Multiple security vulnerabilities have been identified and fixed in the jq tool by the SUSE Product Security Team. These include heap buffer overflows, integer overflows, unbounded recursion leading to resource exhaustion, missing runtime type checks causing crashes, out-of-bounds reads, denial of service via resource exhaustion, memory corruption, and validation bypass. The vulnerabilities affect jq version 1.7.1-160000.3.1.aarch64. No known exploits in the wild have been reported.
A security update has been recommended for the SUSE packages mpv, libKPipeWireRecord6, and ffmpegthumbs-kf5 to address unspecified vulnerabilities. The update aims to fix multiple issues, though specific technical details and affected versions are not provided.
This update for apache2 fixes the following issues
- CVE-2026-29167: mod_ldap per-dir use-after-free (bsc#1267976).
- CVE-2026-29170: mod_proxy_ftp XSS (bsc#1267977).
- CVE-2026-34355: mod_proxy_html buffer overflow (bsc#1267978).
- CVE-2026-34356: malicious backend servers can lead to a heap-based buffer overflow (bsc#1267955).
- CVE-2026-42535: malicious path manipulation can lead to child process crashes (bsc#1267956).
- CVE-2026-42536: processing untrusted content can lead to a heap-based buffer overflow (bsc#1267962).
- CVE-2026-43951: out-of-bound read in `merge_response_headers` can cause crash (bsc#1267963).
- CVE-2026-44119: improper privilege management can lead to an unauthorized read (bsc#1267965).
- CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (bsc#1267969).
- CVE-2026-44186: responses from an attacker-controlled FTP backend can lead to resource exhaustion and a denial of
service (bsc#1267970).
- CVE-2026-44631: crafted regular expression can lead to a buffer underwrite (bsc#1267971).
- CVE-2026-48913: file handle exhaustion during request processing in mod_http2 can lead to a use-after-free
(bsc#1267972).
- CVE-2026-49975: Fix cookie header accounting against LimitRequestFields (bsc#1267503).
A NULL pointer dereference vulnerability (CVE-2025-70102) exists in the parse_option() function of dhcpcd. This vulnerability is addressed in dhcpcd version 10.3.2, which includes multiple fixes to improve stability and security by preventing NULL dereferences and handling DHCP state more robustly.
A heap buffer overflow vulnerability exists in the 'pairwise' function of perl-List-SomeUtils-XS. This issue is identified as CVE-2026-12844 and has been addressed by a security update from the SUSE Product Security Team. The vulnerability is rated as high severity. No specific affected versions are provided in the available data.
A security update for jline3 addresses an unauthenticated remote memory exhaustion vulnerability caused by unbounded Telnet 'NEW-ENVIRON' variables. This flaw could allow an attacker to exhaust memory resources remotely without authentication. The issue is rated medium severity. No specific affected versions or patch details are provided in the available data.
This security update for cadvisor addresses multiple issues through a series of incremental version updates culminating in version 0.60.3. The updates include improvements in OOM watching, enhanced cgroup v2 memory metrics exposure, fixes for container handler tests, and resolution of a nil pointer dereference in Docker integration. Several dependencies were also updated to address security vulnerabilities, including a bump of x/net to 0.55. The update fixes known bugs and improves stability and metrics reporting for container environments.
This update for gstreamer-plugins-good fixes the following issues:
- CVE-2026-53705: wavpackdec: Avoid integer overflow when calculating output buffer size and related fixes (bsc#1268449).
A reflected DOM cross-site scripting (XSS) vulnerability (CVE-2025-11687) was identified and fixed in the python-gi-docgen component by the SUSE Product Security Team. The vulnerability affects SUSE Linux Enterprise and openSUSE Leap 16.0 versions of gi-docgen. No CVSS score is provided, but the issue is rated medium severity. No explicit patch or remediation details are provided in the input data.
A security update for rmt-server addresses CVE-2026-42256, which involves a denial-of-service (DoS) vulnerability when a client authenticates using SCRAM-SHA1 or SCRAM-SHA2 against a hostile IMAP server. The update to version 3.0.0 removes unused ActionMailer/ActionMailbox components to eliminate this vulnerability and improves security by splitting the Rails meta-gem into individual components.
A security update for golang-github-docker-libnetwork addresses CVE-2026-2808, which involves unvalidated user-supplied file paths in github.com/hashicorp/consul. This vulnerability can lead to arbitrary file reads through the Vault Kubernetes authentication provider. The issue was identified and fixed by the SUSE Product Security Team. No specific affected versions are provided. No known exploits are reported in the wild. The severity is assessed as medium.
This security update for systemd addresses multiple issues including improved handling of TLS allocation failures, disabling mounting of debugfs by default, and several fixes related to systemd-update-helper and package management. It also includes changes to runtime dependencies and package structuring. The update is classified as high severity.
CVE-2026-29181 is a denial of service vulnerability in OpenTelemetry-Go, the Go implementation of OpenTelemetry. An attacker can exploit this flaw by sending multiple crafted 'baggage' HTTP header lines, causing excessive CPU and memory consumption. This vulnerability affects the multicluster engine for Kubernetes and related components, potentially rendering services unavailable. The issue is addressed in the etcd-3.6.13-1.1 package on openSUSE Tumbleweed and is relevant to certain SUSE product versions. The vulnerability is rated medium severity.
Multiple security issues were fixed in the Linux kernel as part of the kernel-devel-7.1.2-1.1 package for openSUSE Tumbleweed. These vulnerabilities affect various kernel subsystems and architectures, including ARM64, MIPS, PowerPC, x86, and many device drivers and file systems. The issues could potentially allow an attacker to compromise the system. A patch addressing these vulnerabilities is available.
A security update for the Transmission software addresses CVE-2026-38978 by adding clickjacking safeguards when serving HTTP responses. This update mitigates the risk of clickjacking attacks by implementing protective measures in the HTTP response handling. No specific affected versions are provided. The vulnerability is assessed as medium severity based on the impact description.
Multiple security issues were addressed in the python3-onionshare package version 2.6.4-1.1 for openSUSE Tumbleweed. These vulnerabilities affect versions prior to 2.6.4. The issues are related to CWE-59, indicating potential symbolic link (symlink) attacks or similar file path vulnerabilities. The package update fixes these security problems to improve the software's security posture.
This security update for MuPDF addresses multiple issues including two specific vulnerabilities: CVE-2025-55780, a null pointer dereference in the function break_word_for_overflow_wrap(), and CVE-2026-25556, a double-free vulnerability in fz_fill_pixmap_from_display_list(). The update also introduces changes such as building MuPDF as a shared library instead of static-only, and numerous bug fixes and improvements across versions 1.25.4 through 1.27.2. These vulnerabilities could cause application crashes or memory corruption. The update is provided by the SUSE Product Security Team and is classified as high severity. No explicit patch links or affected versions are stated, and no CVSS score is available.
This security update for coturn addresses multiple issues through version upgrades from 4.10.0 to 4.14.0, including security hardening, bug fixes, and new features such as rate limiting unauthorized responses to reduce reflection attacks. The update includes fixes for memory leaks, out-of-bounds reads, format-string injection, and improvements in TLS and Redis support. No specific CVE details or exploit information are provided, but the update is classified as high severity.