openSUSE-SU-2026:20448-1: important: Security update for expat
openSUSE-SU-2026:20449-1: important: Security update for postgresql13
openSUSE-SU-2026:20452-1: important: Security update for kea
openSUSE-SU-2026:20444-1: important: Security update for tomcat10
openSUSE-SU-2026:20447-1: important: Security update for postgresql16
openSUSE-SU-2026:20437-1: moderate: Security update for net-tools
SUSE-SU-2026:1166-1: important: Security update for expat
openSUSE-SU-2026:10476-1: moderate: python311-Pygments-2.20.0-2.1 on GA media
openSUSE-SU-2026:10475-1: moderate: opensc-0.27.1-1.1 on GA media
openSUSE-SU-2026:10474-1: moderate: ignition-2.26.0-3.1 on GA media
openSUSE-SU-2026:10472-1: moderate: conftest-0.67.1-2.1 on GA media
openSUSE-SU-2026:10468-1: moderate: python311-ecdsa-0.19.2-1.1 on GA media
openSUSE-SU-2026:10467-1: moderate: ovmf-202602-6.1 on GA media
openSUSE-SU-2026:10470-1: moderate: libXvnc-devel-1.16.1-2.1 on GA media
openSUSE-SU-2026:10469-1: moderate: python315-3.15.0~a7-3.1 on GA media
openSUSE-SU-2026:10473-1: moderate: dnsdist-2.0.3-1.1 on GA media
openSUSE-SU-2026:0112-1: important: Security update for chromium
openSUSE-SU-2026:0113-1: important: Security update for chromium
SUSE-SU-2026:1177-1: important: Security update for tar
SUSE-SU-2026:1178-1: moderate: Security update for libsoup
SUSE-SU-2026:1179-1: moderate: Security update for libsoup2
SUSE-SU-2026:1173-1: important: Security update for LibVNCServer
openSUSE-SU-2026:20448-1: important: Security update for expat
openSUSE security update: security update for expat
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20448-1
Rating: important
References:
* bsc#1259711
* bsc#1259726
* bsc#1259729
Cross-References:
* CVE-2026-32776
* CVE-2026-32777
* CVE-2026-32778
CVSS scores:
* CVE-2026-32776 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32776 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32777 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32777 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32778 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32778 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.
Description:
This update for expat fixes the following issues:
- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity
declaration value (bsc#1259726).
- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition
(bsc#1259729).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-466=1
Package List:
- openSUSE Leap 16.0:
expat-2.7.1-160000.5.1
libexpat-devel-2.7.1-160000.5.1
libexpat1-2.7.1-160000.5.1
References:
* https://www.suse.com/security/cve/CVE-2026-32776.html
* https://www.suse.com/security/cve/CVE-2026-32777.html
* https://www.suse.com/security/cve/CVE-2026-32778.html
openSUSE-SU-2026:20449-1: important: Security update for postgresql13
openSUSE security update: security update for postgresql13
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20449-1
Rating: important
References:
* bsc#1253332
* bsc#1253333
Cross-References:
* CVE-2025-12817
* CVE-2025-12818
CVSS scores:
* CVE-2025-12817 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-12817 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-12818 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-12818 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.
Description:
This update for postgresql13 fixes the following issues:
Security fixes:
- CVE-2025-12817: Fixed missing check for CREATE privileges
on the schema in CREATE STATISTICS allowed table owners to create
statistics in any schema, potentially leading to unexpected naming
conflicts (bsc#1253332)
- CVE-2025-12818: Fixed several places in libpq were not
sufficiently careful about computing the required size of a memory
allocation. Sufficiently large inputs could cause integer overflow,
resulting in an undersized buffer, which would then lead to writing
past the end of the buffer (bsc#1253333)
Other fixes:
- Update to 13.23
* https://www.postgresql.org/about/news/p-3171/
* https://www.postgresql.org/docs/release/13.23
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-467=1
Package List:
- openSUSE Leap 16.0:
postgresql13-13.23-160000.1.1
postgresql13-contrib-13.23-160000.1.1
postgresql13-devel-13.23-160000.1.1
postgresql13-docs-13.23-160000.1.1
postgresql13-llvmjit-13.23-160000.1.1
postgresql13-llvmjit-devel-13.23-160000.1.1
postgresql13-plperl-13.23-160000.1.1
postgresql13-plpython-13.23-160000.1.1
postgresql13-pltcl-13.23-160000.1.1
postgresql13-server-13.23-160000.1.1
postgresql13-server-devel-13.23-160000.1.1
postgresql13-test-13.23-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2025-12817.html
* https://www.suse.com/security/cve/CVE-2025-12818.html
openSUSE-SU-2026:20452-1: important: Security update for kea
openSUSE security update: security update for kea
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20452-1
Rating: important
References:
* bsc#1252863
* bsc#1260380
Cross-References:
* CVE-2025-11232
* CVE-2026-3608
CVSS scores:
* CVE-2025-11232 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-11232 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-3608 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-3608 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.
Description:
This update for kea fixes the following issues:
Update to 3.0.3:
- CVE-2025-11232: invalid characters cause assert (bsc#1252863).
- CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380).
Changelog:
* A large number of bracket pairs in a JSON payload directed to
any endpoint would result in a stack overflow, due to recursive
calls when parsing the JSON. This has been fixed.
(CVE-2026-3608)
[bsc#1260380]
* When a hostname or FQDN received from a client is reduced to an
empty string by hostname sanitizing, kea-dhcp4 and kea-dhcp6
will now drop the option.
(CVE-2025-11232)
[bsc#1252863]
* A null dereference is now no longer possible when configuring
the Control Agent with a socket that lacks the mandatory
socket-name entry.
* UNIX sockets are now created as group-writable.
* Removed logging an error in ping check hook library if using
lease cache treshold.
* Fixed deadlock in ping-check hooks library.
* Fixed a data race in ping-check hooks library.
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-470=1
Package List:
- openSUSE Leap 16.0:
kea-3.0.3-160000.1.1
kea-devel-3.0.3-160000.1.1
kea-doc-3.0.3-160000.1.1
kea-hooks-3.0.3-160000.1.1
libkea-asiodns62-3.0.3-160000.1.1
libkea-asiolink88-3.0.3-160000.1.1
libkea-cc83-3.0.3-160000.1.1
libkea-cfgrpt3-3.0.3-160000.1.1
libkea-config84-3.0.3-160000.1.1
libkea-cryptolink64-3.0.3-160000.1.1
libkea-d2srv63-3.0.3-160000.1.1
libkea-database76-3.0.3-160000.1.1
libkea-dhcp109-3.0.3-160000.1.1
libkea-dhcp_ddns68-3.0.3-160000.1.1
libkea-dhcpsrv131-3.0.3-160000.1.1
libkea-dns71-3.0.3-160000.1.1
libkea-eval84-3.0.3-160000.1.1
libkea-exceptions45-3.0.3-160000.1.1
libkea-hooks121-3.0.3-160000.1.1
libkea-http87-3.0.3-160000.1.1
libkea-log-interprocess3-3.0.3-160000.1.1
libkea-log75-3.0.3-160000.1.1
libkea-mysql88-3.0.3-160000.1.1
libkea-pgsql88-3.0.3-160000.1.1
libkea-process91-3.0.3-160000.1.1
libkea-stats53-3.0.3-160000.1.1
libkea-tcp33-3.0.3-160000.1.1
libkea-util-io12-3.0.3-160000.1.1
libkea-util102-3.0.3-160000.1.1
python3-kea-3.0.3-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2025-11232.html
* https://www.suse.com/security/cve/CVE-2026-3608.html
openSUSE-SU-2026:20444-1: important: Security update for tomcat10
openSUSE security update: security update for tomcat10
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20444-1
Rating: important
References:
* bsc#1252753
* bsc#1252756
* bsc#1252905
* bsc#1253460
* bsc#1258371
* bsc#1258385
* bsc#1258387
Cross-References:
* CVE-2025-55752
* CVE-2025-55754
* CVE-2025-61795
* CVE-2025-66614
* CVE-2026-24733
* CVE-2026-24734
CVSS scores:
* CVE-2025-55752 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-55752 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-55754 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-55754 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-61795 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-61795 ( SUSE ): 6 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-66614 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24733 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-24733 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24734 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 6 vulnerabilities and has 7 bug fixes can now be installed.
Description:
This update for tomcat10 fixes the following issues:
Update to Tomcat 10.1.52:
- CVE-2025-55752: directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753).
- CVE-2025-55754: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat
(bsc#1252905).
- CVE-2025-61795: temporary copies during the processing of multipart upload can lead to a denial of service
(bsc#1252756).
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
Changelog:
+ Fix: 69623: Additional fix for the long standing regression that meant
that calls to ClassLoader.getResource().getContent() failed when made from
within a web application with resource caching enabled if the target
resource was packaged in a JAR file. (markt)
+ Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the
CsrfPreventionFilter. (schultz)
+ Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2
requests when the content-length header is not set. (dsoumis)
+ Update: Enable minimum and recommended Tomcat Native versions to be set
separately for Tomcat Native 1.x and 2.x. Update the minimum and
recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum
and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)
+ Add: Add a new ssoReauthenticationMode to the Tomcat provided
Authenticators that provides a per Authenticator override of the SSO Valve
requireReauthentication attribute. (markt)
+ Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception
rather than silently using a replacement character. (markt)
+ Fix: 69932: Fix request end access log pattern regression, which would log
the start time of the request instead. (remm)
+ Fix: 69871: Increase log level to INFO for missing configuration for the
rewrite valve. (remm)
+ Fix: Add log warnings for additional Host appBase suspicious values.
(remm)
+ Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
org.apache.catalina.Connector no longer requires
org.apache.tomcat.jni.AprStatus to be present. (markt)
+ Add: Add the ability to use a custom function to generate the client
identifier in the CrawlerSessionManagerValve. This is only available
programmatically. Pull request #902 by Brian Matzon. (markt)
+ Fix: Change the SSO reauthentication behaviour for SPNEGO authentication
so that a normal SPNEGO authentication is performed if the SSL Valve is
configured with reauthentication enabled. This is so that the delegated
credentials will be available to the web application. (markt)
+ Fix: When generating the class path in the Loader, re-order the check on
individual class path components to avoid a potential
NullPointerException. Identified by Coverity Scan. (markt)
+ Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull
request #915 by Joshua Rogers. (remm)
+ Update: Add an attribute, digestInRfc3112Order, to
MessageDigestCredentialHandler to control the order in which the
credential and salt are digested. By default, the current, non-RFC 3112
compliant, order of salt then credential will be used. This default will
change in Tomcat 12 to the RFC 3112 compliant order of credential then
salt. (markt)
+ Fix: Log warnings when the SSO configuration does not comply with the
documentation. (remm)
+ Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of
the RemoteCIDRFilter and RemoteCIDRValve. (markt)
+ Fix: 69837: Fix corruption of the class path generated by the Loader when
running on Windows. (markt)
+ Fix: Reject requests that map to invalid Windows file names earlier.
(markt)
+ Fix: 69839: Ensure that changes to session IDs (typically after
authentication) are promulgated to the SSO Valve to ensure that SSO
entries are fully clean-up on session expiration. Patch provided by Kim
Johan Andersson. (markt)
+ Fix: Fix a race condition in the creation of the storage location for the
FileStore. (markt)
* Cluster
+ Add: 62814: Document that human-readable names may be used for
mapSendOptions and align documentation with channelSendOptions. Based on
pull request #929 by archan0621. (markt)
* Clustering
+ Fix: Correct a regression introduced in 10.1.45 that broke some clustering
configurations. (markt)
* Coyote
+ Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown
that triggered a significant memory leak. Patch provided by Wes. (markt)
+ Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)
+ Fix: Improve warnings when setting ciphers lists in the FFM code,
mirroring the tomcat-native changes. (remm)
+ Fix: 69910: Dereference TLS objects right after closing a socket to
improve memory efficiency. (remm)
+ Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig
to reflect the existing implementation that allows one configuration style
to be used for the trust attributes and a different style for all the
other attributes. (markt)
+ Fix: Better warning message when OpenSSLConf configuration elements are
used with a JSSE TLS implementation. (markt)
+ Fix: When using OpenSSL via FFM, don't log a warning about missing CA
certificates unless CA certificates were configured and the configuration
failed. (markt)
+ Add: For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers attribute
of an SSLHostConfig are now always ignored (previously they would be
ignored with OpenSSL implementations and used with JSSE implementations)
and a warning is logged that the cipher suite has been ignored. (markt)
+ Add: Add the ciphersuite attribute to SSLHostConfig to configure the
TLSv1.3 cipher suites. (markt)
+ Add: Add OCSP support to JSSE based TLS connectors and make the use of
OCSP configurable per connector for both JSSE and OpenSSL based TLS
implementations. Align the checks performed by OpenSSL with those
performed by JSSE. (markt)
+ Add: Add support for soft failure of OCSP checks with soft failure support
disabled by default. (markt)
+ Add: Add support for configuring the verification flags passed to
OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)
+ Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
+ Fix: Prevent concurrent release of OpenSSLEngine resources and the
termination of the Tomcat Native library as it can cause crashes during
Tomcat shutdown. (markt)
+ Fix: Don't log an incorrect certificate KeyStore location when creating a
TLS connector if the KeyStore instance has been set directly on the
connector. (markt)
+ Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)
+ Add: Add strictSni attribute on the Connector to allow matching the
SSLHostConfig configuration associated with the SNI host name to the
SSLHostConfig configuration matched from the HTTP protocol host name. Non
matching configurations will cause the request to be rejected. The
attribute default value is true, enabling the matching. (remm)
+ Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)
+ Fix: Fix use of deferAccept attribute in JMX, since it is normally only
removed in Tomcat 11. (remm)
+ Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL
provider. Pull request #912 by aogburn. (markt)
+ Fix: Fix potential crash on shutdown when a Connector depends on the
Tomcat Native library. (markt)
+ Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
+ Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests
received via the AJP connector were processed as OPTIONS requests and
PROPFIND requests were processed as TRACE. (markt)
+ Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis)
* General
+ Add: Add test.silent property to suppress JUnit console output during test
execution. Useful for cleaner console output when running tests with
multiple threads. (csutherl)
* Jasper
+ Fix: 69333: Correct a regression in the previous fix for 69333 and ensure
that reuse() or release() is always called for a tag. (markt)
+ Fix: 69877: Catch IllegalArgumentException when processing URIs when
creating the classpath to handle invalid URIs. (remm)
+ Fix: Fix populating the classpath with the webapp classloader
repositories. (remm)
+ Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some
exception details. Patch submitted by Eric Blanquer. (remm)
* Jdbc-pool
+ Fix: 64083: If the underlying connection has been closed, don't add it to
the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
* Web applications
+ Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server
status output if one or more of the web applications failed to start.
(schultz)
+ Add: Manager: Include web application state in the HTML and JSON complete
server status output. (markt)
+ Add: Documentation: Expand the documentation to better explain when OCSP
is supported and when it is not. (markt)
* Websocket
+ Fix: 69920: When attempting to write to a closed Writer or OutputStream
obtained from a WebSocket session, throw an IOException rather than an
IllegalStateExcpetion as required by Writer and strongly suggested by
OutputStream. (markt)
+ Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the
underlying Inflater and/or Deflater throwing IllegalStateException when
closed rather than NullPointerException as they do in Java 24 and earlier.
* Other
+ Update: Update the internal fork of Commons Pool to 2.13.1. (markt)
+ Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)
+ Update: Update Commons Daemon to 1.5.1. (markt)
+ Update: Update ByteBuddy to 1.18.3. (markt)
+ Update: Update UnboundID to 7.0.4. (markt)
+ Update: Update Checkstyle to 12.3.1. (markt)
+ Add: Improvements to French translations. (markt)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Add: Improvements to Chinese translations provided by Yang. vincent.h and
yong hu. (markt)
+ Update: Update Tomcat Native to 2.0.12. (markt)
+ Add: Add property "gpg.sign.files" to optionally disable release artefact
signing with GPG. (rjung)
+ Add: Add test profile system for selective test execution. Profiles can be
specified via -Dtest.profile= to run specific test subsets without
using patterns directly. Profile patterns are defined in
test-profiles.properties. (csutherl)
+ Update: Update file extension to media type mappings to align with the
current list used by the Apache Web Server (httpd). (markt)
+ Update: Update the packaged version of the Tomcat Migration Tool for
Jakarta EE to 1.0.10. (markt)
+ Update: Update Commons Daemon to 1.5.0. (markt)
+ Update: Update Byte Buddy to 1.18.2. (markt)
+ Update: Update Checkstyle to 12.2.0. (markt)
+ Add: Improvements to Spanish translations provided by White Vogel. (markt)
+ Add: Improvements to French translations. (remm)
+ Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)
+ Update: Update to Byte Buddy 1.17.8. (markt)
+ Update: Update to Checkstyle 12.1.1. (markt)
+ Update: Update to Jacoco 0.8.14. (markt)
+ Update: Update to SpotBugs 4.9.8. (markt)
+ Update: Update to JSign 7.4. (markt)
+ Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)
Update to Tomcat 10.1.48:
+ Update: Deprecate the RemoteAddrFilter and RemoteAddValve in favour of the
RemoteCIDRFilter and RemoteCIDRValve. (markt)
+ Fix: HTTP methods are case-sensitive so always use case sensitive
comparisons when comparing HTTP methods. (markt)
+ Fix: 69814: Ensure that HttpSession.isNew() returns false once the client
has joined the session. (markt)
+ Fix: Further performance improvements for ParameterMap. (jengebr/markt)
+ Code: Refactor access log time stamps to be based on the Instant request
processing starts. (markt)
+ Fix: Fix a case-sensitivity issue in the trailer header allow list.
+ Fix: Be proactive in cleaning up temporary files after a failed multi-part
upload rather than waiting for GC to do it. (markt)
+ Update: Change the digest used to calculate strong ETags (if enabled) for
the default Servlet from SHA-1 to SHA-256 to align with the recommendation
in RFC 9110 that hash functions used to generate strong ETags should be
collision resistant. (markt)
+ Fix: Correct a regression in the fix for 69781 that broke FileStore.
+ Code: Remove a number of unnecessary packages from the
catalina-deployer.jar. (markt)
+ Fix: 69781: Fix concurrent access issues in the session FileStore
implementation that were causing lost sessions when the store was used
with the PersistentValve. Based on pull request #882 by Aaron Ogburn.
+ Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)
+ Fix: Prevent the channel configuration (sender, receiver, membership
service) from being changed unless the channel is fully stopped. (markt)
+ Fix: Handle spurious wake-ups during leader election for
NonBlockingCoordinator. (markt)
+ Fix: Handle spurious wake-ups during sending of messages by RpcChannel.
+ Update: Add specific certificate selection code for TLS 1.3 supporting
post quantum cryptography. Certificates defined with type MLDSA will be
selected depending on the TLS client hello. (remm)
+ Update: Add groups attribute on SSLHostConfig allowing to restrict which
groups can be enabled on the SSL engine. (remm)
+ Add: Optimize the conversion of HTTP method from byte form to String form.
+ Fix: Store HTTP request headers using the original case for the header
name rather than forcing it to lower case. (markt)
+ Update: Add hybrid PQC support to OpenSSL, based on code from mod_ssl.
Using this OpenSSL specific code path, additional PQC certificates defined
with type MLDSA are added to contexts which use classic certificates.
(jfclere/remm)
+ Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to
process it, with appropriate logging. (remm)
+ Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when
reading a key fails. (remm)
+ Fix: Fix possible early timeouts for network operations caused by a
spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)
+ Fix: Documentation. Clarify the purpose of the maxPostSize attribute of
the Connector element. (markt)
+ Fix: Avoid NPE in manager webapp displaying certificate information.
+ Update: Update Byte Buddy to 1.17.7. (markt)
+ Update: Update Checkstyle to 11.1.0. (markt)
+ Update: Update SpotBugs to 4.9.6. (markt)
+ Update: Update Jsign to 7.2. (markt)
+ Add: Improvements to Russian translations provided by usmazat. (markt)
+ Update: Minor refactoring in JULI loggers. Patch provided by minjund.
+ Code: Review logging and include the full stack trace and exception
message by default rather then just the exception message when logging an
error or warning in response to an exception. (markt)
+ Add: Add escaping to log formatters to align with JSON formatter. (markt)
+ Update: Update Checkstyle to 11.0.0. (markt)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-462=1
Package List:
- openSUSE Leap 16.0:
tomcat10-10.1.52-160000.1.1
tomcat10-admin-webapps-10.1.52-160000.1.1
tomcat10-doc-10.1.52-160000.1.1
tomcat10-docs-webapp-10.1.52-160000.1.1
tomcat10-el-5_0-api-10.1.52-160000.1.1
tomcat10-embed-10.1.52-160000.1.1
tomcat10-jsp-3_1-api-10.1.52-160000.1.1
tomcat10-jsvc-10.1.52-160000.1.1
tomcat10-lib-10.1.52-160000.1.1
tomcat10-servlet-6_0-api-10.1.52-160000.1.1
tomcat10-webapps-10.1.52-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2025-55752.html
* https://www.suse.com/security/cve/CVE-2025-55754.html
* https://www.suse.com/security/cve/CVE-2025-61795.html
* https://www.suse.com/security/cve/CVE-2025-66614.html
* https://www.suse.com/security/cve/CVE-2026-24733.html
* https://www.suse.com/security/cve/CVE-2026-24734.html
openSUSE-SU-2026:20447-1: important: Security update for postgresql16
openSUSE security update: security update for postgresql16
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20447-1
Rating: important
References:
* bsc#1258008
* bsc#1258009
* bsc#1258010
* bsc#1258011
* bsc#1258754
Cross-References:
* CVE-2026-2003
* CVE-2026-2004
* CVE-2026-2005
* CVE-2026-2006
CVSS scores:
* CVE-2026-2003 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-2004 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2005 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2006 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 4 vulnerabilities and has 5 bug fixes can now be installed.
Description:
This update for postgresql16 fixes the following issues:
- Update to versio 16.13. (bsc#1258754)
- CVE-2026-2003: Guard against unexpected dimensions of oidvector/int2vector (bsc#1258008)
- CVE-2026-2004: Harden selectivity estimators against being attached to operators that accept unexpected data types. (bsc#1258009)
- CVE-2026-2005: Fix buffer overrun in contrib/pgcrypto's PGP decryption functions. (bsc#1258010)
- CVE-2026-2006: Fix inadequate validation of multibyte character lengths. (bsc#1258011)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-465=1
Package List:
- openSUSE Leap 16.0:
postgresql16-16.13-160000.1.1
postgresql16-contrib-16.13-160000.1.1
postgresql16-devel-16.13-160000.1.1
postgresql16-docs-16.13-160000.1.1
postgresql16-llvmjit-16.13-160000.1.1
postgresql16-llvmjit-devel-16.13-160000.1.1
postgresql16-plperl-16.13-160000.1.1
postgresql16-plpython-16.13-160000.1.1
postgresql16-pltcl-16.13-160000.1.1
postgresql16-server-16.13-160000.1.1
postgresql16-server-devel-16.13-160000.1.1
postgresql16-test-16.13-160000.1.1
References:
* https://www.suse.com/security/cve/CVE-2026-2003.html
* https://www.suse.com/security/cve/CVE-2026-2004.html
* https://www.suse.com/security/cve/CVE-2026-2005.html
* https://www.suse.com/security/cve/CVE-2026-2006.html
openSUSE-SU-2026:20437-1: moderate: Security update for net-tools
openSUSE security update: security update for net-tools
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:20437-1
Rating: moderate
References:
* bsc#1243581
* bsc#1248410
* bsc#1248687
* bsc#142461
* bsc#430864
* bsc#544339
Cross-References:
* CVE-2025-46836
CVSS scores:
* CVE-2025-46836 ( SUSE ): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
* CVE-2025-46836 ( SUSE ): 5.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves one vulnerability and has 6 bug fixes can now be installed.
Description:
This update for net-tools fixes the following issues:
- Fix stack buffer overflow in parse_hex (bsc#1248687, GHSA-h667-qrp8-gj58).
- Fix stack-based buffer overflow in proc_gen_fmt (bsc#1248687, GHSA-w7jq-cmw2-cq59).
- Avoid unsafe memcpy in ifconfig (bsc#1248687).
- Prevent overflow in ax25 and netrom (bsc#1248687)
- Keep possibility to enter long interface names, even if they are
not accepted by the kernel, because it was always possible up to
CVE-2025-46836 fix. But issue a warning about an interface name
concatenation (bsc#1248410).
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-454=1
Package List:
- openSUSE Leap 16.0:
net-tools-2.10-160000.3.1
net-tools-deprecated-2.10-160000.3.1
net-tools-lang-2.10-160000.3.1
References:
* https://www.suse.com/security/cve/CVE-2025-46836.html
SUSE-SU-2026:1166-1: important: Security update for expat
# Security update for expat
Announcement ID: SUSE-SU-2026:1166-1
Release Date: 2026-04-02T01:08:59Z
Rating: important
References:
* bsc#1259711
* bsc#1259726
* bsc#1259729
Cross-References:
* CVE-2026-32776
* CVE-2026-32777
* CVE-2026-32778
CVSS scores:
* CVE-2026-32776 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32776 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32776 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-32776 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32777 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32777 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32777 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-32777 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32778 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32778 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32778 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-32778 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* openSUSE Leap 15.4
* openSUSE Leap 15.6
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Micro for Rancher 5.3
* SUSE Linux Enterprise Micro for Rancher 5.4
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
An update that solves three vulnerabilities can now be installed.
## Description:
This update for expat fixes the following issues:
* CVE-2026-32776: NULL pointer dereference when processing empty external
parameter entities inside an entity declaration value (bsc#1259726).
* CVE-2026-32777: denial of service due to infinite loop in DTD content
parsing (bsc#1259711).
* CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an
out-of-memory condition (bsc#1259729).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Micro for Rancher 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2026-1166=1
* SUSE Linux Enterprise Micro 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2026-1166=1
* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2026-1166=1
* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2026-1166=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2026-1166=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1166=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1166=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1166=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1166=1
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1166=1
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1166=1
* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1166=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1166=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1166=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1166=1
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-1166=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-1166=1
## Package List:
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* openSUSE Leap 15.4 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat-devel-32bit-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
* openSUSE Leap 15.4 (aarch64_ilp32)
* libexpat-devel-64bit-2.7.1-150400.3.37.1
* libexpat1-64bit-debuginfo-2.7.1-150400.3.37.1
* libexpat1-64bit-2.7.1-150400.3.37.1
* expat-64bit-debuginfo-2.7.1-150400.3.37.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* libexpat1-2.7.1-150400.3.37.1
* libexpat-devel-2.7.1-150400.3.37.1
* expat-2.7.1-150400.3.37.1
* expat-debuginfo-2.7.1-150400.3.37.1
* expat-debugsource-2.7.1-150400.3.37.1
* libexpat1-debuginfo-2.7.1-150400.3.37.1
* openSUSE Leap 15.6 (x86_64)
* libexpat1-32bit-2.7.1-150400.3.37.1
* libexpat-devel-32bit-2.7.1-150400.3.37.1
* expat-32bit-debuginfo-2.7.1-150400.3.37.1
* libexpat1-32bit-debuginfo-2.7.1-150400.3.37.1
## References:
* https://www.suse.com/security/cve/CVE-2026-32776.html
* https://www.suse.com/security/cve/CVE-2026-32777.html
* https://www.suse.com/security/cve/CVE-2026-32778.html
* https://bugzilla.suse.com/show_bug.cgi?id=1259711
* https://bugzilla.suse.com/show_bug.cgi?id=1259726
* https://bugzilla.suse.com/show_bug.cgi?id=1259729
openSUSE-SU-2026:10476-1: moderate: python311-Pygments-2.20.0-2.1 on GA media
# python311-Pygments-2.20.0-2.1 on GA media
Announcement ID: openSUSE-SU-2026:10476-1
Rating: moderate
Cross-References:
* CVE-2026-4539
CVSS scores:
* CVE-2026-4539 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the python311-Pygments-2.20.0-2.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python311-Pygments 2.20.0-2.1
* python313-Pygments 2.20.0-2.1
* python314-Pygments 2.20.0-2.1
## References:
* https://www.suse.com/security/cve/CVE-2026-4539.html
openSUSE-SU-2026:10475-1: moderate: opensc-0.27.1-1.1 on GA media
# opensc-0.27.1-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10475-1
Rating: moderate
Cross-References:
* CVE-2025-13763
* CVE-2025-49010
* CVE-2025-66037
* CVE-2025-66038
* CVE-2025-66215
CVSS scores:
* CVE-2025-49010 ( SUSE ): 3.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-49010 ( SUSE ): 1 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-66037 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2025-66037 ( SUSE ): 1 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-66038 ( SUSE ): 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2025-66038 ( SUSE ): 1 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-66215 ( SUSE ): 3.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-66215 ( SUSE ): 1 CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 5 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the opensc-0.27.1-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* opensc 0.27.1-1.1
* opensc-bash-completion 0.27.1-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-13763.html
* https://www.suse.com/security/cve/CVE-2025-49010.html
* https://www.suse.com/security/cve/CVE-2025-66037.html
* https://www.suse.com/security/cve/CVE-2025-66038.html
* https://www.suse.com/security/cve/CVE-2025-66215.html
openSUSE-SU-2026:10474-1: moderate: ignition-2.26.0-3.1 on GA media
# ignition-2.26.0-3.1 on GA media
Announcement ID: openSUSE-SU-2026:10474-1
Rating: moderate
Cross-References:
* CVE-2026-33186
CVSS scores:
* CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the ignition-2.26.0-3.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* ignition 2.26.0-3.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33186.html
openSUSE-SU-2026:10472-1: moderate: conftest-0.67.1-2.1 on GA media
# conftest-0.67.1-2.1 on GA media
Announcement ID: openSUSE-SU-2026:10472-1
Rating: moderate
Cross-References:
* CVE-2026-33747
CVSS scores:
* CVE-2026-33747 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-33747 ( SUSE ): 8.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the conftest-0.67.1-2.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* conftest 0.67.1-2.1
* conftest-bash-completion 0.67.1-2.1
* conftest-fish-completion 0.67.1-2.1
* conftest-zsh-completion 0.67.1-2.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33747.html
openSUSE-SU-2026:10468-1: moderate: python311-ecdsa-0.19.2-1.1 on GA media
# python311-ecdsa-0.19.2-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10468-1
Rating: moderate
Cross-References:
* CVE-2026-33936
CVSS scores:
* CVE-2026-33936 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-33936 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the python311-ecdsa-0.19.2-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python311-ecdsa 0.19.2-1.1
* python313-ecdsa 0.19.2-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33936.html
openSUSE-SU-2026:10467-1: moderate: ovmf-202602-6.1 on GA media
# ovmf-202602-6.1 on GA media
Announcement ID: openSUSE-SU-2026:10467-1
Rating: moderate
Cross-References:
* CVE-2025-2296
CVSS scores:
* CVE-2025-2296 ( SUSE ): 5.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L
* CVE-2025-2296 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the ovmf-202602-6.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* ovmf 202602-6.1
* ovmf-tools 202602-6.1
* qemu-ovmf-x86_64 202602-6.1
* qemu-ovmf-x86_64-debug 202602-6.1
* qemu-uefi-aarch64 202602-6.1
* qemu-uefi-riscv64 202602-6.1
## References:
* https://www.suse.com/security/cve/CVE-2025-2296.html
openSUSE-SU-2026:10470-1: moderate: libXvnc-devel-1.16.1-2.1 on GA media
# libXvnc-devel-1.16.1-2.1 on GA media
Announcement ID: openSUSE-SU-2026:10470-1
Rating: moderate
Cross-References:
* CVE-2026-34352
CVSS scores:
* CVE-2026-34352 ( SUSE ): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the libXvnc-devel-1.16.1-2.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* libXvnc-devel 1.16.1-2.1
* libXvnc1 1.16.1-2.1
* tigervnc 1.16.1-2.1
* tigervnc-selinux 1.16.1-2.1
* tigervnc-x11vnc 1.16.1-2.1
* xorg-x11-Xvnc 1.16.1-2.1
* xorg-x11-Xvnc-java 1.16.1-2.1
* xorg-x11-Xvnc-module 1.16.1-2.1
* xorg-x11-Xvnc-novnc 1.16.1-2.1
## References:
* https://www.suse.com/security/cve/CVE-2026-34352.html
openSUSE-SU-2026:10469-1: moderate: python315-3.15.0~a7-3.1 on GA media
# python315-3.15.0~a7-3.1 on GA media
Announcement ID: openSUSE-SU-2026:10469-1
Rating: moderate
Cross-References:
* CVE-2025-13462
* CVE-2026-3644
* CVE-2026-4224
* CVE-2026-4519
CVSS scores:
* CVE-2025-13462 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-13462 ( SUSE ): 2 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-3644 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-3644 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-4224 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-4224 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-4519 ( SUSE ): 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N
* CVE-2026-4519 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 4 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the python315-3.15.0~a7-3.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python315 3.15.0~a7-3.1
* python315-curses 3.15.0~a7-3.1
* python315-dbm 3.15.0~a7-3.1
* python315-idle 3.15.0~a7-3.1
* python315-profiling 3.15.0~a7-3.1
* python315-tk 3.15.0~a7-3.1
* python315-x86-64-v3 3.15.0~a7-3.1
## References:
* https://www.suse.com/security/cve/CVE-2025-13462.html
* https://www.suse.com/security/cve/CVE-2026-3644.html
* https://www.suse.com/security/cve/CVE-2026-4224.html
* https://www.suse.com/security/cve/CVE-2026-4519.html
openSUSE-SU-2026:10473-1: moderate: dnsdist-2.0.3-1.1 on GA media
# dnsdist-2.0.3-1.1 on GA media
Announcement ID: openSUSE-SU-2026:10473-1
Rating: moderate
Cross-References:
* CVE-2026-0396
* CVE-2026-24028
* CVE-2026-24030
* CVE-2026-27854
CVSS scores:
* CVE-2026-0396 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
* CVE-2026-0396 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24028 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-24028 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-24030 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-24030 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-27854 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
* CVE-2026-27854 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 4 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the dnsdist-2.0.3-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* dnsdist 2.0.3-1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-0396.html
* https://www.suse.com/security/cve/CVE-2026-24028.html
* https://www.suse.com/security/cve/CVE-2026-24030.html
* https://www.suse.com/security/cve/CVE-2026-27854.html
openSUSE-SU-2026:0112-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2026:0112-1
Rating: important
References: #1261249
Cross-References: CVE-2026-5272 CVE-2026-5273 CVE-2026-5274
CVE-2026-5275 CVE-2026-5276 CVE-2026-5277
CVE-2026-5278 CVE-2026-5279 CVE-2026-5280
CVE-2026-5281 CVE-2026-5282 CVE-2026-5283
CVE-2026-5284 CVE-2026-5285 CVE-2026-5286
CVE-2026-5287 CVE-2026-5288 CVE-2026-5289
CVE-2026-5290 CVE-2026-5291 CVE-2026-5292
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes 21 vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
Chromium 146.0.7680.177 (boo#1261249):
* CVE-2026-5273: Use after free in CSS
* CVE-2026-5272: Heap buffer overflow in GPU
* CVE-2026-5274: Integer overflow in Codecs
* CVE-2026-5275: Heap buffer overflow in ANGLE
* CVE-2026-5276: Insufficient policy enforcement in WebUSB
* CVE-2026-5277: Integer overflow in ANGLE
* CVE-2026-5278: Use after free in Web MIDI
* CVE-2026-5279: Object corruption in V8
* CVE-2026-5280: Use after free in WebCodecs
* CVE-2026-5281: Use after free in Dawn
* CVE-2026-5282: Out of bounds read in WebCodecs
* CVE-2026-5283: Inappropriate implementation in ANGLE
* CVE-2026-5284: Use after free in Dawn
* CVE-2026-5285: Use after free in WebGL
* CVE-2026-5286: Use after free in Dawn
* CVE-2026-5287: Use after free in PDF
* CVE-2026-5288: Use after free in WebView
* CVE-2026-5289: Use after free in Navigation
* CVE-2026-5290: Use after free in Compositing
* CVE-2026-5291: Inappropriate implementation in WebGL
* CVE-2026-5292: Out of bounds read in WebCodecs
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2026-112=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64):
chromedriver-146.0.7680.177-bp156.2.257.1
chromium-146.0.7680.177-bp156.2.257.1
References:
https://www.suse.com/security/cve/CVE-2026-5272.html
https://www.suse.com/security/cve/CVE-2026-5273.html
https://www.suse.com/security/cve/CVE-2026-5274.html
https://www.suse.com/security/cve/CVE-2026-5275.html
https://www.suse.com/security/cve/CVE-2026-5276.html
https://www.suse.com/security/cve/CVE-2026-5277.html
https://www.suse.com/security/cve/CVE-2026-5278.html
https://www.suse.com/security/cve/CVE-2026-5279.html
https://www.suse.com/security/cve/CVE-2026-5280.html
https://www.suse.com/security/cve/CVE-2026-5281.html
https://www.suse.com/security/cve/CVE-2026-5282.html
https://www.suse.com/security/cve/CVE-2026-5283.html
https://www.suse.com/security/cve/CVE-2026-5284.html
https://www.suse.com/security/cve/CVE-2026-5285.html
https://www.suse.com/security/cve/CVE-2026-5286.html
https://www.suse.com/security/cve/CVE-2026-5287.html
https://www.suse.com/security/cve/CVE-2026-5288.html
https://www.suse.com/security/cve/CVE-2026-5289.html
https://www.suse.com/security/cve/CVE-2026-5290.html
https://www.suse.com/security/cve/CVE-2026-5291.html
https://www.suse.com/security/cve/CVE-2026-5292.html
https://bugzilla.suse.com/1261249
openSUSE-SU-2026:0113-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2026:0113-1
Rating: important
References: #1261249
Cross-References: CVE-2026-5272 CVE-2026-5273 CVE-2026-5274
CVE-2026-5275 CVE-2026-5276 CVE-2026-5277
CVE-2026-5278 CVE-2026-5279 CVE-2026-5280
CVE-2026-5281 CVE-2026-5282 CVE-2026-5283
CVE-2026-5284 CVE-2026-5285 CVE-2026-5286
CVE-2026-5287 CVE-2026-5288 CVE-2026-5289
CVE-2026-5290 CVE-2026-5291 CVE-2026-5292
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes 21 vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
Chromium 146.0.7680.177 (boo#1261249)
* CVE-2026-5273: Use after free in CSS
* CVE-2026-5272: Heap buffer overflow in GPU
* CVE-2026-5274: Integer overflow in Codecs
* CVE-2026-5275: Heap buffer overflow in ANGLE
* CVE-2026-5276: Insufficient policy enforcement in WebUSB
* CVE-2026-5277: Integer overflow in ANGLE
* CVE-2026-5278: Use after free in Web MIDI
* CVE-2026-5279: Object corruption in V8
* CVE-2026-5280: Use after free in WebCodecs
* CVE-2026-5281: Use after free in Dawn
* CVE-2026-5282: Out of bounds read in WebCodecs
* CVE-2026-5283: Inappropriate implementation in ANGLE
* CVE-2026-5284: Use after free in Dawn
* CVE-2026-5285: Use after free in WebGL
* CVE-2026-5286: Use after free in Dawn
* CVE-2026-5287: Use after free in PDF
* CVE-2026-5288: Use after free in WebView
* CVE-2026-5289: Use after free in Navigation
* CVE-2026-5290: Use after free in Compositing
* CVE-2026-5291: Inappropriate implementation in WebGL
* CVE-2026-5292: Out of bounds read in WebCodecs
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2026-113=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le x86_64):
chromedriver-146.0.7680.177-bp157.2.142.1
chromium-146.0.7680.177-bp157.2.142.1
References:
https://www.suse.com/security/cve/CVE-2026-5272.html
https://www.suse.com/security/cve/CVE-2026-5273.html
https://www.suse.com/security/cve/CVE-2026-5274.html
https://www.suse.com/security/cve/CVE-2026-5275.html
https://www.suse.com/security/cve/CVE-2026-5276.html
https://www.suse.com/security/cve/CVE-2026-5277.html
https://www.suse.com/security/cve/CVE-2026-5278.html
https://www.suse.com/security/cve/CVE-2026-5279.html
https://www.suse.com/security/cve/CVE-2026-5280.html
https://www.suse.com/security/cve/CVE-2026-5281.html
https://www.suse.com/security/cve/CVE-2026-5282.html
https://www.suse.com/security/cve/CVE-2026-5283.html
https://www.suse.com/security/cve/CVE-2026-5284.html
https://www.suse.com/security/cve/CVE-2026-5285.html
https://www.suse.com/security/cve/CVE-2026-5286.html
https://www.suse.com/security/cve/CVE-2026-5287.html
https://www.suse.com/security/cve/CVE-2026-5288.html
https://www.suse.com/security/cve/CVE-2026-5289.html
https://www.suse.com/security/cve/CVE-2026-5290.html
https://www.suse.com/security/cve/CVE-2026-5291.html
https://www.suse.com/security/cve/CVE-2026-5292.html
https://bugzilla.suse.com/1261249
SUSE-SU-2026:1177-1: important: Security update for tar
# Security update for tar
Announcement ID: SUSE-SU-2026:1177-1
Release Date: 2026-04-02T15:01:24Z
Rating: important
References:
* bsc#1246399
Cross-References:
* CVE-2025-45582
CVSS scores:
* CVE-2025-45582 ( SUSE ): 8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-45582 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-45582 ( NVD ): 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
Affected Products:
* Basesystem Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Micro 5.2
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Micro for Rancher 5.2
* SUSE Linux Enterprise Micro for Rancher 5.3
* SUSE Linux Enterprise Micro for Rancher 5.4
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
An update that solves one vulnerability can now be installed.
## Description:
This update for tar fixes the following issue:
* CVE-2025-45582: file overwrite via directory traversal in crafted TAR
archives (bsc#1246399).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Micro for Rancher 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2026-1177=1
* SUSE Linux Enterprise Micro 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2026-1177=1
* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2026-1177=1
* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2026-1177=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2026-1177=1
* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-1177=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1177=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1177=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1177=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1177=1
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1177=1
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1177=1
* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1177=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1177=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1177=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1177=1
* SUSE Linux Enterprise Micro 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2026-1177=1
* SUSE Linux Enterprise Micro for Rancher 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2026-1177=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-1177=1
## Package List:
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
* tar-debugsource-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
* tar-debugsource-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* tar-debugsource-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* tar-debugsource-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)
* tar-debugsource-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* Basesystem Module 15-SP7 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* tar-lang-1.34-150000.3.37.1
* SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64)
* tar-debugsource-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64)
* tar-debugsource-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* tar-tests-debuginfo-1.34-150000.3.37.1
* tar-rmt-1.34-150000.3.37.1
* tar-debuginfo-1.34-150000.3.37.1
* tar-1.34-150000.3.37.1
* tar-tests-1.34-150000.3.37.1
* tar-debugsource-1.34-150000.3.37.1
* tar-rmt-debuginfo-1.34-150000.3.37.1
* openSUSE Leap 15.6 (noarch)
* tar-backup-scripts-1.34-150000.3.37.1
* tar-doc-1.34-150000.3.37.1
* tar-lang-1.34-150000.3.37.1
## References:
* https://www.suse.com/security/cve/CVE-2025-45582.html
* https://bugzilla.suse.com/show_bug.cgi?id=1246399
SUSE-SU-2026:1178-1: moderate: Security update for libsoup
# Security update for libsoup
Announcement ID: SUSE-SU-2026:1178-1
Release Date: 2026-04-02T15:08:02Z
Rating: moderate
References:
* bsc#1256418
Cross-References:
* CVE-2026-0716
CVSS scores:
* CVE-2026-0716 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-0716 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
* CVE-2026-0716 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected Products:
* openSUSE Leap 15.4
An update that solves one vulnerability can now be installed.
## Description:
This update for libsoup fixes the following issue:
* CVE-2026-0716: improper bounds handling may allow out-of-bounds read
(bsc#1256418).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-1178=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* libsoup-3_0-0-3.0.4-150400.3.40.1
* libsoup-3_0-0-debuginfo-3.0.4-150400.3.40.1
* libsoup-devel-3.0.4-150400.3.40.1
* libsoup-debugsource-3.0.4-150400.3.40.1
* typelib-1_0-Soup-3_0-3.0.4-150400.3.40.1
* openSUSE Leap 15.4 (x86_64)
* libsoup-3_0-0-32bit-debuginfo-3.0.4-150400.3.40.1
* libsoup-devel-32bit-3.0.4-150400.3.40.1
* libsoup-3_0-0-32bit-3.0.4-150400.3.40.1
* openSUSE Leap 15.4 (noarch)
* libsoup-lang-3.0.4-150400.3.40.1
* openSUSE Leap 15.4 (aarch64_ilp32)
* libsoup-3_0-0-64bit-3.0.4-150400.3.40.1
* libsoup-3_0-0-64bit-debuginfo-3.0.4-150400.3.40.1
* libsoup-devel-64bit-3.0.4-150400.3.40.1
## References:
* https://www.suse.com/security/cve/CVE-2026-0716.html
* https://bugzilla.suse.com/show_bug.cgi?id=1256418
SUSE-SU-2026:1179-1: moderate: Security update for libsoup2
# Security update for libsoup2
Announcement ID: SUSE-SU-2026:1179-1
Release Date: 2026-04-02T15:08:35Z
Rating: moderate
References:
* bsc#1256418
Cross-References:
* CVE-2026-0716
CVSS scores:
* CVE-2026-0716 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-0716 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
* CVE-2026-0716 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected Products:
* openSUSE Leap 15.4
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Micro for Rancher 5.3
* SUSE Linux Enterprise Micro for Rancher 5.4
An update that solves one vulnerability can now be installed.
## Description:
This update for libsoup2 fixes the following issue:
* CVE-2026-0716: improper bounds handling may allow out-of-bounds read
(bsc#1256418).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-1179=1
* SUSE Linux Enterprise Micro for Rancher 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2026-1179=1
* SUSE Linux Enterprise Micro 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2026-1179=1
* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2026-1179=1
* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2026-1179=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2026-1179=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* libsoup-2_4-1-2.74.2-150400.3.34.1
* libsoup-2_4-1-debuginfo-2.74.2-150400.3.34.1
* libsoup2-devel-2.74.2-150400.3.34.1
* typelib-1_0-Soup-2_4-2.74.2-150400.3.34.1
* libsoup2-debugsource-2.74.2-150400.3.34.1
* openSUSE Leap 15.4 (x86_64)
* libsoup-2_4-1-32bit-2.74.2-150400.3.34.1
* libsoup2-devel-32bit-2.74.2-150400.3.34.1
* libsoup-2_4-1-32bit-debuginfo-2.74.2-150400.3.34.1
* openSUSE Leap 15.4 (noarch)
* libsoup2-lang-2.74.2-150400.3.34.1
* openSUSE Leap 15.4 (aarch64_ilp32)
* libsoup2-devel-64bit-2.74.2-150400.3.34.1
* libsoup-2_4-1-64bit-2.74.2-150400.3.34.1
* libsoup-2_4-1-64bit-debuginfo-2.74.2-150400.3.34.1
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
* libsoup-2_4-1-debuginfo-2.74.2-150400.3.34.1
* libsoup-2_4-1-2.74.2-150400.3.34.1
* libsoup2-debugsource-2.74.2-150400.3.34.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
* libsoup-2_4-1-debuginfo-2.74.2-150400.3.34.1
* libsoup-2_4-1-2.74.2-150400.3.34.1
* libsoup2-debugsource-2.74.2-150400.3.34.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* libsoup-2_4-1-debuginfo-2.74.2-150400.3.34.1
* libsoup-2_4-1-2.74.2-150400.3.34.1
* libsoup2-debugsource-2.74.2-150400.3.34.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* libsoup-2_4-1-debuginfo-2.74.2-150400.3.34.1
* libsoup-2_4-1-2.74.2-150400.3.34.1
* libsoup2-debugsource-2.74.2-150400.3.34.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)
* libsoup-2_4-1-debuginfo-2.74.2-150400.3.34.1
* libsoup-2_4-1-2.74.2-150400.3.34.1
* libsoup2-debugsource-2.74.2-150400.3.34.1
## References:
* https://www.suse.com/security/cve/CVE-2026-0716.html
* https://bugzilla.suse.com/show_bug.cgi?id=1256418
SUSE-SU-2026:1173-1: important: Security update for LibVNCServer
# Security update for LibVNCServer
Announcement ID: SUSE-SU-2026:1173-1
Release Date: 2026-04-02T12:43:17Z
Rating: important
References:
* bsc#1260429
* bsc#1260431
Cross-References:
* CVE-2026-32853
* CVE-2026-32854
CVSS scores:
* CVE-2026-32853 ( SUSE ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32853 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
* CVE-2026-32853 ( NVD ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-32853 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
* CVE-2026-32854 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-32854 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-32854 ( NVD ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-32854 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Linux Enterprise Workstation Extension 15 SP7
* SUSE Package Hub 15 15-SP7
An update that solves two vulnerabilities can now be installed.
## Description:
This update for LibVNCServer fixes the following issues:
* CVE-2026-32853: crafted FramebufferUpdate message can lead to information
disclosure or denial of service (bsc#1260431).
* CVE-2026-32854: crafted HTTP requests can cause a denial of service
(bsc#1260429).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-1173=1 openSUSE-SLE-15.6-2026-1173=1
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1173=1
* SUSE Linux Enterprise Workstation Extension 15 SP7
zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-1173=1
## Package List:
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* LibVNCServer-devel-0.9.14-150600.3.6.1
* LibVNCServer-debugsource-0.9.14-150600.3.6.1
* libvncclient1-debuginfo-0.9.14-150600.3.6.1
* libvncserver1-debuginfo-0.9.14-150600.3.6.1
* libvncclient1-0.9.14-150600.3.6.1
* libvncserver1-0.9.14-150600.3.6.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
* LibVNCServer-devel-0.9.14-150600.3.6.1
* LibVNCServer-debugsource-0.9.14-150600.3.6.1
* libvncclient1-debuginfo-0.9.14-150600.3.6.1
* libvncserver1-debuginfo-0.9.14-150600.3.6.1
* libvncclient1-0.9.14-150600.3.6.1
* libvncserver1-0.9.14-150600.3.6.1
* SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64)
* LibVNCServer-debugsource-0.9.14-150600.3.6.1
* libvncclient1-debuginfo-0.9.14-150600.3.6.1
* libvncserver1-debuginfo-0.9.14-150600.3.6.1
* libvncclient1-0.9.14-150600.3.6.1
* libvncserver1-0.9.14-150600.3.6.1
## References:
* https://www.suse.com/security/cve/CVE-2026-32853.html
* https://www.suse.com/security/cve/CVE-2026-32854.html
* https://bugzilla.suse.com/show_bug.cgi?id=1260429
* https://bugzilla.suse.com/show_bug.cgi?id=1260431
