A security update for libnfs addresses an integer overflow vulnerability (CVE-2026-53689) that occurs during a connection to a specially crafted NFS server. This flaw could potentially be exploited to cause unexpected behavior or crashes in affected versions of libnfs.
A vulnerability in the Linux kernel's netfilter nf_tables subsystem can cause improper handling of multiple pending catchall elements during transaction processing, potentially leading to kernel warnings and system compromise. This issue affects certain Linux kernel versions prior to 5.15.0-1111.118~20.04.1 and related versions. Ubuntu and SUSE have released patches addressing this and other kernel vulnerabilities. Users should update to the fixed kernel versions and reboot to apply the changes. Due to ABI changes, recompilation of third-party kernel modules may be necessary.
This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process.
### Impact
A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service.
### Patches
Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support).
### Workarounds
Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the `idna.encode()` function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
A security update for libgcrypt addresses CVE-2026-41990, a low severity vulnerability caused by a lack of bound check that can lead to mishandling of Dilithium signing. No specific affected versions or patch details are provided in the available data.
A security update for perl-libwww-perl addresses CVE-2026-8368, which involves the leakage of authorization and proxy-authorization headers during cross-origin redirects. This vulnerability could potentially expose sensitive authentication information when redirects occur across different origins. The issue has been fixed by the vendor. No CVSS score is available, but the severity is assessed as medium based on the impact described.
A security update for the Podman container management tool has been issued by the SUSE Product Security Team. This update involves rebuilding Podman against the current Go language security release to address underlying vulnerabilities. No specific CVEs or detailed technical vulnerabilities are disclosed. The update is classified as high severity by the source but lacks a CVSS score or detailed impact information.
This security update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.121 addresses multiple vulnerabilities including heap overflow, use-after-free, and improper handling of oversized directory entries. The update fixes five distinct security issues affecting kernel components such as NFSv4.0, network packet handling, FUSE filesystem, and generic receive offload (GRO). These vulnerabilities are rated high severity and have been resolved by the SUSE Product Security Team in this patch.
A security update for the sg3_utils package addresses issues related to SCSI inquiry export output conformance and quoting in a rescan script. The update fixes the sg_inq tool's --export output to conform correctly for SCSI name strings and ATA fields, and corrects quoting of $id_serial in the rescan-scsi-bus.sh script's findmultipath call.
A security update for the sg3_utils package addresses issues related to SCSI name string and ATA field output conformance in the sg_inq tool and quoting of $id_serial in the rescan-scsi-bus.sh script's findmultipath call. These fixes improve the correctness and reliability of these utilities.
This security update for the Gleam programming language addresses multiple vulnerabilities in version 1.17.0. The fixes include restricting custom documentation page paths and sources to prevent escaping the documentation output directory or project root, restricting publication tarball creation to exclude files outside the project root, and enforcing stricter deserialization rules to reject corrupted data in the build directory. These vulnerabilities are identified as CVE-2026-32685, CVE-2026-42795, and CVE-2026-43965. The update also includes various other bug fixes and feature improvements.
This update for warewulf4 fixes the following issues:
Changes in warewulf4:
- updated go-jose to fix CVE-2026-34986 (bsc#1262810)
- chi is fixed in the upstream project
- updating to v4.7.0 with following security fixes
* fixed CVE-2026-39821 (bsc#1266483)
* fixed CVE-2026-33814 (bsc#1265653)
- v4.7.0 with significant changes relative to the v4.6.x series which are:
* New wwctl unset command
* Refactored server routes (URLs)
* New /files/ route for serving individual files and templates
* Server TLS support
* Removed support for fetching individual overlays and individual files from overlays
* Fixed whitespace handling around template functions
* Security fixes, including updated Go and library versions
- changes from v4.6.5:
* new wwctl overlay info command
* fixed wwctl image import --update option
* cross-arch support for wwclient
* improved IPv6 support
* improved support for bonded interfaces
* renamed debian.interfaces overlay to ifupdown
* new systemd-networkd overlay
* warewulf-dracut fixes, including "provision-to-disk" fixes
- remove slurm-overlay package
- fix CVE-2025-69725 (bsc#1258511) by updating chi
- updated to v4.6.5 with following changes:
* new wwctl overlay info command
* fixed wwctl image import --update option (bsc#1254470)
* cross-arch support for wwclient
* improved IPv6 support
* improved support for bonded interfaces
* renamed debian.interfaces overlay to ifupdown
* new systemd-networkd overlay
* warewulf-dracut fixes, including "provision-to-disk" fixes
- default to dnsmasq instead of dhcpd and tftp
Multiple security issues affecting gvim were fixed in the gvim-9.2.0530-1.1 package on the GA media of openSUSE Tumbleweed. These vulnerabilities have been addressed by the SUSE Product Security Team. No specific affected versions or detailed technical information are provided.
This update for webkit2gtk3 fixes the following issues
Update to version 2.52.4:
- CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code
execution due to a heap buffer overflow (bsc#1267506).
- CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after-
free issue (bsc#1267507).
- CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267508).
- CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267509).
- CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267510).
- CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267511).
- CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267512).
- CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due
to improper input validation (bsc#1267513).
- CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free
(bsc#1267514).
- CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free
(bsc#1267515).
- CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free
(bsc#1267516).
- CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267517).
- CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267518).
- CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519).
- CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due to improper memory
handling (bsc#1267520).
- CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due
to issues with logic (bsc#1267521).
Changes for webkit2gtk3:
+ Add support for half-width fonts.
+ Improve content filter compilation by avoiding file copies.
+ Improve handling of out of disk space conditions when the
NetworkProcess tried to write data in caches.
+ Improve how the CMake build system checks whether libatomic is
required.
+ Fix painting scrollbars when their width changes.
+ Fix playback of certain YouTube videos with low frame rates.
+ Fix webkit://gpu not working in systems where neither
libGL.so.1 nor libOpenGL.so.0 are available.
+ Fix the build with librice 0.4 or newer when the GStreamer
WebRTC backend is enabled at build configuration time.
+ Fix the build with USE_GSTREAMER_WEBRTC=OFF.
+ Fix the build with USE_GBM=OFF.
+ Fix several crashes and rendering issues.
+ Security fixes: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, CVe-2026-43660.
+ Changes in version .52.3;
+ Add support for the "scrollbar-color" CSS property.
+ Fix some emoji glyphs being rendered as missing glyph boxes.
+ Fix JavaScriptCore crashes on architectures other than x86_64.
+ Fix the build on s390x.
+ Changes in version 2.52.2:
+ Improve handling of real-time threads.
+ Fix scrollbar rendering glitches visible in some GPU
configurations.
+ Fix V4L2 hardware accelerated media codecs now working due to
overly restrictive sandbox device access rules.
+ Fix leak of bitmap images in
webkit_favicon_database_get_favicon_finish().
+ Fix the build with USE_GTK4=OFF.
A security update for cosign addresses CVE-2026-39395, which involves incorrect attestation verification caused by malformed payloads or mismatched predicate types. This vulnerability could affect the integrity of attestation processes. The update also includes a non-security version upgrade to 3.0.5. The severity of this issue is assessed as medium.
A vulnerability (CVE-2026-4948) in firewalld allows a local unprivileged user to modify the firewall state due to improper authorization of two runtime D-Bus setters. This issue affects certain versions of firewalld and has been assigned a medium severity with a CVSS score of 5.5. Red Hat has released an update for firewalld in Red Hat Enterprise Linux 10.2 and later that addresses this flaw.
This update for mutt fixes the following issues
- CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897).
- CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896).
- CVE-2026-43861: missing check for `\0` in `url_pct_decode` (bsc#1263895).
- CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894).
- CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893).
- CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).
This security update for Avahi fixes two vulnerabilities that can cause the avahi-daemon to crash, resulting in denial of service. One vulnerability is a reachable assertion failure in the transport_flags_from_domain function. The other involves unsolicited mDNS responses containing a recursive CNAME record. Both issues can cause the daemon to crash and disrupt service.
This update for postfix fixes the following issue
- CVE-2026-43964: buffer overread and process crash via an enhanced status code that lacks text after the third number
(bsc#1264062).