-
Description: A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J"substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- samba-client-libs < 4.17.12+git.553.4b71189e782-150500.3.39.1 (version in image is 4.17.12+git.510.0efaadf376b-150500.3.34.1).
-
Description: A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- samba-client-libs < 4.17.12+git.553.4b71189e782-150500.3.39.1 (version in image is 4.17.12+git.510.0efaadf376b-150500.3.34.1).
-
Description: A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- rsync > 0-0 (version in image is 3.2.3-150400.3.26.1).
-
Description: When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To prevent this, cloud-init default configurations disable platform enumeration.
Packages affected:
- sle-module-public-cloud-release == 15.5 (version in image is 15.5-150500.43.2).
- cloud-init < 25.1.3-150400.15.7.6 (version in image is 23.3-150100.8.85.4).
-
Description: zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain a buffer overflow vulnerability in the Zlib::GzipReader. The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. This issue has been fixed in versions 3.0.1, 3.1.2 and 3.2.3.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libruby2_5-2_5 > 0-0 (version in image is 2.5.9-150000.4.54.1).
-
Description: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libruby2_5-2_5 > 0-0 (version in image is 2.5.9-150000.4.54.1).
-
Description: A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences.A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory.Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- perl-XML-LibXML > 0-0 (version in image is 2.0132-150000.3.3.1).
-
Description: Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- python3-Jinja2 > 0-0 (version in image is 2.10.1-150000.3.21.1).
-
Description: gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). However, three other public methods that also evaluate `@src` via `eval()` were not given the same guard: `ERB#def_method`, `ERB#def_module`, and `ERB#def_class`. An attacker who can trigger `Marshal.load` on untrusted data in a Ruby application that has `erb` loaded can use `ERB#def_module` (zero-arg, default parameters) as a code execution sink, bypassing the `@_init` protection entirely. ERB 4.0.3.1, 4.0.4.1, 6.0.1.1, and 6.0.4 patch the issue.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- ruby > 0-0 (version in image is 2.5-1.21).
-
Description: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can exploit this vulnerability to disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness and facilitating further exploitation.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition.The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-pip > 0-0 (version in image is 22.3.1-150400.17.19.1).
-
Description: A flaw was found in Samba's certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- samba-client-libs < 4.17.12+git.553.4b71189e782-150500.3.39.1 (version in image is 4.17.12+git.510.0efaadf376b-150500.3.34.1).
-
Description: GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: The adjustments made for XSA-379 as well as those subsequently becomingXSA-387 still left a race window, when a HVM or PVH guest does a granttable version change from v2 to v1 in parallel with mapping the statuspage(s) via XENMEM_add_to_physmap. Some of the status pages may then befreed while mappings of them would still be inserted into the guest'ssecondary (P2M) page tables.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs < 4.17.6_08-150500.3.65.1 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- haveged < 1.9.14-150400.3.11.1 (version in image is 1.9.14-150400.3.8.1).
-
Description: `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/bash`) with root privileges.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libzypp > 0-0 (version in image is 17.37.18-150500.6.64.1).
-
Description: Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() inruntime/autoload/tar.vim when decompressing .tgz archives on Unix-like systems. The function builds :!gunzip and :!gzip -d commands using shellescape(tartail) without the {special} flag, allowing a crafted archive filename to trigger Vim cmdline-special expansion and execute shell commands in the user's context. This vulnerability is fixed in 9.2.0479.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsolv-tools > 0-0 (version in image is 0.7.34-150500.6.12.3).
-
Description: A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious file, which could lead to arbitrary code execution, allowing the attacker to run unauthorized commands, or cause a denial of service, making the system unavailable.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: libcurl can in some circumstances reuse the wrong connection when asked to doan Negotiate-authenticated HTTP or HTTPS request.libcurl features a pool of recent connections so that subsequent requests canreuse an existing connection to avoid overhead.When reusing a connection a range of criterion must first be met. Due to alogical error in the code, a request that was issued by an application couldwrongfully reuse an existing connection to the same server that wasauthenticated using different credentials. One underlying reason being thatNegotiate sometimes authenticates *connections* and not *requests*, contraryto how HTTP is designed to work.An application that allows Negotiate authentication to a server (that respondswanting Negotiate) with `user1:password1` and then does another operation tothe same server also using Negotiate but with `user2:password2` (while theprevious connection is still alive) - the second request wrongly reused thesame connection and since it then sees that the Negotiate negotiation isalready made, it just sends the request over that connection thinking it usesthe user2 credentials when it is in fact still using the connectionauthenticated for user1...The set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.Applications can disable libcurl's reuse of connections and thus mitigate thisproblem, by using one of the following libcurl options to alter howconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using thecurl_multi API).
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libcurl4 < 8.14.1-150400.5.83.1 (version in image is 8.14.1-150400.5.80.1).
-
Description: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets. Typically these servers will be found in Active Directory integrated DNS deployments and/or Kerberos-secured DNS environments.This issue affects BIND 9 versions 9.0.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.9.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- bind-utils > 0-0 (version in image is 9.16.50-150500.8.35.1).
-
Description: Unknown.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- samba-client-libs < 4.17.12+git.553.4b71189e782-150500.3.39.1 (version in image is 4.17.12+git.510.0efaadf376b-150500.3.34.1).
-
Description: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- openssh < 8.4p1-150300.3.60.1 (version in image is 8.4p1-150300.3.57.1).
-
Description: The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glibc > 0-0 (version in image is 2.31-150300.98.1).
-
Description: A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: When an Expat parser with a registered ElementDeclHandler parses an inlinedocument type definition containing a deeply nested content model a C stackoverflow occurs.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-Twisted > 0-0 (version in image is 22.10.0-150400.5.23.1).
-
Description: urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-urllib3 < 1.25.10-150300.4.27.1 (version in image is 1.25.10-150300.4.24.1).
-
Description: An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the compact-serialization payload segment before enforcing the detached-payload rules. For b64=false, PyJWT later discards that decoded payload and replaces it with the caller-provided detached_payload. In practice, this turns the middle segment into an attacker-controlled “work amplifier”: a remote client can supply an arbitrarily large Base64URL payload segment that forces CPU work + memory allocations even if the signature is invalid. This creates an unauthenticated DoS vector against any endpoint that verifies detached JWS using PyJWT. This vulnerability is fixed in 2.13.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-PyJWT > 0-0 (version in image is 2.4.0-150200.3.11.1).
-
Description: Unknown.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsolv-tools > 0-0 (version in image is 0.7.34-150500.6.12.3).
-
Description: Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) - for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths - recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data - can cause assertion failures in `named`.This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- bind-utils > 0-0 (version in image is 9.16.50-150500.8.35.1).
-
Description: `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs > 0-0 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: Unknown.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libzypp > 0-0 (version in image is 17.37.18-150500.6.64.1).
-
Description: XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- liblzma5 < 5.2.3-150000.4.10.1 (version in image is 5.2.3-150000.4.7.1).
-
Description: The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker to use the issuer public key as the secret key for HMAC algorithm. This vulnerability is fixed in 2.13.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-PyJWT > 0-0 (version in image is 2.4.0-150200.3.11.1).
-
Description: In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victim must run rsync with -X (aka --xattrs). On Linux, many (but not all) common configurations are vulnerable. Non-Linux platforms are more widely vulnerable.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest-Shamir-Adleman - Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written,2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.This issue was fixed in version 4.10.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- sed > 0-0 (version in image is 4.4-150300.13.3.1).
-
Description: Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodiumlibsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277 https://www.cve.org/CVERecord?id=CVE-2025-69277 .The libsodium vulnerability states:In atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsodium23 > 0-0 (version in image is 1.0.18-150000.4.14.1).
-
Description: The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311 > 0-0 (version in image is 3.11.15-150400.9.85.1).
-
Description: A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting in an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is not discarded.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libtasn1 > 0-0 (version in image is 4.13-150000.4.14.1).
-
Description: net-tools is a collection of programs that form the base set of the NET-3 networking distribution for the Linux operating system. Inn versions up to and including 2.10, the Linux network utilities (like ifconfig) from the net-tools package do not properly validate the structure of /proc files when showing interfaces. `get_name()` in `interface.c` copies interface labels from `/proc/net/dev` into a fixed 16-byte stack buffer without bounds checking, leading to possible arbitrary code execution or crash. The known attack path does not require privilege but also does not provide privilege escalation in this scenario. A patch is available and expected to be part of version 2.20.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- net-tools > 0-0 (version in image is 2.0+git20170221.479bb4a-150000.5.13.1).
-
Description: Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion to resolve environment variables and wildcards. If the filename field contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: Vim is an open source, command line text editor. Prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath. This issue has been patched in version 9.2.0450.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- rsync > 0-0 (version in image is 3.2.3-150400.3.26.1).
-
Description: A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- rsync > 0-0 (version in image is 3.2.3-150400.3.26.1).
-
Description: URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl intosaving the output file outside of the current directory without the userexplicitly asking for it.This flaw only affects the wcurl command line tool.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate theprivileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- nfs-client > 0-0 (version in image is 2.1.1-150500.22.3.1).
-
Description: When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- krb5 > 0-0 (version in image is 1.20.1-150500.3.17.1).
-
Description: ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- iputils > 0-0 (version in image is 20221126-150500.3.14.1).
-
Description: When passing through PCI devices, the detach logic in libxl won't removeaccess permissions to any 64bit memory BARs the device might have. As aresult a domain can still have access any 64bit memory BAR when suchdevice is no longer assigned to the domain.For PV domains the permission leak allows the domain itself to map the memoryin the page-tables. For HVM it would require a compromised device model orstubdomain to map the leaked memory into the HVM domain p2m.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs > 0-0 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libavahi-client3 > 0-0 (version in image is 0.8-150400.7.26.1).
-
Description: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libavahi-client3 > 0-0 (version in image is 0.8-150400.7.26.1).
-
Description: There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the “tarfile” module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311 > 0-0 (version in image is 3.11.15-150400.9.85.1).
-
Description: A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libssh-config > 0-0 (version in image is 0.9.8-150400.3.17.1).
-
Description: A flaw was found in Samba's vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- samba-client-libs < 4.17.12+git.553.4b71189e782-150500.3.39.1 (version in image is 4.17.12+git.510.0efaadf376b-150500.3.34.1).
-
Description: Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHEScommand within a transaction due to an assert() triggering.In case xenstored was built with NDEBUG #defined nothing bad willhappen, as assert() is doing nothing in this case. Note that thedefault is not to define NDEBUG for xenstored builds even in releasebuilds of Xen.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs < 4.17.6_08-150500.3.65.1 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., "h.local" as a CNAME for "h.local"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libavahi-client3 > 0-0 (version in image is 0.8-150400.7.26.1).
-
Description: In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libexpat1 > 0-0 (version in image is 2.7.1-150400.3.37.1).
-
Description: Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- openssh > 0-0 (version in image is 8.4p1-150300.3.57.1).
-
Description: spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count in parseHeaderValueBlock, and individual header field sizes - all read as 32-bit integers and used directly as allocation sizes with no bounds checking. Because SPDY header blocks are zlib-compressed, a small on-the-wire payload can decompress into large attacker-controlled values. A remote peer that can send SPDY frames to a service using spdystream can exhaust process memory and cause an out-of-memory crash with a single crafted control frame. This issue has been fixed in version 0.5.1.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Attackers can exploit the vulnerability by setting CF_INC_RECURSE in compatibility flags and sending a specially crafted file list where the first sorted entry is not the leading dot directory, followed by a transfer record with ndx=0 and an iflag word without ITEM_TRANSFER, causing the receiver to read 8 bytes before the allocated pointer array and dereference an invalid pointer at an unmapped address, resulting in a deterministic SIGSEGV crash of the rsync client.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requests within transaction operations, to bypass RBAC authorization checks. An authenticated user without sufficient read or lease-related permissions may be able to access unauthorized data or attach leases by invoking transaction operations with these features enabled. This vulnerability is fixed in 3.4.44, 3.5.30, and 3.6.11.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: libcurl might in some circumstances reuse the wrong connection when asked todo an authenticated HTTP(S) request after a Negotiate-authenticated one, whenboth use the same host.libcurl features a pool of recent connections so that subsequent requests canreuse an existing connection to avoid overhead.When reusing a connection a range of criteria must be met. Due to a logicalerror in the code, a request that was issued by an application couldwrongfully reuse an existing connection to the same server that wasauthenticated using different credentials.An application that first uses Negotiate authentication to a server with`user1:password1` and then does another operation to the same server askingfor any authentication method but for `user2:password2` (while the previousconnection is still alive) - the second request gets confused and wronglyreuses the same connection and sends the new request over that connectionthinking it uses a mix of user1's and user2's credentials when it is in factstill using the connection authenticated for user1...
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libcurl4 < 8.14.1-150400.5.83.1 (version in image is 8.14.1-150400.5.80.1).
-
Description: A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsolv-tools > 0-0 (version in image is 0.7.34-150500.6.12.3).
-
Description: A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsolv-tools > 0-0 (version in image is 0.7.34-150500.6.12.3).
-
Description: A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parse_option() function, leading grub to crash or, in some rare scenarios, corrupt the IVT data.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted .mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot protections.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A flaw was found in grub2. The calculation of the translation buffer when reading a language .mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsystemd0 > 0-0 (version in image is 249.17-150400.8.55.1).
-
Description: A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- rsync > 0-0 (version in image is 3.2.3-150400.3.26.1).
-
Description: When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,changing TLS options in one thread would inadvertently change them globallyand therefore possibly also affect other concurrently setup transfers.Disabling certificate verification for a specific transfer couldunintentionally disable the feature for other threads as well.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync > 0-0 (version in image is 3.2.3-150400.3.26.1).
-
Description: Perl threads have a working directory race condition where file operations may target unintended paths.If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- perl > 0-0 (version in image is 5.26.1-150300.17.20.1).
-
Description: libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malformed USB configuration descriptor where an interface claims bNumEndpoints greater than zero but is followed by a class-specific descriptor whose bLength exceeds the remaining buffer size, causing parse_interface() to return early without allocating the endpoint array. Attackers can exploit this flaw through libusb_get_active_config_descriptor or libusb_get_config_descriptor by providing crafted descriptors via virtualized USB passthrough, file-based descriptor parsing, or network sources, causing any application iterating over endpoints to dereference a NULL endpoint pointer and crash.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libusb-1_0-0 > 0-0 (version in image is 1.0.24-150400.3.3.1).
-
Description: Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libblkid1 > 0-0 (version in image is 2.37.4-150500.9.26.1).
-
Description: A flaw was found in GNU Binutils. This heap-based buffer overflow vulnerability, specifically an out-of-bounds read in the bfd linker, allows an attacker to gain access to sensitive information. By convincing a user to process a specially crafted XCOFF object file, an attacker can trigger this flaw, potentially leading to information disclosure or an application level denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: A flaw was found in GNU Binutils. This vulnerability, a heap-based buffer overflow, specifically an out-of-bounds read, exists in the bfd linker component. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file. Successful exploitation may lead to the disclosure of sensitive information or cause the application to crash, resulting in an application level denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- screen > 0-0 (version in image is 4.6.2-150000.5.8.1).
-
Description: Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands.
Packages affected:
- sle-module-public-cloud-release == 15.5 (version in image is 15.5-150500.43.2).
- cloud-init < 25.1.3-150400.15.7.6 (version in image is 23.3-150100.8.85.4).
-
Description: Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-requests > 0-0 (version in image is 2.25.1-150300.3.18.1).
-
Description: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libruby2_5-2_5 > 0-0 (version in image is 2.5.9-150000.4.54.1).
-
Description: A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glib2-tools > 0-0 (version in image is 2.70.5-150400.3.34.1).
-
Description: A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- krb5 > 0-0 (version in image is 1.20.1-150500.3.17.1).
-
Description: In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- gpg2 > 0-0 (version in image is 2.2.27-150300.3.19.1).
-
Description: A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- krb5 > 0-0 (version in image is 1.20.1-150500.3.17.1).
-
Description: In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- krb5 > 0-0 (version in image is 1.20.1-150500.3.17.1).
-
Description: lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-lxml > 0-0 (version in image is 4.9.1-150500.3.4.3).
-
Description: A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glibc > 0-0 (version in image is 2.31-150300.98.1).
-
Description: curl might erroneously pass on credentials for a first proxy to a secondproxy.This can happen when the following conditions are true:1. curl is setup to use specific different proxies for different URL schemes2. the first proxy needs credentials3. the second proxy uses no credentials4. while using the first proxy (using say `http://`), curl is asked to follow a redirect to a URL using another scheme (say `https://`), accessed using a second, different, proxy
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libcurl4 < 8.14.1-150400.5.83.1 (version in image is 8.14.1-150400.5.80.1).
-
Description: When asked to both use a `.netrc` file for credentials and to follow HTTPredirects, libcurl could leak the password used for the first host to thefollowed-to host under certain circumstances.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libcurl4 < 8.14.1-150400.5.83.1 (version in image is 8.14.1-150400.5.80.1).
-
Description: Successfully using libcurl to do a transfer over a specific HTTP proxy(`proxyA`) with **Digest** authentication and then changing the proxy host toa second one (`proxyB`) for a second transfer, reusing the same handle, makeslibcurl wrongly pass on the `Proxy-Authorization:` header field meant for`proxyA`, to `proxyB`.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-pip > 0-0 (version in image is 22.3.1-150400.17.19.1).
-
Description: Closing of an event channel in the Linux kernel can result in a deadlock.This happens when the close is being performed in parallel to an unrelatedXen console action and the handling of a Xen console interrupt in anunprivileged guest.The closing of an event channel is e.g. triggered by removal of aparavirtual device on the other side. As this action will cause consolemessages to be issued on the other side quite often, the chance oftriggering the deadlock is not neglectable.Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernelon Arm doesn't use queued-RW-locks, which are required to trigger theissue (on Arm32 a waiting writer doesn't block further readers to getthe lock).
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- xen-libs > 0-0 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glibc > 0-0 (version in image is 2.31-150300.98.1).
-
Description: There exists a heap buffer overflow vulnerable in Abseil-cpp. The sized constructors, reserve(), and rehash() methods of absl::{flat,node}hash{set,map} did not impose an upper bound on their size argument. As a result, it was possible for a caller to pass a very large size that would cause an integer overflow when computing the size of the container's backing store, and a subsequent out-of-bounds memory write. Subsequent accesses to the container might also access out-of-bounds memory. We recommend upgrading past commit 5a0e2cb5e3958dd90bb8569a2766622cb74d90c1
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libabsl2401_0_0 > 0-0 (version in image is 20240116.3-150500.13.10.1).
-
Description: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim's internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libblkid1 > 0-0 (version in image is 2.37.4-150500.9.26.1).
-
Description: IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date._dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- perl > 0-0 (version in image is 5.26.1-150300.17.20.1).
-
Description: A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially resulting in loss of confidentiality.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs < 4.17.6_08-150500.3.65.1 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either callingthe RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libavahi-client3 > 0-0 (version in image is 0.8-150400.7.26.1).
-
Description: An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: In the context switch logic Xen attempts to skip an IBPB in the case ofa vCPU returning to a CPU on which it was the previous vCPU to run.While safe for Xen's isolation between vCPUs, this prevents the guestkernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again.Now, task 2 is running on CPU A with task 1's training still in the BTB.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs > 0-0 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libexpat1 > 0-0 (version in image is 2.7.1-150400.3.37.1).
-
Description: Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-requests > 0-0 (version in image is 2.25.1-150300.3.18.1).
-
Description: Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libavahi-client3 > 0-0 (version in image is 0.8-150400.7.26.1).
-
Description: Unknown.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-pyOpenSSL > 0-0 (version in image is 23.2.0-150400.3.13.1).
-
Description: A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpolkit-agent-1-0 > 0-0 (version in image is 121-150500.3.11.1).
-
Description: A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- tar > 0-0 (version in image is 1.34-150000.3.37.1).
-
Description: A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI (Extensible Firmware Interface) device path node header. A local user could exploit this vulnerability by providing a specially crafted device path node. This can lead to infinite recursion, causing stack exhaustion and a process crash, resulting in a denial of service (DoS).
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libefivar1 > 0-0 (version in image is 37-6.12.1).
-
Description: ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- iputils > 0-0 (version in image is 20221126-150500.3.14.1).
-
Description: An integer overflow exists in the FTS5 https://sqlite.org/fts5.html extension. It occurs when the size of an array of tombstone pointers is calculated and truncated into a 32-bit integer. A pointer to partially controlled data can then be written out of bounds.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsqlite3-0 > 0-0 (version in image is 3.51.3-150000.3.39.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The token header alg is checked against the caller-supplied algorithms allow-list, but signature verification is performed with the algorithm bound to the PyJWK object instead of the header algorithm. An attacker who controls a registered JWK/JWKS private key can sign with a disallowed algorithm, advertise an allowed algorithm in the JWT header, and still be accepted. The issue affects the documented PyJWKClient.get_signing_key_from_jwt(...) flow. This vulnerability is fixed in 2.13.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-PyJWT > 0-0 (version in image is 2.4.0-150200.3.11.1).
-
Description: A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- rsync > 0-0 (version in image is 3.2.3-150400.3.26.1).
-
Description: A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 > 0-0 (version in image is 3.7.3-150400.4.56.1).
-
Description: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libavahi-client3 > 0-0 (version in image is 0.8-150400.7.26.1).
-
Description: When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transferperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the newtarget host.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: When doing TLS related transfers with reused easy or multi handles andaltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentallyreuse a CA store cached in memory for which the partial chain option wasreversed. Contrary to the user's wishes and expectations. This could makelibcurl find and accept a trust chain that it otherwise would not.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 > 0-0 (version in image is 3.7.3-150400.4.56.1).
-
Description: When doing SSH-based transfers using either SCP or SFTP, and setting theknown_hosts file, libcurl could still mistakenly accept connecting to hosts*not present* in the specified file if they were added as recognized in thelibssh *global* known_hosts file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting length of the name.This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libruby2_5-2_5 > 0-0 (version in image is 2.5.9-150000.4.54.1).
-
Description: The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-urllib3 > 0-0 (version in image is 1.25.10-150300.4.24.1).
-
Description: Shadow mode tracing code uses a set of per-CPU variables to avoidcumbersome parameter passing. Some of these variables are written towith guest controlled data, of guest controllable size. That size canbe larger than the variable, and bounding of the writes was missing.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs > 0-0 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-urllib3 > 0-0 (version in image is 1.25.10-150300.4.24.1).
-
Description: urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-urllib3 > 0-0 (version in image is 1.25.10-150300.4.24.1).
-
Description: A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libz1 > 0-0 (version in image is 1.2.13-150500.4.6.1).
-
Description: When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed. This can lead to data being accepted which may be processed differently by other implementations. Use "validate=True" to enable stricter processing of base64 data.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone, the resolver will consume disproportionate resources.This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- bind-utils > 0-0 (version in image is 9.16.50-150500.8.35.1).
-
Description: A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libssh-config > 0-0 (version in image is 0.9.8-150400.3.17.1).
-
Description: Unknown.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-idna > 0-0 (version in image is 2.6-150000.3.6.1).
-
Description: The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glibc > 0-0 (version in image is 2.31-150300.98.1).
-
Description: The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glibc > 0-0 (version in image is 2.31-150300.98.1).
-
Description: The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv() was patched to replace server-supplied PASV host addresses with the actual peer address (getpeername()[0]), ftpcp() still calls parse227() directly and passes the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpng16-16 > 0-0 (version in image is 1.6.34-150000.3.22.1).
-
Description: A malicious SCP server can send unexpected paths that could make theclient application override local files outside of working directory.This could be misused to create malicious executable or configurationfiles and make the user execute them under specific consequences.This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libssh-config > 0-0 (version in image is 0.9.8-150400.3.17.1).
-
Description: A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glib2-tools > 0-0 (version in image is 2.70.5-150400.3.34.1).
-
Description: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- glib2-tools > 0-0 (version in image is 2.70.5-150400.3.34.1).
-
Description: A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: Unknown.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-paramiko > 0-0 (version in image is 3.4.0-150400.13.10.4).
-
Description: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is currently no documented option to restrict which schemes PyJWKClient will fetch. If an application's jku URL ingestion path accepts attacker-influenced URLs (e.g., from JWT header, configuration file, OAuth flow parameter), the attacker can cause PyJWKClient to read arbitrary local files via file:// (SSRF on local filesystem), cause PyJWKClient to attempt FTP / data-URI fetches (broader SSRF surface), or forge tokens that PyJWT verifies as valid. The library does not directly return non-HTTP(S) URI contents to the attacker; the chained "plant a JWKS to forge tokens" scenario described in the original report requires additional application-layer flaws (attacker write access to a filesystem path, untrusted jku derivation) that this fix does not address. This vulnerability is fixed in 2.13.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-PyJWT > 0-0 (version in image is 2.4.0-150200.3.11.1).
-
Description: A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- pam > 0-0 (version in image is 1.3.0-150000.6.86.1).
-
Description: GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: When setting up interrupt remapping for legacy PCI(-X) devices,including PCI(-X) bridges, a lookup of the upstream bridge is required.This lookup, itself involving acquiring of a lock, is done in a contextwhere acquiring that lock is unsafe. This can lead to a deadlock.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- xen-libs > 0-0 (version in image is 4.17.6_06-150500.3.62.2).
-
Description: A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libssh-config > 0-0 (version in image is 0.9.8-150400.3.17.1).
-
Description: util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libblkid1 > 0-0 (version in image is 2.37.4-150500.9.26.1).
-
Description: containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end ofa line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer atthe specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- containerd > 0-0 (version in image is 1.7.29-150000.132.1).
-
Description: libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsodium23 > 0-0 (version in image is 1.0.18-150000.4.14.1).
-
Description: The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libncurses6 > 0-0 (version in image is 6.1-150000.5.33.1).
-
Description: Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.from_yaml. from_yaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-based metadata of a gem. YAML aliases allow for Denial of Service attacks with so-called `YAML-bombs` (comparable to Billion laughs attacks). This was patched. There is is no action required by users. This issue is also tracked as GHSL-2024-001 and was discovered by the GitHub security lab.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libruby2_5-2_5 > 0-0 (version in image is 2.5.9-150000.4.54.1).
-
Description: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libsqlite3-0 > 0-0 (version in image is 3.51.3-150000.3.39.1).
-
Description: urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-urllib3 > 0-0 (version in image is 1.25.10-150300.4.24.1).
-
Description: When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- openssh < 8.4p1-150300.3.60.1 (version in image is 8.4p1-150300.3.57.1).
-
Description: Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memory by sending a malformed HTTP proxy response. Attackers can exploit this by positioning themselves between the client and proxy or controlling the proxy server to send a response line of 1023 or more bytes without a newline terminator, causing a null byte to be written to an out-of-bounds stack address when the RSYNC_PROXY environment variable is set.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- rsync < 3.2.3-150400.3.31.1 (version in image is 3.2.3-150400.3.26.1).
-
Description: Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libexpat1 > 0-0 (version in image is 2.7.1-150400.3.37.1).
-
Description: A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 > 0-0 (version in image is 3.7.3-150400.4.56.1).
-
Description: Unknown.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: libusb before version 1.0.30 contains a one-byte out-of-bounds read vulnerability in parse_iad_array() in descriptor.c that allows attackers to trigger a denial of service by supplying a malformed USB descriptor whose bLength equals size minus one, causing the bounds check to use the original buffer size instead of the remaining size. Attackers in virtualized environments with USB passthrough can supply crafted descriptors through libusb_get_active_interface_association_descriptors or libusb_get_interface_association_descriptors to read one byte past the end of the malloc allocation, resulting in a denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libusb-1_0-0 > 0-0 (version in image is 1.0.24-150400.3.3.1).
-
Description: A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- grub2 > 0-0 (version in image is 2.06-150500.29.65.1).
-
Description: http.cookies.Morsel.js_output() returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 > 0-0 (version in image is 3.7.3-150400.4.56.1).
-
Description: A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-cryptography > 0-0 (version in image is 41.0.3-150400.16.22.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient.get_signing_key() forces a fresh HTTP request to the JWKS endpoint for every JWT with an unknown kid value, with no rate limiting. Since kid comes from the unverified token header, an attacker can trigger unlimited outbound requests. The vulnerability surfaces only when a JWKS fetch fails; an attacker can attempt to provoke that with sustained unknown-kid traffic, but the outcome depends on upstream JWKS-endpoint behavior (rate limiting, transient errors) which is beyond the attacker's control. This vulnerability is fixed in 2.13.0.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3-PyJWT > 0-0 (version in image is 2.4.0-150200.3.11.1).
-
Description: A vulnerability exists where a connection requiring TLS incorrectly reuses anexisting unencrypted connection from the same connection pool. If an initialtransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent requestto that same host bypasses the TLS requirement and instead transmit dataunencrypted.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libcurl4 < 8.14.1-150400.5.83.1 (version in image is 8.14.1-150400.5.80.1).
-
Description: libcurl might in some circumstances reuse the wrong connection for SMB(S)transfers.libcurl features a pool of recent connections so that subsequent requests canreuse an existing connection to avoid overhead.When reusing a connection a range of criteria must be met. Due to a logicalerror in the code, a network transfer operation that was requested by anapplication could wrongfully reuse an existing SMB connection to the sameserver that was using a different 'share' than the new subsequent transfershould.This could in unlucky situations lead to the download of the wrong file or theupload of a file to the wrong place. When this happens, the same credentialsare used and the server name is the same.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: Using libcurl, when a custom `Host:` header is first set for an HTTP requestand a second request is subsequently done using the same *easy handle* butwithout the custom `Host:` header set, the second request would use staleinformation and pass on cookies meant for the first host in the secondrequest. Leak them.
Packages affected:
- sle-module-basesystem-release == 15.5 (version in image is 15.5-150500.43.2).
- libcurl4 < 8.14.1-150400.5.83.1 (version in image is 8.14.1-150400.5.80.1).
-
Description: In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- openssh > 0-0 (version in image is 8.4p1-150300.3.57.1).
-
Description: pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-pip > 0-0 (version in image is 22.3.1-150400.17.19.1).
-
Description: bzip2 contains an off-by-one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out-of-bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libbz2-1 > 0-0 (version in image is 1.0.8-150400.1.122).
-
Description: The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types.
Packages affected:
- sle-module-development-tools-release == 15.5 (version in image is 15.5-150500.43.2).
- crash > 0-0 (version in image is 7.3.1-150500.3.4).
-
Description: A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing a manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. This patch is called 16357. It is best practice to apply a patch to resolve this issue.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpcap1 > 0-0 (version in image is 1.10.1-150400.3.9.1).
-
Description: A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/fa.c. The manipulation of the argument re leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- augeas > 0-0 (version in image is 1.12.0-150400.3.8.1).
-
Description: Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malformed header fields. During relocation processing, an invalid or null section pointer may be passed into display_relocations(), resulting in a segmentation fault (SIGSEGV) and abrupt termination. No evidence of memory corruption beyond the null pointer dereference, nor any possibility of code execution, was observed.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: The 'zipfile' module would not check the validity of the ZIP64 End ofCentral Directory (EOCD) Locator record offset value would not be used tolocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would beassumed to be the previous record in the ZIP archive. This could be abusedto create ZIP archives that are handled differently by the 'zipfile' modulecompared to other ZIP implementations.Remediation maintains this behavior, but checks that the offset specifiedin the ZIP64 EOCD Locator record matches the expected value.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libssh-config > 0-0 (version in image is 0.9.8-150400.3.17.1).
-
Description: A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-Pygments > 0-0 (version in image is 2.15.1-150400.7.7.4).
-
Description: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above.
Packages affected:
- sle-module-containers-release == 15.5 (version in image is 15.5-150500.43.2).
- docker > 0-0 (version in image is 28.5.1_ce-150000.245.2).
-
Description: When doing SSH-based transfers using either SCP or SFTP, and asked to dopublic key authentication, curl would wrongly still ask and authenticate usinga locally running SSH agent.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- curl > 0-0 (version in image is 8.14.1-150400.5.80.1).
-
Description: During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311 > 0-0 (version in image is 3.11.15-150400.9.85.1).
-
Description: A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libssh-config > 0-0 (version in image is 0.9.8-150400.3.17.1).
-
Description: When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical situations.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-pip > 0-0 (version in image is 22.3.1-150400.17.19.1).
-
Description: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python311-aiohttp > 0-0 (version in image is 3.9.3-150400.10.36.1).
-
Description: OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- openssh > 0-0 (version in image is 8.4p1-150300.3.57.1).
-
Description: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libxml2-2 > 0-0 (version in image is 2.10.3-150500.5.38.1).
-
Description: REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libruby2_5-2_5 > 0-0 (version in image is 2.5.9-150000.4.54.1).
-
Description: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libexpat1 > 0-0 (version in image is 2.7.1-150400.3.37.1).
-
Description: In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- iproute2 > 0-0 (version in image is 5.14-150400.3.3.1).
-
Description: A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).
-
Description: In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- gpg2 > 0-0 (version in image is 2.2.27-150300.3.19.1).
-
Description: An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libpython3_6m1_0 < 3.6.15-150300.10.118.1 (version in image is 3.6.15-150300.10.109.1).
-
Description: If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- python3 > 0-0 (version in image is 3.6.15-150300.10.109.1).
-
Description: An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- binutils > 0-0 (version in image is 2.45-150100.7.57.1).
-
Description: OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- openssh > 0-0 (version in image is 8.4p1-150300.3.57.1).
-
Description: libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libexpat1 > 0-0 (version in image is 2.7.1-150400.3.37.1).
-
Description: A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libssh-config > 0-0 (version in image is 0.9.8-150400.3.17.1).
-
Description: A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libgnutls30 < 3.7.3-150400.4.59.1 (version in image is 3.7.3-150400.4.56.1).
-
Description: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- libz1 > 0-0 (version in image is 1.2.13-150500.4.6.1).
-
Description: Vim is an open source, command line text editor. Prior to version 9.2.0383, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the sftp:// or file:// protocol handlers), an attacker can execute arbitrary shell commands with the privileges of the Vim process. This issue has been patched in version 9.2.0383.
Packages affected:
- sles-release == 15.5 (version in image is 15.5-150500.61.4.1).
- vim > 0-0 (version in image is 9.2.0280-150500.20.46.1).