This security update provides a functional equivalent of RHSA-2026:83156.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:83156.
A security update for the SUSE Linux Enterprise 15 SP7 RT kernel addresses multiple security vulnerabilities across various kernel components, including hardware monitoring, Bluetooth, SCSI, networking, tracing, and more. These fixes resolve issues such as null pointer dereferences, memory leaks, use-after-free, out-of-bounds reads/writes, race conditions, and other kernel-level bugs. The update mitigates a broad range of potential security risks by correcting these defects.
A security update has been issued for librabbitmq by the SUSE Product Security Team, providing a functional equivalent to Red Hat's advisory RHSA-2026:75582. The update addresses a high-severity vulnerability identified as CVE-2026-44236. No specific affected versions or detailed technical information are provided in the available data.
A vulnerability in the tftp-hpa in.tftpd remap engine allows remote unauthenticated attackers to cause out-of-bounds read/write operations by sending a crafted request with an inverse remap rule containing a non-empty custom error message. This leads to a daemon crash and denial of service. The issue affects multiple specific versions of tftp-hpa. A security update addressing this denial of service vulnerability is available from Red Hat.
Multiple security issues were addressed in the iscsiuio-0.7.8.8-114.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities affecting the iscsiuio component in this specific package version. No detailed technical information or CVSS scores are provided for these issues.
Mozilla Firefox Extended Support Release 153.4.0 ESR addresses multiple security vulnerabilities across various components including networking, audio/video playback, DOM, graphics, JavaScript engine, storage, sandbox escapes, privilege escalations, and mitigation bypasses. These issues include use-after-free bugs, information disclosure, sandbox escapes, privilege escalations, denial-of-service, and same-origin policy bypasses. The update fixes these vulnerabilities to improve browser security.
A security update for Chromium version 155.0.8059.39 addresses multiple vulnerabilities including use-after-free, uninitialized resource, incorrect authorization, race conditions, information leaks, integer overflows, type confusion, improper input validation, missing authorization, confused deputy, code injection, and UI misrepresentation issues across various components such as Chromecast, Browser, ANGLE, Omnibox, V8, Media, PDF, and others. These vulnerabilities collectively pose critical security risks. The update promotes Chromium 155 to stable and fixes these issues.
SUSE Linux Enterprise 15 SP5 kernel received a security update addressing multiple vulnerabilities across various kernel components including networking, bonding, team, cpuidle, bpf, netfilter, sctp, futex, dm log, locking, virtiofs, tipc, keys, apparmor, scsi target, ipv6, tunnels, netfilter synproxy, nfc, security keys, net tls, drm, af_unix, vsock, RDMA, crypto, bpf devmap, ipv4 igmp, ALSA, KVM, rhashtable, fib, gtp, xfrm, btrfs, pppoe, ceph, and others. These fixes resolve issues such as memory leaks, infinite loops, type confusion, use-after-free, out-of-bounds reads/writes, race conditions, and other kernel-level bugs. The update is classified as high severity due to the breadth and nature of the vulnerabilities fixed. No CVSS score is provided. No specific affected versions are explicitly stated in the input data.
Multiple denial of service vulnerabilities have been identified in the Berkeley Internet Name Domain (BIND) software used in Red Hat Enterprise Linux 9. These include issues with DNS negative cache handling, crafted DNSSEC replies, and malformed DNS64 responses. Red Hat has released security updates to address these vulnerabilities.
A denial of service vulnerability exists in the mod_auth_openidc module for Apache HTTP Server due to malformed state cookie parsing. This module enables Apache to function as an OpenID Connect Relying Party or OAuth 2.0 Resource Server. The vulnerability is identified as CVE-2026-54789 and affects certain versions of mod_auth_openidc distributed with Red Hat Enterprise Linux 9.4 and 10. A security update addressing this issue has been released by Red Hat.
Multiple security issues affecting the traefik package were addressed in the traefik-3.7.13-1.1 update for openSUSE Tumbleweed. These vulnerabilities have been fixed in this package version. No specific technical details or CVSS scores are provided. The overall severity is assessed as medium based on the available information.
Multiple security issues affecting various versions of the kernel-devel package on openSUSE Tumbleweed have been fixed in the kernel-devel-7.2.9-1.1 update. These vulnerabilities impact specific versions of the SUSE kernel-devel package and have been addressed by this update. The severity of these issues is assessed as medium. No CVSS score is provided, and no known exploits are reported in the wild.
This security update addresses multiple vulnerabilities in the jackson-annotations, jackson-core, and jackson-databind libraries. The issues include bypasses of number length constraints in asynchronous parsers, unsafe deserialization of java.nio.file.Path URIs, unbounded cache growth, denial of service via unbounded string builder growth, and unsafe polymorphic deserialization allowing arbitrary Comparable types. The update to version 2.18.11 includes fixes that enforce length limits, restrict URI schemes, optimize parsing functions, and prevent unbounded resource consumption.
A medium severity heap out-of-bounds read vulnerability (CVE-2026-2303) was found in the GSSAPI error handling of the go.mongodb.org mongo-driver dependency used by Apptainer. The vulnerability is addressed by removing this dependency in a security update for the alloy component. The update also adds support for building the SUID starter on SLES 15. A patch is available for affected versions.
A security update for the SUSE Linux Enterprise Kernel addresses CVE-2026-74612, a vulnerability in the veth component related to skb length accounting after XDP fragment adjustment. This issue affects multiple specific SUSE Linux kernel versions. The vulnerability is rated as high severity. No CVSS score is provided. There are no known exploits in the wild. The update fixes the issue, and users should apply the security update to affected versions.
An integer overflow vulnerability in the compositing component of Google Chrome versions prior to 154.0.8037.97 allows a remote attacker to leak cross-origin data by crafting a malicious HTML page. The vulnerability has a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. No explicit patch information is provided in the input data.
FreeRDP versions prior to 3.31.0 contain a heap buffer overflow vulnerability in the nego_send_negotiation_request() function. This occurs because the LB_LOAD_BALANCE_INFO field length is not properly validated before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can exploit this by sending a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value, potentially causing denial of service or heap corruption before authentication completes. Red Hat has issued a security update addressing this vulnerability.