SUSE-SU-2026:1870-1

Details

Description of the patch:

This update for mozjs115 fixes the following issues

CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259728).
CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713).
CVE-2026-32778: libexpat: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259731).

Affected Packages

libmozjs-115-0

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6openSUSE Leap 15.6

Fixed in:

115.4.0-150600.3.14.1

mozjs115-devel

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6openSUSE Leap 15.6

Fixed in:

115.4.0-150600.3.14.1

mozjs115

openSUSE Leap 15.6

Fixed in:

115.4.0-150600.3.14.1

References

ADVISORY

https://bugzilla.suse.com/1259713

ADVISORY

https://bugzilla.suse.com/1259728

ADVISORY