Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Security issue fixed: CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-lusitaniae-apacheexporter: Non customer facing changes...

Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Security issue fixed: CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-lusitaniae-apacheexporter: Non customer facing changes...

Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: Security issue fixed: CVE-2022-21698: Fixed prometheus/clientgolang possible denial of service using InstrumentHandlerCounter bsc1248699 golang-github-lusitaniae-apacheexporter: Non customer facing changes...

Security update for libnfs

This update for libnfs fixes the following issue CVE-2026-53689: integer overflow during a connection to a crafted NFS server bsc1268135. Changes for libnfs: Add libnfs-CVE-2026-53689.patch: ZDR: check the string size for sanity bsc1268135 CVE-2026-53689. Patch Instructions: To install this SUSE...

Security update for apache2

This update for apache2 fixes the following issues CVE-2026-29167: modldap per-dir use-after-free bsc1267976. CVE-2026-29170: modproxyftp XSS bsc1267977. CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow...

Security update for tracker-miners

This update for tracker-miners fixes the following issues: CVE-2026-1764: heap buffer overflow leads to denial of service or information disclosure when parsing MP3 files bsc1257606. CVE-2026-1765: denial of service and potential information disclosure via crafted MP3 files bsc1257607...

Security update for perl-DBI

This update for perl-DBI fixes the following issue CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer bsc1267957. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for perl-DBI

This update for perl-DBI fixes the following issues CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer bsc1267957. CVE-2026-10879: SQL statements with more than 9 binders can cause an heap overflow bsc1267849. Patch Instructions: To install this SUSE update u...

Security update for perl-DBI

This update for perl-DBI fixes the following issue CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer bsc1267957. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for libarchive

This update for libarchive fixes the following issues CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches bsc1253088. CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing bsc1259928. CVE-2026-4426: undefined behavior due to unvalidated...

Security update for firewalld-legacy

This update for firewalld-legacy fixes the following issue CVE-2026-4948: local unprivileged users can modify firewall state due to D-Bus setter mis-authorizations bsc1260903. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue CVE-2026-52719: gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder bsc1268401. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue CVE-2026-52719: gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder bsc1268401. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods lik...

Security update for pacemaker

This update for pacemaker fixes the following issue CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for golang-github-docker-libnetwork

This update for golang-github-docker-libnetwork fixes the following issue CVE-2026-2808: github.com/hashicorp/consul: unvalidated user-supplied file paths can lead to arbitrary file reads through the Vault Kubernetes authentication provider bsc1259566. Patch Instructions: To install this SUSE...

Security update for fontforge

This update for fontforge fixes the following issues CVE-2025-15269: Remote Code Execution via Use-After-Free in SFD file parsing bsc1256032. CVE-2025-15275: Arbitrary code execution via SFD file parsing buffer overflow bsc1256025. CVE-2025-15279: Remote Code Execution via heap-based buffer...

Security update for apache2

This update for apache2 fixes the following issues CVE-2026-29167: modldap per-dir use-after-free bsc1267976. CVE-2026-29170: modproxyftp XSS bsc1267977. CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow...

Security update for buildah

This update for buildah fixes the following issues CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files bsc1267179. CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input...

Security update for cups

This update for cups fixes the following issues CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup bsc1261572. CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss bsc1261571. CVE-2026-34979: Heap overflow in getoptions...

Security update for editorconfig-core-c

This update for editorconfig-core-c fixes the following issue: CVE-2026-40489: improper use of strcpy can lead to a stack buffer overflow bsc1262131. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternative...

Security update for python-lxml

This update for python-lxml fixes the following issue CVE-2026-41066: information disclosure via untrusted XML input leading to local file read bsc1263254. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for python-lxml

This update for python-lxml fixes the following issue CVE-2026-41066: information disclosure via untrusted XML input leading to local file read bsc1263254. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for gstreamer-plugins-good

This update for gstreamer-plugins-good fixes the following issues CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer bsc1234421. CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow bsc1268449. Patch Instructions: To install this SUSE update use the SUSE...

Security update for python-tornado

This update for python-tornado fixes the following issues CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient bsc1268395. CVE-2026-49854: out-of-bounds memory access via C extension bsc1268396. CVE-2026-49855: AsyncHTTPClient accumulates...

Security update for python-tornado6

This update for python-tornado6 fixes the following issues CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient bsc1268395. CVE-2026-49854: out-of-bounds memory access via C extension bsc1268396. CVE-2026-49855: AsyncHTTPClient accumulates...

Security update for python-python-dotenv

This update for python-python-dotenv fixes the following issue: CVE-2026-28684: follow symbolic links when rewriting .env files bsc1262423 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can...

Security update for python311

This update for python311 fixes the following issues: Security issues fixed: CVE-2026-3446: base64 decoding stops at first padded quad by default and ignores other information that could be processed bsc1261970. Other updates and bugfixes: Rewrite structure of Python interpreter packages. python3...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs bsc1266290. CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3registerwork...

Security update for dracut

This update for dracut fixes the following issue CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: Update to version 055+suse.402.g2720eea: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893 fixnetwork-legacy...

Security update for dracut

This update for dracut fixes the following issue CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes for dracut: Update to version 055+suse.365.g79144c5: fixnetwork-legacy: sanitize DHCP values in dhclient-script.sh bsc1268322, CVE-2026-6893 fixnetwork-legacy...

Security update for pacemaker

This update for pacemaker fixes the following issues: CVE-2026-10649: Fixed denial-of-service via integer overflow in remote message decompression bsc1268381. Changes for pacemaker: Update to version 2.1.10+20260618.4bca25e3c1: libcrmcommon: Add additional checks to pcmkremotemessagexml...

Security update for cups

This update for cups fixes the following issues CVE-2026-27447: Authorization bypass via case-insensitive group-member lookup bsc1261572. CVE-2026-34978: Path traversal in RSS notify-recipient-uri enables file write outside CacheDir/rss bsc1261571. CVE-2026-34979: Heap overflow in getoptions...

Security update for apache2

This update for apache2 fixes the following issues CVE-2026-29167: modldap per-dir use-after-free bsc1267976. CVE-2026-29170: modproxyftp XSS bsc1267977. CVE-2026-34355: modproxyhtml buffer overflow bsc1267978. CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow...

Security update for pacemaker

This update for pacemaker fixes the following issue CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for podman

This update for podman rebuilds it against the current go security release. CVE-2026-34986: Update github.com/go-jose/go-jose/v3+v4 dependency bsc1262856. CVE-2026-39829, CVE-2026-39830, CVE-2026-42508, CVE-2026-46598: Update golang.org/x/crypto/ssh dependency bsc1266125. Patch Instructions: To...

Security update for tar

This update for tar fixes the following issues Security fixes: CVE-2026-5704: crafted archives can be used to to hide file injection bsc1261900. Other fixes: Fix tar changing dir permissions temporarily even when using --no-overwrite-dir. Fix --dereference/-h not working properly after...

Security update for tracker

This update for tracker fixes the following issues: CVE-2026-1765: heap buffer overflow vulnerability in extracttxxxtags bsc1257607. CVE-2026-1766: heap buffer overflow vulnerability in getid3v23tags bsc1257608. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

Security update for xdg-desktop-portal

This update for xdg-desktop-portal fixes the following issue: CVE-2026-40354: File deletion via symlink attack bsc1262045. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command...

Security update for perl-Config-IniFiles

This update for perl-Config-IniFiles fixes the following issue CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for perl-Config-IniFiles

This update for perl-Config-IniFiles fixes the following issue CVE-2026-11527: OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle bsc1268236. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for buildah

This update for buildah fixes the following issues CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files bsc1267179. CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input...

Security update for exiv2-0_26

This update for exiv2-026 fixes the following issues CVE-2025-54080: out-of-bounds read in Exiv2::EpsImage::writeMetadata when writing metadata into a crafted image file bsc1248962. CVE-2026-25884: out-of-bounds read in CrwMap::decode0x0805 bsc1259083. CVE-2026-27596: integer overflow in...

Security update for curl

This update for curl fixes the following issues CVE-2026-4873: connection reuse ignores TLS requirement bsc1262631. CVE-2026-5545: wrong reuse of HTTP Negotiate connection bsc1262632. CVE-2026-5773: wrong reuse of SMB connection bsc1262633. CVE-2026-6253: proxy credentials leak over redirect-to...

Security update for libsoup

This update for libsoup fixes the following issue CVE-2026-1801: HTTP Request Smuggling in soupfilterinputstreamreadline bsc1257649. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run th...

Security update for pacemaker

This update for pacemaker fixes the following issue CVE-2026-10649: denial of service via integer overflow in remote message decompression bsc1268381. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for cifs-utils

This update for cifs-utils fixes the following issue CVE-2026-12505: cifs.upcall local privilege escalation via requestkey-controlled namespace switch and NSS loading bsc1267389. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate o...

Security update for cifs-utils

This update for cifs-utils fixes the following issue CVE-2026-12505: cifs.upcall local privilege escalation via requestkey-controlled namespace switch and NSS loading bsc1267389. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate o...

Security update for opensc

This update for opensc fixes the following issues CVE-2025-49010: stack-buffer-overflow via crafted smart card or USB device responses bsc1261214. CVE-2025-66037: crafted input can cause an out-of-bounds read bsc1261218. CVE-2025-66038: improper compact-TLV length validation can lead to crash or...

Security update for 7zip

This update for 7zip fixes the following issues Update to 26.01: CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure bsc1267858. CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation bsc1267421. CVE-2026-48101: Information...

Security update for nodejs22

This update for nodejs22 fixes the following issues: CVE-2026-48618: tls: normalize hostname for server identity checks bsc1268593. CVE-2026-48933: crypto: guard WebCrypto cipher output length bsc1268592. CVE-2026-48615: lib,test: redact proxy credentials in tunnel errors bsc1268598...