SUSE-SU-2026:2388-1

Details

Description of the patch:

This update for qemu fixes the following issues:

Security fixes:

CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).

Other fixes:

[openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023)

Affected Packages(23 packages)

qemu-sgabios

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Micro 5.5SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

8-150500.49.42.1

qemu

SUSE Linux Enterprise Micro 5.5

Fixed in:

7.1.0-150500.49.42.1

qemu-SLOF

SUSE Linux Enterprise Micro 5.5

Fixed in:

7.1.0-150500.49.42.1

qemu-accel-tcg-x86

SUSE Linux Enterprise Micro 5.5