SUSE Product Security Team vulnerabilities and threats

This update for libsoup fixes the following issues: - CVE-2025-11021: Fixed out-of-bounds read in Cookie Date Handling of libsoup HTTP Library (bsc#1250562). - CVE-2026-0719: Fixed stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399). - CVE-2026-0716: Fixed improper bounds handling may allow out-of-bounds read (bsc#1256418).

This security update for jasper addresses three vulnerabilities fixed in version 4.2.8. The fixes include resolving a bug in the JPC decoder that could cause bad memory accesses when debug level is high, adding missing range checks on coding parameters in the JPC encoder, and adding a check for a missing color component in the jas_image_chclrspc function. These issues could potentially lead to memory safety problems or incorrect image processing.

This update for glibc fixes the following issues: Security fixes: - CVE-2025-0395: Fixed buffer overflow in the assert() function (bsc#1236282). - CVE-2026-0861: Fixed inadequate size check in the memalign suite may result in an integer overflow (bsc#1256766). - CVE-2026-0915: Fixed uninitialized stack buffer used as DNS query name when net==0 in _nss_dns_getnetbyaddr_r (bsc#1256822). - CVE-2025-15281: Fixed uninitialized memory may cause the process abort (bsc#1257005). Other fixes: - NPTL: Optimize trylock for high cache contention workloads (bsc#1256436)

A security update for OpenVPN addresses CVE-2025-13086, which involves improper validation of source IP addresses that could lead to a denial of service (DoS) condition. The update fixes this vulnerability to prevent potential service disruption.

This security update addresses multiple vulnerabilities in the SUSE elemental-register and elemental-toolkit components by updating to elemental-register 1.8.1 and elemental-toolkit 2.3.2. The updates include bumps to dependencies such as github.com/rancher-sandbox/go-tpm and golang.org/x/crypto, which fix several CVEs including CVE-2025-22872, CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, and CVE-2025-58190. No specific affected versions are provided. No CVSS score is available, but the severity is assessed as high.

An update to cloud-init version 25.1.3 addresses multiple issues including fixes for vulnerabilities CVE-2024-6174 and CVE-2024-11584. The update also removes an unnecessary test dependency and corrects a dependency replacement. No specific affected versions prior to this update are stated. The vulnerabilities are rated as high severity but no CVSS score is provided.

This update for python-python-multipart fixes the following issues: - CVE-2026-24486: Fixed non-default configuration options can lead to path traversal (bsc#1257301).

This security update for the ucode-amd package addresses multiple updates to AMD CPU microcode and related firmware files. The updates include several revisions to the AMD CPU microcode and corrections to documentation regarding minimum revisions. No specific vulnerability details or exploitation methods are provided. The update is classified as high severity based on the vendor's assessment.

A security update for python-h2 addresses CVE-2025-57804, which is an HTTP Request Smuggling vulnerability caused by illegal characters in headers. This vulnerability has been fixed by the SUSE Product Security Team. No specific affected versions are provided. The severity is assessed as medium.

This update for python-FontTools fixes the following issues: - CVE-2025-66034: Fixed arbitrary file write vulnerability that could lead to remote code execution (bsc#1254366).

This update for ImageMagick fixes the following issues: - CVE-2025-65955: Fixed use-after-free/double-free in ImageMagick (bsc#1254435) - CVE-2025-66628: Fixed Integer Overflow leading to out of bounds read in ImageMagick (32-bit only) (bsc#1254820) - CVE-2025-68618: Fixed that reading a malicious SVG file may result in a DoS attack (bsc#1255821) - CVE-2025-68950: Fixed check for circular references in mvg files may lead to stack overflow (bsc#1255822) - CVE-2025-69204: Fixed an integer overflow can lead to a DoS attack (bsc#1255823)

A security update for cockpit-subscriptions addresses a prototype pollution vulnerability in the js-yaml library. The issue, tracked as CVE-2025-64718, was fixed in version 12.1 of cockpit-subscriptions. The vulnerability is classified with medium severity. No CVSS score is provided.

A vulnerability in PHP versions 8.1 before 8.1.33, 8.2 before 8.2.29, 8.3 before 8.3.23, and 8.4 before 8.4.10 allows null byte characters in hostnames passed to functions like fsockopen(). This can cause inconsistent hostname parsing by other functions such as parse_url(), potentially leading to security issues if user code relies on these functions for access control. Red Hat has issued security updates addressing this issue.

This update for php8 fixes the following issues: Version update to 8.4.16: Security fixes: - CVE-2025-14177: getimagesize() function may leak uninitialized heap memory into the APPn segments when reading images in multi-chunk mode (bsc#1255710). - CVE-2025-14178: heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE (bsc#1255711). - CVE-2025-14180: null pointer dereference in pdo_parse_params() function when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled (bsc#1255712). Other fixes: - php8 contains Directories owned by wwwrun but does not require User. (bsc#1255043)

A heap buffer overflow vulnerability exists in the PHP array_merge() function in versions prior to 8.1.34, 8.2.30, 8.3.29, 8.4.16, and 8.5.1. The flaw occurs due to an integer overflow in element count precomputation when merging packed arrays with a total element count exceeding 32-bit limits or HT_MAX_SIZE. This can lead to memory corruption or crashes, affecting server integrity and availability. Red Hat has released security updates addressing this issue in their PHP packages for Red Hat Enterprise Linux 9.6 Extended Update Support.

This update for python-jaraco.context fixes the following issues: - CVE-2026-23949: Fixed malicious tar archives may lead to path traversal (bsc#1256954).

A security update for BIND addresses CVE-2025-13878, which fixes incorrect length checks for BRID and HHIT DNS record types. The update also includes various feature improvements and bug fixes related to DNSSEC, catalog zones, and DNS-over-TLS. No known exploits are reported in the wild. The update is part of BIND release 9.20.18.

This update for python-virtualenv fixes the following issues: - CVE-2026-22702: Fixed local attacker can redirect file operations via TOCTOU race condition (bsc#1256458).

This update for python-marshmallow fixes the following issues: - CVE-2025-68480: Fixed possible DoS when using Schema.load(data, many=True) (bsc#1255473).