This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues:
The following security issues were fixed:
- CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1275458).
- CVE-2026-64561: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Zapscape) (bsc#1273232).
- CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing (SCTPhantom) (bsc#1274074).
- CVE-2026-68138: net/sched: serialize qdisc_rtab_list against concurrent get/put (bsc#1274942).
This update for gnome-shell fixes the following issue:
- CVE-2026-91786: missing dimension validation when processing icons from a remote search provider via D-Bus can lead to
an out-of-bounds read (bsc#1280619).
A high severity vulnerability exists in libsoup's WebSocket handling where the ::pong signal emits a GByteArray pointer instead of the expected GBytes, causing type confusion. This flaw can lead to heap corruption or crashes when applications connect handlers expecting GBytes and receive a crafted Pong frame. The vulnerability is remotely triggerable without authentication. Red Hat has released an important security update for Red Hat Enterprise Linux 9 addressing this and related heap buffer overflow issues in libsoup.
This update for perl-Protocol-HTTP2 fixes the following issue:
- CVE-2026-16028: memory exhaustion leading to denial of service due to closed streams never being removed by
`stream_state` from the connection stream table (bsc#1279629).
This update for php-composer2 fixes the following issues:
- CVE-2026-59944: path traversal and link following issue can make files world readable and executable (bsc#1279898).
A high severity security update has been issued for PostgreSQL by the SUSE Product Security Team addressing multiple vulnerabilities including CVE-2026-14662. This update corresponds functionally to Red Hat's advisory RHSA-2026:69924. The vulnerabilities relate to integer overflow issues (CWE-190) and affect various SUSE PostgreSQL versions. A patch is available to remediate these issues.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193)
* freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVE-2026-91949)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for Chromium addresses multiple vulnerabilities including buffer overflows, use-after-free errors, out-of-bounds writes, missing or incorrect authorization, race conditions, information leaks, improper input validation, and UI misrepresentations across various components such as ANGLE, GPU, ServiceWorker, DevTools, V8, and others. These issues are fixed in Chromium version 154.0.8037.57. The update resolves a wide range of security flaws that could impact the browser's stability and security.
A security update for radare2 version 6.2.2 addresses multiple vulnerabilities including denial of service, command injection, out-of-bounds reads, heap overflows, and integer overflows. The update fixes issues such as validation errors in file parsers, infinite loops, and use-after-free conditions. These vulnerabilities collectively pose critical risks to the integrity and availability of the software. No specific affected versions are provided in the data. The update includes various fixes improving analysis, core functionality, and plugin behavior.
This update for expat fixes the following issues:
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a
denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,
XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).
- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within
handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer
overflows (bsc#1268573).
- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code
execution (bsc#1275096).
- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory
corruption, and application crashes (bsc#1275096).
- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary
code execution (bsc#1275096).
- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and
application crashes (bsc#1275096).
- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial
of service (bsc#1275096).
- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes
(bsc#1275096).
- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and
arbitrary file write conditions (bsc#1275096).
- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information
disclosure, and potential code execution (bsc#1275096).
- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and
denial of service (bsc#1275096).
- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free
conditions and arbitrary code execution (bsc#1275096).
- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the
storeAtts() function in xmlparse.c (bsc#1275732).
- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger
memory corruption (bsc#1275915).
- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via
crafted X (bsc#1275860).
- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).
Changes for expat:
- Updated to version 2.8.4
Multiple security issues were addressed in the libpoppler-cpp3 package version 26.09.0-2.1 for openSUSE Tumbleweed. These vulnerabilities affect numerous specific versions of the package across Ubuntu and SUSE distributions. The issues have been fixed in the updated package release.
Multiple remote code execution vulnerabilities have been identified in the GStreamer streaming media framework, specifically within the gstreamer1-plugins-good package. These include heap-based buffer overflows in MRF and PNG file parsing, and a use-after-free in rtpsbcdepay. These vulnerabilities affect various versions of the package used in Red Hat Enterprise Linux and SUSE distributions. A security update addressing these issues is available.
This security update provides a functional equivalent of RHSA-2026:71387.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:71387.
A stack buffer overflow vulnerability (CWE-121) exists in the rrdtool component of Red Hat Enterprise Linux 10, specifically in the rrdcached handle_request_create() function. This flaw allows local privilege escalation via unbounded DS/RRA arguments. The issue has been addressed by a security update provided by Red Hat. The vulnerability affects multiple architectures and versions of Red Hat Enterprise Linux 10 and related products.
Multiple security vulnerabilities have been identified and fixed in the pcre2 library. These include out-of-bounds reads and writes, integer overflow, incorrect memory free operations, and information disclosure issues. The flaws affect various functions such as pcre2_dfa_match, pcre2_compile_32, and pcre2_serialize_encode. These vulnerabilities can lead to memory corruption and potential information leaks. The update addresses seven distinct CVEs related to these issues.
A denial of service vulnerability (CVE-2026-9499) exists in the Qt software toolkit due to an out-of-bounds read in text codec handling. This affects certain versions of Qt packages used in Red Hat Hardened Images. A security update addressing this vulnerability is available from Red Hat.
SUSE Linux Enterprise 12 SP5 kernel received a security update addressing multiple vulnerabilities across various kernel components including drm, timers, netfilter, Bluetooth, media, ACPI, powerpc, TPM, RAID, IPMI, BPF, networking, and others. These fixes resolve issues such as race conditions, NULL pointer dereferences, use-after-free, buffer overflows, and validation errors. The update mitigates a broad range of security risks affecting kernel stability and security.