Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen

This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: Firefox Extended Support Release 153.2.0 ESR Fixed: Various security fixes. MFSA 2026-85 bsc1278001: CVE-2026-75874: Sandbox escape in the...

Security update for ansible-core

This update for ansible-core fixes the following issues: CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. CVE-2026-16243: arraycmp SIMD...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for perl-Mojolicious

This update for perl-Mojolicious fixes the following issue: CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH compression oracle bsc1271431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption bsc1269550. CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c bsc1272755. CVE-2026-64834: Infinite Loop Do...

Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: CVE-2026-58049: incorrect validation in the RASC video decoder can lead to an out-of-bounds heap write and memory corruption bsc1269550. CVE-2026-64833: Out-of-Bounds Read via S/PDIF Muxer spdifenc.c bsc1272755. CVE-2026-64834: Infinite Loop Do...

Security update for NetworkManager

This update for NetworkManager fixes the following issues: CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for NetworkManager

This update for NetworkManager fixes the following issues: CVE-2026-10805: Local privilege escalation via malformed MUD URLs in dhclient backend bsc1267696. CVE-2026-19685: missing user ownership checks for 802.1X directory properties can allow WPA-Enterprise server certificate validation bypass...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers bsc1276534. CVE-2026-78126: NULL-Pointer Dereference When Handling...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

Security update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen

This update for MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: This update ships Firefox Extended Support Release 153.2.0 ESR Fixed: Various security fixes. MFSA 2026-85 bsc1278001: CVE-2026-75874: Sandbox escape in the Remote...

Security update for dovecot23

This update for dovecot23 fixes the following issues: CVE-2024-23184: parsing of messages containing many address headers From, To, Cc, Bcc, etc. could be excessively CPU intensive bsc1229184. CVE-2024-23185: large headers can cause resource exhaustion when parsing message bsc1229183...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

Security update for php7

This update for php7 fixes the following issue: CVE-2026-7260: Stack overflow in phar with circular symlinks bsc1273077. Other changes: Allow removal of apache2-modphp7 even if the php7 module is not enabled bsc1205782, bsc1276531. Patch Instructions: To install this SUSE update use the SUSE...

Security update for tomcat

This update for tomcat fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276733. CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issu...

Security update for opensc

This update for opensc fixes the following issue: CVE-2026-40510: stack buffer overflow in pivprocesshistory allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device bsc1266964. Patch Instructions: To install this SUSE update use the SU...

Security update for opensc

This update for opensc fixes the following issue: CVE-2026-40510: stack buffer overflow in pivprocesshistory allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device bsc1266964. Patch Instructions: To install this SUSE update use the SU...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues: The following security issues were fixed: CVE-2024-57841: net: fix memory leak in tcpconnrequest bsc1235944. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225. CVE-2025-7107...

Security update for tomcat10

This update for tomcat10 fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

Security update for strongswan

This update for strongswan fixes the following issues: CVE-2026-47895: Double-Free When Destroying Certain Cloned Identities bsc1266360. CVE-2026-78123: Undefined Memory Access When Handling PKCS7 Containers bsc1276533. CVE-2026-78124: Memory Leak When Processing Certificates in PKCS7 Containers...

Security update for tomcat11

This update for tomcat11 fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

Security update for python-Authlib

This update for python-Authlib fixes the following issue: CVE-2026-41479: crafted authorization requests with unsupported responsetypes can cause unauthenticated open redirects bsc1275231. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for opensc

This update for opensc fixes the following issue: CVE-2026-40510: stack buffer overflow in pivprocesshistory allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device bsc1266964. Patch Instructions: To install this SUSE update use the SU...

Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 71 bsc1277833: CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes bsc1274276. CVE-2026-16243: arraycmp SIMD...

Security update for golang-github-vpenso-prometheus_slurm_exporter

This update for golang-github-vpenso-prometheusslurmexporter fixes the following issue: CVE-2022-21698: github.com/prometheus/clientgolang/prometheus/promhttp: Denial of service using InstrumentHandlerCounter bsc1248703. Changes for golang-github-vpenso-prometheusslurmexporter: Update to version...

Security update for libsoup

This update for libsoup fixes the following issue: CVE-2026-12548: out-of-bounds read in multipart body parser due to an integer truncation bsc1272196. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for python-pip

This update for python-pip fixes the following issue: Fixed patch for CVE-2026-1703 to work with python2 where os.path.commonpath doesn't exists bsc1257599 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

Security update for libssh2_org

This update for libssh2org fixes the following issues: CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. CVE-2026-7598: integer overflow in function userauthpassword of file src/userauth.c bsc1263890. CVE-2026-58050: attacker controlled...

Security update for multipath-tools

This update for multipath-tools fixes the following issues: Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. Path traversal in device-mapper-multipath failedwwids management bsc1277210. SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows bsc127721...

Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: Security issue fixed: invalidating legacy libzypp unsigned-repository cache state LIBZYPP-LEGACY-CACHE-01 bsc1274625. hasCredentials requires both username AND password to be non-empty bsc1273242. GPG Key hints in repoindex.xml require a...

Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues: The following security issues were fixed: CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie bsc1270023. CVE-2026-53246: sctp: validate cached peer INIT chunk length in...

Security update for the Linux Kernel (Live Patch 21 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-44.1 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-23449: net/sched: teql: Fix double-free in teqlmasterxmit bsc1262213...

Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues: The following security issues were fixed: CVE-2026-46037: ipv4: icmp: validate reply type before using icmppointers bsc1267362. CVE-2026-46242: eventpoll: fix epremove struct eventpoll / struct file UAF...

Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-48.1 fixes various security issues: The following security issues were fixed: CVE-2026-46242: eventpoll: fix epremove struct eventpoll / struct file UAF bsc1270300. CVE-2026-46319: net/sched: actct: Only release RCU read lock after ctft...

Security update for the Linux Kernel (Live Patch 26 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-49.1 fixes various security issues: The following security issues were fixed: CVE-2026-46242: eventpoll: fix epremove struct eventpoll / struct file UAF bsc1270300. CVE-2026-52956: libceph: Fix potential out-of-bounds access in cephxdecrypt...

Security update for the Linux Kernel (Live Patch 22 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-45.1 fixes various security issues: The following security issues were fixed: CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-23449: net/sched: teql: Fix double-free in teqlmasterxmit bsc1262213...

Security update for the Linux Kernel (Live Patch 23 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues: The following security issues were fixed: CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock bsc1269282. CVE-2026-46037: ipv4: icmp: validate reply type before using icmppointers...

Security update for the Linux Kernel RT (Live Patch 14 for SUSE Linux Enterprise Micro 6.0)

This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues: The following security issues were fixed: CVE-2025-40204: sctp: Fix MAC comparison to be constant-time bsc1253437. CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. CVE-2026-23449:...

Security update for xen

This update for xen fixes the following issues: Update to version 4.20.3 jscPED-8907. Security issues fixed: CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling...

Security update for xen

This update for xen fixes the following issues: CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding bsc1276838. CVE-2026-79602: x86: improper handling of HVM emulation return codes bsc1276839. Special Instructions and Notes: Please reboot the system after installing this update. Patch...

Security update for xen

This update for xen fixes the following issues: CVE-2026-62437: x86: DMs may cause mem leak by IRQ binding bsc1276838. CVE-2026-79602: x86: improper handling of HVM emulation return codes bsc1276839. CVE-2026-79603: unconditionally do TLB flushing ahead of page scrubbing bsc1276841. Special...