This security update for the SUSE Linux Enterprise Kernel 4.12.14-122.299 addresses multiple vulnerabilities including a heap overflow in the NFSv4.0 LOCK replay cache, a use-after-free in network packet handling, fixes related to dirty.frag, and an issue in generic receive offload (GRO) merging. These vulnerabilities were fixed in this update to improve kernel security.
A security update for the sg3_utils package addresses issues related to SCSI inquiry export output conformance and quoting in a rescan script. The update fixes the sg_inq tool's --export output to conform correctly for SCSI name strings and ATA fields, and corrects quoting of $id_serial in the rescan-scsi-bus.sh script's findmultipath call.
A security update for the sg3_utils package addresses issues related to SCSI name string and ATA field output conformance in the sg_inq tool and quoting of $id_serial in the rescan-scsi-bus.sh script's findmultipath call. These fixes improve the correctness and reliability of these utilities.
This security update for the Gleam programming language addresses multiple vulnerabilities in version 1.17.0. The fixes include restricting custom documentation page paths and sources to prevent escaping the documentation output directory or project root, restricting publication tarball creation to exclude files outside the project root, and enforcing stricter deserialization rules to reject corrupted data in the build directory. These vulnerabilities are identified as CVE-2026-32685, CVE-2026-42795, and CVE-2026-43965. The update also includes various other bug fixes and feature improvements.
This update for warewulf4 fixes the following issues:
Changes in warewulf4:
- updated go-jose to fix CVE-2026-34986 (bsc#1262810)
- chi is fixed in the upstream project
- updating to v4.7.0 with following security fixes
* fixed CVE-2026-39821 (bsc#1266483)
* fixed CVE-2026-33814 (bsc#1265653)
- v4.7.0 with significant changes relative to the v4.6.x series which are:
* New wwctl unset command
* Refactored server routes (URLs)
* New /files/ route for serving individual files and templates
* Server TLS support
* Removed support for fetching individual overlays and individual files from overlays
* Fixed whitespace handling around template functions
* Security fixes, including updated Go and library versions
- changes from v4.6.5:
* new wwctl overlay info command
* fixed wwctl image import --update option
* cross-arch support for wwclient
* improved IPv6 support
* improved support for bonded interfaces
* renamed debian.interfaces overlay to ifupdown
* new systemd-networkd overlay
* warewulf-dracut fixes, including "provision-to-disk" fixes
- remove slurm-overlay package
- fix CVE-2025-69725 (bsc#1258511) by updating chi
- updated to v4.6.5 with following changes:
* new wwctl overlay info command
* fixed wwctl image import --update option (bsc#1254470)
* cross-arch support for wwclient
* improved IPv6 support
* improved support for bonded interfaces
* renamed debian.interfaces overlay to ifupdown
* new systemd-networkd overlay
* warewulf-dracut fixes, including "provision-to-disk" fixes
- default to dnsmasq instead of dhcpd and tftp
Multiple security issues affecting gvim were fixed in the gvim-9.2.0530-1.1 package on the GA media of openSUSE Tumbleweed. These vulnerabilities have been addressed by the SUSE Product Security Team. No specific affected versions or detailed technical information are provided.
This update for webkit2gtk3 fixes the following issues
Update to version 2.52.4:
- CVE-2026-28847: processing maliciously crafted web content may lead to an unexpected process crash or arbitrary code
execution due to a heap buffer overflow (bsc#1267506).
- CVE-2026-28883: processing maliciously crafted web content may lead to an unexpected process crash due to a use-after-
free issue (bsc#1267507).
- CVE-2026-28901: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267508).
- CVE-2026-28902: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267509).
- CVE-2026-28903: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267510).
- CVE-2026-28904: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267511).
- CVE-2026-28905: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267512).
- CVE-2026-28907: processing maliciously crafted web content may prevent Content Security Policy from being enforced due
to improper input validation (bsc#1267513).
- CVE-2026-28942: processing maliciously crafted web content may lead to an unexpected crash due to use-after-free
(bsc#1267514).
- CVE-2026-28946: processing maliciously crafted web content may lead to an unexpected crash due to a use-after-free
(bsc#1267515).
- CVE-2026-28947: rocessing maliciously crafted web content may lead to an unexpected crash due to a use-after-free
(bsc#1267516).
- CVE-2026-28953: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267517).
- CVE-2026-28955: processing maliciously crafted web content may lead to an unexpected process crash due to improper
memory handling (bsc#1267518).
- CVE-2026-28958: an app may be able to access sensitive user data due to improper data protection (bsc#1267519).
- CVE-2026-43658: processing maliciously crafted web content may lead to an unexpected crash due to improper memory
handling (bsc#1267520).
- CVE-2026-43660: processing maliciously crafted web content may prevent Content Security Policy from being enforced due
to issues with logic (bsc#1267521).
Changes for webkit2gtk3:
+ Add support for half-width fonts.
+ Improve content filter compilation by avoiding file copies.
+ Improve handling of out of disk space conditions when the
NetworkProcess tried to write data in caches.
+ Improve how the CMake build system checks whether libatomic is
required.
+ Fix painting scrollbars when their width changes.
+ Fix playback of certain YouTube videos with low frame rates.
+ Fix webkit://gpu not working in systems where neither
libGL.so.1 nor libOpenGL.so.0 are available.
+ Fix the build with librice 0.4 or newer when the GStreamer
WebRTC backend is enabled at build configuration time.
+ Fix the build with USE_GSTREAMER_WEBRTC=OFF.
+ Fix the build with USE_GBM=OFF.
+ Fix several crashes and rendering issues.
+ Security fixes: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, CVe-2026-43660.
+ Changes in version .52.3;
+ Add support for the "scrollbar-color" CSS property.
+ Fix some emoji glyphs being rendered as missing glyph boxes.
+ Fix JavaScriptCore crashes on architectures other than x86_64.
+ Fix the build on s390x.
+ Changes in version 2.52.2:
+ Improve handling of real-time threads.
+ Fix scrollbar rendering glitches visible in some GPU
configurations.
+ Fix V4L2 hardware accelerated media codecs now working due to
overly restrictive sandbox device access rules.
+ Fix leak of bitmap images in
webkit_favicon_database_get_favicon_finish().
+ Fix the build with USE_GTK4=OFF.
A security update for cosign addresses CVE-2026-39395, which involves incorrect attestation verification caused by malformed payloads or mismatched predicate types. This vulnerability could affect the integrity of attestation processes. The update also includes a non-security version upgrade to 3.0.5. The severity of this issue is assessed as medium.
A vulnerability (CVE-2026-4948) in firewalld allows a local unprivileged user to modify the firewall state due to improper authorization of two runtime D-Bus setters. This issue affects certain versions of firewalld and has been assigned a medium severity with a CVSS score of 5.5. Red Hat has released an update for firewalld in Red Hat Enterprise Linux 10.2 and later that addresses this flaw.
This update for mutt fixes the following issues
- CVE-2026-43859: `strfcpy` used instead of `memcpy` for the IMAP `auth_cram` MD5 digest (bsc#1263897).
- CVE-2026-43860: truncation of `hash_passwd` by one byte for IMAP `auth_cram` MD5 digest (bsc#1263896).
- CVE-2026-43861: missing check for `\0` in `url_pct_decode` (bsc#1263895).
- CVE-2026-43862: mishandling of the `imap_auth_gss` security level (bsc#1263894).
- CVE-2026-43863: infinite loop in `data_object_to_stream` in `crypt-gpgme.c` (bsc#1263893).
- CVE-2026-43864: NULL pointer dereference in function `show_sig_summary` (bsc#1263892).
This security update for Avahi fixes two vulnerabilities that can cause the avahi-daemon to crash, resulting in denial of service. One vulnerability is a reachable assertion failure in the transport_flags_from_domain function. The other involves unsolicited mDNS responses containing a recursive CNAME record. Both issues can cause the daemon to crash and disrupt service.
This update for postfix fixes the following issue
- CVE-2026-43964: buffer overread and process crash via an enhanced status code that lacks text after the third number
(bsc#1264062).
A security update for perl-Config-IniFiles addresses CVE-2026-11527, which involves OS command injection and file overwrite vulnerabilities via a two-argument open() call of the -file argument in the _make_filehandle function. This vulnerability could allow an attacker to execute arbitrary commands or overwrite files. The issue is recognized by the SUSE Product Security Team and classified as high severity. No specific affected versions or patch details are provided in the available data.
This security update for rpcbind addresses multiple issues including a stack buffer overflow in rpcinfo, unauthenticated oversized allocation in rpcbind, and several memory leaks. It also introduces various hardening options and updates to configuration and documentation. The update corresponds to rpcbind version 1.2.9.
This security update for rpcbind addresses multiple issues including a stack buffer overflow in rpcinfo's rpcbaddrlist(), unauthenticated oversized allocation in PMAPPROC_CALLIT decode, and several memory leaks. Additional improvements include hardening options in systemd service files and configuration relocations. The update corresponds to rpcbind version 1.2.9.
This security update for libexif addresses multiple vulnerabilities related to integer underflow and overflow in the decoding of MakerNotes metadata. The issues include buffer overwrite, information disclosure, crashes, and denial of service. These vulnerabilities affect specific SUSE libexif packages and architectures. The severity is assessed as medium based on the described impacts.
A security update for dnsdist addresses multiple vulnerabilities including injection of HTML content, CORS misconfiguration leading to information disclosure, out-of-bounds reads and writes, denial of service via excessive memory allocation or crafted queries, use-after-free conditions, and input validation issues in the internal webserver. The update fixes these issues by upgrading dnsdist to version 1.9.13.
This security update for perl-DBI addresses two vulnerabilities affecting versions prior to 1.648. The first vulnerability (CVE-2026-9698) involves saving errors in a limited-sized buffer, and the second (CVE-2026-10879) involves a heap overflow triggered by SQL statements with more than 9 binders. Both vulnerabilities can cause memory corruption or instability in applications using affected versions of perl-DBI.
Pallets Click versions 8.3.2 and below contain a command injection vulnerability in the click.edit() function. This flaw allows attackers to execute arbitrary operating system commands from an unprivileged account. A security update addressing this issue is available. The vulnerability has been rated with medium severity. There are no known exploits in the wild at this time.