SUSE-SU-2026:1817-1

Details

Description of the patch:

This update for mozjs60 fixes the following issues

CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259728).
CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713).
CVE-2026-32778: libexpat: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259731).

Affected Packages

libmozjs-60

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Micro 5.3

Fixed in:

60.9.0-150200.6.11.1

mozjs60-devel

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Desktop Applications 15 SP7

Fixed in:

60.9.0-150200.6.11.1

References

ADVISORY

https://bugzilla.suse.com/1259713

ADVISORY

https://bugzilla.suse.com/1259728

ADVISORY

https://bugzilla.suse.com/1259731

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2026-May/046422.html

ADVISORY