in compress.c bsc1271104. CVE-2026-46569:...

Security update for multipath-tools

This update for multipath-tools fixes the following issues Update to version 0.7.9+238+suse.1249506. kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device or disk image bsc1268145. kpartx: missing bounds check can lead to a DASD VOL1...

Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issue CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. Patch Instructions: To install this SUSE update use the SUSE recommended...

Security update for wget

This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...

Security update for wget

This update for wget fixes the following issues CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58470: server-controlled Content-Range header values can cause an integer overflow in parsecontentrange bsc1271034...

Security update for GraphicsMagick

This update for GraphicsMagick fixes the following issue CVE-2026-61870: Memory leak in VIFF encoder when allocation fails bsc1271293. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run...

Security update for sssd

This update for sssd fixes the following issues CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation bsc1270709. CVE-2026-14476: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypas...

Security update for ImageMagick

This update for ImageMagick fixes the following issues CVE-2026-56375: possible memory leak in ASHLAR coder when action fails bsc1271495. CVE-2026-61464: heap buffer overwrite in X11 import with crafted window title bsc1271496. CVE-2026-61859: policy bypass in script operation due to missing chec...

Security update for openexr

This update for openexr fixes the following issues CVE-2026-54920: unchecked integer overflows in Image::resize followed by an exception can lead to an invalid delete via uninitialized pointers bsc1269703. CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a heap...

Security update for tomcat

This update for tomcat fixes the following issues Update to Tomcat 9.0.119. Security issues fixed: CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example bsc1269791. CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused...

Security update for pam

This update for pam fixes the following issue CVE-2026-54411: timing discrepancy in the pamuserdb module's plaintext-password comparison bsc1268290. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternativel...

Security update for nghttp2

This update for nghttp2 fixes the following issue CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate ...

Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length bsc1270542. CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrapkey bsc1270705. CVE-2026-41681:...

Security update for 389-ds

This update for 389-ds fixes the following issues Update to version 2.7.0git212.9b0755edb. CVE-2026-11610: heap buffer overflow in sasliorecv via padded SASL UNBIND bsc1270695. CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth bsc1267975...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues CVE-2026-12892: 1-byte heap out-of-bounds read in H.264 NAL extension slice parser bsc1268971. CVE-2026-14935: webrtcbin accepts remote SDP without a=fingerprint due to inverted presence check bsc1271051. CVE-2026-52720: invalid che...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 bsc1243603. CVE-2025-71302: drm/panthor: fix for dma-fence safe access...

Security update for libqt4

This update for libqt4 fixes the following issue CVE-2025-14575: local user can load rogue CA certificates as trusted system authority via a crafted file placed in the application's working directory bsc1265896. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

Security update for python-msgpack

This update for python-msgpack fixes the following issue CVE-2026-57585: Unpacker reuse after a caught error can lead to an out-of-bounds read and a crash bsc1269947. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for libxml2

This update for libxml2 fixes the following issue CVE-2026-11979: stack-based buffer overflows in the xmlcatalog utility when running in --shell mode bsc1269790. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues Update to version go1.26.5 bsc1255111. CVE-2026-27145: crypto/x509: split candidate hostname only once bsc1267450. CVE-2026-39822: os: Root escape via symlink plus trailing slash bsc1271014. CVE-2026-42504: mime: quadratic complexity in...

Security update for python-idna

This update for python-idna fixes the following issue CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: CVE-2025-9943: SQL injection in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394. Patch Instructions: To install this SUSE...

Security update for openssl-3

This update for openssl-3 fixes the following issues CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages bsc1266344. CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption bsc1266350. Patch Instructions: To install this SUSE update use the SUSE...

Security update for python-paramiko

This update for python-paramiko fixes the following issue CVE-2026-44405: data integrity compromise due to allowed SHA-1 algorithm use bsc1264225. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively...

Security update for dnsmasq

This update for dnsmasq fixes the following issues CVE-2026-12725: heap buffer overflow in logquery when logging unsupported DS/DNSKEY replies bsc1268764. CVE-2026-12969: out-of-bounds read in findsoa due to missing extrabytes validation bsc1268882. Changes for dnsmasq: Update to 2.93: Fix a...

Security update for uriparser

This update for uriparser fixes the following issues CVE-2026-42371: numeric truncation in text range comparison when an application accepts URIs with a length in gigabytes bsc1262999. CVE-2026-44927: truncation of ptrdifft to int in various places bsc1264578. CVE-2026-44928: function family...

Security update for glib-networking

This update for glib-networking fixes the following issue CVE-2026-10028: two certificates which are each signed by the other can lead to an infinite loop bsc1267979. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for dracut

This update for dracut fixes the following issue CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: Update to version 059+suse.565.g682306ec5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893...