An update that solves one vulnerability can now be installed.. # Security update for cosign Announcement ID: SUSE-SU-2026:2365-1 Release Date: 2026-06-11T07:58:20Z Rating: moderate References: * bsc#1261859 Cross-References: * CVE-2026-39395 CVSS scores: * CVE-2026-39395 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-39395 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2026-39395 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-39395 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP7 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves one vulnerability can now be installed. ## Description: This update for cosign fixes the following issue * CVE-2026-39395: Incorrect attestation verification due to malformed payloads or mismatched predicate types (bsc#1261859). Changes for cosign: * update to 3.0.6: * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801) * Handle whitespace-only certificate annotation (#4760) * fix(sign): closing SignerVerifier too early when signing with a security key (#4761) * Disallow --new-bundle-format and --rfc3161-timestamp (#4762) * support managed keys in conformance testing (#4728) * Add support for GCE metadata server env var (#4732) * fix: preserve per-layer annotations in WriteAttestationsReferrer (#4709) * Fix parsing of in-toto for string predicates * Mark batch of flags for deprecation (#4698) * disallow key and cert identity being used together during verification (#4636) * support key creation in GitLab group (#4704) * Set CGO_ENABLED=1 for fixing s390x failed build * build against a maintained golang version (upstream uses go1.20) ## Patch Instructions: To install thisSUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-2365=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-2365=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cosign-3.0.6-150400.3.42.1 * cosign-debuginfo-3.0.6-150400.3.42.1 * openSUSE Leap 15.4 (noarch) * cosign-bash-completion-3.0.6-150400.3.42.1 * cosign-zsh-completion-3.0.6-150400.3.42.1 * cosign-fish-completion-3.0.6-150400.3.42.1 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * cosign-3.0.6-150400.3.42.1 * cosign-debuginfo-3.0.6-150400.3.42.1 * Basesystem Module 15-SP7 (noarch) * cosign-bash-completion-3.0.6-150400.3.42.1 * cosign-zsh-completion-3.0.6-150400.3.42.1 ## References: * https://www.suse.com/security/cve/CVE-2026-39395.html * https://bugzilla.suse.com/show_bug.cgi?id=1261859 . Update for cosign addresses a moderate risk vulnerability related to malformed payloads and verification issues.. openSUSE Cosign Update, Moderate Risk, Payload Vulnerability, Security Correction. . Severity: moderate. LinuxSecurity.com Team
An update that fixes 5 vulnerabilities is now available.. openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2025:0301-1 Rating: important References: #1247981 Cross-References: CVE-2025-8879 CVE-2025-8880 CVE-2025-8881 CVE-2025-8882 CVE-2025-8901 Affected Products: openSUSE Backports SLE-15-SP7 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 139.0.7258.127 (boo#1247981): * CVE-2025-8879: Heap buffer overflow in libaom * CVE-2025-8880: Race in V8 * CVE-2025-8901: Out of bounds write in ANGLE * CVE-2025-8881: Inappropriate implementation in File Picker * CVE-2025-8882: Use after free in Aura * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP7: zypper in -t patch openSUSE-2025-301=1 Package List: - openSUSE Backports SLE-15-SP7 (aarch64 ppc64le x86_64): chromedriver-139.0.7258.127-bp157.2.37.1 chromedriver-debuginfo-139.0.7258.127-bp157.2.37.1 chromium-139.0.7258.127-bp157.2.37.1 chromium-debuginfo-139.0.7258.127-bp157.2.37.1 References: https://www.suse.com/security/cve/CVE-2025-8879.html https://www.suse.com/security/cve/CVE-2025-8880.html https://www.suse.com/security/cve/CVE-2025-8881.html https://www.suse.com/security/cve/CVE-2025-8882.html https://www.suse.com/security/cve/CVE-2025-8901.html https://bugzilla.suse.com/1247981 . Critical update for openSUSE fixes 5 important issues in Chromium relatingto memory management vulnerabilities.. openSUSE update chromium vulnerabilities security patch. . Severity: Important. LinuxSecurity.com Team
An update that solves one vulnerability can now be installed.. # perl-Protocol-HTTP2-1.130.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10988-1 Rating: moderate Cross-References: * CVE-2026-10725 CVSS scores: * CVE-2026-10725 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the perl-Protocol-HTTP2-1.130.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * perl-Protocol-HTTP2 1.130.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-10725.html . A moderate vulnerability fix for perl-Protocol-HTTP2 in openSUSE Tumbleweed resolved with updated security packages.. openSUSE Tumbleweed, perl-Protocol-HTTP2, security update, moderate risk, CVE-2026-10725. . Severity: moderate. LinuxSecurity.com Team
An update that solves 2 vulnerabilities can now be installed.. # perl-DBI-1.648.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10986-1 Rating: moderate Cross-References: * CVE-2026-10879 * CVE-2026-9698 CVSS scores: * CVE-2026-10879 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-10879 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-9698 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the perl-DBI-1.648.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * perl-DBI 1.648.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-10879.html * https://www.suse.com/security/cve/CVE-2026-9698.html . Two vulnerabilities addressed in openSUSE Tumbleweed perl-DBI package with moderate severity ratings.. openSUSE perl-DBI moderate update vulnerabilities. . Severity: moderate. LinuxSecurity.com Team
An update that solves 2 vulnerabilities can now be installed.. # libIex-3_4-33-3.4.12-1.1 on GA media Announcement ID: openSUSE-SU-2026:10985-1 Rating: moderate Cross-References: * CVE-2026-44663 * CVE-2026-45696 Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the libIex-3_4-33-3.4.12-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libIex-3_4-33 3.4.12-1.1 * libIex-3_4-33-32bit 3.4.12-1.1 * libIex-3_4-33-x86-64-v3 3.4.12-1.1 * libIlmThread-3_4-33 3.4.12-1.1 * libIlmThread-3_4-33-32bit 3.4.12-1.1 * libIlmThread-3_4-33-x86-64-v3 3.4.12-1.1 * libOpenEXR-3_4-33 3.4.12-1.1 * libOpenEXR-3_4-33-32bit 3.4.12-1.1 * libOpenEXR-3_4-33-x86-64-v3 3.4.12-1.1 * libOpenEXRCore-3_4-33 3.4.12-1.1 * libOpenEXRCore-3_4-33-32bit 3.4.12-1.1 * libOpenEXRCore-3_4-33-x86-64-v3 3.4.12-1.1 * libOpenEXRUtil-3_4-33 3.4.12-1.1 * libOpenEXRUtil-3_4-33-32bit 3.4.12-1.1 * libOpenEXRUtil-3_4-33-x86-64-v3 3.4.12-1.1 * openexr 3.4.12-1.1 * openexr-devel 3.4.12-1.1 * openexr-doc 3.4.12-1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-44663.html * https://www.suse.com/security/cve/CVE-2026-45696.html . Update available for openSUSE Tumbleweed addresses 2 moderate issues in libIex-3_4-33-33 package.. openSUSE Tumbleweed, libIex, moderate security, software update. . Severity: moderate. LinuxSecurity.com Team
An update that solves one vulnerability can now be installed.. # perl-Git-Repository-1.326.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10987-1 Rating: moderate Cross-References: * CVE-2022-39253 CVSS scores: * CVE-2022-39253 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the perl-Git-Repository-1.326.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * perl-Git-Repository 1.326.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2022-39253.html . Update for openSUSE Tumbleweed fixes moderate security issue related to perl-Git-Repository affecting system integrity.. openSUSE security update, perl-Git-Repository vulnerability, moderate severity issue, CVE-2022-39253, Linux security patch. . Severity: moderate. LinuxSecurity.com Team
An update that solves 5 vulnerabilities can now be installed.. # python311-Django4-4.2.30-3.1 on GA media Announcement ID: openSUSE-SU-2026:10989-1 Rating: moderate Cross-References: * CVE-2026-35193 * CVE-2026-48587 * CVE-2026-6873 * CVE-2026-7666 * CVE-2026-8404 CVSS scores: * CVE-2026-35193 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-35193 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-48587 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-48587 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-6873 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2026-6873 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-7666 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-7666 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-8404 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-8404 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 5 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the python311-Django4-4.2.30-3.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * python311-Django4 4.2.30-3.1 * python313-Django4 4.2.30-3.1 * python314-Django4 4.2.30-3.1 ## References: * https://www.suse.com/security/cve/CVE-2026-35193.html * https://www.suse.com/security/cve/CVE-2026-48587.html * https://www.suse.com/security/cve/CVE-2026-6873.html * https://www.suse.com/security/cve/CVE-2026-7666.html * https://www.suse.com/security/cve/CVE-2026-8404.html . Update released for openSUSE Tumbleweed fixing 5 vulnerabilities in python311-Django4, levels rated Moderate.. openSUSE Tumbleweed,Django security update,access controlissues,python vulnerabilities. . Severity: moderate. LinuxSecurity.com Team
An update that solves 2 vulnerabilities can now be installed.. # libzypp-17.38.13-1.1 on GA media Announcement ID: openSUSE-SU-2026:10984-1 Rating: moderate Cross-References: * CVE-2026-44941 * CVE-2026-44942 CVSS scores: * CVE-2026-44941 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2026-44941 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-44942 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2026-44942 ( SUSE ): 6 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the libzypp-17.38.13-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libzypp 17.38.13-1.1 * libzypp-devel 17.38.13-1.1 * libzypp-devel-doc 17.38.13-1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-44941.html * https://www.suse.com/security/cve/CVE-2026-44942.html . Discover moderate security updates for libzypp on openSUSE Tumbleweed addressing key vulnerabilities effectively.. libzypp security update, openSUSE vulnerabilities, moderate risk issues. . Severity: moderate. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.