Описание
Security update for yq
This update for yq fixes the following issues:
- CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267053).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1267199).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
Ссылки
- Link for SUSE-SU-2026:2285-1
- E-Mail link for SUSE-SU-2026:2285-1
- SUSE Security Ratings
- SUSE Bug 1267053
- SUSE Bug 1267199
- SUSE CVE CVE-2026-25680 page
- SUSE CVE CVE-2026-25681 page
- SUSE CVE CVE-2026-27136 page
- SUSE CVE CVE-2026-39821 page
- SUSE CVE CVE-2026-42502 page
- SUSE CVE CVE-2026-42506 page
Описание
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
Затронутые продукты
Ссылки
- CVE-2026-25680
- SUSE Bug 1267044
Описание
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Затронутые продукты
Ссылки
- CVE-2026-25681
- SUSE Bug 1267044
Описание
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Затронутые продукты
Ссылки
- CVE-2026-27136
- SUSE Bug 1267044
Описание
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Затронутые продукты
Ссылки
- CVE-2026-39821
- SUSE Bug 1266474
Описание
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Затронутые продукты
Ссылки
- CVE-2026-42502
- SUSE Bug 1267044
Описание
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Затронутые продукты
Ссылки
- CVE-2026-42506
- SUSE Bug 1267044