SUSE-SU-2026:1956-1

Details

Description of the patch:

This update for mozjs78 fixes the following issues

CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259728).
CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing (bsc#1259713).
CVE-2026-32778: libexpat: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259731).

Affected Packages

libmozjs-78-0

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Package Hub 15 SP7

Fixed in:

78.15.0-150400.3.17.1

mozjs78-devel

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

78.15.0-150400.3.17.1

References

ADVISORY

https://bugzilla.suse.com/1259713

ADVISORY

https://bugzilla.suse.com/1259728

ADVISORY

https://bugzilla.suse.com/1259731

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2026-May/046527.html

ADVISORY