openSUSE-SU-2026:21636-1

Опубликовано: 24 авг. 2026

Источник: suse-cvrf

Описание

Security update for pcp

This update for pcp fixes the following issues:

CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

Список пакетов

openSUSE Leap 16.0

libpcp-devel-6.2.0-160000.4.1

libpcp3-6.2.0-160000.4.1

libpcp_gui2-6.2.0-160000.4.1

libpcp_import1-6.2.0-160000.4.1

libpcp_mmv1-6.2.0-160000.4.1

libpcp_trace2-6.2.0-160000.4.1

libpcp_web1-6.2.0-160000.4.1

pcp-6.2.0-160000.4.1

pcp-conf-6.2.0-160000.4.1

pcp-devel-6.2.0-160000.4.1

pcp-doc-6.2.0-160000.4.1

pcp-export-pcp2elasticsearch-6.2.0-160000.4.1

pcp-export-pcp2graphite-6.2.0-160000.4.1

pcp-export-pcp2influxdb-6.2.0-160000.4.1

pcp-export-pcp2json-6.2.0-160000.4.1

pcp-export-pcp2spark-6.2.0-160000.4.1

pcp-export-pcp2xml-6.2.0-160000.4.1

pcp-export-pcp2zabbix-6.2.0-160000.4.1

pcp-gui-6.2.0-160000.4.1

pcp-import-collectl2pcp-6.2.0-160000.4.1

pcp-import-ganglia2pcp-6.2.0-160000.4.1

pcp-import-iostat2pcp-6.2.0-160000.4.1

pcp-import-mrtg2pcp-6.2.0-160000.4.1

pcp-import-sar2pcp-6.2.0-160000.4.1

pcp-pmda-activemq-6.2.0-160000.4.1

pcp-pmda-apache-6.2.0-160000.4.1

pcp-pmda-bash-6.2.0-160000.4.1

pcp-pmda-bonding-6.2.0-160000.4.1

pcp-pmda-cifs-6.2.0-160000.4.1

pcp-pmda-cisco-6.2.0-160000.4.1

pcp-pmda-dbping-6.2.0-160000.4.1

pcp-pmda-dm-6.2.0-160000.4.1

pcp-pmda-docker-6.2.0-160000.4.1

pcp-pmda-ds389-6.2.0-160000.4.1

pcp-pmda-ds389log-6.2.0-160000.4.1

pcp-pmda-elasticsearch-6.2.0-160000.4.1

pcp-pmda-gfs2-6.2.0-160000.4.1

pcp-pmda-gluster-6.2.0-160000.4.1

pcp-pmda-gpfs-6.2.0-160000.4.1

pcp-pmda-gpsd-6.2.0-160000.4.1

pcp-pmda-hacluster-6.2.0-160000.4.1

pcp-pmda-haproxy-6.2.0-160000.4.1

pcp-pmda-infiniband-6.2.0-160000.4.1

pcp-pmda-json-6.2.0-160000.4.1

pcp-pmda-lio-6.2.0-160000.4.1

pcp-pmda-lmsensors-6.2.0-160000.4.1

pcp-pmda-logger-6.2.0-160000.4.1

pcp-pmda-lustre-6.2.0-160000.4.1

pcp-pmda-lustrecomm-6.2.0-160000.4.1

pcp-pmda-mailq-6.2.0-160000.4.1

pcp-pmda-memcache-6.2.0-160000.4.1

pcp-pmda-mic-6.2.0-160000.4.1

pcp-pmda-mounts-6.2.0-160000.4.1

pcp-pmda-mysql-6.2.0-160000.4.1

pcp-pmda-named-6.2.0-160000.4.1

pcp-pmda-netcheck-6.2.0-160000.4.1

pcp-pmda-netfilter-6.2.0-160000.4.1

pcp-pmda-news-6.2.0-160000.4.1

pcp-pmda-nfsclient-6.2.0-160000.4.1

pcp-pmda-nginx-6.2.0-160000.4.1

pcp-pmda-nutcracker-6.2.0-160000.4.1

pcp-pmda-nvidia-gpu-6.2.0-160000.4.1

pcp-pmda-openmetrics-6.2.0-160000.4.1

pcp-pmda-openvswitch-6.2.0-160000.4.1

pcp-pmda-oracle-6.2.0-160000.4.1

pcp-pmda-pdns-6.2.0-160000.4.1

pcp-pmda-perfevent-6.2.0-160000.4.1

pcp-pmda-postfix-6.2.0-160000.4.1

pcp-pmda-rabbitmq-6.2.0-160000.4.1

pcp-pmda-redis-6.2.0-160000.4.1

pcp-pmda-resctrl-6.2.0-160000.4.1

pcp-pmda-roomtemp-6.2.0-160000.4.1

pcp-pmda-rsyslog-6.2.0-160000.4.1

pcp-pmda-samba-6.2.0-160000.4.1

pcp-pmda-sendmail-6.2.0-160000.4.1

pcp-pmda-shping-6.2.0-160000.4.1

pcp-pmda-slurm-6.2.0-160000.4.1

pcp-pmda-smart-6.2.0-160000.4.1

pcp-pmda-snmp-6.2.0-160000.4.1

pcp-pmda-sockets-6.2.0-160000.4.1

pcp-pmda-summary-6.2.0-160000.4.1

pcp-pmda-systemd-6.2.0-160000.4.1

pcp-pmda-trace-6.2.0-160000.4.1

pcp-pmda-unbound-6.2.0-160000.4.1

pcp-pmda-weblog-6.2.0-160000.4.1

pcp-pmda-zimbra-6.2.0-160000.4.1

pcp-pmda-zswap-6.2.0-160000.4.1

pcp-selinux-6.2.0-160000.4.1

pcp-system-tools-6.2.0-160000.4.1

pcp-testsuite-6.2.0-160000.4.1

pcp-zeroconf-6.2.0-160000.4.1

perl-PCP-LogImport-6.2.0-160000.4.1

perl-PCP-LogSummary-6.2.0-160000.4.1

perl-PCP-MMV-6.2.0-160000.4.1

perl-PCP-PMDA-6.2.0-160000.4.1

python3-pcp-6.2.0-160000.4.1

Ссылки

https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1272922
SUSE Bug 1272922
https://bugzilla.suse.com/1272923
SUSE Bug 1272923
https://bugzilla.suse.com/1272924
SUSE Bug 1272924
https://bugzilla.suse.com/1272925
SUSE Bug 1272925
https://bugzilla.suse.com/1272926
SUSE Bug 1272926
https://bugzilla.suse.com/1272927
SUSE Bug 1272927
https://bugzilla.suse.com/1272928
SUSE Bug 1272928
https://bugzilla.suse.com/1272930
SUSE Bug 1272930
https://www.suse.com/security/cve/CVE-2026-16524/
SUSE CVE CVE-2026-16524 page
https://www.suse.com/security/cve/CVE-2026-16526/
SUSE CVE CVE-2026-16526 page
https://www.suse.com/security/cve/CVE-2026-16527/
SUSE CVE CVE-2026-16527 page
https://www.suse.com/security/cve/CVE-2026-16529/
SUSE CVE CVE-2026-16529 page
https://www.suse.com/security/cve/CVE-2026-16530/
SUSE CVE CVE-2026-16530 page
https://www.suse.com/security/cve/CVE-2026-16531/
SUSE CVE CVE-2026-16531 page

Описание

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

Затронутые продукты

openSUSE Leap 16.0:libpcp-devel-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp3-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_gui2-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_import1-6.2.0-160000.4.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-16524.html
CVE-2026-16524
https://bugzilla.suse.com/1271393
SUSE Bug 1271393

Описание

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.

Затронутые продукты

openSUSE Leap 16.0:libpcp-devel-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp3-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_gui2-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_import1-6.2.0-160000.4.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-16526.html
CVE-2026-16526
https://bugzilla.suse.com/1271393
SUSE Bug 1271393

Описание

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

Затронутые продукты

openSUSE Leap 16.0:libpcp-devel-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp3-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_gui2-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_import1-6.2.0-160000.4.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-16527.html
CVE-2026-16527
https://bugzilla.suse.com/1271393
SUSE Bug 1271393

Описание

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

Затронутые продукты

openSUSE Leap 16.0:libpcp-devel-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp3-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_gui2-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_import1-6.2.0-160000.4.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-16529.html
CVE-2026-16529
https://bugzilla.suse.com/1271393
SUSE Bug 1271393

Описание

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

Затронутые продукты

openSUSE Leap 16.0:libpcp-devel-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp3-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_gui2-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_import1-6.2.0-160000.4.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-16530.html
CVE-2026-16530
https://bugzilla.suse.com/1271393
SUSE Bug 1271393

Описание

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Затронутые продукты

openSUSE Leap 16.0:libpcp-devel-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp3-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_gui2-6.2.0-160000.4.1

openSUSE Leap 16.0:libpcp_import1-6.2.0-160000.4.1

Ссылки

https://www.suse.com/security/cve/CVE-2026-16531.html
CVE-2026-16531
https://bugzilla.suse.com/1271393
SUSE Bug 1271393

openSUSE-SU-2026:21636-1

Описание

Список пакетов

openSUSE Leap 16.0

Ссылки

Уязвимость: CVE-2026-16524

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-16526

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-16527

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-16529

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-16530

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2026-16531

Описание

Затронутые продукты

Ссылки