Skip to content
OpenAdvisories

Source

SUSE / openSUSE Security Updates

Source: https://www.suse.com/support/update/

All Critical High Medium Low With exploited CVEs

35,581 results · Feed

  • Critical max 9.0
    SUSE-SU-2026:3500-1 2 CVEs

    Security update for libXfont2

    This update for libXfont2 fixes the following issues: - CVE-2026-44950: fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow (bsc#1272661). - CVE-2026-59679: fs_read_glyphs() heap OOB read/write via encoding array index mismatch (bsc#12726…

    first Aug 5, 2026
  • High max 7.1
    openSUSE-SU-2026:21529-1 1 CVE

    Security update for perl-HTTP-Tiny

    This update for perl-HTTP-Tiny fixes the following issues: Changes in perl-HTTP-Tiny: - updated to 0.096 - CVE-2026-7017: Fixed forwarded credential headers to cross-origin redirect targets (bsc#1271020) - Caller-supplied Authorization, Cookie, and Proxy-Auth…

    first Aug 4, 2026
  • High max 7.5
    openSUSE-SU-2026:21526-1 1 CVE

    Security update for python-httplib2

    This update for python-httplib2 fixes the following issue - CVE-2026-59939: Fixed a vulnerability where a malicious or compromised HTTP server could return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError o…

    first Aug 4, 2026
  • High max 7.8
    openSUSE-SU-2026:21525-1 1 CVE

    Security update for rrdtool

    This update for rrdtool fixes the following issue: - CVE-2026-43958: stack buffer overflow in `rrdcached` `handle_request_create()` can lead to local privilege escalation via unbounded DS/RRA arguments (bsc#1267243).

    first Aug 4, 2026
  • High max 8.1
    openSUSE-SU-2026:21524-1 1 CVE

    Security update for nginx

    This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability (bsc#1271514).

    first Aug 4, 2026
  • High max 8.8
    openSUSE-SU-2026:21522-1 5 CVEs

    Security update for ffmpeg-4

    This update for ffmpeg-4 fixes the following issues: Changes in ffmpeg-4: - CVE-2026-64835: Out-of-Bounds Memory Access in ADX Audio Decoder (bsc#1272758) - CVE-2026-64832: Double-Free in NVDEC Hardware Decoder via nvdec.c (bsc#1272754) - CVE-2026-64830: Heap…

    first Aug 3, 2026
  • High max 7.8
    openSUSE-SU-2026:21521-1 3 CVEs

    Security update for gimp

    This update for gimp fixes the following issues: Changes in gimp: - CVE-2026-66757: signed integer overflow in `file-sgi` causes the plugin to crash when RLE-compressed SGI images are processed (bsc#1273151) - CVE-2026-66758: integer overflow in `file-fits` p…

    first Aug 3, 2026
  • High max 8.7
    openSUSE-SU-2026:21518-1 1 CVE

    Security update for python-ujson

    This update for python-ujson fixes the following issue: - CVE-2026-44660: failing to decrement a serialized JSON object during a write exception in ujson.dump() can lead to memory leaks (bsc#1270301).

    first Aug 3, 2026
  • High max 7.9
    openSUSE-SU-2026:21516-1 1 CVE

    Security update for python-sh

    This update for python-sh fixes the following issue - CVE-2026-54552: `_uid` option performs an incomplete privilege drop on Linux/Unix-like systems and allows for privilege escalation (bsc#1272424).

    first Aug 3, 2026
  • Medium max 5.3
    openSUSE-SU-2026:11450-1 1 CVE

    perl-Mojo-JWT-1.20.0-2.1 on GA media

    These are all security issues fixed in the perl-Mojo-JWT-1.20.0-2.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • Medium max 5.6
    openSUSE-SU-2026:11451-1 1 CVE

    python311-pip-26.2-1.1 on GA media

    These are all security issues fixed in the python311-pip-26.2-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • High max 7.8
    openSUSE-SU-2026:11449-1 3 CVEs

    gimp-3.2.4-3.1 on GA media

    These are all security issues fixed in the gimp-3.2.4-3.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • High max 8.8
    openSUSE-SU-2026:11448-1 5 CVEs

    ffmpeg-4-4.4.8-3.1 on GA media

    These are all security issues fixed in the ffmpeg-4-4.4.8-3.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • High max 7.5
    openSUSE-SU-2026:11447-1 1 CVE

    cockpit-subscriptions-16.3-1.1 on GA media

    These are all security issues fixed in the cockpit-subscriptions-16.3-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • High max 7.5
    openSUSE-SU-2026:11446-1 1 CVE

    cockpit-repos-4.9-1.1 on GA media

    These are all security issues fixed in the cockpit-repos-4.9-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • High max 7.5
    openSUSE-SU-2026:11444-1 1 CVE

    azure-storage-azcopy-10.32.6-1.1 on GA media

    These are all security issues fixed in the azure-storage-azcopy-10.32.6-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • High max 8.3
    openSUSE-SU-2026:11442-1 8 CVEs

    OpenImageIO-3.1.16.0-1.1 on GA media

    These are all security issues fixed in the OpenImageIO-3.1.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • High max 8.7
    SUSE-SU-2026:3482-1 19 CVEs

    Security update for netty, netty-tcnative

    This update for netty, netty-tcnative fixes the following issues: Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final. Security issues fixed - CVE-2026-44891: memory exhaustion in `io.netty:netty-codec-stomp` (bsc#1271435). - …

    first Aug 4, 2026
  • Critical max 9.3
    openSUSE-SU-2026:11445-1 32 CVEs

    bouncycastle-1.85-1.1 on GA media

    These are all security issues fixed in the bouncycastle-1.85-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • Low max 3.3
    openSUSE-SU-2026:11443-1 1 CVE

    amazon-ecs-init-1.106.0-1.1 on GA media

    These are all security issues fixed in the amazon-ecs-init-1.106.0-1.1 package on the GA media of openSUSE Tumbleweed.

    first Aug 4, 2026
  • Critical max 9.6
    SUSE-SU-2026:3480-1 4 CVEs

    Security update for kubevirt

    This update for kubevirt fixes the following issues: - Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree: * CVE-2026-39821 (bsc#1266575): the previous entry claimed th…

    first Aug 4, 2026
  • High max 8.1
    SUSE-SU-2026:3478-1 1 CVE

    Security update for rsyslog

    This update for rsyslog fixes the following issues: - CVE-2026-61548: parsing of crafted RFC 5424 messages in `mmpstrucdata` can lead to a stack buffer overflow (bsc#1272414). - Configuration-dependent issue in the optional `imptcp` input module can allow an …

    first Aug 4, 2026
  • High max 8.1
    SUSE-SU-2026:3498-1 1 CVE

    Security update for rsyslog

    This update for rsyslog fixes the following issues: - CVE-2026-61548: parsing of crafted RFC 5424 messages in `mmpstrucdata` can lead to a stack buffer overflow (bsc#1272414). - Configuration-dependent issue in the optional `imptcp` input module can allow an …

    first Aug 4, 2026
  • High max 7.5
    SUSE-SU-2026:3497-1 1 CVE

    Security update for google-guest-agent

    This update for google-guest-agent fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop (bsc#1272118).

    first Aug 4, 2026
  • High max 7.5
    SUSE-SU-2026:3496-1 1 CVE

    Security update for google-osconfig-agent

    This update for google-osconfig-agent fixes the following issue - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop (bsc#1272118).

    first Aug 4, 2026
  • High max 8.8
    openSUSE-SU-2026:21520-1 7 CVEs

    Security update for php-composer2

    This update for php-composer2 fixes the following issues: - CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504). - CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host …

    first Aug 3, 2026
  • Critical max 9.8
    openSUSE-SU-2026:21519-1 61 CVEs

    Security update for MozillaFirefox

    This update for MozillaFirefox fixes the following issues: - Update to Firefox Extended Support Release 140.13.0 ESR. - MFSA 2026-70 (bsc#1271649): * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component * CVE-2026-15719: Site isolation iss…

    first Aug 3, 2026
  • High max 8.6
    SUSE-SU-2026:3484-1 4 CVEs

    Security update for bind

    This update for bind fixes the following issues - CVE-2026-11622: Potential memory usage beyond configured limits (bsc#1271986). - CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards (bsc#1271987). - CVE-2026-13204: Une…

  • Unscored
    SUSE-SU-2026:3493-1 0 CVEs

    Security update for libpng16

    This update for libpng16 fixes the following issues: Changes for libpng16: - version update to 1.6.58 (jsc#PED-16190).

  • Medium max 6.8
    SUSE-SU-2026:3492-1 1 CVE

    Security update for alsa

    This update for alsa fixes the following issue - CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory (bsc#1268853).

  • Medium max 6.7
    SUSE-SU-2026:3491-1 1 CVE

    Security update for libgcrypt

    This update for libgcrypt fixes the following issue - CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service (bsc#1262684).

  • Low max 3.7
    SUSE-SU-2026:3490-1 1 CVE

    Security update for wpa_supplicant

    This update for wpa_supplicant fixes the following issues: - CVE-2025-24912: hostapd RADIUS authentication of wi-fi devices allows a user in between the hostapd and the RADIUS server to inject crafted RADIUS packets and force RADIUS authentications to fail (b…

  • Unscored
    SUSE-SU-2026:3489-1 0 CVEs

    Security update for multipath-tools

    This update for multipath-tools fixes the following issues: Update to version 0.9.4+134+suse.c82f347. - kpartx: integer overflow in the GPT partition table size calculation can lead to heap OOB read via crafted USB device or disk image (bsc#1268145). - kpartx…

  • Unscored
    SUSE-SU-2026:3488-1 0 CVEs

    Security update for openssl-1_1

    This update for openssl-1_1 fixes the following issue - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations (bsc#1271712).

  • Unscored
    SUSE-SU-2026:3487-1 0 CVEs

    Security update for openssl-1_1

    This update for openssl-1_1 fixes the following issue - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations (bsc#1271712).

  • Unscored
    SUSE-SU-2026:3486-1 0 CVEs

    Security update for openssl-3

    This update for openssl-3 fixes the following issues: - HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations (bsc#1271712).

  • Medium max 5.1
    SUSE-SU-2026:3485-1 2 CVEs

    Security update for spice-vdagent

    This update for spice-vdagent fixes the following issues: - CVE-2026-57965: integer overflow in `udscs_write()` can lead to heap buffer overflow (bsc#1269553). - CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to…

  • High max 8.8
    SUSE-SU-2026:3483-1 2 CVEs

    Security update for valkey

    This update for valkey fixes the following issues - CVE-2026-56684: use-after-free in TLS connection handling (bsc#1272443). - CVE-2026-63639: RCE via corrupt stream RDB files containing a shared NACK across consumers (bsc#1272442). Changes for valkey: - Upda…

  • Critical max 9.6
    SUSE-SU-2026:22996-1 2 CVEs

    Security update for ignition

    This update for ignition fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266606). - CVE-2026-56852: golang.org/x/text/unicode…

    first Jul 30, 2026
  • Critical max 9.8
    SUSE-SU-2026:22995-1 6 CVEs

    Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)

    This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1262404). - CVE-2026-31738: vxlan: validate N…

    first Jul 30, 2026