Skip to content
OpenAdvisories

Source

SUSE / openSUSE Security Updates

Source: https://www.suse.com/support/update/

All Critical High Medium Low With exploited CVEs

35,581 results · Feed

  • High max 7.5
    openSUSE-SU-2026:11496-1 1 CVE

    musescore-4.7.4-1.1 on GA media

    These are all security issues fixed in the musescore-4.7.4-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 11, 2026
  • Medium max 5.6
    SUSE-SU-2026:3589-1 1 CVE

    Security update for python-pip

    This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed to arbitrary locations on disk (bsc#1273090).

    first Aug 11, 2026
  • Medium max 5.6
    SUSE-SU-2026:3588-1 1 CVE

    Security update for python3-pip

    This update for python3-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed to arbitrary locations on disk (bsc#1273090).

    first Aug 11, 2026
  • Unscored
    SUSE-SU-2026:3587-1 0 CVEs

    Security update for libarchive

    This update for libarchive fixes the following issues: - creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable (bsc#1254340). - file descriptor l…

    first Aug 11, 2026
  • Medium max 5.3
    SUSE-SU-2026:3586-1 1 CVE

    Security update for ImageMagick

    This update for ImageMagick fixes the following issue: - CVE-2026-64685: heap buffer over-read in BGR decoder due to missing end-of-file check (bsc#1272953).

    first Aug 11, 2026
  • Critical max 9.1
    SUSE-SU-2026:3579-1 22 CVEs

    Security update for erlang26

    This update for erlang26 fixes the following issues: - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning (bsc#1261726). - CVE-2026-42789: `public_key` application accepts non-CA certificates as intermediate issuers and this enables…

    first Aug 11, 2026
  • Unscored
    SUSE-SU-2026:3578-1 0 CVEs

    Security update for openssl-1_1

    This update for openssl-1_1 fixes the following issues: - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations (bsc#1271712).

    first Aug 11, 2026
  • High max 8.7
    SUSE-SU-2026:3576-1 8 CVEs

    Security update for himmelblau, himmelblau.SUSE_SLE-15-SP5_Update

    This update for himmelblau, himmelblau.SUSE_SLE-15-SP5_Update fixes the following issues: Security fixes: - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270182). - CVE-2026-41677: openssl:…

    first Aug 11, 2026
  • Medium max 5.1
    SUSE-SU-2026:3585-1 2 CVEs

    Security update for spice-vdagent

    This update for spice-vdagent fixes the following issues: Security fixes: - CVE-2026-57965: integer overflow in `udscs_write()` can lead to heap buffer overflow (bsc#1269553). - CVE-2026-57966: improper sanitization allows a compromised SPICE host to write ar…

    first Aug 11, 2026
  • Unscored
    SUSE-SU-2026:3575-1 0 CVEs

    Security update for libarchive

    This update for libarchive fixes the following issues: - creating temporary files in the current working directory instead of the target directory can lead to file creation failures when the working directory is not writable (bsc#1254340). - file descriptor l…

    first Aug 11, 2026
  • High max 8.2
    SUSE-SU-2026:3572-1 1 CVE

    Security update for xmlrpc-c

    This update for xmlrpc-c fixes the following issue: - CVE-2026-15928: reflected cross-site scripting (XSS) via HTML injection in the error page component (bsc#1272769).

    first Aug 11, 2026
  • Medium max 5.3
    SUSE-SU-2026:3571-1 1 CVE

    Security update for ImageMagick

    This update for ImageMagick fixes the following issue: - CVE-2026-64685: heap buffer overread in BGR decoder due to missing end-of-file check (bsc#1272953).

    first Aug 11, 2026
  • High max 8.7
    SUSE-SU-2026:3577-1 3 CVEs

    Security update for snpguest

    This update for snpguest fixes the following issues: - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274139). - CVE-2026-41678: openssl: incorrect bounds assertion in AES keywrap can lead to an …

    first Aug 11, 2026
  • High max 8.7
    SUSE-SU-2026:3569-1 9 CVEs

    Security update for python312

    This update for python312 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-3276: quadratic…

    first Aug 11, 2026
  • High max 8.8
    SUSE-SU-2026:3562-1 20 CVEs

    Security update for freerdp

    This update for freerdp fixes the following issues: - CVE-2026-27951: 32-bit system denial of service via endless blocking loop in `Stream_EnsureCapacity` (bsc#1258939). - CVE-2026-33952: client denial of service via unvalidated authentication length field (b…

    first Aug 10, 2026
  • Critical max 9.3
    SUSE-SU-2026:3559-1 32 CVEs

    Security update for bouncycastle

    This update for bouncycastle fixes the following issues: - CVE-2026-8763: Name Constraints bypass via trailing dot in rfc822Name and URI (bsc#1272700). - CVE-2026-12185: BKS/UBER keystore allocates from untrusted lengths before integrity check (bsc#1272701). …

    first Aug 10, 2026
  • Critical max 9.1
    SUSE-SU-2026:3558-1 3 CVEs

    Security update for perl

    This update for perl fixes the following issues: - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304). - CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap …

    first Aug 10, 2026
  • High max 7.5
    SUSE-SU-2026:3557-1 11 CVEs

    Security update for nodejs22

    This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks (bsc#1272882). - CVE-2026-56846: HTTP/2 retained h…

    first Aug 10, 2026
  • High max 8.8
    SUSE-SU-2026:3555-1 23 CVEs

    Security update for webkit2gtk3

    This update for webkit2gtk3 fixes the following issue: Security fixes: - CVE-2024-4367,CVE-2026-39872,CVE-2026-43663,CVE-2026-43676,CVE-2026-43699,CVE-2026-43701, CVE-2026-43705,CVE-2026-43707,CVE-2026-43712,CVE-2026-43713,CVE-2026-43715,CVE-2026-43716, CVE-2…

    first Aug 10, 2026
  • Unscored
    SUSE-SU-2026:3553-1 0 CVEs

    Security update for gd

    This update for gd fixes the following issue: - CVE-2026-9672: security issues in `libgd` (bsc#1273101).

    first Aug 10, 2026
  • High max 8.8
    SUSE-SU-2026:3552-1 2 CVEs

    Security update for ffmpeg

    This update for ffmpeg fixes the following issues: - CVE-2026-64830: Heap Buffer Overflow via VobSub Subtitle Demuxer (bsc#1272752). - CVE-2026-66039: MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File (bsc#1272765).

    first Aug 10, 2026
  • High max 7.5
    SUSE-SU-2026:3551-1 2 CVEs

    Security update for perl-Date-Manip

    This update for perl-Date-Manip fixes the following issues: - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check (bsc#1273063). - CVE-2026-60075: CPU exhaustion due to quadratic backtra…

    first Aug 10, 2026
  • High max 8.7
    SUSE-SU-2026:3560-1 9 CVEs

    Security update for python311

    This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-3276: quadratic…

    first Aug 10, 2026
  • High max 8.1
    SUSE-SU-2026:3556-1 1 CVE

    Security update for ruby2.5

    This update for ruby2.5 fixes the following issue - CVE-2026-41316: erb: @_init deserialization guard bypass via def_module / def_method / def_class (bsc#1262441).

    first Aug 10, 2026
  • High max 8.6
    SUSE-SU-2026:3554-1 6 CVEs

    Security update for bind

    This update for bind fixes the following issues: - CVE-2026-10723: incorrect acceptance of NSEC3 records (bsc#1271982). - CVE-2026-11331: potential wildcard CNAME RPZ policy bypass (bsc#1271984). - CVE-2026-11622: potential memory usage beyond configured limi…

    first Aug 10, 2026
  • Unscored
    SUSE-SU-2026:3549-1 0 CVEs

    Security update for python3-sqlparse

    This update for python3-sqlparse fixes the following issue: - Fixed an issue where formatting list of tuples leads to denial of service (bsc#1268597).

    first Aug 10, 2026
  • Low max 3.3
    SUSE-SU-2026:3433-2 1 CVE

    Security update for runc

    This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a `/dev` symlink can trigger limited host filesystem integrity violations (bsc#1268275). Other updates and bugfixes: - Version 1.3.6: * When masking direc…

    first Aug 10, 2026
  • High max 8.8
    SUSE-SU-2026:23064-1 6 CVEs

    Security update for pcp

    This update for pcp fixes the following issues: - CVE-2026-16524: command injection in `linux_sockets` PMDA via `network.persocket.filter` (bsc#1272922). - CVE-2026-16526: pmdaroot privilege escalation via `FD_CLOEXEC` fd inheritance and missing peer credenti…

    first Aug 11, 2026
  • High max 8.3
    SUSE-SU-2026:23063-1 12 CVEs

    Security update for libpng16

    This update for libpng16 fixes the following issues: Changes for libpng16: - version update to 1.6.58 (jsc#PED-16190).

    first Aug 11, 2026
  • High max 7.5
    SUSE-SU-2026:23050-1 24 CVEs

    Security update for unbound

    This update for unbound fixes the following issues: Update to version 1.25.2. Security issues fixed: - CVE-2026-14586: DoS via assertion in `libngtcp2` for DNS-over-QUIC environments with high concurrency (bsc#1271879). - CVE-2026-32665: Remote DNS-over-QUIC …

    first Aug 10, 2026
  • High max 8.8
    SUSE-SU-2026:23049-1 8 CVEs

    Security update for libssh2_org

    This update for libssh2_org fixes the following issues: - CVE-2025-15661: out-of-bounds heap read vulnerability in the `sftp_symlink()` function in `src/sftp.c` (bsc#1268546). - CVE-2026-7598: integer overflow in function `userauth_password` of file `src/user…

    first Aug 10, 2026
  • Medium max 6.9
    openSUSE-SU-2026:11488-1 7 CVEs

    java-21-openj9-21.0.12.0-1.1 on GA media

    These are all security issues fixed in the java-21-openj9-21.0.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 10, 2026
  • High max 7.5
    openSUSE-SU-2026:11485-1 8 CVEs

    java-11-openj9-11.0.32.0-1.1 on GA media

    These are all security issues fixed in the java-11-openj9-11.0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 10, 2026
  • Unscored
    SUSE-SU-2026:3547-1 0 CVEs

    Security update for suseconnect-ng

    This update for suseconnect-ng fixes the following issue: - Update version to 1.23.0: - Use product identifier for product migrations. (bsc#1268596) - Switch to using go1.26-openssl as the default Go version to install to support building the package (jsc#SCC…

    first Aug 10, 2026
  • High max 8.8
    openSUSE-SU-2026:11490-1 6 CVEs

    libpcp-devel-6.3.8-3.1 on GA media

    These are all security issues fixed in the libpcp-devel-6.3.8-3.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 10, 2026
  • Medium max 6.9
    openSUSE-SU-2026:11486-1 7 CVEs

    java-17-openj9-17.0.20.0-1.1 on GA media

    These are all security issues fixed in the java-17-openj9-17.0.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 10, 2026
  • Critical max 9.6
    openSUSE-SU-2026:11484-1 41 CVEs

    chromedriver-151.0.7922.108-1.1 on GA media

    These are all security issues fixed in the chromedriver-151.0.7922.108-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 10, 2026
  • High max 8.8
    SUSE-SU-2026:3541-1 8 CVEs

    Security update for libssh2_org

    This update for libssh2_org fixes the following issues: - CVE-2025-15661: out-of-bounds heap read vulnerability in the `sftp_symlink()` function in `src/sftp.c` (bsc#1268546). - CVE-2026-7598: integer overflow in function `userauth_password` of file `src/user…

    first Aug 10, 2026
  • High max 8.7
    SUSE-SU-2026:3539-1 1 CVE

    Security update for python-ujson

    This update for python-ujson fixes the following issue: - CVE-2026-44660: memory leak in `ujson.dump()` on write failure can lead to DoS (bsc#1270301).

    first Aug 10, 2026
  • High max 8.8
    openSUSE-SU-2026:11491-1 4 CVEs

    python313-Django5-5.2.17-1.1 on GA media

    These are all security issues fixed in the python313-Django5-5.2.17-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 10, 2026