Multiple security issues affecting the jupyter-jupyterlab package on openSUSE Tumbleweed have been addressed in version 4.5.10-1.1. These vulnerabilities are collectively fixed in this package update. No specific technical details or CVSS scores are provided. The severity is assessed as medium based on the available information.
CVE-2026-71401 is an integer underflow vulnerability in the DHCPv4 packet capture code of SUSE wicked. The function ni_capture_inspect_udp_header() does not properly verify that the IP total length is at least as large as the IP header length before performing a subtraction, leading to an out-of-bounds read. An unauthenticated attacker on the same network can exploit this to crash the wicked DHCPv4 client daemon. No information disclosure or other impacts have been demonstrated. This affects wicked versions up to and including 0.6.80.
Multiple security issues were addressed in the owasp-modsecurity-crs-4.29.0-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes pertain to the SUSE distribution and specifically affect the owasp-modsecurity-crs package versions listed. No CVSS score is available for these vulnerabilities, but the severity is assessed as medium.
This update for cloudflared fixes the following issues:
Changes in cloudflared:
- Update version to 2026.8.2
* Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817)
* Add OpenRC support
* Migrate config renovate.json
* Fix bugs
This update for file-roller fixes the following issues:
Changes in file-roller:
- CVE-2026-78322: Check line length when parsing command output (bsc#1276442).
CVE-2026-71402 is a medium-severity out-of-bounds read vulnerability in the DHCPv4 packet capture code of SUSE wicked up to version 0.6.80. The flaw occurs because the function ni_capture_inspect_udp_header() incorrectly reports the IP total length as the payload length, causing the DHCPv4 client to read up to 68 bytes beyond the end of the packet buffer. An unauthenticated attacker on the same network can send a crafted DHCP/UDP packet to trigger this over-read, potentially causing the client to interpret adjacent heap memory as DHCP options. No memory writes or remote data exfiltration have been demonstrated. No official fix or patch information is currently available.
This security update for suseconnect-ng upgrades the software to version 1.23.0, addressing multiple issues including improved product migration handling, updating the default Go version for building the package, fixing flag parsing errors, ensuring consistent interactive/noninteractive behavior during release package installation, adding an optional collector for installed SUSE RPM packages, and allowing deregistration when a subscribed registration code has expired.
A global buffer overflow vulnerability (CVE-2026-41992) exists in the LZH decompression logic of GNU gzip due to improper reuse of shared global state between different decompression formats. This flaw can lead to out-of-bounds reads, potentially causing information disclosure or denial of service. The vulnerability affects multiple gzip versions and has been addressed by security updates from vendors including Red Hat and SUSE.
Multiple security vulnerabilities have been fixed in wget, including server-side request forgery via unvalidated FTP PASV response IP addresses, heap buffer underread from Metalink documents with whitespace-only URLs, integer overflow from server-controlled Content-Range headers, heap memory corruption from character set conversion of server-supplied filenames, and heap buffer overflow from crafted HTML attributes requiring entity encoding. Additional bug fixes address segmentation faults and regressions related to Metalink processing. These issues have been addressed by the SUSE Product Security Team.
The coturn-4.17.2-1.1 package on openSUSE Tumbleweed addresses multiple security issues. These vulnerabilities have been fixed in this package version. No specific details about the individual vulnerabilities or affected versions are provided.
A timing attack vulnerability was found in the Linux kernel SCTP implementation used by SUSE Linux Enterprise 16. The issue involved a non-constant-time comparison of message authentication codes (MACs), which could allow attackers to infer sensitive information through timing analysis. The vulnerability has been fixed by updating the MAC comparison to use a constant-time helper function, preventing timing attacks.
A security update for rsync addresses multiple vulnerabilities including directory escape, command injection, symlink races, denial of service, privilege escalation, and unauthorized file access. These issues affect various rsync daemon and sender/receiver functionalities and could allow attackers to bypass restrictions, execute arbitrary commands, cause crashes, or manipulate files outside intended directories. The update fixes a broad set of issues identified by multiple CVEs ranging from CVE-2026-53783 to CVE-2026-70464.
This security update for v2ray-core addresses multiple vulnerabilities including CVE-2026-27017, CVE-2026-39821, CVE-2026-72815, CVE-2026-72816, and CVE-2026-72817. The update includes version upgrades to 5.53.0 and 5.51.2, which add new features and fix bugs related to gRPC transport, UDP connections, Wireguard TCP listener support, and other components. The golang.org/x/net module was also updated to version 0.55.0 to resolve additional issues. No specific affected versions were stated. The severity is assessed as high based on the vendor's classification.
Multiple security vulnerabilities affecting the rmt-server component of SUSE have been fixed in version 3.1. These include issues such as parser differentials leading to WAF bypass, header injection and response splitting, root directory disclosure, denial of service via crafted headers, exposure of unintended files, header bypass, excessive resource consumption, unbounded chunked uploads, and incorrect HTTP response framing. The update also addresses various other bugs and compatibility issues with newer Ruby and Ruby on Rails versions.
A heap buffer overflow vulnerability in 7zip when processing XZ chunked data can lead to remote code execution. This issue is addressed in the 7zip update to version 26.02. The vulnerability is tracked as CVE-2026-14266 and was fixed by the SUSE Product Security Team.