Packages changed: MicroOS-release (20260923 -> 20260924) coreutils (9.11 -> 9.12) coreutils-systemd (9.11 -> 9.12) flatpak (1.18.2 -> 1.18.3) kernel-source (7.2.6 -> 7.2.7) librsvg (2.62.3 -> 2.62.4) sysvinit (3.14 -> 3.18) tesseract-ocr === Details === ==== MicroOS-release ==== Version update (20260923 -> 20260924) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== coreutils ==== Version update (9.11 -> 9.12) - coreutils-9.12-env-quote-fix.patch: Add post-release upstream patch to revert env(1) behavior, i.e., only quote when outputting to terminals. - coreutils-i18n.patch: Sync with Fedora. * src/linebuffer.h: Remove unnecessary hunk. Avoid false-positives in French locale: * tests/Coreutils.pm: Adjust test name length for "-mb" suffix. * tests/pr/pr-tests.pl: Skip "neg-page" test. * tests/sort/sort.pl: Skip "invalid-parallel" test. - Update to 9.12: Bug fixes * 'chcon', 'chgrp', 'chmod', 'chown', 'du', 'ls' which traverse hierarchies with - R, no longer fail merely because files may be being removed in parallel. [This bug was present in "the beginning".] * 'comm - -' no longer closes standard input twice. Previously it would mistakenly exit with a nonzero status. [This bug was present in "the beginning".] * 'cp', 'install', and 'mv' now fall back to a standard copy if a --reflink=auto clone fails due to EDQUOT, ENOMEM, or ENOSPC. E.g., with XFS, a clone can exhaust metadata space in an allocation group, while a standard copy works. [bug introduced in coreutils-9.2] * 'cut -d' with multiple multi-byte delimiter options specified will correctly match the last delimiter specified. [bug introduced with multi-byte support in coreutils-9.11] * 'date -d '1-2-3' "+%_D"' no longer propagates flags like _ and - to the year component of the %D date specifier, keeping consistent component formatting. [bug introduced in coreutils-8.31] * 'du --max-depth=N' now exits with a nonzero exit status and an error message if N is negative. Previously it behaved as if N were zero. [bug introduced in coreutils-9.4] * 'factor' avoids a buffer over-read (CWE-126) for certain values. [bug introduced in coreutils-9.8] * 'head' and 'tail' now quote names in file headers when needed. [This bug was present in "the beginning".] * 'ls --color' no longer reads freed memory when LS_COLORS sets "ln=target" and later becomes unparsable, e.g., LS_COLORS='ln=target:x'. [This bug was present in "the beginning".] * 'mv' now warns when copying extended attributes fails with ENOTSUP, e.g., when moving files to a file system that does not support them. [bug introduced in coreutils-7.3] * 'numfmt', 'printf', and 'seq' on Solaris, no longer output an extraneous e+00 when using a large precision like "%.5119f". [This bug was present in "the beginning".] * 'pinky -l' no longer no longer prints output in the incorrect order when standard output is fully buffered, e.g., when redirected to a file. [bug introduced in coreutils-9.10] * 'pr' now exits gracefully upon exceeding internal accounting limits, like when processing large tab stops. [This bug was present in "the beginning".] * 'ptx -G' no longer loops forever when the output width is smaller than twice the gap size, as with 'ptx -G -w4', or when a long reference leaves that little room, as with 'ptx -G -r'. [This bug was present in "the beginning".] * 'ptx -W' no longer loops forever with a word regular expression that can match the empty string, like: echo ab | ptx -W 'a*'. [This bug was present in "the beginning".] * 'shred' no longer blocks when opening a FIFO that has no readers. [This bug was present in "the beginning".] * 'stty' no longer fails when the system uses speed encodings that are variations of the requested speed. [bug introduced in coreutils-9.8] * 'tee' no longer loops infinitely after writing all output if a write call sets errno to EAGAIN. [bug introduced in coreutils-9.11] * 'tee' no longer treats short writes as errors. [bug introduced in coreutils-9.11] * 'test' no longer treats '-a' and '-o' as operators when given as strings to a binary operator. E.g., 'test -a -a -a' exits successfully instead of exiting with an error. [This bug was present in "the beginning".] * 'truncate --reference=R' no longer hangs when R is a FIFO with no readers. [bug introduced in coreutils-8.17] * 'unexpand -t' no longer overflows a heap buffer, for tab values > SIZE_MAX/16, or with multi-byte blank characters longer than the tab value. [bugs introduced in coreutils-9.11] * 'uniq -w' no longer overruns the read buffer in multibyte locales. [bug introduced in coreutils-9.5] * 'wc' no longer reads past the end of a lookup table in legacy multibyte locales like SHIFT-JIS where a single byte can decode to a wide character. [bug introduced in coreutils-9.5] * Messages from Gnulib are no longer mistranslated in non-English locales. [bug introduced in coreutils-9.6] New Features * 'env' now supports --env0-from=FILE to read NUL-delimited environment entries from a file. With -i, entries are preserved exactly, allowing full round-tripping of environments containing duplicate or nonstandard entries. * 'stat' and 'tail' now know about the "failfs" and "nullfs" file system types. stat -f -c%T now reports the file system type, and tail -f uses inotify for these file systems. * uname adds the -A,--all-labeled option to label all output, one item per line. Changes in behavior * 'env' and 'printenv' now quote printed environment variables honoring the QUOTING_STYLE environment variable, defaulting to shell-escape style. This avoids printing arbitrary data to the terminal and allows the output to be sourced by a POSIX shell. * 'ls' -w,--width no longer includes '\n' in the width of a line. I.e., the width or $COLUMNS is interpreted to be an _inclusive_ maximum. * 'stat' now uses shell quoting when required, to more robustly escape file names. Previously it only quoted file names with the %N format. ... changelog too long, skipping 47 lines ... - Refresh all other patches. ==== coreutils-systemd ==== Version update (9.11 -> 9.12) - coreutils-9.12-env-quote-fix.patch: Add post-release upstream patch to revert env(1) behavior, i.e., only quote when outputting to terminals. - coreutils-i18n.patch: Sync with Fedora. * src/linebuffer.h: Remove unnecessary hunk. Avoid false-positives in French locale: * tests/Coreutils.pm: Adjust test name length for "-mb" suffix. * tests/pr/pr-tests.pl: Skip "neg-page" test. * tests/sort/sort.pl: Skip "invalid-parallel" test. - Update to 9.12: Bug fixes * 'chcon', 'chgrp', 'chmod', 'chown', 'du', 'ls' which traverse hierarchies with - R, no longer fail merely because files may be being removed in parallel. [This bug was present in "the beginning".] * 'comm - -' no longer closes standard input twice. Previously it would mistakenly exit with a nonzero status. [This bug was present in "the beginning".] * 'cp', 'install', and 'mv' now fall back to a standard copy if a --reflink=auto clone fails due to EDQUOT, ENOMEM, or ENOSPC. E.g., with XFS, a clone can exhaust metadata space in an allocation group, while a standard copy works. [bug introduced in coreutils-9.2] * 'cut -d' with multiple multi-byte delimiter options specified will correctly match the last delimiter specified. [bug introduced with multi-byte support in coreutils-9.11] * 'date -d '1-2-3' "+%_D"' no longer propagates flags like _ and - to the year component of the %D date specifier, keeping consistent component formatting. [bug introduced in coreutils-8.31] * 'du --max-depth=N' now exits with a nonzero exit status and an error message if N is negative. Previously it behaved as if N were zero. [bug introduced in coreutils-9.4] * 'factor' avoids a buffer over-read (CWE-126) for certain values. [bug introduced in coreutils-9.8] * 'head' and 'tail' now quote names in file headers when needed. [This bug was present in "the beginning".] * 'ls --color' no longer reads freed memory when LS_COLORS sets "ln=target" and later becomes unparsable, e.g., LS_COLORS='ln=target:x'. [This bug was present in "the beginning".] * 'mv' now warns when copying extended attributes fails with ENOTSUP, e.g., when moving files to a file system that does not support them. [bug introduced in coreutils-7.3] * 'numfmt', 'printf', and 'seq' on Solaris, no longer output an extraneous e+00 when using a large precision like "%.5119f". [This bug was present in "the beginning".] * 'pinky -l' no longer no longer prints output in the incorrect order when standard output is fully buffered, e.g., when redirected to a file. [bug introduced in coreutils-9.10] * 'pr' now exits gracefully upon exceeding internal accounting limits, like when processing large tab stops. [This bug was present in "the beginning".] * 'ptx -G' no longer loops forever when the output width is smaller than twice the gap size, as with 'ptx -G -w4', or when a long reference leaves that little room, as with 'ptx -G -r'. [This bug was present in "the beginning".] * 'ptx -W' no longer loops forever with a word regular expression that can match the empty string, like: echo ab | ptx -W 'a*'. [This bug was present in "the beginning".] * 'shred' no longer blocks when opening a FIFO that has no readers. [This bug was present in "the beginning".] * 'stty' no longer fails when the system uses speed encodings that are variations of the requested speed. [bug introduced in coreutils-9.8] * 'tee' no longer loops infinitely after writing all output if a write call sets errno to EAGAIN. [bug introduced in coreutils-9.11] * 'tee' no longer treats short writes as errors. [bug introduced in coreutils-9.11] * 'test' no longer treats '-a' and '-o' as operators when given as strings to a binary operator. E.g., 'test -a -a -a' exits successfully instead of exiting with an error. [This bug was present in "the beginning".] * 'truncate --reference=R' no longer hangs when R is a FIFO with no readers. [bug introduced in coreutils-8.17] * 'unexpand -t' no longer overflows a heap buffer, for tab values > SIZE_MAX/16, or with multi-byte blank characters longer than the tab value. [bugs introduced in coreutils-9.11] * 'uniq -w' no longer overruns the read buffer in multibyte locales. [bug introduced in coreutils-9.5] * 'wc' no longer reads past the end of a lookup table in legacy multibyte locales like SHIFT-JIS where a single byte can decode to a wide character. [bug introduced in coreutils-9.5] * Messages from Gnulib are no longer mistranslated in non-English locales. [bug introduced in coreutils-9.6] New Features * 'env' now supports --env0-from=FILE to read NUL-delimited environment entries from a file. With -i, entries are preserved exactly, allowing full round-tripping of environments containing duplicate or nonstandard entries. * 'stat' and 'tail' now know about the "failfs" and "nullfs" file system types. stat -f -c%T now reports the file system type, and tail -f uses inotify for these file systems. * uname adds the -A,--all-labeled option to label all output, one item per line. Changes in behavior * 'env' and 'printenv' now quote printed environment variables honoring the QUOTING_STYLE environment variable, defaulting to shell-escape style. This avoids printing arbitrary data to the terminal and allows the output to be sourced by a POSIX shell. * 'ls' -w,--width no longer includes '\n' in the width of a line. I.e., the width or $COLUMNS is interpreted to be an _inclusive_ maximum. * 'stat' now uses shell quoting when required, to more robustly escape file names. Previously it only quoted file names with the %N format. ... changelog too long, skipping 47 lines ... - Refresh all other patches. ==== flatpak ==== Version update (1.18.2 -> 1.18.3) Subpackages: flatpak-selinux libflatpak0 system-user-flatpak - Update to version 1.18.3: + Bug fixes: - Update Meson wrap subprojects for projects that are normally taken from the host system: . bubblewrap 0.12.0 (CVE-2026-87766) . xdg-dbus-proxy 0.1.8 (CVE-2026-93676) - Fix regressions in 1.18.2 when building apps/runtimes, especially on SELinux systems or when the runtime is not installed per-user - Fix subsandbox startup (`flatpak-spawn`) when run from an app that was configured with `--no-talk-name` or `--system-no-talk-name` - Fix a crash when a bundle is installed with explicit key bytes - Documentation updates (code of conduct, contributor guidelines) ==== kernel-source ==== Version update (7.2.6 -> 7.2.7) - Update patches.kernel.org/7.2.4-001-drm-amd-display-Skip-Update-HDCP-Config-In-Tran.patch (bsc#1012628 CVE-2026-89773 bsc#1280700). - Update patches.kernel.org/7.2.4-009-btrfs-write-protect-folios-during-data-writebac.patch (bsc#1012628 CVE-2026-89772 bsc#1280699). - Update patches.kernel.org/7.2.4-010-ring-buffer-Fix-subbuf-resize-race-with-ring-bu.patch (bsc#1012628 CVE-2026-89771 bsc#1280712). - Update patches.kernel.org/7.2.4-014-iomap-don-t-free-integrity-payload-that-doesn-t.patch (bsc#1012628 CVE-2026-89770 bsc#1280710). - Update patches.kernel.org/7.2.4-017-clocksource-drivers-nxp-pit-Fix-IRQ-leak-on-cpu.patch (bsc#1012628 CVE-2026-89769 bsc#1280708). - Update patches.kernel.org/7.2.4-019-fs-fix-user-path-of-nested-backing-files.patch (bsc#1012628 CVE-2026-89768 bsc#1280734). - Update patches.kernel.org/7.2.4-020-ovl-fix-double-end_creating-on-the-casefold-mis.patch (bsc#1012628 CVE-2026-89767 bsc#1280730). - Update patches.kernel.org/7.2.4-021-pidfd-hold-exec_update_lock-around-namespace-io.patch (bsc#1012628 CVE-2026-89766 bsc#1280725). - Update patches.kernel.org/7.2.4-024-timers-itimer-Zero-init-old-itimerval-before-co.patch (bsc#1012628 CVE-2026-89765 bsc#1281182). - Update patches.kernel.org/7.2.4-032-rust-devres-fix-race-between-concurrent-revoker.patch (bsc#1012628 CVE-2026-89764 bsc#1280818). - Update patches.kernel.org/7.2.4-041-KEYS-trusted-Fix-TPM-teardown-ordering.patch (bsc#1012628 CVE-2026-89763 bsc#1280820). - Update patches.kernel.org/7.2.4-042-apparmor-fix-cred-UAF-caused-by-begin_current_l.patch (bsc#1012628 CVE-2026-89762 bsc#1280749). - Update patches.kernel.org/7.2.4-043-apparmor-fix-out-of-bounds-write-when-null-term.patch (bsc#1012628 CVE-2026-89761 bsc#1280745). - Update patches.kernel.org/7.2.4-045-mm-swap-don-t-free-a-hibernation-slot-that-is-i.patch (bsc#1012628 CVE-2026-89760 bsc#1280740). - Update patches.kernel.org/7.2.4-053-mm-kmemleak-avoid-soft-lockup-when-scanning-tas.patch (bsc#1012628 CVE-2026-89759 bsc#1280821). - Update patches.kernel.org/7.2.4-055-mm-mempolicy-skip-non-present-PMDs-when-queuein.patch (bsc#1012628 CVE-2026-89758 bsc#1280757). - Update patches.kernel.org/7.2.4-056-mm-mglru-fix-and-remove-redundant-unevictable-f.patch (bsc#1012628 CVE-2026-89757 bsc#1280763). - Update patches.kernel.org/7.2.4-057-mm-migrate-report-RCU-tasks-quiescent-states-in.patch (bsc#1012628 CVE-2026-89756 bsc#1280756). - Update patches.kernel.org/7.2.4-059-mm-migrate_device-clear-stale-mapping-after-fre.patch (bsc#1012628 CVE-2026-89755 bsc#1280770). - Update patches.kernel.org/7.2.4-063-mm-pagewalk-fix-stale-walk-action-escaping-walk.patch (bsc#1012628 CVE-2026-89754 bsc#1280769). - Update patches.kernel.org/7.2.4-069-mm-vmscan-report-RCU-tasks-quiescent-states-in-.patch (bsc#1012628 CVE-2026-89753 bsc#1281178). - Update patches.kernel.org/7.2.4-074-mm-memcg-stop-reclaim-when-a-limit-update-is-su.patch (bsc#1012628 CVE-2026-89752 bsc#1281176). - Update patches.kernel.org/7.2.4-084-x86-tdx-Fix-off-by-one-in-port-I-O-handling.patch (bsc#1012628 CVE-2026-89751 bsc#1280822). - Update patches.kernel.org/7.2.4-088-tracing-user_events-Clear-copied-tracing-state-.patch (bsc#1012628 CVE-2026-89750 bsc#1281172). - Update patches.kernel.org/7.2.4-089-tracing-Fix-crash-passing-ERR_PTR-to-kthread_st.patch (bsc#1012628 CVE-2026-89749 bsc#1281166). - Update patches.kernel.org/7.2.4-091-tracing-Fix-retry-exhaustion-in-simple-ring-buf.patch (bsc#1012628 CVE-2026-89748 bsc#1281024). - Update patches.kernel.org/7.2.4-092-tracing-Fix-use-after-free-in-trace_pipe-read-o.patch (bsc#1012628 CVE-2026-89747 bsc#1281025). - Update patches.kernel.org/7.2.4-093-tracing-Fix-use-after-free-with-same-name-named.patch (bsc#1012628 CVE-2026-89746 bsc#1281026). - Update patches.kernel.org/7.2.4-095-debugfs-Fix-lockdown-check-for-mmap_prepare.patch (bsc#1012628 CVE-2026-89745 bsc#1281209). - Update patches.kernel.org/7.2.4-096-device-property-fix-infinite-loop-in-fwnode_for.patch (bsc#1012628 CVE-2026-89744 bsc#1281029). - Update patches.kernel.org/7.2.4-097-misc-nsm-bound-the-device-reported-response-len.patch (bsc#1012628 CVE-2026-89743 bsc#1281028). - Update patches.kernel.org/7.2.4-099-rapidio-mport_cdev-fix-use-after-free-in-dma_re.patch (bsc#1012628 CVE-2026-89742 bsc#1281027). - Update patches.kernel.org/7.2.4-100-Revert-media-v4l2-dev-fix-error-handling-in-__v.patch (bsc#1012628 CVE-2026-89741 bsc#1281030). ... changelog too long, skipping 3942 lines ... - commit 125ac6f ==== librsvg ==== Version update (2.62.3 -> 2.62.4) - Update to version 2.62.4: + librsvg crate version 2.62.4 + librsvg-rebind crate version 0.3.0 + Fix use-after-free when there are duplicate XML entities in nested Xinclude documents. + Dependency updates: lopdf for RUSTSEC-2026-0187, crossbeam-epoch for RUSTSEC-2026-0204. ==== sysvinit ==== Version update (3.14 -> 3.18) - Update to sysvinit 3.18 * This release fixes builds with man pages when language-specific directories are not available. * Removed unused "check" command from Makefile. * Fix version number in init.c and changelog. * Remove shell script which has a license conflict from contrib directory. * Clean up of inittab manual page (typos and syntax) by Bjarni Ingi Gislason. * Clean up of init manual page (typos and syntax) by Bjarni Ingi Gislason. * Improved systemd to sysv unit-to-script conversion. Provided by avivdaum. * Remove some debug/status messages when reading the /etc/inittab.d/ directory. * Document how init reads the inittab.d directory in the inittab manual page. * Removed unused variable/code from sulogin * Some manual page clean-up for init to fix typos and formatting. * Small change to optimize getting string length in a loop in init. * Small fixes for formatting and typos in runlevel manual page. - Update to startpar 0.67 * This release introduces no feature changes, but does clean up compiler issues with GCC 15 and newer. Following the compiler's C standards we now use stdbool.h instead of defining our own boolean type. ==== tesseract-ocr ==== Subpackages: libtesseract5 tesseract-ocr-common - CVE-2026-88047: stack buffer overflow in Classify::ReadNormProtos on crafted traineddata (boo#1280925) * tesseract-CVE-2026-88047.patch - CVE-2026-88048: heap out-of-bounds write/read in FullyConnected::Forward via dimension mismatch (boo#1280929) * tesseract-CVE-2026-88048.patch - CVE-2026-88049: heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch (boo#1280930) * tesseract-CVE-2026-88049.patch - CVE-2026-88050: out-of-bounds write in UnicharCompress via unvalidated recoder code values (boo#1280931) * tesseract-CVE-2026-88050.patch - CVE-2026-88051: heap out-of-bounds write in GenericVector::read via reserved/size_used_ mismatch (boo#1280932) * tesseract-CVE-2026-88051.patch - CVE-2026-88052: heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization (boo#1280933) * tesseract-CVE-2026-88052.patch - CVE-2026-88053: heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted traineddata (boo#1280934) * tesseract-CVE-2026-88053.patch - CVE-2026-88054: denial of service via empty-stack dereference at model load (boo#1280935) * tesseract-CVE-2026-88054.patch - CVE-2026-73067 (boo#1275623): heap out-of-bounds read in SquishedDawg on crafted model, already fixed in the shipped 5.5.3 (DAWG edge-structure validation).