ImageMagick, Firefox, Busybox, and more updates for SUSE

SUSE 5587 Published by

Several security updates have been released for SUSE Linux, including updates for ImageMagick and GraphicsMagick. Other updated packages include MozillaFirefox, busybox, python, tomcat11, postgresql18, MozillaThunderbird, and postgresql16. These updates address various security vulnerabilities in the affected software and are considered important or moderate by SUSE. In addition to these SUSE-specific updates, some security updates have also been released for openSUSE Linux.

SUSE-SU-2026:0870-1: moderate: Security update for ImageMagick
SUSE-SU-2026:0874-1: moderate: Security update for GraphicsMagick
SUSE-SU-2026:0871-1: important: Security update for MozillaFirefox
SUSE-SU-2026:0875-1: moderate: Security update for go1.25
SUSE-SU-2026:0872-1: important: Security update for busybox
SUSE-SU-2026:0873-1: important: Security update for python
SUSE-SU-2026:0876-1: moderate: Security update for go1.26
SUSE-SU-2026:0877-1: important: Security update for tomcat11
SUSE-SU-2026:0881-1: important: Security update for postgresql18
SUSE-SU-2026:0880-1: important: Security update for MozillaThunderbird
SUSE-SU-2026:0882-1: important: Security update for postgresql16
SUSE-SU-2026:0883-1: important: Security update for postgresql17
openSUSE-SU-2026:20345-1: moderate: Security update for python-lxml_html_clean
openSUSE-SU-2026:20348-1: moderate: Security update for python-PyPDF2
openSUSE-SU-2026:20340-1: important: Security update for cJSON
SUSE-SU-2026:0885-1: important: Security update for curl
SUSE-SU-2026:0886-1: moderate: Security update for libsoup2




SUSE-SU-2026:0870-1: moderate: Security update for ImageMagick


# Security update for ImageMagick

Announcement ID: SUSE-SU-2026:0870-1
Release Date: 2026-03-11T16:45:32Z
Rating: moderate
References:

* bsc#1258790

Cross-References:

* CVE-2026-24484

CVSS scores:

* CVE-2026-24484 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-24484 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-24484 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:

* openSUSE Leap 15.6

An update that solves one vulnerability can now be installed.

## Description:

This update for ImageMagick fixes the following issue:

* CVE-2026-24484: denial of service vulnerability via multi-layer nested MVG
to SVG conversion (bsc#1258790).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-870=1 openSUSE-SLE-15.6-2026-870=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* ImageMagick-7.1.1.21-150600.3.45.1
* ImageMagick-debugsource-7.1.1.21-150600.3.45.1
* libMagickWand-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.45.1
* ImageMagick-config-7-upstream-websafe-7.1.1.21-150600.3.45.1
* perl-PerlMagick-debuginfo-7.1.1.21-150600.3.45.1
* ImageMagick-config-7-upstream-open-7.1.1.21-150600.3.45.1
* ImageMagick-config-7-SUSE-7.1.1.21-150600.3.45.1
* ImageMagick-debuginfo-7.1.1.21-150600.3.45.1
* ImageMagick-extra-debuginfo-7.1.1.21-150600.3.45.1
* libMagick++-7_Q16HDRI5-7.1.1.21-150600.3.45.1
* ImageMagick-devel-7.1.1.21-150600.3.45.1
* libMagickCore-7_Q16HDRI10-7.1.1.21-150600.3.45.1
* libMagickCore-7_Q16HDRI10-debuginfo-7.1.1.21-150600.3.45.1
* libMagickWand-7_Q16HDRI10-7.1.1.21-150600.3.45.1
* libMagick++-7_Q16HDRI5-debuginfo-7.1.1.21-150600.3.45.1
* ImageMagick-extra-7.1.1.21-150600.3.45.1
* ImageMagick-config-7-upstream-secure-7.1.1.21-150600.3.45.1
* ImageMagick-config-7-upstream-limited-7.1.1.21-150600.3.45.1
* perl-PerlMagick-7.1.1.21-150600.3.45.1
* libMagick++-devel-7.1.1.21-150600.3.45.1
* openSUSE Leap 15.6 (x86_64)
* libMagick++-devel-32bit-7.1.1.21-150600.3.45.1
* libMagick++-7_Q16HDRI5-32bit-debuginfo-7.1.1.21-150600.3.45.1
* ImageMagick-devel-32bit-7.1.1.21-150600.3.45.1
* libMagickWand-7_Q16HDRI10-32bit-7.1.1.21-150600.3.45.1
* libMagickCore-7_Q16HDRI10-32bit-debuginfo-7.1.1.21-150600.3.45.1
* libMagickWand-7_Q16HDRI10-32bit-debuginfo-7.1.1.21-150600.3.45.1
* libMagick++-7_Q16HDRI5-32bit-7.1.1.21-150600.3.45.1
* libMagickCore-7_Q16HDRI10-32bit-7.1.1.21-150600.3.45.1
* openSUSE Leap 15.6 (noarch)
* ImageMagick-doc-7.1.1.21-150600.3.45.1
* openSUSE Leap 15.6 (aarch64_ilp32)
* libMagickCore-7_Q16HDRI10-64bit-debuginfo-7.1.1.21-150600.3.45.1
* libMagickWand-7_Q16HDRI10-64bit-debuginfo-7.1.1.21-150600.3.45.1
* libMagickWand-7_Q16HDRI10-64bit-7.1.1.21-150600.3.45.1
* ImageMagick-devel-64bit-7.1.1.21-150600.3.45.1
* libMagick++-devel-64bit-7.1.1.21-150600.3.45.1
* libMagickCore-7_Q16HDRI10-64bit-7.1.1.21-150600.3.45.1
* libMagick++-7_Q16HDRI5-64bit-debuginfo-7.1.1.21-150600.3.45.1
* libMagick++-7_Q16HDRI5-64bit-7.1.1.21-150600.3.45.1

## References:

* https://www.suse.com/security/cve/CVE-2026-24484.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258790



SUSE-SU-2026:0874-1: moderate: Security update for GraphicsMagick


# Security update for GraphicsMagick

Announcement ID: SUSE-SU-2026:0874-1
Release Date: 2026-03-11T17:07:37Z
Rating: moderate
References:

* bsc#1258786

Cross-References:

* CVE-2026-25799

CVSS scores:

* CVE-2026-25799 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-25799 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-25799 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-25799 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7

An update that solves one vulnerability can now be installed.

## Description:

This update for GraphicsMagick fixes the following issue:

* CVE-2026-25799: Division-by-Zero in YUV sampling factor validation leads to
crash (bsc#1258786).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-874=1 openSUSE-SLE-15.6-2026-874=1

* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-874=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* perl-GraphicsMagick-debuginfo-1.3.42-150600.3.10.1
* libGraphicsMagick++-Q16-12-1.3.42-150600.3.10.1
* libGraphicsMagick-Q16-3-1.3.42-150600.3.10.1
* GraphicsMagick-debugsource-1.3.42-150600.3.10.1
* GraphicsMagick-devel-1.3.42-150600.3.10.1
* libGraphicsMagick++-devel-1.3.42-150600.3.10.1
* libGraphicsMagick-Q16-3-debuginfo-1.3.42-150600.3.10.1
* GraphicsMagick-1.3.42-150600.3.10.1
* libGraphicsMagickWand-Q16-2-debuginfo-1.3.42-150600.3.10.1
* libGraphicsMagick3-config-1.3.42-150600.3.10.1
* libGraphicsMagickWand-Q16-2-1.3.42-150600.3.10.1
* libGraphicsMagick++-Q16-12-debuginfo-1.3.42-150600.3.10.1
* perl-GraphicsMagick-1.3.42-150600.3.10.1
* GraphicsMagick-debuginfo-1.3.42-150600.3.10.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* perl-GraphicsMagick-debuginfo-1.3.42-150600.3.10.1
* libGraphicsMagick++-Q16-12-1.3.42-150600.3.10.1
* libGraphicsMagick-Q16-3-1.3.42-150600.3.10.1
* GraphicsMagick-debugsource-1.3.42-150600.3.10.1
* GraphicsMagick-devel-1.3.42-150600.3.10.1
* libGraphicsMagick++-devel-1.3.42-150600.3.10.1
* libGraphicsMagick-Q16-3-debuginfo-1.3.42-150600.3.10.1
* GraphicsMagick-1.3.42-150600.3.10.1
* libGraphicsMagickWand-Q16-2-debuginfo-1.3.42-150600.3.10.1
* libGraphicsMagick3-config-1.3.42-150600.3.10.1
* libGraphicsMagickWand-Q16-2-1.3.42-150600.3.10.1
* libGraphicsMagick++-Q16-12-debuginfo-1.3.42-150600.3.10.1
* perl-GraphicsMagick-1.3.42-150600.3.10.1
* GraphicsMagick-debuginfo-1.3.42-150600.3.10.1

## References:

* https://www.suse.com/security/cve/CVE-2026-25799.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258786



SUSE-SU-2026:0871-1: important: Security update for MozillaFirefox


# Security update for MozillaFirefox

Announcement ID: SUSE-SU-2026:0871-1
Release Date: 2026-03-11T17:06:03Z
Rating: important
References:

* bsc#1258568

Cross-References:

* CVE-2026-2757
* CVE-2026-2758
* CVE-2026-2759
* CVE-2026-2760
* CVE-2026-2761
* CVE-2026-2762
* CVE-2026-2763
* CVE-2026-2764
* CVE-2026-2765
* CVE-2026-2766
* CVE-2026-2767
* CVE-2026-2768
* CVE-2026-2769
* CVE-2026-2770
* CVE-2026-2771
* CVE-2026-2772
* CVE-2026-2773
* CVE-2026-2774
* CVE-2026-2775
* CVE-2026-2776
* CVE-2026-2777
* CVE-2026-2778
* CVE-2026-2779
* CVE-2026-2780
* CVE-2026-2781
* CVE-2026-2782
* CVE-2026-2783
* CVE-2026-2784
* CVE-2026-2785
* CVE-2026-2786
* CVE-2026-2787
* CVE-2026-2788
* CVE-2026-2789
* CVE-2026-2790
* CVE-2026-2791
* CVE-2026-2792
* CVE-2026-2793

CVSS scores:

* CVE-2026-2757 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2757 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2757 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2758 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2758 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2758 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2759 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2759 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2759 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2760 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2760 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2760 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2761 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2761 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2761 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2762 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2762 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2762 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2763 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2763 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2763 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2764 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2764 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2764 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2765 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2765 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2765 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2766 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2766 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2766 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2767 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2767 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2767 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2768 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2768 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2768 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2769 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2769 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2770 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2770 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2770 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2771 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2771 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2771 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2772 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2772 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2772 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2773 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2773 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2773 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2774 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2774 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2774 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2775 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-2775 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2775 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2776 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2776 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2776 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2777 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2777 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2777 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2778 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2778 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2778 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2779 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2779 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2779 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2780 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2780 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2780 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2781 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2781 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2781 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2782 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2782 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2782 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2783 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-2783 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-2783 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
* CVE-2026-2784 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2784 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2784 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2785 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2785 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2785 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2786 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2786 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2786 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2787 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2787 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2787 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2788 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2788 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2788 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2789 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2789 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2789 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2790 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-2790 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2790 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2791 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-2791 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2791 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2792 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2792 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2792 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2793 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2793 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2793 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* Desktop Applications Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves 37 vulnerabilities can now be installed.

## Description:

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 140.8.0 ESR (MFSA 2026-15)
(bsc#1258568):

* CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video
component
* CVE-2026-2758: Use-after-free in the JavaScript: GC component
* CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib
component
* CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
* CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
* CVE-2026-2762: Integer overflow in the JavaScript: Standard Library
component
* CVE-2026-2763: Use-after-free in the JavaScript Engine component
* CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine:
JIT component
* CVE-2026-2765: Use-after-free in the JavaScript Engine component
* CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component
* CVE-2026-2767: Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-2768: Sandbox escape in the Storage: IndexedDB component
* CVE-2026-2769: Use-after-free in the Storage: IndexedDB component
* CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component
* CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component
* CVE-2026-2772: Use-after-free in the Audio/Video: Playback component
* CVE-2026-2773: Incorrect boundary conditions in the Web Audio component
* CVE-2026-2774: Integer overflow in the Audio/Video component
* CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component
* CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the
Telemetry component in External Software
* CVE-2026-2777: Privilege escalation in the Messaging System component
* CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the
DOM: Core & HTML component
* CVE-2026-2779: Incorrect boundary conditions in the Networking: JAR
component
* CVE-2026-2780: Privilege escalation in the Netmonitor component
* CVE-2026-2781: Integer overflow in the Libraries component in NSS
* CVE-2026-2782: Privilege escalation in the Netmonitor component
* CVE-2026-2783: Information disclosure due to JIT miscompilation in the
JavaScript Engine: JIT component
* CVE-2026-2784: Mitigation bypass in the DOM: Security component
* CVE-2026-2785: Invalid pointer in the JavaScript Engine component
* CVE-2026-2786: Use-after-free in the JavaScript Engine component
* CVE-2026-2787: Use-after-free in the DOM: Window and Location component
* CVE-2026-2788: Incorrect boundary conditions in the Audio/Video: GMP
component
* CVE-2026-2789: Use-after-free in the Graphics: ImageLib component
* CVE-2026-2790: Same-origin policy bypass in the Networking: JAR component
* CVE-2026-2791: Mitigation bypass in the Networking: Cache component
* CVE-2026-2792: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird
ESR 140.8, Firefox 148 and Thunderbird 148
* CVE-2026-2793: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR
140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-871=1

* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-871=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-871=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-871=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-871=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-871=1

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-871=1

* Desktop Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-871=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-871=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-871=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-871=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-871=1

## Package List:

* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-branding-upstream-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* openSUSE Leap 15.6 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* Desktop Applications Module 15-SP7 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* MozillaFirefox-debugsource-140.8.0-150200.152.222.1
* MozillaFirefox-translations-other-140.8.0-150200.152.222.1
* MozillaFirefox-debuginfo-140.8.0-150200.152.222.1
* MozillaFirefox-translations-common-140.8.0-150200.152.222.1
* MozillaFirefox-140.8.0-150200.152.222.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
* MozillaFirefox-devel-140.8.0-150200.152.222.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2757.html
* https://www.suse.com/security/cve/CVE-2026-2758.html
* https://www.suse.com/security/cve/CVE-2026-2759.html
* https://www.suse.com/security/cve/CVE-2026-2760.html
* https://www.suse.com/security/cve/CVE-2026-2761.html
* https://www.suse.com/security/cve/CVE-2026-2762.html
* https://www.suse.com/security/cve/CVE-2026-2763.html
* https://www.suse.com/security/cve/CVE-2026-2764.html
* https://www.suse.com/security/cve/CVE-2026-2765.html
* https://www.suse.com/security/cve/CVE-2026-2766.html
* https://www.suse.com/security/cve/CVE-2026-2767.html
* https://www.suse.com/security/cve/CVE-2026-2768.html
* https://www.suse.com/security/cve/CVE-2026-2769.html
* https://www.suse.com/security/cve/CVE-2026-2770.html
* https://www.suse.com/security/cve/CVE-2026-2771.html
* https://www.suse.com/security/cve/CVE-2026-2772.html
* https://www.suse.com/security/cve/CVE-2026-2773.html
* https://www.suse.com/security/cve/CVE-2026-2774.html
* https://www.suse.com/security/cve/CVE-2026-2775.html
* https://www.suse.com/security/cve/CVE-2026-2776.html
* https://www.suse.com/security/cve/CVE-2026-2777.html
* https://www.suse.com/security/cve/CVE-2026-2778.html
* https://www.suse.com/security/cve/CVE-2026-2779.html
* https://www.suse.com/security/cve/CVE-2026-2780.html
* https://www.suse.com/security/cve/CVE-2026-2781.html
* https://www.suse.com/security/cve/CVE-2026-2782.html
* https://www.suse.com/security/cve/CVE-2026-2783.html
* https://www.suse.com/security/cve/CVE-2026-2784.html
* https://www.suse.com/security/cve/CVE-2026-2785.html
* https://www.suse.com/security/cve/CVE-2026-2786.html
* https://www.suse.com/security/cve/CVE-2026-2787.html
* https://www.suse.com/security/cve/CVE-2026-2788.html
* https://www.suse.com/security/cve/CVE-2026-2789.html
* https://www.suse.com/security/cve/CVE-2026-2790.html
* https://www.suse.com/security/cve/CVE-2026-2791.html
* https://www.suse.com/security/cve/CVE-2026-2792.html
* https://www.suse.com/security/cve/CVE-2026-2793.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258568



SUSE-SU-2026:0875-1: moderate: Security update for go1.25


# Security update for go1.25

Announcement ID: SUSE-SU-2026:0875-1
Release Date: 2026-03-11T18:34:40Z
Rating: moderate
References:

* bsc#1244485
* bsc#1259264
* bsc#1259265
* bsc#1259268

Cross-References:

* CVE-2026-25679
* CVE-2026-27139
* CVE-2026-27142

CVSS scores:

* CVE-2026-25679 ( SUSE ): 4.6
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-25679 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
* CVE-2026-25679 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27139 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-27139 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-27139 ( NVD ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-27142 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-27142 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-27142 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* Development Tools Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves three vulnerabilities and has one security fix can now be
installed.

## Description:

This update for go1.25 fixes the following issues:

Update to go1.25.8 (bsc#1244485):

* CVE-2026-25679: net/url: reject IPv6 literal not at start of host
(bsc#1259264).
* CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
* CVE-2026-27142: html/template: URLs in meta content attribute actions are
not escaped (bsc#1259265).

Changelog:

* go#77253 cmd/compile: miscompile of global array initialization
* go#77406 os: Go 1.25.x regression on RemoveAll for windows
* go#77413 runtime: netpollinit() incorrectly prints the error from
linux.Eventfd
* go#77438 cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to
1.25.6 due to --define-variable flag in pkg-config
* go#77531 net/smtp: expiry date of localhostCert for testing is too short

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-875=1

* Development Tools Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-875=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-875=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-875=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-875=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-875=1

* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-875=1

* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-875=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-875=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-875=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-875=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-875=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* Development Tools Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* go1.25-1.25.8-150000.1.32.1
* go1.25-race-1.25.8-150000.1.32.1
* go1.25-doc-1.25.8-150000.1.32.1

## References:

* https://www.suse.com/security/cve/CVE-2026-25679.html
* https://www.suse.com/security/cve/CVE-2026-27139.html
* https://www.suse.com/security/cve/CVE-2026-27142.html
* https://bugzilla.suse.com/show_bug.cgi?id=1244485
* https://bugzilla.suse.com/show_bug.cgi?id=1259264
* https://bugzilla.suse.com/show_bug.cgi?id=1259265
* https://bugzilla.suse.com/show_bug.cgi?id=1259268



SUSE-SU-2026:0872-1: important: Security update for busybox


# Security update for busybox

Announcement ID: SUSE-SU-2026:0872-1
Release Date: 2026-03-11T17:06:44Z
Rating: important
References:

* bsc#1192869
* bsc#1217580
* bsc#1217584
* bsc#1217585
* bsc#1241661
* bsc#1253245
* bsc#1258163
* bsc#1258167

Cross-References:

* CVE-2021-42380
* CVE-2023-42363
* CVE-2023-42364
* CVE-2023-42365
* CVE-2025-46394
* CVE-2025-60876
* CVE-2026-26157
* CVE-2026-26158

CVSS scores:

* CVE-2021-42380 ( SUSE ): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
* CVE-2021-42380 ( NVD ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
* CVE-2021-42380 ( NVD ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-42363 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-42363 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-42364 ( SUSE ): 5.1
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2023-42364 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-42364 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-42364 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-42365 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-42365 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2025-46394 ( SUSE ): 5.9
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
* CVE-2025-46394 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
* CVE-2025-46394 ( NVD ): 3.2 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
* CVE-2025-46394 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2025-60876 ( SUSE ): 8.8
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N
* CVE-2025-60876 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
* CVE-2025-60876 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-26157 ( SUSE ): 7.1
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-26157 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-26157 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-26158 ( SUSE ): 7.1
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-26158 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-26158 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products:

* openSUSE Leap 15.4
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server for SAP Applications 15 SP4

An update that solves eight vulnerabilities can now be installed.

## Description:

This update for busybox fixes the following issues:

* CVE-2023-42363: use-after-free vulnerability in xasprintf function in
xfuncs_printf.c (bsc#1217580).
* CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
* CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
* CVE-2025-46394: files in a TAR archive can have their filenames hidden from
a listing if terminal escape sequences are used when naming other files
included in the archive (bsc#1241661).
* CVE-2025-60876: request line incorrectly neutralized mat lead to header
injection (bsc#1253245).
* CVE-2026-26157: Arbitrary file overwrite and potential code execution via
incomplete path sanitization (bsc#1258163).
* CVE-2026-26158: Arbitrary file modification and privilege escalation via
unvalidated tar archive entries (bsc#1258167).
* CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-872=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-872=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-872=1

* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-872=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-872=1

## Package List:

* openSUSE Leap 15.4 (noarch)
* busybox-less-1.35.0-150400.4.7.1
* busybox-net-tools-1.35.0-150400.4.7.1
* busybox-sysvinit-tools-1.35.0-150400.4.7.1
* busybox-tftp-1.35.0-150400.4.7.1
* busybox-sh-1.35.0-150400.4.7.1
* busybox-traceroute-1.35.0-150400.4.7.1
* busybox-vi-1.35.0-150400.4.7.1
* busybox-vlan-1.35.0-150400.4.7.1
* busybox-cpio-1.35.0-150400.4.7.1
* busybox-patch-1.35.0-150400.4.7.1
* busybox-tar-1.35.0-150400.4.7.1
* busybox-tunctl-1.35.0-150400.4.7.1
* busybox-ed-1.35.0-150400.4.7.1
* busybox-diffutils-1.35.0-150400.4.7.1
* busybox-time-1.35.0-150400.4.7.1
* busybox-kmod-1.35.0-150400.4.7.1
* busybox-netcat-1.35.0-150400.4.7.1
* busybox-psmisc-1.35.0-150400.4.7.1
* busybox-grep-1.35.0-150400.4.7.1
* busybox-man-1.35.0-150400.4.7.1
* busybox-selinux-tools-1.35.0-150400.4.7.1
* busybox-telnet-1.35.0-150400.4.7.1
* busybox-bind-utils-1.35.0-150400.4.7.1
* busybox-misc-1.35.0-150400.4.7.1
* busybox-unzip-1.35.0-150400.4.7.1
* busybox-iproute2-1.35.0-150400.4.7.1
* busybox-dos2unix-1.35.0-150400.4.7.1
* busybox-util-linux-1.35.0-150400.4.7.1
* busybox-procps-1.35.0-150400.4.7.1
* busybox-bzip2-1.35.0-150400.4.7.1
* busybox-adduser-1.35.0-150400.4.7.1
* busybox-sendmail-1.35.0-150400.4.7.1
* busybox-iputils-1.35.0-150400.4.7.1
* busybox-ncurses-utils-1.35.0-150400.4.7.1
* busybox-hostname-1.35.0-150400.4.7.1
* busybox-attr-1.35.0-150400.4.7.1
* busybox-bc-1.35.0-150400.4.7.1
* busybox-whois-1.35.0-150400.4.7.1
* busybox-gzip-1.35.0-150400.4.7.1
* busybox-findutils-1.35.0-150400.4.7.1
* busybox-sharutils-1.35.0-150400.4.7.1
* busybox-syslogd-1.35.0-150400.4.7.1
* busybox-kbd-1.35.0-150400.4.7.1
* busybox-sed-1.35.0-150400.4.7.1
* busybox-policycoreutils-1.35.0-150400.4.7.1
* busybox-which-1.35.0-150400.4.7.1
* busybox-wget-1.35.0-150400.4.7.1
* busybox-links-1.35.0-150400.4.7.1
* busybox-xz-1.35.0-150400.4.7.1
* busybox-gawk-1.35.0-150400.4.7.1
* busybox-coreutils-1.35.0-150400.4.7.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* busybox-static-1.35.0-150400.3.14.1
* busybox-1.35.0-150400.3.14.1
* busybox-testsuite-1.35.0-150400.3.14.1
* openSUSE Leap 15.4 (aarch64 x86_64 i586)
* busybox-warewulf3-1.35.0-150400.3.14.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* busybox-static-1.35.0-150400.3.14.1
* busybox-1.35.0-150400.3.14.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* busybox-static-1.35.0-150400.3.14.1
* busybox-1.35.0-150400.3.14.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* busybox-static-1.35.0-150400.3.14.1
* busybox-1.35.0-150400.3.14.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* busybox-static-1.35.0-150400.3.14.1
* busybox-1.35.0-150400.3.14.1

## References:

* https://www.suse.com/security/cve/CVE-2021-42380.html
* https://www.suse.com/security/cve/CVE-2023-42363.html
* https://www.suse.com/security/cve/CVE-2023-42364.html
* https://www.suse.com/security/cve/CVE-2023-42365.html
* https://www.suse.com/security/cve/CVE-2025-46394.html
* https://www.suse.com/security/cve/CVE-2025-60876.html
* https://www.suse.com/security/cve/CVE-2026-26157.html
* https://www.suse.com/security/cve/CVE-2026-26158.html
* https://bugzilla.suse.com/show_bug.cgi?id=1192869
* https://bugzilla.suse.com/show_bug.cgi?id=1217580
* https://bugzilla.suse.com/show_bug.cgi?id=1217584
* https://bugzilla.suse.com/show_bug.cgi?id=1217585
* https://bugzilla.suse.com/show_bug.cgi?id=1241661
* https://bugzilla.suse.com/show_bug.cgi?id=1253245
* https://bugzilla.suse.com/show_bug.cgi?id=1258163
* https://bugzilla.suse.com/show_bug.cgi?id=1258167



SUSE-SU-2026:0873-1: important: Security update for python


# Security update for python

Announcement ID: SUSE-SU-2026:0873-1
Release Date: 2026-03-11T17:07:20Z
Rating: important
References:

* bsc#1257181

Cross-References:

* CVE-2026-1299

CVSS scores:

* CVE-2026-1299 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-1299 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
* CVE-2026-1299 ( NVD ): 6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected Products:

* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7

An update that solves one vulnerability can now be installed.

## Description:

This update for python fixes the following issue:

* CVE-2026-1299: header injection when an email is serialized due to improper
newline quoting in `BytesGenerator` (bsc#1257181).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-873=1

* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-873=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* python-curses-2.7.18-150000.108.1
* python-gdbm-debuginfo-2.7.18-150000.108.1
* python-base-debuginfo-2.7.18-150000.108.1
* python-devel-2.7.18-150000.108.1
* python-xml-2.7.18-150000.108.1
* python-tk-debuginfo-2.7.18-150000.108.1
* libpython2_7-1_0-debuginfo-2.7.18-150000.108.1
* python-xml-debuginfo-2.7.18-150000.108.1
* libpython2_7-1_0-2.7.18-150000.108.1
* python-debuginfo-2.7.18-150000.108.1
* python-curses-debuginfo-2.7.18-150000.108.1
* python-2.7.18-150000.108.1
* python-gdbm-2.7.18-150000.108.1
* python-debugsource-2.7.18-150000.108.1
* python-idle-2.7.18-150000.108.1
* python-base-2.7.18-150000.108.1
* python-demo-2.7.18-150000.108.1
* python-base-debugsource-2.7.18-150000.108.1
* python-tk-2.7.18-150000.108.1
* openSUSE Leap 15.6 (x86_64)
* libpython2_7-1_0-32bit-2.7.18-150000.108.1
* python-32bit-debuginfo-2.7.18-150000.108.1
* python-base-32bit-2.7.18-150000.108.1
* python-32bit-2.7.18-150000.108.1
* python-base-32bit-debuginfo-2.7.18-150000.108.1
* libpython2_7-1_0-32bit-debuginfo-2.7.18-150000.108.1
* openSUSE Leap 15.6 (noarch)
* python-doc-2.7.18-150000.108.1
* python-doc-pdf-2.7.18-150000.108.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* python-curses-2.7.18-150000.108.1
* python-gdbm-debuginfo-2.7.18-150000.108.1
* python-base-debuginfo-2.7.18-150000.108.1
* libpython2_7-1_0-debuginfo-2.7.18-150000.108.1
* python-xml-debuginfo-2.7.18-150000.108.1
* libpython2_7-1_0-2.7.18-150000.108.1
* python-debuginfo-2.7.18-150000.108.1
* python-curses-debuginfo-2.7.18-150000.108.1
* python-2.7.18-150000.108.1
* python-gdbm-2.7.18-150000.108.1
* python-debugsource-2.7.18-150000.108.1
* python-base-2.7.18-150000.108.1
* python-xml-2.7.18-150000.108.1
* python-base-debugsource-2.7.18-150000.108.1

## References:

* https://www.suse.com/security/cve/CVE-2026-1299.html
* https://bugzilla.suse.com/show_bug.cgi?id=1257181



SUSE-SU-2026:0876-1: moderate: Security update for go1.26


# Security update for go1.26

Announcement ID: SUSE-SU-2026:0876-1
Release Date: 2026-03-11T18:35:52Z
Rating: moderate
References:

* bsc#1255111
* bsc#1259264
* bsc#1259265
* bsc#1259266
* bsc#1259267
* bsc#1259268

Cross-References:

* CVE-2026-25679
* CVE-2026-27137
* CVE-2026-27138
* CVE-2026-27139
* CVE-2026-27142

CVSS scores:

* CVE-2026-25679 ( SUSE ): 4.6
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-25679 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
* CVE-2026-25679 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27137 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-27137 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-27137 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27138 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-27138 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27138 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-27139 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-27139 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-27139 ( NVD ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-27142 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-27142 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-27142 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* Development Tools Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves five vulnerabilities and has one security fix can now be
installed.

## Description:

This update for go1.26 fixes the following issues:

Update to go1.26.1 (bsc#1255111):

* CVE-2026-25679: net/url: reject IPv6 literal not at start of host
(bsc#1259264).
* CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
(bsc#1259266).
* CVE-2026-27138: crypto/x509: panic in name constraint checking for malformed
certificates (bsc#1259267).
* CVE-2026-27139: os: FileInfo can escape from a Root (bsc#1259268).
* CVE-2026-27142: html/template: URLs in meta content attribute actions are
not escaped (bsc#1259265).

Changelog:

* go#77252 cmd/compile: miscompile of global array initialization
* go#77407 os: Go 1.25.x regression on RemoveAll for windows
* go#77474 cmd/go: CGO compilation fails after upgrading from Go 1.25.5 to
1.25.6 due to --define-variable flag in pkg-config
* go#77529 cmd/fix, x/tools/go/analysis/passes/modernize: stringscut: OOB
panic in indexArgValid analyzing "buf.Bytes()" call
* go#77532 net/smtp: expiry date of localhostCert for testing is too short
* go#77536 cmd/compile: internal compiler error: 'main.func1': not lowered:
v15, Load STRUCT PTR SSA
* go#77618 strings: HasSuffix doesn't work correctly for multibyte runes in go
1.26
* go#77623 cmd/compile: internal compiler error on : "tried to free an already
free register" with generic function and type >= 192 bytes
* go#77624 cmd/fix, x/tools/go/analysis/passes/modernize: stringsbuilder
breaks code when combining two strings.Builders
* go#77680 cmd/link: TestFlagW/-w_-linkmode=external fails on illumos
* go#77766 cmd/fix,x/tools/go/analysis/passes/modernize: rangeint uses target
platform's type in the range expression, breaking other platforms
* go#77780 reflect: breaking change for reflect.Value.Interface behaviour
* go#77786 cmd/compile: rewriteFixedLoad does not properly sign extend AuxInt
* go#77803 cmd/fix,x/tools/go/analysis/passes/modernize: reflect.TypeOf(nil)
transformed into reflect.TypeForuntyped nil
* go#77804 cmd/fix,x/tools/go/analysis/passes/modernize: minmax breaks select
statements
* go#77805 cmd/fix, x/tools/go/analysis/passes/modernize: waitgroup leads to a
compilation error
* go#77807 cmd/fix,x/tools/go/analysis/passes/modernize: stringsbuilder
ignores variables if they are used multiple times
* go#77849 cmd/fix,x/tools/go/analysis/passes/modernize: stringscut rewrite
changes behavior
* go#77860 cmd/go: change go mod init default go directive back to 1.N
* go#77899 cmd/fix, x/tools/go/analysis/passes/modernize: bad rangeint
rewriting
* go#77904 x/tools/go/analysis/passes/modernize: stringsbuilder breaks code
when GenDecl is a block declaration

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* Development Tools Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-876=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-876=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-876=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-876=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-876=1

* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-876=1

* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-876=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-876=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-876=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-876=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-876=1

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-876=1

## Package List:

* Development Tools Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* go1.26-race-1.26.1-150000.1.6.1
* go1.26-doc-1.26.1-150000.1.6.1
* go1.26-1.26.1-150000.1.6.1

## References:

* https://www.suse.com/security/cve/CVE-2026-25679.html
* https://www.suse.com/security/cve/CVE-2026-27137.html
* https://www.suse.com/security/cve/CVE-2026-27138.html
* https://www.suse.com/security/cve/CVE-2026-27139.html
* https://www.suse.com/security/cve/CVE-2026-27142.html
* https://bugzilla.suse.com/show_bug.cgi?id=1255111
* https://bugzilla.suse.com/show_bug.cgi?id=1259264
* https://bugzilla.suse.com/show_bug.cgi?id=1259265
* https://bugzilla.suse.com/show_bug.cgi?id=1259266
* https://bugzilla.suse.com/show_bug.cgi?id=1259267
* https://bugzilla.suse.com/show_bug.cgi?id=1259268



SUSE-SU-2026:0877-1: important: Security update for tomcat11


# Security update for tomcat11

Announcement ID: SUSE-SU-2026:0877-1
Release Date: 2026-03-12T05:39:53Z
Rating: important
References:

* bsc#1253460
* bsc#1258371
* bsc#1258385
* bsc#1258387

Cross-References:

* CVE-2025-66614
* CVE-2026-24733
* CVE-2026-24734

CVSS scores:

* CVE-2025-66614 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-66614 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-66614 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2025-66614 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
* CVE-2026-24733 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-24733 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-24733 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-24733 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-24734 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-24734 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-24734 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products:

* openSUSE Leap 15.6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* Web and Scripting Module 15-SP7

An update that solves three vulnerabilities and has one security fix can now be
installed.

## Description:

This update for tomcat11 fixes the following issues:

Update to Tomcat 11.0.18:

* CVE-2025-66614: client certificate verification bypass due to virtual host
mapping (bsc#1258371).
* CVE-2026-24733: improper input validation on HTTP/0.9 requests
(bsc#1258385).
* CVE-2026-24734: certificate revocation bypass due to incomplete OCSP
verification checks (bsc#1258387).

Changelog:

* Catalina
* Fix: 69932: Fix request end access log pattern regression, which would log
the start time of the request instead. (remm)
* Fix: 69623: Additional fix for the long standing regression that meant that
calls to ClassLoader.getResource().getContent() failed when made from within
a web application with resource caching enabled if the target resource was
packaged in a JAR file. (markt)
* Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the
CsrfPreventionFilter. (schultz)
* Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2
requests when the content-length header is not set. (dsoumis)
* Update: Enable minimum and recommended Tomcat Native versions to be set
separately for Tomcat Native 1.x and 2.x. Update the minimum and recommended
versions for Tomcat Native 1.x to 1.3.4. Update the minimum and recommended
versions for Tomcat Native 2.x to 2.0.12. (markt)
* Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators
that provides a per Authenticator override of the SSO Valve
requireReauthentication attribute. (markt)
* Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception
rather than silently using a replacement character. (markt)
* Fix: 69871: Increase log level to INFO for missing configuration for the
rewrite valve. (remm)
* Fix: Add log warnings for additional Host appBase suspicious values. (remm)
* Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
org.apache.catalina.Connector no longer requires
org.apache.tomcat.jni.AprStatus to be present. (markt)
* Add: Add the ability to use a custom function to generate the client
identifier in the CrawlerSessionManagerValve. This is only available
programmatically. Pull request #902 by Brian Matzon. (markt)
* Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so
that a normal SPNEGO authentication is performed if the SSL Valve is
configured with reauthentication enabled. This is so that the delegated
credentials will be available to the web application. (markt)
* Fix: When generating the class path in the Loader, re-order the check on
individual class path components to avoid a potential NullPointerException.
Identified by Coverity Scan. (markt)
* Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull
request #915 by Joshua Rogers. (remm)
* Update: Add an attribute, digestInRfc3112Order, to
MessageDigestCredentialHandler to control the order in which the credential
and salt are digested. By default, the current, non-RFC 3112 compliant,
order of salt then credential will be used. This default will change in
Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt)
* Cluster
* Add: 62814: Document that human-readable names may be used for
mapSendOptions and align documentation with channelSendOptions. Based on
pull request #929 by archan0621. (markt)
* Clustering
* Fix: Correct a regression introduced in 11.0.11 that broke some clustering
configurations. (markt)
* Coyote
* Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown
that triggered a significant memory leak. Patch provided by Wes. (markt)
* Fix: Prevent concurrent release of OpenSSLEngine resources and the
termination of the Tomcat Native library as it can cause crashes during
Tomcat shutdown. (markt)
* Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring
the tomcat-native changes. (remm)
* Fix: 69910: Dereference TLS objects right after closing a socket to improve
memory efficiency. (remm)
* Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig
to reflect the existing implementation that allows one configuration style
to be used for the trust attributes and a different style for all the other
attributes. (markt)
* Fix: Better warning message when OpenSSLConf configuration elements are used
with a JSSE TLS implementation. (markt)
* Fix: When using OpenSSL via FFM, don't log a warning about missing CA
certificates unless CA certificates were configured and the configuration
failed. (markt)
* Add: For configuration consistency between OpenSSL and JSSE TLS
implementations, TLSv1.3 cipher suites included in the ciphers attribute of
an SSLHostConfig are now always ignored (previously they would be ignored
with OpenSSL implementations and used with JSSE implementations) and a
warning is logged that the cipher suite has been ignored. (markt)
* Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3
cipher suites. (markt)
* Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP
configurable per connector for both JSSE and OpenSSL based TLS
implementations. Align the checks performed by OpenSSL with those performed
by JSSE. (markt)
* Add: Add support for soft failure of OCSP checks with soft failure support
disabled by default. (markt)
* Add: Add support for configuring the verification flags passed to
OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt)
* Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
* Fix: Don't log an incorrect certificate KeyStore location when creating a
TLS connector if the KeyStore instance has been set directly on the
connector. (markt)
* Fix: HTTP/0.9 only allows GET as the HTTP method. (remm)
* Add: Add strictSni attribute on the Connector to allow matching the
SSLHostConfig configuration associated with the SNI host name to the
SSLHostConfig configuration matched from the HTTP protocol host name. Non
matching configurations will cause the request to be rejected. The attribute
default value is true, enabling the matching. (remm)
* Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm)
* Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL
provider. Pull request #912 by aogburn. (markt)
* Fix: Fix potential crash on shutdown when a Connector depends on the Tomcat
Native library. (markt)
* Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
* Jasper
* Fix: 69333: Correct a regression in the previous fix for 69333 and ensure
that reuse() or release() is always called for a tag. (markt)
* Fix: 69877: Catch IllegalArgumentException when processing URIs when
creating the classpath to handle invalid URIs. (remm)
* Fix: Fix populating the classpath with the webapp classloader repositories.
(remm)
* Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some
exception details. Patch submitted by Eric Blanquer. (remm)
* Jdbc-pool
* Fix: 64083: If the underlying connection has been closed, don't add it to
the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
* Web applications
* Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server
status output if one or more of the web applications failed to start.
(schultz)
* Add: Manager: Include web application state in the HTML and JSON complete
server status output. (markt)
* Add: Documentation: Expand the documentation to better explain when OCSP is
supported and when it is not. (markt)
* Websocket
* Fix: 69920: When attempting to write to a closed Writer or OutputStream
obtained from a WebSocket session, throw an IOException rather than an
IllegalStateExcpetion as required by Writer and strongly suggested by
OutputStream. (markt)
* Other
* Add: Add property "gpg.sign.files" to optionally disable release artefact
signing with GPG. (rjung)
* Add: Add test.silent property to suppress JUnit console output during test
execution. Useful for cleaner console output when running tests with
multiple threads. (csutherl)
* Update: Update the internal fork of Commons Pool to 2.13.1. (markt)
* Update: Update the internal fork of Commons DBCP to 2.14.0. (markt)
* Update: Update Commons Daemon to 1.5.1. (markt)
* Update: Update to the Eclipse JDT compiler 4.37. (markt)
* Update: Update ByteBuddy to 1.18.3. (markt)
* Update: Update UnboundID to 7.0.4. (markt)
* Update: Update Checkstyle to 12.3.1. (markt)
* Add: Improvements to French translations. (markt)
* Add: Improvements to Japanese translations provided by tak7iji. (markt)
* Add: Improvements to Chinese translations provided by Yang. vincent.h and
yong hu. (markt)
* Update: Update Tomcat Native to 2.0.12. (markt)
* Add: Add test profile system for selective test execution. Profiles can be
specified via -Dtest.profile= to run specific test subsets without
using patterns directly. Profile patterns are defined in test-
profiles.properties. (csutherl)
* Update: Update file extension to media type mappings to align with the
current list used by the Apache Web Server (httpd). (markt)
* Update: Update the packaged version of the Tomcat Migration Tool for Jakarta
EE to 1.0.10. (markt)
* Update: Update Commons Daemon to 1.5.0. (markt)
* Update: Update Byte Buddy to 1.18.2. (markt)
* Update: Update Checkstyle to 12.2.0. (markt)
* Add: Improvements to Spanish translations provided by White Vogel. (markt)
* Add: Improvements to French translations. (remm)
* Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt)
* Update: Update to Byte Buddy 1.17.8. (markt)
* Update: Update to Checkstyle 12.1.1. (markt)
* Update: Update to Jacoco 0.8.14. (markt)
* Update: Update to SpotBugs 4.9.8. (markt)
* Update: Update to JSign 7.4. (markt)
* Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-877=1 openSUSE-SLE-15.6-2026-877=1

* Web and Scripting Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP7-2026-877=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-877=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-877=1

## Package List:

* openSUSE Leap 15.6 (noarch)
* tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1
* tomcat11-embed-11.0.18-150600.13.15.1
* tomcat11-admin-webapps-11.0.18-150600.13.15.1
* tomcat11-11.0.18-150600.13.15.1
* tomcat11-el-6_0-api-11.0.18-150600.13.15.1
* tomcat11-doc-11.0.18-150600.13.15.1
* tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1
* tomcat11-docs-webapp-11.0.18-150600.13.15.1
* tomcat11-jsvc-11.0.18-150600.13.15.1
* tomcat11-lib-11.0.18-150600.13.15.1
* tomcat11-webapps-11.0.18-150600.13.15.1
* Web and Scripting Module 15-SP7 (noarch)
* tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1
* tomcat11-admin-webapps-11.0.18-150600.13.15.1
* tomcat11-11.0.18-150600.13.15.1
* tomcat11-el-6_0-api-11.0.18-150600.13.15.1
* tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1
* tomcat11-lib-11.0.18-150600.13.15.1
* tomcat11-webapps-11.0.18-150600.13.15.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1
* tomcat11-admin-webapps-11.0.18-150600.13.15.1
* tomcat11-11.0.18-150600.13.15.1
* tomcat11-el-6_0-api-11.0.18-150600.13.15.1
* tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1
* tomcat11-lib-11.0.18-150600.13.15.1
* tomcat11-webapps-11.0.18-150600.13.15.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* tomcat11-jsp-4_0-api-11.0.18-150600.13.15.1
* tomcat11-admin-webapps-11.0.18-150600.13.15.1
* tomcat11-11.0.18-150600.13.15.1
* tomcat11-el-6_0-api-11.0.18-150600.13.15.1
* tomcat11-servlet-6_1-api-11.0.18-150600.13.15.1
* tomcat11-lib-11.0.18-150600.13.15.1
* tomcat11-webapps-11.0.18-150600.13.15.1

## References:

* https://www.suse.com/security/cve/CVE-2025-66614.html
* https://www.suse.com/security/cve/CVE-2026-24733.html
* https://www.suse.com/security/cve/CVE-2026-24734.html
* https://bugzilla.suse.com/show_bug.cgi?id=1253460
* https://bugzilla.suse.com/show_bug.cgi?id=1258371
* https://bugzilla.suse.com/show_bug.cgi?id=1258385
* https://bugzilla.suse.com/show_bug.cgi?id=1258387



SUSE-SU-2026:0881-1: important: Security update for postgresql18


# Security update for postgresql18

Announcement ID: SUSE-SU-2026:0881-1
Release Date: 2026-03-12T10:19:08Z
Rating: important
References:

* bsc#1258008
* bsc#1258009
* bsc#1258010
* bsc#1258011
* bsc#1258012
* bsc#1258754

Cross-References:

* CVE-2026-2003
* CVE-2026-2004
* CVE-2026-2005
* CVE-2026-2006
* CVE-2026-2007

CVSS scores:

* CVE-2026-2003 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-2003 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-2004 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2004 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2005 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2005 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2006 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2006 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2007 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
* CVE-2026-2007 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected Products:

* Basesystem Module 15-SP7
* openSUSE Leap 15.6
* Server Applications Module 15-SP7
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7

An update that solves five vulnerabilities and has one security fix can now be
installed.

## Description:

This update for postgresql18 fixes the following issues:

Update to version 18.3 (bsc#1258754).

Security issues fixed:

* CVE-2026-2003: improper validation of type "oidvector" may allow disclose a
few bytes of server memory (bsc#1258008).
* CVE-2026-2004: intarray missing validation of type of input to selectivity
estimator could lead to arbitrary code execution (bsc#1258009).
* CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions
could lead to arbitrary code execution (bsc#1258010).
* CVE-2026-2006: inadequate validation of multibyte character lengths could
lead to arbitrary code execution (bsc#1258011).
* CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto
server memory (bsc#1258012).

Regression fixes:

* the substring() function raises an error "invalid byte sequence for
encoding" on non-ASCII text values if the source of that value is a database
column (caused by CVE-2026-2006 fix).
* a standby may halt and return an error "could not access status of
transaction".

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-881=1 openSUSE-SLE-15.6-2026-881=1

* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-881=1

* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-881=1

* Server Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-881=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-881=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-881=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* postgresql18-server-18.3-150600.13.8.1
* postgresql18-plpython-18.3-150600.13.8.1
* postgresql18-plperl-18.3-150600.13.8.1
* postgresql18-server-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-18.3-150600.13.8.1
* postgresql18-plpython-debuginfo-18.3-150600.13.8.1
* libecpg6-18.3-150600.13.8.1
* postgresql18-18.3-150600.13.8.1
* postgresql18-devel-mini-18.3-150600.13.8.1
* postgresql18-plperl-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-mini-debuginfo-18.3-150600.13.8.1
* libecpg6-debuginfo-18.3-150600.13.8.1
* postgresql18-debuginfo-18.3-150600.13.8.1
* postgresql18-llvmjit-debuginfo-18.3-150600.13.8.1
* postgresql18-llvmjit-devel-18.3-150600.13.8.1
* postgresql18-pltcl-debuginfo-18.3-150600.13.8.1
* postgresql18-server-devel-debuginfo-18.3-150600.13.8.1
* postgresql18-contrib-18.3-150600.13.8.1
* postgresql18-mini-debugsource-18.3-150600.13.8.1
* libpq5-debuginfo-18.3-150600.13.8.1
* postgresql18-contrib-debuginfo-18.3-150600.13.8.1
* postgresql18-pltcl-18.3-150600.13.8.1
* postgresql18-server-devel-18.3-150600.13.8.1
* postgresql18-test-18.3-150600.13.8.1
* postgresql18-llvmjit-18.3-150600.13.8.1
* postgresql18-debugsource-18.3-150600.13.8.1
* libpq5-18.3-150600.13.8.1
* openSUSE Leap 15.6 (x86_64)
* libpq5-32bit-debuginfo-18.3-150600.13.8.1
* libecpg6-32bit-18.3-150600.13.8.1
* libecpg6-32bit-debuginfo-18.3-150600.13.8.1
* libpq5-32bit-18.3-150600.13.8.1
* openSUSE Leap 15.6 (noarch)
* postgresql18-docs-18.3-150600.13.8.1
* openSUSE Leap 15.6 (aarch64_ilp32)
* libecpg6-64bit-debuginfo-18.3-150600.13.8.1
* libecpg6-64bit-18.3-150600.13.8.1
* libpq5-64bit-debuginfo-18.3-150600.13.8.1
* libpq5-64bit-18.3-150600.13.8.1
* Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* libpq5-debuginfo-18.3-150600.13.8.1
* postgresql18-debuginfo-18.3-150600.13.8.1
* postgresql18-debugsource-18.3-150600.13.8.1
* postgresql18-18.3-150600.13.8.1
* libpq5-18.3-150600.13.8.1
* Basesystem Module 15-SP7 (x86_64)
* libpq5-32bit-debuginfo-18.3-150600.13.8.1
* libpq5-32bit-18.3-150600.13.8.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql18-test-18.3-150600.13.8.1
* postgresql18-llvmjit-18.3-150600.13.8.1
* postgresql18-llvmjit-debuginfo-18.3-150600.13.8.1
* postgresql18-llvmjit-devel-18.3-150600.13.8.1
* Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql18-pltcl-debuginfo-18.3-150600.13.8.1
* postgresql18-plpython-18.3-150600.13.8.1
* postgresql18-server-18.3-150600.13.8.1
* postgresql18-plperl-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-debuginfo-18.3-150600.13.8.1
* postgresql18-plperl-18.3-150600.13.8.1
* postgresql18-server-devel-debuginfo-18.3-150600.13.8.1
* postgresql18-server-debuginfo-18.3-150600.13.8.1
* postgresql18-debuginfo-18.3-150600.13.8.1
* libecpg6-debuginfo-18.3-150600.13.8.1
* postgresql18-contrib-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-18.3-150600.13.8.1
* postgresql18-plpython-debuginfo-18.3-150600.13.8.1
* postgresql18-pltcl-18.3-150600.13.8.1
* postgresql18-server-devel-18.3-150600.13.8.1
* postgresql18-contrib-18.3-150600.13.8.1
* libecpg6-18.3-150600.13.8.1
* postgresql18-debugsource-18.3-150600.13.8.1
* Server Applications Module 15-SP7 (noarch)
* postgresql18-docs-18.3-150600.13.8.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* postgresql18-server-18.3-150600.13.8.1
* postgresql18-plpython-18.3-150600.13.8.1
* postgresql18-plperl-18.3-150600.13.8.1
* postgresql18-server-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-18.3-150600.13.8.1
* postgresql18-plpython-debuginfo-18.3-150600.13.8.1
* libecpg6-18.3-150600.13.8.1
* postgresql18-18.3-150600.13.8.1
* postgresql18-plperl-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-debuginfo-18.3-150600.13.8.1
* libecpg6-debuginfo-18.3-150600.13.8.1
* postgresql18-debuginfo-18.3-150600.13.8.1
* postgresql18-pltcl-debuginfo-18.3-150600.13.8.1
* postgresql18-server-devel-debuginfo-18.3-150600.13.8.1
* postgresql18-contrib-18.3-150600.13.8.1
* libpq5-debuginfo-18.3-150600.13.8.1
* postgresql18-contrib-debuginfo-18.3-150600.13.8.1
* postgresql18-pltcl-18.3-150600.13.8.1
* postgresql18-server-devel-18.3-150600.13.8.1
* postgresql18-debugsource-18.3-150600.13.8.1
* libpq5-18.3-150600.13.8.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* postgresql18-docs-18.3-150600.13.8.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
* libpq5-32bit-debuginfo-18.3-150600.13.8.1
* libpq5-32bit-18.3-150600.13.8.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* postgresql18-server-18.3-150600.13.8.1
* postgresql18-plpython-18.3-150600.13.8.1
* postgresql18-plperl-18.3-150600.13.8.1
* postgresql18-server-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-18.3-150600.13.8.1
* postgresql18-plpython-debuginfo-18.3-150600.13.8.1
* libecpg6-18.3-150600.13.8.1
* postgresql18-18.3-150600.13.8.1
* postgresql18-plperl-debuginfo-18.3-150600.13.8.1
* postgresql18-devel-debuginfo-18.3-150600.13.8.1
* libecpg6-debuginfo-18.3-150600.13.8.1
* postgresql18-debuginfo-18.3-150600.13.8.1
* postgresql18-pltcl-debuginfo-18.3-150600.13.8.1
* postgresql18-server-devel-debuginfo-18.3-150600.13.8.1
* postgresql18-contrib-18.3-150600.13.8.1
* libpq5-debuginfo-18.3-150600.13.8.1
* postgresql18-contrib-debuginfo-18.3-150600.13.8.1
* postgresql18-pltcl-18.3-150600.13.8.1
* postgresql18-server-devel-18.3-150600.13.8.1
* postgresql18-debugsource-18.3-150600.13.8.1
* libpq5-18.3-150600.13.8.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* postgresql18-docs-18.3-150600.13.8.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
* libpq5-32bit-debuginfo-18.3-150600.13.8.1
* libpq5-32bit-18.3-150600.13.8.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2003.html
* https://www.suse.com/security/cve/CVE-2026-2004.html
* https://www.suse.com/security/cve/CVE-2026-2005.html
* https://www.suse.com/security/cve/CVE-2026-2006.html
* https://www.suse.com/security/cve/CVE-2026-2007.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258008
* https://bugzilla.suse.com/show_bug.cgi?id=1258009
* https://bugzilla.suse.com/show_bug.cgi?id=1258010
* https://bugzilla.suse.com/show_bug.cgi?id=1258011
* https://bugzilla.suse.com/show_bug.cgi?id=1258012
* https://bugzilla.suse.com/show_bug.cgi?id=1258754



SUSE-SU-2026:0880-1: important: Security update for MozillaThunderbird


# Security update for MozillaThunderbird

Announcement ID: SUSE-SU-2026:0880-1
Release Date: 2026-03-12T10:18:38Z
Rating: important
References:

* bsc#1258568

Cross-References:

* CVE-2026-2757
* CVE-2026-2758
* CVE-2026-2759
* CVE-2026-2760
* CVE-2026-2761
* CVE-2026-2762
* CVE-2026-2763
* CVE-2026-2764
* CVE-2026-2765
* CVE-2026-2766
* CVE-2026-2767
* CVE-2026-2768
* CVE-2026-2769
* CVE-2026-2770
* CVE-2026-2771
* CVE-2026-2772
* CVE-2026-2773
* CVE-2026-2774
* CVE-2026-2775
* CVE-2026-2776
* CVE-2026-2777
* CVE-2026-2778
* CVE-2026-2779
* CVE-2026-2780
* CVE-2026-2781
* CVE-2026-2782
* CVE-2026-2783
* CVE-2026-2784
* CVE-2026-2785
* CVE-2026-2786
* CVE-2026-2787
* CVE-2026-2788
* CVE-2026-2789
* CVE-2026-2790
* CVE-2026-2791
* CVE-2026-2792
* CVE-2026-2793

CVSS scores:

* CVE-2026-2757 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2757 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2757 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2758 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2758 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2758 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2759 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2759 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2759 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2760 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2760 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2760 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2761 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2761 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2761 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2762 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2762 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2762 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2763 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2763 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2763 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2764 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2764 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2764 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2765 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2765 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2765 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2766 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2766 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2766 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2767 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2767 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2767 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2768 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2768 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2768 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2769 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2769 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2770 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2770 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2770 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2771 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2771 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2771 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2772 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2772 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2772 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2773 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2773 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2773 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2774 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2774 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2774 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2775 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-2775 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2775 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2776 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2776 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2776 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2777 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2777 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2777 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2778 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-2778 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2778 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
* CVE-2026-2779 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2779 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2779 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2780 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2780 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2780 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2781 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2781 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2781 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2782 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2782 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2782 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2783 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-2783 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-2783 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
* CVE-2026-2784 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2784 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2784 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2785 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2785 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2785 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2786 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2786 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2786 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2787 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2787 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2787 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2788 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2788 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2788 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2789 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2026-2789 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2789 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2790 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-2790 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2790 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2791 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-2791 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2791 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2792 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2792 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2792 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2793 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-2793 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2793 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Linux Enterprise Workstation Extension 15 SP7
* SUSE Package Hub 15 15-SP7

An update that solves 37 vulnerabilities can now be installed.

## Description:

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird 140.8 MFSA 2026-17 (bsc#1258568):

* CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video
component
* CVE-2026-2758: Use-after-free in the JavaScript: GC component
* CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib
component
* CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
* CVE-2026-2761: Sandbox escape in the Graphics: WebRender component
* CVE-2026-2762: Integer overflow in the JavaScript: Standard Library
component
* CVE-2026-2763: Use-after-free in the JavaScript Engine component
* CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine:
JIT component
* CVE-2026-2765: Use-after-free in the JavaScript Engine component
* CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component
* CVE-2026-2767: Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-2768: Sandbox escape in the Storage: IndexedDB component
* CVE-2026-2769: Use-after-free in the Storage: IndexedDB component
* CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component
* CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component
* CVE-2026-2772: Use-after-free in the Audio/Video: Playback component
* CVE-2026-2773: Incorrect boundary conditions in the Web Audio component
* CVE-2026-2774: Integer overflow in the Audio/Video component
* CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component
* CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the
Telemetry component in External Software
* CVE-2026-2777: Privilege escalation in the Messaging System component
* CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the
DOM: Core & HTML component
* CVE-2026-2779: Incorrect boundary conditions in the Networking: JAR
component
* CVE-2026-2780: Privilege escalation in the Netmonitor component
* CVE-2026-2781: Integer overflow in the Libraries component in NSS
* CVE-2026-2782: Privilege escalation in the Netmonitor component
* CVE-2026-2783: Information disclosure due to JIT miscompilation in the
JavaScript Engine: JIT component
* CVE-2026-2784: Mitigation bypass in the DOM: Security component
* CVE-2026-2785: Invalid pointer in the JavaScript Engine component
* CVE-2026-2786: Use-after-free in the JavaScript Engine component
* CVE-2026-2787: Use-after-free in the DOM: Window and Location component
* CVE-2026-2788: Incorrect boundary conditions in the Audio/Video: GMP
component
* CVE-2026-2789: Use-after-free in the Graphics: ImageLib component
* CVE-2026-2790: Same-origin policy bypass in the Networking: JAR component
* CVE-2026-2791: Mitigation bypass in the Networking: Cache component
* CVE-2026-2792: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird
ESR 140.8, Firefox 148 and Thunderbird 148
* CVE-2026-2793: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR
140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Workstation Extension 15 SP7
zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-880=1

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-880=1

* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-880=1

## Package List:

* SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64)
* MozillaThunderbird-debugsource-140.8.0-150200.8.260.1
* MozillaThunderbird-translations-other-140.8.0-150200.8.260.1
* MozillaThunderbird-debuginfo-140.8.0-150200.8.260.1
* MozillaThunderbird-translations-common-140.8.0-150200.8.260.1
* MozillaThunderbird-140.8.0-150200.8.260.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-debugsource-140.8.0-150200.8.260.1
* MozillaThunderbird-translations-other-140.8.0-150200.8.260.1
* MozillaThunderbird-debuginfo-140.8.0-150200.8.260.1
* MozillaThunderbird-translations-common-140.8.0-150200.8.260.1
* MozillaThunderbird-140.8.0-150200.8.260.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
* MozillaThunderbird-debugsource-140.8.0-150200.8.260.1
* MozillaThunderbird-translations-other-140.8.0-150200.8.260.1
* MozillaThunderbird-debuginfo-140.8.0-150200.8.260.1
* MozillaThunderbird-translations-common-140.8.0-150200.8.260.1
* MozillaThunderbird-140.8.0-150200.8.260.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2757.html
* https://www.suse.com/security/cve/CVE-2026-2758.html
* https://www.suse.com/security/cve/CVE-2026-2759.html
* https://www.suse.com/security/cve/CVE-2026-2760.html
* https://www.suse.com/security/cve/CVE-2026-2761.html
* https://www.suse.com/security/cve/CVE-2026-2762.html
* https://www.suse.com/security/cve/CVE-2026-2763.html
* https://www.suse.com/security/cve/CVE-2026-2764.html
* https://www.suse.com/security/cve/CVE-2026-2765.html
* https://www.suse.com/security/cve/CVE-2026-2766.html
* https://www.suse.com/security/cve/CVE-2026-2767.html
* https://www.suse.com/security/cve/CVE-2026-2768.html
* https://www.suse.com/security/cve/CVE-2026-2769.html
* https://www.suse.com/security/cve/CVE-2026-2770.html
* https://www.suse.com/security/cve/CVE-2026-2771.html
* https://www.suse.com/security/cve/CVE-2026-2772.html
* https://www.suse.com/security/cve/CVE-2026-2773.html
* https://www.suse.com/security/cve/CVE-2026-2774.html
* https://www.suse.com/security/cve/CVE-2026-2775.html
* https://www.suse.com/security/cve/CVE-2026-2776.html
* https://www.suse.com/security/cve/CVE-2026-2777.html
* https://www.suse.com/security/cve/CVE-2026-2778.html
* https://www.suse.com/security/cve/CVE-2026-2779.html
* https://www.suse.com/security/cve/CVE-2026-2780.html
* https://www.suse.com/security/cve/CVE-2026-2781.html
* https://www.suse.com/security/cve/CVE-2026-2782.html
* https://www.suse.com/security/cve/CVE-2026-2783.html
* https://www.suse.com/security/cve/CVE-2026-2784.html
* https://www.suse.com/security/cve/CVE-2026-2785.html
* https://www.suse.com/security/cve/CVE-2026-2786.html
* https://www.suse.com/security/cve/CVE-2026-2787.html
* https://www.suse.com/security/cve/CVE-2026-2788.html
* https://www.suse.com/security/cve/CVE-2026-2789.html
* https://www.suse.com/security/cve/CVE-2026-2790.html
* https://www.suse.com/security/cve/CVE-2026-2791.html
* https://www.suse.com/security/cve/CVE-2026-2792.html
* https://www.suse.com/security/cve/CVE-2026-2793.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258568



SUSE-SU-2026:0882-1: important: Security update for postgresql16


# Security update for postgresql16

Announcement ID: SUSE-SU-2026:0882-1
Release Date: 2026-03-12T10:19:44Z
Rating: important
References:

* bsc#1258008
* bsc#1258009
* bsc#1258010
* bsc#1258011
* bsc#1258754

Cross-References:

* CVE-2026-2003
* CVE-2026-2004
* CVE-2026-2005
* CVE-2026-2006

CVSS scores:

* CVE-2026-2003 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-2003 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-2004 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2004 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2005 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2005 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2006 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2006 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* Legacy Module 15-SP7
* openSUSE Leap 15.6
* Server Applications Module 15-SP7
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7

An update that solves four vulnerabilities and has one security fix can now be
installed.

## Description:

This update for postgresql16 fixes the following issues:

Update to version 16.13 (bsc#1258754).

Security issues fixed:

* CVE-2026-2003: improper validation of type "oidvector" may allow disclose a
few bytes of server memory (bsc#1258008).
* CVE-2026-2004: intarray missing validation of type of input to selectivity
estimator could lead to arbitrary code execution (bsc#1258009).
* CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions
could lead to arbitrary code execution (bsc#1258010).
* CVE-2026-2006: inadequate validation of multibyte character lengths could
lead to arbitrary code execution (bsc#1258011).

Regression fixes:

* the substring() function raises an error "invalid byte sequence for
encoding" on non-ASCII text values if the source of that value is a database
column (caused by CVE-2026-2006 fix).
* a standby may halt and return an error "could not access status of
transaction".

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-882=1 openSUSE-SLE-15.6-2026-882=1

* Legacy Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP7-2026-882=1

* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-882=1

* Server Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-882=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-882=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-882=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* postgresql16-test-16.13-150600.16.30.1
* postgresql16-plpython-16.13-150600.16.30.1
* postgresql16-devel-16.13-150600.16.30.1
* postgresql16-16.13-150600.16.30.1
* postgresql16-pltcl-debuginfo-16.13-150600.16.30.1
* postgresql16-llvmjit-16.13-150600.16.30.1
* postgresql16-contrib-debuginfo-16.13-150600.16.30.1
* postgresql16-plpython-debuginfo-16.13-150600.16.30.1
* postgresql16-contrib-16.13-150600.16.30.1
* postgresql16-llvmjit-devel-16.13-150600.16.30.1
* postgresql16-debuginfo-16.13-150600.16.30.1
* postgresql16-llvmjit-debuginfo-16.13-150600.16.30.1
* postgresql16-server-debuginfo-16.13-150600.16.30.1
* postgresql16-debugsource-16.13-150600.16.30.1
* postgresql16-plperl-debuginfo-16.13-150600.16.30.1
* postgresql16-plperl-16.13-150600.16.30.1
* postgresql16-pltcl-16.13-150600.16.30.1
* postgresql16-server-16.13-150600.16.30.1
* postgresql16-devel-debuginfo-16.13-150600.16.30.1
* postgresql16-server-devel-debuginfo-16.13-150600.16.30.1
* postgresql16-server-devel-16.13-150600.16.30.1
* openSUSE Leap 15.6 (noarch)
* postgresql16-docs-16.13-150600.16.30.1
* Legacy Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql16-debugsource-16.13-150600.16.30.1
* postgresql16-contrib-debuginfo-16.13-150600.16.30.1
* postgresql16-devel-debuginfo-16.13-150600.16.30.1
* postgresql16-contrib-16.13-150600.16.30.1
* postgresql16-debuginfo-16.13-150600.16.30.1
* postgresql16-devel-16.13-150600.16.30.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql16-debuginfo-16.13-150600.16.30.1
* postgresql16-test-16.13-150600.16.30.1
* postgresql16-llvmjit-16.13-150600.16.30.1
* postgresql16-debugsource-16.13-150600.16.30.1
* postgresql16-llvmjit-devel-16.13-150600.16.30.1
* postgresql16-llvmjit-debuginfo-16.13-150600.16.30.1
* Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql16-server-16.13-150600.16.30.1
* postgresql16-16.13-150600.16.30.1
* postgresql16-server-debuginfo-16.13-150600.16.30.1
* postgresql16-debugsource-16.13-150600.16.30.1
* postgresql16-debuginfo-16.13-150600.16.30.1
* postgresql16-server-devel-16.13-150600.16.30.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* postgresql16-server-16.13-150600.16.30.1
* postgresql16-16.13-150600.16.30.1
* postgresql16-pltcl-debuginfo-16.13-150600.16.30.1
* postgresql16-server-debuginfo-16.13-150600.16.30.1
* postgresql16-debugsource-16.13-150600.16.30.1
* postgresql16-contrib-debuginfo-16.13-150600.16.30.1
* postgresql16-devel-debuginfo-16.13-150600.16.30.1
* postgresql16-plperl-debuginfo-16.13-150600.16.30.1
* postgresql16-plpython-debuginfo-16.13-150600.16.30.1
* postgresql16-server-devel-debuginfo-16.13-150600.16.30.1
* postgresql16-contrib-16.13-150600.16.30.1
* postgresql16-debuginfo-16.13-150600.16.30.1
* postgresql16-plperl-16.13-150600.16.30.1
* postgresql16-plpython-16.13-150600.16.30.1
* postgresql16-server-devel-16.13-150600.16.30.1
* postgresql16-pltcl-16.13-150600.16.30.1
* postgresql16-devel-16.13-150600.16.30.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* postgresql16-docs-16.13-150600.16.30.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* postgresql16-server-16.13-150600.16.30.1
* postgresql16-16.13-150600.16.30.1
* postgresql16-pltcl-debuginfo-16.13-150600.16.30.1
* postgresql16-server-debuginfo-16.13-150600.16.30.1
* postgresql16-debugsource-16.13-150600.16.30.1
* postgresql16-contrib-debuginfo-16.13-150600.16.30.1
* postgresql16-devel-debuginfo-16.13-150600.16.30.1
* postgresql16-plperl-debuginfo-16.13-150600.16.30.1
* postgresql16-plpython-debuginfo-16.13-150600.16.30.1
* postgresql16-server-devel-debuginfo-16.13-150600.16.30.1
* postgresql16-contrib-16.13-150600.16.30.1
* postgresql16-debuginfo-16.13-150600.16.30.1
* postgresql16-plperl-16.13-150600.16.30.1
* postgresql16-plpython-16.13-150600.16.30.1
* postgresql16-server-devel-16.13-150600.16.30.1
* postgresql16-pltcl-16.13-150600.16.30.1
* postgresql16-devel-16.13-150600.16.30.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* postgresql16-docs-16.13-150600.16.30.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2003.html
* https://www.suse.com/security/cve/CVE-2026-2004.html
* https://www.suse.com/security/cve/CVE-2026-2005.html
* https://www.suse.com/security/cve/CVE-2026-2006.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258008
* https://bugzilla.suse.com/show_bug.cgi?id=1258009
* https://bugzilla.suse.com/show_bug.cgi?id=1258010
* https://bugzilla.suse.com/show_bug.cgi?id=1258011
* https://bugzilla.suse.com/show_bug.cgi?id=1258754



SUSE-SU-2026:0883-1: important: Security update for postgresql17


# Security update for postgresql17

Announcement ID: SUSE-SU-2026:0883-1
Release Date: 2026-03-12T10:20:22Z
Rating: important
References:

* bsc#1258008
* bsc#1258009
* bsc#1258010
* bsc#1258011
* bsc#1258754

Cross-References:

* CVE-2026-2003
* CVE-2026-2004
* CVE-2026-2005
* CVE-2026-2006

CVSS scores:

* CVE-2026-2003 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-2003 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-2004 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2004 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2005 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2005 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2006 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-2006 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* Basesystem Module 15-SP7
* openSUSE Leap 15.6
* Server Applications Module 15-SP7
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7

An update that solves four vulnerabilities and has one security fix can now be
installed.

## Description:

This update for postgresql17 fixes the following issues:

Update to version 17.9 (bsc#1258754).

Security issues fixed:

* CVE-2026-2003: improper validation of type "oidvector" may allow disclose a
few bytes of server memory (bsc#1258008).
* CVE-2026-2004: intarray missing validation of type of input to selectivity
estimator could lead to arbitrary code execution (bsc#1258009).
* CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions
could lead to arbitrary code execution (bsc#1258010).
* CVE-2026-2006: inadequate validation of multibyte character lengths could
lead to arbitrary code execution (bsc#1258011).

Regression fixes:

* the substring() function raises an error "invalid byte sequence for
encoding" on non-ASCII text values if the source of that value is a database
column (caused by CVE-2026-2006 fix).
* a standby may halt and return an error "could not access status of
transaction".

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-883=1 SUSE-2026-883=1

* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-883=1

* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-883=1

* Server Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-883=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-883=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-883=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* postgresql17-plpython-debuginfo-17.9-150600.13.24.1
* postgresql17-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-contrib-debuginfo-17.9-150600.13.24.1
* postgresql17-contrib-17.9-150600.13.24.1
* postgresql17-plpython-17.9-150600.13.24.1
* postgresql17-llvmjit-17.9-150600.13.24.1
* postgresql17-debuginfo-17.9-150600.13.24.1
* postgresql17-plperl-debuginfo-17.9-150600.13.24.1
* postgresql17-server-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-devel-17.9-150600.13.24.1
* postgresql17-server-devel-17.9-150600.13.24.1
* postgresql17-llvmjit-devel-17.9-150600.13.24.1
* postgresql17-debugsource-17.9-150600.13.24.1
* postgresql17-plperl-17.9-150600.13.24.1
* postgresql17-llvmjit-debuginfo-17.9-150600.13.24.1
* postgresql17-server-17.9-150600.13.24.1
* postgresql17-test-17.9-150600.13.24.1
* postgresql17-pltcl-debuginfo-17.9-150600.13.24.1
* postgresql17-17.9-150600.13.24.1
* postgresql17-server-debuginfo-17.9-150600.13.24.1
* postgresql17-pltcl-17.9-150600.13.24.1
* openSUSE Leap 15.6 (noarch)
* postgresql17-docs-17.9-150600.13.24.1
* Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql17-debuginfo-17.9-150600.13.24.1
* postgresql17-debugsource-17.9-150600.13.24.1
* postgresql17-17.9-150600.13.24.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql17-debuginfo-17.9-150600.13.24.1
* postgresql17-test-17.9-150600.13.24.1
* postgresql17-llvmjit-debuginfo-17.9-150600.13.24.1
* postgresql17-llvmjit-devel-17.9-150600.13.24.1
* postgresql17-debugsource-17.9-150600.13.24.1
* postgresql17-llvmjit-17.9-150600.13.24.1
* Server Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* postgresql17-plpython-debuginfo-17.9-150600.13.24.1
* postgresql17-debuginfo-17.9-150600.13.24.1
* postgresql17-server-17.9-150600.13.24.1
* postgresql17-plperl-debuginfo-17.9-150600.13.24.1
* postgresql17-server-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-devel-17.9-150600.13.24.1
* postgresql17-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-pltcl-debuginfo-17.9-150600.13.24.1
* postgresql17-server-devel-17.9-150600.13.24.1
* postgresql17-server-debuginfo-17.9-150600.13.24.1
* postgresql17-pltcl-17.9-150600.13.24.1
* postgresql17-debugsource-17.9-150600.13.24.1
* postgresql17-contrib-debuginfo-17.9-150600.13.24.1
* postgresql17-contrib-17.9-150600.13.24.1
* postgresql17-plpython-17.9-150600.13.24.1
* postgresql17-plperl-17.9-150600.13.24.1
* Server Applications Module 15-SP7 (noarch)
* postgresql17-docs-17.9-150600.13.24.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* postgresql17-plpython-debuginfo-17.9-150600.13.24.1
* postgresql17-debuginfo-17.9-150600.13.24.1
* postgresql17-server-17.9-150600.13.24.1
* postgresql17-plperl-debuginfo-17.9-150600.13.24.1
* postgresql17-server-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-devel-17.9-150600.13.24.1
* postgresql17-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-pltcl-debuginfo-17.9-150600.13.24.1
* postgresql17-server-devel-17.9-150600.13.24.1
* postgresql17-17.9-150600.13.24.1
* postgresql17-server-debuginfo-17.9-150600.13.24.1
* postgresql17-pltcl-17.9-150600.13.24.1
* postgresql17-debugsource-17.9-150600.13.24.1
* postgresql17-contrib-debuginfo-17.9-150600.13.24.1
* postgresql17-contrib-17.9-150600.13.24.1
* postgresql17-plpython-17.9-150600.13.24.1
* postgresql17-plperl-17.9-150600.13.24.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
* postgresql17-docs-17.9-150600.13.24.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* postgresql17-plpython-debuginfo-17.9-150600.13.24.1
* postgresql17-debuginfo-17.9-150600.13.24.1
* postgresql17-server-17.9-150600.13.24.1
* postgresql17-plperl-debuginfo-17.9-150600.13.24.1
* postgresql17-server-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-devel-17.9-150600.13.24.1
* postgresql17-devel-debuginfo-17.9-150600.13.24.1
* postgresql17-pltcl-debuginfo-17.9-150600.13.24.1
* postgresql17-server-devel-17.9-150600.13.24.1
* postgresql17-17.9-150600.13.24.1
* postgresql17-server-debuginfo-17.9-150600.13.24.1
* postgresql17-pltcl-17.9-150600.13.24.1
* postgresql17-debugsource-17.9-150600.13.24.1
* postgresql17-contrib-debuginfo-17.9-150600.13.24.1
* postgresql17-contrib-17.9-150600.13.24.1
* postgresql17-plpython-17.9-150600.13.24.1
* postgresql17-plperl-17.9-150600.13.24.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
* postgresql17-docs-17.9-150600.13.24.1

## References:

* https://www.suse.com/security/cve/CVE-2026-2003.html
* https://www.suse.com/security/cve/CVE-2026-2004.html
* https://www.suse.com/security/cve/CVE-2026-2005.html
* https://www.suse.com/security/cve/CVE-2026-2006.html
* https://bugzilla.suse.com/show_bug.cgi?id=1258008
* https://bugzilla.suse.com/show_bug.cgi?id=1258009
* https://bugzilla.suse.com/show_bug.cgi?id=1258010
* https://bugzilla.suse.com/show_bug.cgi?id=1258011
* https://bugzilla.suse.com/show_bug.cgi?id=1258754



openSUSE-SU-2026:20345-1: moderate: Security update for python-lxml_html_clean


openSUSE security update: security update for python-lxml_html_clean
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20345-1
Rating: moderate
References:

* bsc#1259378
* bsc#1259379

Cross-References:

* CVE-2026-28348
* CVE-2026-28350

Affected Products:

openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.

Description:

This update for python-lxml_html_clean fixes the following issues:

Changes in python-lxml_html_clean:

- CVE-2026-28348: improper keywords checking can allow external CSS loading (bsc#1259378)
- CVE-2026-28350: lack of base tag handling can allow the hijacking of the resolution of relative URLs (bsc#1259379)

Patch instructions:

To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

zypper in -t patch openSUSE-Leap-16.0-packagehub-157=1

Package List:

- openSUSE Leap 16.0:

python313-lxml_html_clean-0.4.2-bp160.2.1

References:

* https://www.suse.com/security/cve/CVE-2026-28348.html
* https://www.suse.com/security/cve/CVE-2026-28350.html



openSUSE-SU-2026:20348-1: moderate: Security update for python-PyPDF2


openSUSE security update: security update for python-pypdf2
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20348-1
Rating: moderate
References:

* bsc#1259404

Cross-References:

* CVE-2026-28804

CVSS scores:

* CVE-2026-28804 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-28804 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products:

openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves one vulnerability and has one bug fix can now be installed.

Description:

This update for python-PyPDF2 fixes the following issues:

Changes in python-PyPDF2:

- CVE-2026-28804: Denial of Service via crafted PDF with ASCIIHexDecode filter (bsc#1259404)
- Update sources with osc run download_files

Patch instructions:

To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

zypper in -t patch openSUSE-Leap-16.0-packagehub-160=1

Package List:

- openSUSE Leap 16.0:

python313-PyPDF2-2.11.1-bp160.3.1

References:

* https://www.suse.com/security/cve/CVE-2026-28804.html



openSUSE-SU-2026:20340-1: important: Security update for cJSON


openSUSE security update: security update for cjson
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20340-1
Rating: important
References:

* bsc#1241502
* bsc#1249112

Cross-References:

* CVE-2023-26819
* CVE-2025-57052

CVSS scores:

* CVE-2023-26819 ( SUSE ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2023-26819 ( SUSE ): 2.1 CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-57052 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-57052 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products:

openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 2 vulnerabilities and has 2 bug fixes can now be installed.

Description:

This update for cJSON fixes the following issues:

- Update to version 1.7.19
* Check for NULL in cJSON_DetachItemViaPointer.
* Check overlap before calling strcpy in cJSON_SetValuestring.
* Fix Max recursion depth for cJSON_Duplicate to prevent stack
exhaustion.
* Allocate memory for the temporary buffer when paring numbers.
This fixes CVE-2023-26819. (bsc#1241502)
* Fix the incorrect check in decode_array_index_from_pointer.
This fixes CVE-2025-57052. (bsc#1249112)
- Remove not longer needed patch for NULL to deallocated pointers.

Patch instructions:

To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

zypper in -t patch openSUSE-Leap-16.0-369=1

Package List:

- openSUSE Leap 16.0:

cJSON-devel-1.7.19-160000.1.1
libcjson1-1.7.19-160000.1.1

References:

* https://www.suse.com/security/cve/CVE-2023-26819.html
* https://www.suse.com/security/cve/CVE-2025-57052.html



SUSE-SU-2026:0885-1: important: Security update for curl


# Security update for curl

Announcement ID: SUSE-SU-2026:0885-1
Release Date: 2026-03-12T14:50:21Z
Rating: important
References:

* bsc#1259362
* bsc#1259363
* bsc#1259364
* bsc#1259365

Cross-References:

* CVE-2026-1965
* CVE-2026-3783
* CVE-2026-3784
* CVE-2026-3805

CVSS scores:

* CVE-2026-1965 ( SUSE ): 6.9
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
* CVE-2026-1965 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-1965 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2026-3783 ( SUSE ): 5.6
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-3783 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
* CVE-2026-3783 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-3784 ( SUSE ): 1.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-3784 ( SUSE ): 4.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-3784 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-3805 ( SUSE ): 2.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-3805 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2026-3805 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* openSUSE Leap 15.6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP6 LTSS
* SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves four vulnerabilities can now be installed.

## Description:

This update for curl fixes the following issues:

* CVE-2026-1965: bad reuse of HTTP Negotiate connection (bsc#1259362).
* CVE-2026-3783: token leak with redirect and netrc (bsc#1259363).
* CVE-2026-3784: wrong proxy connection reuse with credentials (bsc#1259364).
* CVE-2026-3805: use after free in SMB connection reuse (bsc#1259365).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-885=1 openSUSE-SLE-15.6-2026-885=1

* SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-885=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-885=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* curl-debuginfo-8.14.1-150600.4.40.1
* curl-8.14.1-150600.4.40.1
* curl-mini-debugsource-8.14.1-150600.4.40.1
* libcurl-mini4-8.14.1-150600.4.40.1
* libcurl-mini4-debuginfo-8.14.1-150600.4.40.1
* curl-debugsource-8.14.1-150600.4.40.1
* libcurl4-debuginfo-8.14.1-150600.4.40.1
* libcurl4-8.14.1-150600.4.40.1
* libcurl-devel-8.14.1-150600.4.40.1
* openSUSE Leap 15.6 (noarch)
* curl-zsh-completion-8.14.1-150600.4.40.1
* curl-fish-completion-8.14.1-150600.4.40.1
* libcurl-devel-doc-8.14.1-150600.4.40.1
* openSUSE Leap 15.6 (x86_64)
* libcurl4-32bit-debuginfo-8.14.1-150600.4.40.1
* libcurl4-32bit-8.14.1-150600.4.40.1
* libcurl-devel-32bit-8.14.1-150600.4.40.1
* openSUSE Leap 15.6 (aarch64_ilp32)
* libcurl4-64bit-8.14.1-150600.4.40.1
* libcurl-devel-64bit-8.14.1-150600.4.40.1
* libcurl4-64bit-debuginfo-8.14.1-150600.4.40.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
* curl-debuginfo-8.14.1-150600.4.40.1
* curl-8.14.1-150600.4.40.1
* curl-debugsource-8.14.1-150600.4.40.1
* libcurl4-debuginfo-8.14.1-150600.4.40.1
* libcurl4-8.14.1-150600.4.40.1
* libcurl-devel-8.14.1-150600.4.40.1
* SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
* libcurl4-32bit-debuginfo-8.14.1-150600.4.40.1
* libcurl4-32bit-8.14.1-150600.4.40.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
* curl-debuginfo-8.14.1-150600.4.40.1
* curl-8.14.1-150600.4.40.1
* curl-debugsource-8.14.1-150600.4.40.1
* libcurl4-debuginfo-8.14.1-150600.4.40.1
* libcurl4-8.14.1-150600.4.40.1
* libcurl-devel-8.14.1-150600.4.40.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
* libcurl4-32bit-debuginfo-8.14.1-150600.4.40.1
* libcurl4-32bit-8.14.1-150600.4.40.1

## References:

* https://www.suse.com/security/cve/CVE-2026-1965.html
* https://www.suse.com/security/cve/CVE-2026-3783.html
* https://www.suse.com/security/cve/CVE-2026-3784.html
* https://www.suse.com/security/cve/CVE-2026-3805.html
* https://bugzilla.suse.com/show_bug.cgi?id=1259362
* https://bugzilla.suse.com/show_bug.cgi?id=1259363
* https://bugzilla.suse.com/show_bug.cgi?id=1259364
* https://bugzilla.suse.com/show_bug.cgi?id=1259365



SUSE-SU-2026:0886-1: moderate: Security update for libsoup2


# Security update for libsoup2

Announcement ID: SUSE-SU-2026:0886-1
Release Date: 2026-03-12T14:50:37Z
Rating: moderate
References:

* bsc#1256418

Cross-References:

* CVE-2026-0716

CVSS scores:

* CVE-2026-0716 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-0716 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
* CVE-2026-0716 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected Products:

* Basesystem Module 15-SP7
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves one vulnerability can now be installed.

## Description:

This update for libsoup2 fixes the following issue:

* CVE-2026-0716: improper bounds handling may allow out-of-bounds read
(bsc#1256418).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2026-886=1 openSUSE-SLE-15.6-2026-886=1

* Basesystem Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-886=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* libsoup2-debugsource-2.74.3-150600.4.33.1
* typelib-1_0-Soup-2_4-2.74.3-150600.4.33.1
* libsoup-2_4-1-2.74.3-150600.4.33.1
* libsoup-2_4-1-debuginfo-2.74.3-150600.4.33.1
* libsoup2-devel-2.74.3-150600.4.33.1
* openSUSE Leap 15.6 (x86_64)
* libsoup2-devel-32bit-2.74.3-150600.4.33.1
* libsoup-2_4-1-32bit-debuginfo-2.74.3-150600.4.33.1
* libsoup-2_4-1-32bit-2.74.3-150600.4.33.1
* openSUSE Leap 15.6 (noarch)
* libsoup2-lang-2.74.3-150600.4.33.1
* openSUSE Leap 15.6 (aarch64_ilp32)
* libsoup-2_4-1-64bit-2.74.3-150600.4.33.1
* libsoup2-devel-64bit-2.74.3-150600.4.33.1
* libsoup-2_4-1-64bit-debuginfo-2.74.3-150600.4.33.1
* Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
* libsoup2-debugsource-2.74.3-150600.4.33.1
* typelib-1_0-Soup-2_4-2.74.3-150600.4.33.1
* libsoup-2_4-1-2.74.3-150600.4.33.1
* libsoup-2_4-1-debuginfo-2.74.3-150600.4.33.1
* libsoup2-devel-2.74.3-150600.4.33.1
* Basesystem Module 15-SP7 (noarch)
* libsoup2-lang-2.74.3-150600.4.33.1

## References:

* https://www.suse.com/security/cve/CVE-2026-0716.html
* https://bugzilla.suse.com/show_bug.cgi?id=1256418


LibXML2 and LibArchive updates for Slackware

LibPNG, GIMP, .NET, and more updates for Ubuntu

Windows

Linux

macOS

Community

  • Lexonight
    Hey everyone,Wanted to share a project I've been b ...
  • SeveG
    need some help here... situationPC= Packard BellOS= win1 ...
  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...