An integer overflow vulnerability (CVE-2026-42046) exists in the canvas import functionality of libcaca. This flaw may allow an attacker to cause a controlled heap out-of-bounds write. The issue is addressed by a security update from the SUSE Product Security Team. No specific affected versions or patch details are provided. No known exploits in the wild have been reported.
A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML parameters could allow remote attackers to break out of an image, and execute e.g. malicious containers.
A security update for perl-Compress-Raw-Zlib addresses multiple issues including a fix related to CVE-2026-3381. The update involves upgrading the perl-Compress-Raw-Zlib package to version 2.222, which includes security fixes and other improvements. The CVE-2026-3381 vulnerability is associated with the underlying zlib 1.3.2 library. No specific affected versions are stated in the provided data.
This security update for perl-Cpanel-JSON-XS addresses multiple issues including fixes for CVE-2025-40929 related to overflow with overlong numbers, and other bugs affecting JSON encoding and decoding. The update improves handling of malformed numbers, fixes memory corruption and type confusion vulnerabilities, and aligns behavior with JSON::PP. The update is critical due to the nature of the overflow vulnerability and other memory-related fixes.
This update for zypper, libzypp, libsolv fixes the following issues:
Changes in zypper:
Update to 1.14.98:
- Transactional systems: Delegate rw-commands to
transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)
On a transactional system where the root filesystem is mounted
read-only, zypper commands that modify the system cannot be
executed directly.
If the system provides a transactional-wrapper utility, zypper
will automatically attempt to invoke it. The wrapper
transparently executes the zypper command within a new, writable
snapshot and manages the lifecycle of that snapshot based on the
command's exit status.
On transactional systems lacking a transactional-wrapper, users
must manually invoke specialized tools -such as
transactional-update- to install, update, or remove software.
- Add --filter-version-change to zypper lu.
Adds filtering by version change significance to reduce noise in
update listings. Supports levels: rebuild (hides rebuild-only
changes) and package (hides all release-only changes).
- Autorefresh ris-services the way as plugin-services (bsc#1246504)
It's actually wrong to treat service refreshes different
depending on the service type. For the purpose of a service it
makes no difference how the data about the repos to use are
acquired.
Changes in libzypp:
Updated to 17.38.13:
- A .repo files "path=" entry must not refer to a location
outside the repo (bsc#1267874, CVE-2026-44942)
A "path=" entry may solely denote a sub-directory of the baseurl
where the metadata are located. A relative path trying to access
data outside the baseurl is reported and sanitized.
- Repo "keyhint" must denote a filename, no path (bsc#1267426,
CVE-2026-44941)
- Fix potential crash on malformed or malicious repository
metadata (fixes #740)
- Repo metadata: discard entries referring to a location outside
the repo (bsc#1259802, CVE-2026-25707)
Mirroring those data locally would refer to a location outside
the repo's local cache directory. Those data entries are reported
and discarded.
- zypp.conf: Allow [env] section to add environment variables.
This feature is designed to enable environment-specific settings
or debugging options over an extended period. See zypp.conf(5).
- Prevent configured scripts from escaping the sigcheck directory
(bsc#1265223, CVE-2026-44933)
- StringV: guard hasPrefix/hasPrefixCI against reading past the
view end (fixes #735)
- Mandatory signature verification plugin support (PED#11922)
- Fix purge-kernel -rc kernel handling (bsc#1239718)
- Explicitly_set_pool_DISTTYPE_RPM (fixes #726)
- Check for trusted key updates when updating the general keyring
(bsc#1259706)
- Support multiple MirroredOrigin authorities (bsc#1253193)
- Workaround doxygen bug: doxygen/doxygen#12057
- libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842)
Changes in libsolv:
Updated to 0.7.39:
- fix solv_chksum_free segfault when called with a NULL pointer
- made repo_add_solv more robust against corrupt files
[bsc#1265935] [CVE-2026-9149]
- fix potential buffer overflow when verifying EdDSA signatures
[bsc#1266039] [CVE-2026-48863]
- added limit checks in multiple places to catch overflows
- reduce the size of the language id cache
- fixed Debian canon selection
- fixed dbpath detection in repo_rpmdb_librpm
- reduced stack usage in repo page compression (needed for musl)
- fix parsing of sha512 checksums in debian repositories
[bsc#1265938] [CVE-2026-9150]
- improve speed of dirpool_add_dir makeing parsing of filelists.xml
twice as fast
- fix parsing of recommends in the old Mandriva synthesis format
PyJWKClient in the kimi-cli library allows fetching JSON Web Key Sets (JWKS) from URLs with schemes beyond HTTP and HTTPS, including file://, ftp://, and data:. This can lead to server-side request forgery (SSRF) on local files and other protocols. An attacker who can influence the jku URL and write to a local file path can forge JWT tokens that the application accepts as valid. The vulnerability affects PyJWT versions 2.11.0 and 2.12.1 and likely earlier versions. A fix is available that restricts allowed URL schemes to HTTP and HTTPS.
This update for unbound fixes the following issues
- CVE-2026-32792: Packet of death with DNSCrypt (bsc#1265583).
- CVE-2026-33278: Possible remote code execution during DNSSEC validation (bsc#1265587).
- CVE-2026-40622: "Ghost domain name" variant (bsc#1265581).
- CVE-2026-41292: Parsing a long list of incoming EDNS options degrades performance (bsc#1265580).
- CVE-2026-42534: Jostle logic bypass degrades resolution performance (bsc#1265585).
- CVE-2026-42923: Degradation of service with unbounded NSEC3 hash calculations (bsc#1265589).
- CVE-2026-42944: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (bsc#1265578).
- CVE-2026-42959: Crash during DNSSEC validation of malicious content (bsc#1265586).
- CVE-2026-42960: Possible cache poisoning attack while following delegation (bsc#1265588).
- CVE-2026-44390: Unbounded name compression in certain cases causes degradation of service (bsc#1265584).
- CVE-2026-44608: Use after free and crash in RPZ code (bsc#1265582).
This update for java-1_8_0-ibm fixes the following issues
- CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).
- CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).
- CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495).
- CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496).
- CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).
- CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).
- CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261)
Changes for java-1_8_0-ibm:
- Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.
A security update for perl-Crypt-PasswdMD5 addresses a weakness by replacing the use of the cryptographically weak rand() function with the stronger Crypt::URandom::urandom(). This update corresponds to version 1.43 and fixes CVE-2026-6659. The update is classified as a security upgrade by the SUSE Product Security Team.
A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request to that same host bypasses the TLS requirement and instead transmit data unencrypted.
Multiple security vulnerabilities have been addressed in libheif with the release of version 1.23.0. These include heap buffer over-reads, out-of-bounds reads and writes, integer overflows, infinite loop denial-of-service, null pointer dereferences, and information disclosure issues. The vulnerabilities arise from malformed or crafted HEIF image files and affect various components such as overlay compositing, sample duration lookup, mask image decoding, and metadata parsing. The update also includes new API functions and other feature enhancements.
Multiple security issues affecting the libopenvswitch-3_7-0 package for openSUSE Tumbleweed on the aarch64 architecture have been addressed in version 3.7.1-33.1. The fixes are included in the general availability release media. The severity of these issues is assessed as medium. No CVSS score is provided. No known exploits are reported in the wild.
This update for MozillaFirefox fixes the following issues
- Update to Firefox Extended Support Release 140.11.0 ESR MFSA 2026-48 (bsc#1265212).
MFSA 2026-48:
- CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component.
- CVE-2026-8391: Other issue in the JavaScript Engine component.
- CVE-2026-8401: Sandbox escape in the Profile Backup component.
- CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component.
- CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component.
- CVE-2026-8949: Integer overflow in the Widget: Win32 component.
- CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component.
- CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access APIs component.
- CVE-2026-8954: Incorrect boundary conditions, integer overflow in the Audio/Video component.
- CVE-2026-8955: Privilege escalation in the DOM: Workers component.
- CVE-2026-8956: Integer overflow in the Networking: JAR component.
- CVE-2026-8957: Privilege escalation in the Enterprise Policies component.
- CVE-2026-8958: Information disclosure, sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
- CVE-2026-8961: Spoofing issue in the Form Autofill component.
- CVE-2026-8962: Mitigation bypass in the DOM: Security component.
- CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component.
- CVE-2026-8970: Privilege escalation in the Security component.
- CVE-2026-8974: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151.
- CVE-2026-8975: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151.
This update for MozillaFirefox fixes the following issues
Updated to Firefox Extended Support Release 140.10.2 ESR (bsc#1264378,MFSA 2026-41):
- CVE-2026-8090: Use-after-free in the DOM: Networking component.
- CVE-2026-8091: Incorrect boundary conditions in the Audio/Video: Playback component.
- CVE-2026-8092: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2.
- CVE-2026-8094: Other issue in the WebRTC component.
An attacker with network-level access between the SUSE Virtualization
and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it
to bypass TLS as a security control.
Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
A security update for the SUSE Linux Enterprise 15 SP5 kernel addresses multiple vulnerabilities across various kernel subsystems. The update fixes issues including out-of-bounds writes, double free errors, and improper handling in networking, RDMA, DRM, and SMB client components. These vulnerabilities could potentially allow attackers to compromise system integrity or cause denial of service. The update is available and should be applied to affected versions to mitigate these risks.