Packages changed: MicroOS-release (20260922 -> 20260923) PackageKit (1.3.6 -> 1.4.0) cups-filters2 gzip (1.14 -> 1.15) harfbuzz (14.4.0 -> 14.5.0) hplip (3.26.4 -> 3.26.6) libheif (1.23.4 -> 1.23.5) libinput (1.31.3 -> 1.32) libsolv (0.7.39 -> 0.7.40) libssh libupnp (22.1.0 -> 22.1.2) libzypp (17.38.15 -> 17.38.16) ncurses (6.6.20260912 -> 6.6.20260919) p11-kit (0.26.2 -> 0.26.5) python-tornado6 (6.5.8 -> 6.5.10) rootlesskit (3.1.0 -> 3.2.0) rsync (3.4.3 -> 3.5.1) selinux-policy (20260914 -> 20260923) thin-provisioning-tools (1.3.3 -> 1.3.4) util-linux (2.42.2 -> 2.42.3) util-linux-systemd (2.42.2 -> 2.42.3) === Details === ==== MicroOS-release ==== Version update (20260922 -> 20260923) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== PackageKit ==== Version update (1.3.6 -> 1.4.0) Subpackages: PackageKit-backend-dnf5 libpackagekit-glib2-18 typelib-1_0-PackageKitGlib-1_0 - Update to version 1.4.0: + Backends: - zypp: respect libzypp package locks - Drop unmaintained DNF backend - Various changes/fixes for alpm, dnf5 and eopkg + Bugfixes: - pkgcli: Skip blocked updates in full upgrade too - python: Use a raw string for regex - lib: Tighten the pk-client-helper mainloop spin fix - lib: Prevent mainloop spin in pk-debconf-helper by dispatching on POLLHUP and POLLERR - lib: Close gaps in the public header include guards - Pass daemon config on the command line, so test binaries are identical to production - Refactor, so daemon run in test-mode never touches the host's state - offline-update: Never let a Trigger call disarm or replace an armed trigger - Drop dead error macros for nonexistent types - spawn: Reject stdin-protocol delimiters in caller-supplied strings - Validate a distro-ID in UpgradeSystem for invalid characters + Miscellaneous: - Move the Python backend module to the top level - Flatten the client library into lib/ - Install headers into $includedir/packagekit - Autoformat the source code in (almost) its original style - Add security policy - Drop PackageKit-CVE-2026-19816.patch, PackageKit-zypp-respect-libzypp-package-locks.patch and PackageKit-alias-dnf-to-dnf5.patch: fixed upstream - Rebase PackageKit-remove-polkit-rules.patch - No longer pass -Dlocal_checkout=false to meson: option is no longer supported. - Add PackageKit-CVE-2026-19816.patch: dnf5: Never execute repo-remove for simulated transactions (bsc#1280033, CVE-2026-19816). ==== cups-filters2 ==== - disable-universal-cups-filter : do not use a single, universal CUPS filter executable for all filter functions, see https://github.com/OpenPrinting/cups-filters/discussions/727 which reads (excerpts) "drivers with ... filter chains ... made universal fail ... 2 filters ... which come from ... driver package, but universal only supports ... one single driver filter" ==== gzip ==== Version update (1.14 -> 1.15) - Update to version 1.15: * Bug fixes: - gzip no longer can mistakenly remove the wrong file if some other process simultaneously renames a gzip destination's ancestor. [bug present since the beginning] - gzip -d no longer rejects PKZIP signatures, local header, and data descriptors. These can appear in well-formed streamed zip files. [bug present since the beginning] - gzip diagnostics now quote file names containing unusual characters. [bug present since the beginning] - A use of uninitialized memory on some malformed inputs has been fixed. [bug present since the beginning] - A buffer overflow has been fixed when decompressing an .lzh file after decompressing a .Z file. [bug present since the beginning] - When decompressing an .lzh file, the output is no longer corrupted when an internal bit buffer is not properly cleared. [bug present since the beginning] - When decompressing an .lzh file after another .lzh file, the output is no longer corrupted by the previous file's decoding table. [bug present since the beginning] - gzip --synchronous no longer fails to synchronize unreadable parent directories on platforms like GNU/Linux that have O_PATH, or to synchronize any parent directories on platforms like FreeBSD that have O_SEARCH but not O_PATH. [bug introduced in gzip-1.7] - On old-fashioned or limited platforms lacking mktemp, gzexe, zdiff and znew no longer have a race when creating a temporary file. [bug present since the beginning] + Changes in behavior: - gzip no longer insists on the "C" locale; instead, it follows the typical practice of using the locale specified by the environment. This change, which is needed for file name quoting, can affect the format of floating-point numbers output by gzip's -l and -v options. Diagnostics are still in English, though. - gzip -l now reports "-Inf%" instead of "0.0%" for the infinite compression ratio of an empty file. - znew's -P option is now ignored, with a warning. It was present only to improve performance, and its implementation had too many bugs to be worth supporting. - Add fix-aarch64-build.patch: build: avoid failure to build on linux aarch64. - Drop CVE-2026-41991.patch, CVE-2026-41992.patch and gzip-1.14-s390x-errno.patch: Fixed upstream. - Rebase patches with quilt. ==== harfbuzz ==== Version update (14.4.0 -> 14.5.0) Subpackages: libharfbuzz-gobject0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0 - Update to version 14.5.0: + Update Unicode 18.0 data and script support, including script values for Jurchen, Proto-Cuneiform, and Seal, and the corresponding shaping support. + Add support for VARC table subsetting, including pruning auxiliary data, remapping glyph IDs, and guarding the feature in lean builds. + Add rendering work budgets to the draw and paint APIs and share them across the raster, vector, GPU, and Cairo renderers so nested outline work remains bounded. + Improve performance in set iteration, lookup traversal, and the repacker, and add coverage for new benchmarks and fuzzing seeds + Fix various correctness and robustness issues across the CFF, Graphite, DirectWrite, and repacker code paths, including memory leaks, overflow checks, bounds issues, and malformed-font handling. + Various build, portability, and CI fixes. ==== hplip ==== Version update (3.26.4 -> 3.26.6) Subpackages: hplip-common hplip-cups hplip-driver-hpcups libhplip0 - hpmud.rules: use SYSTEMD_WANTS for firmware upload to USB printers (boo#1274562) * add hpmud.rules-use-SYSTEMD_WANTS-rather-than-RUN.patch - Fix download of propietary plugin for 3.26.6 * add pluginhandler.py-add-fallback-location-for-3.26.6.patch - Update to HPLIP 3.26.6 - Fix hplip CVEs (bsc#1282051): * CVE-2026-91097 (bsc#1281303) * CVE-2026-91098 (bsc#1281304) * CVE-2026-91099 (bsc#1281305) * CVE-2026-91100 (bsc#1281306) * CVE-2026-91101 (bsc#1281307) * CVE-2026-91102 (bsc#1281308) * CVE-2026-91103 (bsc#1281309) * CVE-2026-91105 (bsc#1281310) * CVE-2026-91104 (bsc#1281313) * CVE-2026-91106 (bsc#1281314) - Add support for the following new printers: * HP ScanJet Enterprise Flow N9000 sn1 * HP ScanJet Enterprise Flow 9000 s1 * HP ScanJet Pro 4200 s1 * HP LaserJet Pro 4006dn printer * HP LaserJet Pro 4006dw printer * HP LaserJet Pro 4006n printer * HP LaserJet Pro 4002d printer * HP LaserJet Pro 4007dw printer * HP LaserJet Pro 4007n printer * HP LaserJet Pro 4008d * HP LaserJet Pro 4008dn * HP LaserJet Pro 4008dw * HP LaserJet Pro MFP 4112dw printer * HP LaserJet Pro MFP 4112fdn printer * HP LaserJet Pro MFP 4112fdw printer * HP LaserJet Pro MFP 4113dw printer * HP LaserJet Pro MFP 4113dwg printer * HP LaserJet Pro MFP 4113fdn printer * HP LaserJet Pro MFP 4113fdng printer * HP LaserJet Pro MFP 4113fdw printer * HP LaserJet Pro MFP 4113fdwg printer * HP LaserJet Pro MFP 4114dw * HP LaserJet Pro MFP 4114fdn * HP LaserJet Pro MFP 4114fdw - Remove hp-pkservice - Add compat-fix-shlex.quote-Python-2.7-incompatibility.patch ==== libheif ==== Version update (1.23.4 -> 1.23.5) - update to 1.23.5: * (GHSA-v8qw-hwjv-44hw) Memory exhaustion through a mismatch between the container and the bitstream image size. A crafted image can declare a small size in its ispe property while the bitstream declares a much larger coded frame. The container-level checks used the ispe size, so the oversized bitstream reached the decoder, which allocated a frame buffer for the in-band size before libheif rejected the mismatch. The advisory demonstrated this for AV1 with the libaom backend (a 351-byte AVIF declaring 64x64 but coding up to 27648x27648, allocating hundreds of MB to more than 10 GB), but the same class affects every codec whose real frame size lives in the bitstream. The coded size is now checked against max_image_size_pixels in the codec- independent decode path, before any bytes reach a decoder plugin: all AV1 sequence headers, all HEVC/AVC/VVC SPS NAL units (including those carried in the item data, not only the ones in the configuration record), the JPEG SOF marker and the JPEG 2000 SIZ reference grid are scanned for the largest coded size. (high) * (GHSA-qwpf-5wf7-r996) Heap use-after-free and double free when encoding an image that carries a TAI timestamp, including transcoding a file with an itai property. ImageDescription shallow-copied its raw heif_tai_timestamp_packet pointer, and a temporary in ImageItem::encode_to_bitstream_and_boxes() freed the packet while the item and the source image still held it. The timestamp is now stored by value. (medium) * (GHSA-9c75-9g8r-4728) Memory amplification through a JPEG 2000 pclr box declaring zero palette columns. The entry-count bound was skipped for zero columns, so an 11-byte box allocated 65,535 empty palette entries, and nested j2kH containers could repeat this within the child and nesting limits: a 3 KB file reached about 330 MB RSS, none of it charged to max_total_memory. Zero columns are rejected (ISO/IEC 15444-1 requires 1 to 255), the byte bound is unconditional, and the palette storage is charged to the memory limits. (medium) * (GHSA-r7gr-2xm2-23wf) Heap out-of-bounds read in alpha compositing for uncompressed (unci) images whose colour planes have different bit depths. Op_flatten_alpha_plane read every plane through the sample type of the first colour plane, so an 8-bit blue plane next to 16-bit red and green planes was read with a halved stride past its end, and the bytes ended up in the composited output. ColorState now tracks one bit depth per plane, and the operator declines mixed sample widths at planning time. (medium) * (GHSA-q492-cfcm-895h) The OpenJPEG decoder plugin's pre-decode size check bounded the JPEG 2000 window span (x1-x0)*(y1-y0) but not the absolute reference-grid coordinates, so a codestream with a 17-pixel window on a grid near the 32-bit boundary reached opj_decode(). Against OpenJPEG 2.3.1 this produced a heap-buffer-overflow write inside OpenJPEG (the class of CVE-2020-6851); OpenJPEG 2.5.4 rejects the input. The reference-grid area is now bounded as well. (low) * (GHSA-qfj5-c4pq-q998) Heap out-of-bounds read in the uncompressed encoder when an application attached a separate alpha plane to an image with an interleaved chroma format. The interleaved encoders took their component list from the chroma format (three entries) but decided whether to write alpha from the presence of an alpha plane, and indexed the list at [3]. heif_image_add_plane() now rejects a separate alpha plane on interleaved images, and the encoders derive both decisions from the chroma format. Only reachable through the public API; decoding never produces such an image. (low) * (GHSA-7pwf-qh74-p35w) The caller's heif_security_limits were not applied when parsing a mini box (the MIAF minimized image format) or the av1C/hvcC blob embedded in it; the built-in defaults were used instead. An application that tightened the limits got no enforcement of its max_memory_block_size or max_total_memory on such files. The allocations are bounded by the bytes present in the box, so this could not amplify memory use. (low) ==== libinput ==== Version update (1.31.3 -> 1.32) - Update to release 1.32 * Circular scrolling on circular touchpads (e.g. Panasonic CF-SV1) * New convenience features, e.g. dragging on a touchpad automatically enables a drag lock if the finger near the edge. * On touchpads, disable-while-typing no longer cancels ongoing interactions. * For tablets, we now allow the physical eraser button to be mapped to any button. * `libinput record` now allows a `--no-events` flag. - Delete kill-env.diff (no longer needed, %python3_fix_shebang_path already takes care of it) ==== libsolv ==== Version update (0.7.39 -> 0.7.40) Subpackages: libsolv-tools-base libsolv1 - improve SUSE product link dependency generation if there are multiple release packages for the same product [bsc#1279541] - fix possible segfault in the SUSE namespace dependency generation - bump version to 0.7.39 ==== libssh ==== Subpackages: libssh-config libssh4 - Fix: libssh ignores explicit username in URL if User specified in SSH config (bsc#1279934) * options: do not let config override explicitly-set options * tests: cover config-vs-app-set option precedence * Add patches: - libssh-options-do-not-let-config-override-explicitly-set-options.patch - libssh-tests-cover-config-vs-app-set-option-precedence.patch ==== libupnp ==== Version update (22.1.0 -> 22.1.2) Subpackages: libixml22 libupnp22 - Update to release 22.1.2 * Fix quadratic-time DOM construction in ixmlParseBufferEx() [GHSA-xr5m-v53v-jfq9] - Update to release 22.1.1 * Fix unauthenticated remote crash in SOAP QueryStateVariable handling. [GHSA-7mx2-6v7x-xhv7] ==== libzypp ==== Version update (17.38.15 -> 17.38.16) - BuildRequires: %{libsolv_devel_package} >= 0.7.40 (bsc#1279541) This fix resolves issues in online migrations to SLES 16.1. - version 17.38.16 (35) ==== ncurses ==== Version update (6.6.20260912 -> 6.6.20260919) Subpackages: libncurses6 ncurses-utils terminfo-base - Add ncurses patch 20260919 + revise content/formatting/style of man pages (patches by Branden Robinson) + add overline to ghostty (report by Jared Finder) + review ghostty -TD + add overline to rlogin-color -TD + add null pointer check for stdscr in endwin() when saving keypad mode (patch by Branden Robinson). + remove an adjustment to stdscr in doupdate() when restoring keypad mode (OpenSUSE boo#1281268). ==== p11-kit ==== Version update (0.26.2 -> 0.26.5) Subpackages: libp11-kit0 p11-kit-tools - Update to 0.26.5: * CVE-2026-18938: guard against overflow when decoding nested attributes (bsc#1280702) - Update to 0.26.4: * Build fix [PR#773] * Update translations [PR#743, PR#772] - Update to 0.26.3: * CVE-2026-13757: server: fixed stack exhaustion via unbounded recursion in RPC attribute parsing by enforcing a recursion depth limit (bsc#1269664) * fixed confusing error message when trying to store an existing cert with trust anchor [PR#770] * fixed assert when parsing p11-kit files with value (") [PR#762] * fixed numerous memory management issues [PR#751, PR#753, PR#754, PR#756, PR#758, PR#763, PR#764, PR#765, PR#766, PR#769] * Build and test fixes [PR#746, PR#747, PR#752, PR#755, PR#757, PR#760, PR#761] ==== python-tornado6 ==== Version update (6.5.8 -> 6.5.10) - update to 6.5.10: - tornado.web: The allowed_symlink_directory argument of StaticFileHandler may now be a list of directories instead of just a single directory. This feature has been adjusted to improve compatibility with Jupyter, which would fail to load with Tornado 6.5.9. - 6.5.9: [#] Security fixes - .StaticFileHandler no longer follows symlinks outside of the static root directory. Applications that wish to continue the previous behavior may set the new argument allowed_symlink_directory to the directory (an ancestor of the static root) that should be used for symlink validation. Thanks to Yasha-ops and iaohkut-from-NightWolf-Team for reporting this issue. - curl_httpclient has a new max_body_size argument (default 100MB, same as for simple_httpclient). This limit is enforced on all requests, whether or not streaming_callback is used. curl_httpclient now also controls its memory usage when decompressing response bodies. Thanks to afldl, iaohkut-from-NightWolf-Team, and aoto-tech for reporting this issue. - simple_httpclient now correctly applies the max_body_size limit to responses using HTTP/1.0 format (no Content-Length or Transfer-Encoding). Previously it silently truncated such responses at max_buffer_size instead. Thanks to afldl for reporting this issue. - simple_httpclient now rejects responses that use more than 10 100 Continue responses, which could previously cause stack overflow errors. Thanks to afldl for reporting this issue. - The limit ParseBodyConfig.urlencoded.max_argument is now applied to URL arguments in addition to POST bodies. Thanks to iaohkut-from-NightWolf-Team, afldl, and manus-pi for reporting this issue. ==== rootlesskit ==== Version update (3.1.0 -> 3.2.0) - Update to version 3.2.0: * v3.2.0 * pkg/parent: fix warnSelfIDRanges message * refactor: use `netip.Addr.Next()` instead of `math/big` in `AddIPInt6` * v3.2.0-beta.0+dev * v3.2.0-beta.0 * CI: update Ubuntu (26.04) * CI: avoid AppArmor-confined nslookup with --detach-netns * Fix socket activation with systemd v258 and later * go.mod: github.com/inetaf/tcpproxy v0.0.0-20260515195445-c159a6051109 * go.mod: github.com/insomniacslk/dhcp v0.0.0-20260901064844-234b97448fae * go.mod: golang.org/x/crypto v0.57.0 * CI: update Docker (29.8.0) * CI: update slirp4netns (1.3.5) * CI: update shadow (4.20.2) * Build(deps): Bump golang.org/x/sync from 0.22.0 to 0.23.0 * Build(deps): Bump golang.org/x/sys from 0.47.0 to 0.48.0 * CI: Go 1.26 * pkg/port/portutil: fix `go vet` * ci: fix existing golangci-lint findings * gvisortapvsock: improve incoming and outgoing TCP throughput * feat: support --port-driver=pesto for IPv6 * ci: enforce golanci-lint in CI * Build(deps): Bump github.com/sirupsen/logrus from 1.10.1 to 1.10.2 * Build(deps): Bump github.com/gofrs/flock from 0.13.0 to 0.13.1 * port/builtin: switch from iptables to nft for transparent routing * parent: warn when a subid range contains the own ID * parent: exclude the own UID/GID from the subid ranges * Build(deps): Bump github.com/sirupsen/logrus from 1.10.0 to 1.10.1 * chore: apply go fmt ./... * fix(pasta): assign a fixed IPv6 address, gateway, and DNS to the netns * Build(deps): Bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 * docs: refresh port driver benchmark table * v3.1.0+dev ==== rsync ==== Version update (3.4.3 -> 3.5.1) - Update to 3.5.1 - Protocol: - The protocol number was changed to 33. - Bug fixes: - Fixed several path-handling regressions from 3.5.0. Explicit sender paths can again traverse symlinked ancestors without weakening confinement of paths found during recursive scans. Local and remote-shell `--files-from` paths are handled as operator-supplied paths rather than paths beneath the transfer root. - Fixed access to `/dev/stdin`, `/dev/stdout`, `/dev/stderr` and `/dev/fd/N` when they refer to pipes or descriptors inside user namespaces. Reading batch data from a FIFO or process substitution works again. - Restored `--max-alloc=0` as a spelling for the parser's maximum allocation limit rather than disabling that limit. - Fixed restricted-root paths in `rrsync` and detection of an inetd connection when a daemon is started with a local socket on standard input, as can happen under ADB without a PTY. - Allowed `--contimeout` for daemon connections made through `--rsh` without applying it to ordinary remote-shell transfers. - Tightened validation of partial-directory state and alternate-destination paths on the receiver. An alternate-destination leaf symlink is no longer followed as a basis file. - Fixed undefined shifts in the bundled zlib code and a FreeBSD amd64 build failure involving the assembly and SIMD objects. - Enhancements: - Added support for internationalised domain names when the required library is available at build time. - Added the number of 4 KiB logical blocks touched to `--stats`. This counts distinct logical file regions written by the receiver, not physical disk blocks or disk I/O. It is reported when both peers negotiate protocol 33. - Build and tests: - `install-strip` now honours `STRIP` including during cross-compilation. - Updated platform tests and fleet-test coverage for the 3.5.0 fixes. - Activate IDN (internationalised domain name) support by adding BuildRequires: libidn2-devel - Drop rsync-fix-protected-regultar-test.patch (already upstream) - Fix test suit protected-regular test * Added rsync-fix-protected-regultar-test.patch - explicitly require python-rpm-macros to not rely on any indirect requires. Fixes build on SLE 16.0 - Update to 3.5.0 - Security update (bsc#1269060, rsync 3.5.0 security backports): - CVE-2026-53783, bsc#1269041: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist) - CVE-2026-53784, bsc#1269042: Daemon module-root chdir escape under "use chroot = no" - CVE-2026-53785, bsc#1269043: --relative implied-parent creation escapes the destination tree - CVE-2026-53786, bsc#1269044: Daemon --filter merge file bypasses the module filter list - CVE-2026-53788, bsc#1269046: Daemon name-converter accepts newline-bearing names into its line protocol - CVE-2026-53789, bsc#1269047: Malicious sender expands --delete scope by reclassifying an implied parent - CVE-2026-53790, bsc#1269048: Command / argument injection via unquoted peer- or host-controlled values - CVE-2026-53791, bsc#1269049: PROXY-protocol mode lets a direct client spoof the daemon's source address - CVE-2026-53792, bsc#1269050: Receiver-supplied zero checksum block length drives sender matching negative - CVE-2026-53793, bsc#1269051: Chroot "/./" inner-module escape via a parent-component symlink - CVE-2026-53794, bsc#1269052: Remote peer disables the per-allocation sanity cap via --max-alloc=0 - CVE-2026-53795, bsc#1269053: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link confinement - CVE-2026-53796, bsc#1269054: Non-daemon receiver destination-chdir symlink race (TOCTOU) - CVE-2026-53797, bsc#1269055: Sender source-tree parent-component symlink race -> out-of-tree disclosure - CVE-2026-53798, bsc#1269045: Daemon name-converter empty response maps an unknown name to uid/gid 0 - CVE-2026-53799, bsc#1269056: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local privilege escalation) - CVE-2026-53800, bsc#1269057: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary file deletion outside the source tree - CVE-2026-53801, bsc#1269058: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-tree disclosure - CVE-2026-53802, bsc#1269039: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files - CVE-2026-53803, bsc#1269040: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths - CVE-2026-70463, bsc#1273430: "auth users" ignores documented comma-only parsing, silently skipping a deny/read-only rule - CVE-2026-70462, bsc#1273431: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (signed overflow, and a non-positive value) - CVE-2026-70461, bsc#1273432: Peer-driven one-byte heap out-of-bounds write in add_implied_include() - CVE-2026-70460, bsc#1273433: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving via an in-module symlink - CVE-2026-70459, bsc#1273434: Per-connection daemon child crash from a crafted first incremental file list with a non-directory transfer root - CVE-2026-70458, bsc#1273435: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H - CVE-2026-70457, bsc#1273436: Attacker-chosen-offset write in parse_size_arg() error formatting - CVE-2026-70456, bsc#1273437: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on maxargs - CVE-2026-70454, bsc#1273439: rsync-ssl establishes an unauthenticated TLS connection (no CA verification; no stunnel hostname binding) - CVE-2026-70453, bsc#1273440: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain - CVE-2026-70464, bsc#1273429: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module - CVE-2026-70455, bsc#1273438: Peer-controlled Zstandard worker exhaustion on an rsync daemon - CVE-2026-70452, bsc#1273441: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the host it was meant to block - Rejected CVEs (duplicates, resolved to canonical CVEs above): - CVE-2026-44507, bsc#1271931: duplicate of CVE-2026-43617 - CVE-2026-44508, bsc#1271932: duplicate of CVE-2026-43618 - CVE-2026-44509, bsc#1271933: duplicate of CVE-2026-43619 - CVE-2026-44510, bsc#1271934: duplicate of CVE-2026-43620 - Security update: - CVE-2025-10158, bsc#1254441: Out of bounds array access via negative index - CVE-2026-41035, bsc#1262223: count of entries mismatch can lead to a use-after-free - CVE-2026-43617, bsc#1264515: Authorization Bypass via Hostname Resolution - CVE-2026-29518, bsc#1264512: Integer Overflow Information Disclosure - CVE-2026-43619, bsc#1264514: Symlink Race Condition via Path-Based Syscalls - CVE-2026-43620, bsc#1264513: Out-of-Bounds Array Read via recv_files() - CVE-2026-45232, bsc#1265296: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing - SECURITY FIXES: - This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. ... changelog too long, skipping 443 lines ... don't assume python3 is the binary name. use sys.executable. ==== selinux-policy ==== Version update (20260914 -> 20260923) Subpackages: selinux-policy-targeted - Update to version 20260923: * Add common criteria banner labels (bsc#1282303) - Fail cleanoldsepoldir.service with a warning instead of an error when snapper is not installed, as snapper is not installed by default in public cloud images (bsc#1271814) ==== thin-provisioning-tools ==== Version update (1.3.3 -> 1.3.4) - Update to version 1.3.4: * thin_dump: fix panics when btree nodes point beyond the end of the metadata device * thin_check, cache_check and the other tools: fix overflows in IoEngine block range tracking and offset calculation, which caused panics or reads at the wrong offset on damaged metadata * fix an integer overflow in space map boundary checks * remove redundant leaf insertions in LeafWalker * update bundled dependencies to their latest compatible releases - Drop thin-provisioning-tools-tests-clap-single-alias.patch: merged upstream, which now also requires clap 4.6. - Refresh the vendored Rust crates: 48 changed version, zlib-rs added, windows_i686_gnullvm dropped. - Re-derive License from the crates actually linked into the shipped binary: unchanged. zlib-rs is vendored but stays unlinked, since flate2 still defaults to miniz_oxide, so no Zlib obligation is taken on. ==== util-linux ==== Version update (2.42.2 -> 2.42.3) Subpackages: libblkid1 libfdisk1 libmount1 libsmartcols1 libuuid1 - Update to version 2.42.3: * Security fixes: * CVE-2026-76642 - mount(8) post-mount hooks execute after helper failure. When an external mount. helper exits nonzero, post-mount hooks (X-mount.idmap, X-mount.owner/group/mode) still execute as if the mount had succeeded, allowing privileged operations on the pre-existing target filesystem (bsc#1274864, bsc#1278349). * CVE-2026-78410 - mount(8) TOCTOU race on source path. In restricted (SUID, non-root) mode, the source path is canonicalized with realpath() as euid=0, following symlinks through user-writable directories. Additionally, open_tree() follows symlinks in intermediate path components. A local attacker can redirect a privileged mount or post-mount ownership change to an arbitrary path (bsc#1274864, bsc#1278347). * CVE-2026-78409 - mount(8) X-mount.subdir symlink escape. The open_tree() call used to open a subdirectory on a detached mount follows symlinks in intermediate path components, allowing escape from the detached tree (bsc#1274864, bsc#1278346). * CVE-2026-78408 - nsenter(1), unshare(1) file descriptor leak. File descriptors in nsenter and unshare were not created with O_CLOEXEC, potentially leaking them across exec. Added O_CLOEXEC as defense in depth (bsc#1274864, bsc#1278348). * wall(1), write(1) - hostname escape sequence injection. The CVE-2024-28085 fix sanitized only message bodies; the banner headers still interpolated the system hostname without sanitization. An unprivileged user can inject terminal escape sequences via a user namespace hostname. Additional fix for CVE-2024-28085. Reported-by: Skyler Ferrante * agetty: fix spurious issue file reprinting on reload * col: * guard c_width sign before size_t cast in BS branch * fix cur_col underflow on backspace over a wide char * disk-utils: fix memory leak in execute function * hexdump: stop after stdout write errors * libblkid: * befs fix possible load of misaligned address * befs fix possible too large shift * dos fix 32-bit overflow in partition start/size [coverity CID 503517, 503518] * (iso9660) fix out-of-bounds read of root dir record * libfdisk: fix OOM on GPT with huge partition entries array * libmount: * skip post-mount hooks after failed mount helper [CVE-2026-76642] * pin source path with openat2() for restricted users [CVE-2026-78410] * restrict source path canonicalization for non-root users [CVE-2026-78410] * fix X-mount.subdir symlink following on detached tree [CVE-2026-78409] * reuse existing act fd in mnt_update_start on ro retry * properly end act file in mnt_free_update * don't ignore "/" target in mount --all when target prefix is set * lscpu: * remove mmu reference not available in stable/v2.42 * add NULL guards for RISC-V ISA functions [coverity CID 503785] * mbsalign: check remaining buffer space before writing hex escapes * more: fix out-of-bounds write in get_line() on invalid multibyte input * nsenter, unshare: add O_CLOEXEC to all open() calls [CVE-2026-78408] * pg: fix out-of-bounds access past wbuf on a trailing tab * unshare: Fix --map-auto regression * wall, write: sanitize hostname in banner header - Refresh Add-documentation-on-blacklisted-modules-to-mount-8-.patch. ==== util-linux-systemd ==== Version update (2.42.2 -> 2.42.3) Subpackages: lastlog2 liblastlog2-2 - Update to version 2.42.3: * Security fixes: * CVE-2026-76642 - mount(8) post-mount hooks execute after helper failure. When an external mount. helper exits nonzero, post-mount hooks (X-mount.idmap, X-mount.owner/group/mode) still execute as if the mount had succeeded, allowing privileged operations on the pre-existing target filesystem (bsc#1274864, bsc#1278349). * CVE-2026-78410 - mount(8) TOCTOU race on source path. In restricted (SUID, non-root) mode, the source path is canonicalized with realpath() as euid=0, following symlinks through user-writable directories. Additionally, open_tree() follows symlinks in intermediate path components. A local attacker can redirect a privileged mount or post-mount ownership change to an arbitrary path (bsc#1274864, bsc#1278347). * CVE-2026-78409 - mount(8) X-mount.subdir symlink escape. The open_tree() call used to open a subdirectory on a detached mount follows symlinks in intermediate path components, allowing escape from the detached tree (bsc#1274864, bsc#1278346). * CVE-2026-78408 - nsenter(1), unshare(1) file descriptor leak. File descriptors in nsenter and unshare were not created with O_CLOEXEC, potentially leaking them across exec. Added O_CLOEXEC as defense in depth (bsc#1274864, bsc#1278348). * wall(1), write(1) - hostname escape sequence injection. The CVE-2024-28085 fix sanitized only message bodies; the banner headers still interpolated the system hostname without sanitization. An unprivileged user can inject terminal escape sequences via a user namespace hostname. Additional fix for CVE-2024-28085. Reported-by: Skyler Ferrante * agetty: fix spurious issue file reprinting on reload * col: * guard c_width sign before size_t cast in BS branch * fix cur_col underflow on backspace over a wide char * disk-utils: fix memory leak in execute function * hexdump: stop after stdout write errors * libblkid: * befs fix possible load of misaligned address * befs fix possible too large shift * dos fix 32-bit overflow in partition start/size [coverity CID 503517, 503518] * (iso9660) fix out-of-bounds read of root dir record * libfdisk: fix OOM on GPT with huge partition entries array * libmount: * skip post-mount hooks after failed mount helper [CVE-2026-76642] * pin source path with openat2() for restricted users [CVE-2026-78410] * restrict source path canonicalization for non-root users [CVE-2026-78410] * fix X-mount.subdir symlink following on detached tree [CVE-2026-78409] * reuse existing act fd in mnt_update_start on ro retry * properly end act file in mnt_free_update * don't ignore "/" target in mount --all when target prefix is set * lscpu: * remove mmu reference not available in stable/v2.42 * add NULL guards for RISC-V ISA functions [coverity CID 503785] * mbsalign: check remaining buffer space before writing hex escapes * more: fix out-of-bounds write in get_line() on invalid multibyte input * nsenter, unshare: add O_CLOEXEC to all open() calls [CVE-2026-78408] * pg: fix out-of-bounds access past wbuf on a trailing tab * unshare: Fix --map-auto regression * wall, write: sanitize hostname in banner header - Refresh Add-documentation-on-blacklisted-modules-to-mount-8-.patch.