An update that solves one vulnerability and has one security fix can now be installed.. # Security update for munge Announcement ID: SUSE-SU-2026:0448-1 Release Date: 2026-02-11T14:51:56Z Rating: important References: * bsc#1246088 * bsc#1257651 Cross-References: * CVE-2026-25506 CVSS scores: * CVE-2026-25506 ( SUSE ): 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L * CVE-2026-25506 ( NVD ): 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L Affected Products: * HPC Module 12 * SUSE Linux Enterprise High Performance Computing 12 SP2 * SUSE Linux Enterprise High Performance Computing 12 SP3 * SUSE Linux Enterprise High Performance Computing 12 SP4 * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP2 * SUSE Linux Enterprise Server 12 SP3 * SUSE Linux Enterprise Server 12 SP4 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP2 * SUSE Linux Enterprise Server for SAP Applications 12 SP3 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for munge fixes the following issues: * CVE-2026-25506: buffer overflow in message unpacking (bsc#1257651). * Make `logrotate` work on log as user `munge` to prevent local privilege escalation (bsc#1246088). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * HPC Module 12 zypper in -t patch SUSE-SLE-Module-HPC-12-2026-448=1 ## Package List: * HPC Module 12 (aarch64 x86_64) * munge-debuginfo-0.5.14-3.11.1 * munge-0.5.14-3.11.1 * libmunge2-0.5.14-3.11.1 * munge-debugsource-0.5.14-3.11.1 * munge-devel-0.5.14-3.11.1 *libmunge2-debuginfo-0.5.14-3.11.1 ## References: * https://www.suse.com/security/cve/CVE-2026-25506.html * https://bugzilla.suse.com/show_bug.cgi?id=1246088 * https://bugzilla.suse.com/show_bug.cgi?id=1257651 . Critical update for munge addresses buffer overflow and local escalation risks in SUSE using patch methods like zypper.. SUSE updates, munge security, buffer overflow, local privilege escalation. . Severity: Important. LinuxSecurity.com Team
The package exim before version 4.98.2-1 is vulnerable to privilege escalation. . Arch Linux Security Advisory ASA-202503-1 ========================================= Severity: High Date : 2025-03-26 CVE-ID : CVE-2025-30232 Package : exim Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2859 Summary ======= The package exim before version 4.98.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.98.2-1. # pacman -Syu "exim> =4.98.2-1" The problem has been fixed upstream in version 4.98.2. Workaround ========== None. Description =========== A use-after-free has been discovered in exim that can lead to potential privilege escalation due to the lack of nulling out the debug_pretrigger_buf pointer before freeing the buffer by the storage management. Impact ====== A local unprivileged attacker is able to escalate privileges on the affected host. References ========== https://exim.org/static/doc/security/CVE-2025-30232.txt https://lists.exim.org/lurker/message/20250326.140105.6b97555b.en.html https://security.archlinux.org/CVE-2025-30232 . Exim prior to 4.98.2-1 on Arch Linux is vulnerable to high-severity privilege escalation. Upgrade recommended.. package, version, vulnerable, privilege, escalation, linux, security. . Severity: Critical. LinuxSecurity.com Team
Due to a security engineering oversight, the SSL library from KDE,which Konqueror uses, doesn't check whether an intermediatecertificate for a connection is signed by the certificate authority assafe for the purpose, but accepts it when it is signed.. -------------------------------------------------------------------------- Debian Security Advisory DSA 155-1
Get the latest Linux and open source security news straight to your inbox.