Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

SUSE 16.0 mozjs128 Important NULL Pointer DoS RISK Advisory 2026-21545-1

suse
Calendar Grey May 11, 2026
Dist Suse Esm H88
Important SUSE security update for mozjs128 fixes critical issues including denial of service and null pointer risks.
An update that solves three vulnerabilities can now be installed.

Summary

## This update for mozjs128 fixes the following issues: * CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259728). * CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713). * CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition (bsc#1259731). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-676=1 * SUSE Linux Enterprise Server 16.0

Topics%20covered

Topics Covered

security advisory denial of service SuSE important null pointer libexpat

References

* bsc#1259713

* bsc#1259728

* bsc#1259731

Cross-

* CVE-2026-32776

* CVE-2026-32777

* CVE-2026-32778

CVSS scores:

* CVE-2026-32776 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-32776 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-32776 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2026-32776 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-32777 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-32777 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-32777 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2026-32777 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:21545-1
Release Date: 2026-05-05T00:25:19Z
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service SuSE important null pointer libexpat

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here