Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here.
Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=3&version=Tumbleweed&build=20260921 Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: Mesa (26.2.2 -> 26.2.3) Mesa-drivers (26.2.2 -> 26.2.3) MozillaFirefox (154.0 -> 156.0) libX11 libXrender libtpms mozilla-nss (3.127 -> 3.128) openSUSE-release (20260919 -> 20260921) qt6-webengine xxhash (0.8.3 -> 0.8.4) === Details === ==== Mesa ==== Version update (26.2.2 -> 26.2.3) Subpackages: Mesa-libEGL1 Mesa-libGL1 libgbm1 - Update to 26.2.3 bugfix release - -> https://docs.mesa3d.org/relnotes/26.2.3 ==== Mesa-drivers ==== Version update (26.2.2 -> 26.2.3) Subpackages: Mesa-dri Mesa-libva Mesa-vulkan-device-select libvulkan_lvp - Update to 26.2.3 bugfix release - -> https://docs.mesa3d.org/relnotes/26.2.3 ==== MozillaFirefox ==== Version update (154.0 -> 156.0) Subpackages: MozillaFirefox-branding-upstream - Mozilla Firefox 156.0 https://www.firefox.com/en-US/firefox/156.0/releasenotes/ MFSA 2026-90 (bsc#1280371) * CVE-2026-92033 (bmo#2047339) Privilege escalation in Firefox for Android * CVE-2026-92005 (bmo#2056051) Use-after-free in the Audio/Video: Web Codecs component * CVE-2026-92006 (bmo#2057121) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92007 (bmo#2058064) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92008 (bmo#2058065) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92009 (bmo#2058066) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92010 (bmo#2058067) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92011 (bmo#2058068) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92012 (bmo#2058069) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92013 (bmo#2058078) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-92015 (bmo#2060235) Privilege escalation in the WebExtensions component * CVE-2026-92034 (bmo#2060295) Site isolation issue in the Graphics component * CVE-2026-92035 (bmo#2061245) Sandbox escape due to incorrect boundary conditions in the Graphics component * CVE-2026-92016 (bmo#2061327) Use-after-free in the Disability Access APIs component * CVE-2026-92017 (bmo#2061777) Privilege escalation in the DOM: Service Workers component * CVE-2026-92018 (bmo#2064287) Sandbox escape in the DOM: Core & HTML component * CVE-2026-92019 (bmo#2065636) Mitigation bypass in the Remote Settings Client component * CVE-2026-92020 (bmo#2066329) Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component * CVE-2026-92022 (bmo#2068059) Use-after-free in the DOM: HTML Parser component * CVE-2026-92023 (bmo#2068342) Use-after-free in the XML component * CVE-2026-92024 (bmo#2068354) Use-after-free in the SVG component * CVE-2026-92025 (bmo#2068361) Use-after-free in the DOM: Navigation component * CVE-2026-92026 (bmo#2068378) Use-after-free in the Networking component * CVE-2026-92036 (bmo#2068416) Incorrect boundary conditions in the Networking: HTTP component * CVE-2026-92027 (bmo#2068433) Use-after-free in the DOM: Streams component * CVE-2026-92028 (bmo#2068440) Use-after-free in the DOM: Core & HTML component * CVE-2026-92029 (bmo#2068445) Use-after-free in the SVG component * CVE-2026-92037 (bmo#2068460) Incorrect boundary conditions in the DOM: Animation component * CVE-2026-92038 (bmo#2068952) Mitigation bypass in the Remote Settings Client component * CVE-2026-92039 (bmo#2001265) Mitigation bypass in the DOM: Notifications component * CVE-2026-92040 (bmo#2024248) Use-after-free in the JavaScript: WebAssembly component * CVE-2026-92041 (bmo#2029482) Mitigation bypass in the DOM: Networking component * CVE-2026-92042 (bmo#2049342) Race condition in the DOM: Content Processes component * CVE-2026-92043 (bmo#2050150) Privilege escalation due to incorrect boundary conditions in the Audio/Video component * CVE-2026-92044 (bmo#2051466) Information disclosure in the Networking: HTTP component * CVE-2026-92045 (bmo#2054622) Sandbox escape due to incorrect boundary conditions in the WebRTC component * CVE-2026-92030 (bmo#2058417) Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component * CVE-2026-92046 (bmo#2058618) Use-after-free in the Graphics component * CVE-2026-92047 (bmo#2059021) Privilege escalation in the Crash Reporting component * CVE-2026-92048 (bmo#2061235) Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component * CVE-2026-92049 (bmo#2061295) Use-after-free in the Widget: Win32 component ... changelog too long, skipping 186 lines ... start when the system font was MS UI Gothic. (bmo#2056856) ==== libX11 ==== Subpackages: libX11-6 libX11-data libX11-xcb1 - u_xkb-Check-the-keysym-range-in-_XkbReadKeyActions-CVE.patch * libX11 XkbGetMap Reply Heap-based Buffer Overflow (CVE-2026-88806, ZDI-CAN-32061, bsc#1280910) ==== libXrender ==== - u_Check-numSubpixel-against-numScreens-to-avoid-OOB-wr.patch * A malicious server could reply to XRenderQueryFormat with a numSubpixels count greater than the number of screens, causing an OOB write into screen->subpixel which was allocated using numScreens (CVE-2026-88807, ZDI-CAN-32093, bsc#1280911) ==== libtpms ==== - CVE-2026-85769: Fixed heap out-of-bounds read in TPM2 state unmarshalling via unchecked block_skip_read() blocksize (bsc#1279628) - libtpms-CVE-2026-85769.patch ==== mozilla-nss ==== Version update (3.127 -> 3.128) Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs mozilla-nss-tools - update to NSS 3.128 * bmo#2063360 - Rejoin the table cells the conversion wrapped mid-construct * bmo#2063360 - Generate heading anchors and stop the headings linking to themselves * bmo#2063360 - Unlink the self-linking headings in the release notes * bmo#2063360 - Point documentation cross-references at the dashed anchors * bmo#2063360 - Fix doc-lint in the release process * bmo#2066375 - Make fuzz tasks selectable with try syntax * bmo#2066375 - Build Cryptofuzz in its own CI task * bmo#2066604 - fix EC public key encoding in sftk_PutPubKey * bmo#2066183 - set CKA_ID on imported private keys * bmo#2017925 - Hash prfs need to be evaluated for indicators * bmo#2066327 - rename libcrux gyp target * bmo#2066415 - Update BoGo tests to disable ML_DSA Default test * bmo#2065354 - unify the two clang-format docker images * bmo#2056265 - -trust-cert for TLS BoGo tests * bmo#2056235 - DTLS1.2/1.3 - silently discard invalid records * bmo#2052273 - Adding -trust-cert support for BoGo DTLS tests * bmo#2063443 - nullify dangling pointers in libssl, pk11wrap, and softoken * bmo#2027768 - Fix build failure due to missing gcm stubs if on big endian * bmo#2065354 - clang-format everything * bmo#2065354 - Update clang-format version to 22 * bmo#2054818 - make mach try work with git-cinnabar checkouts * bmo#2054696 - avoid integer overflow in PK11SDR_EncryptWithMechanism * bmo#2056778 - fix slot over-release in PK11_FindCertFromDERCertItem * bmo#2056789 - fix missing BAD_PARAM_CAST in NSC_DeriveKey CKM_DES3_CBC_ENCRYPT_DATA branch * bmo#2064946 - additional ML-DSA ssl gtests * bmo#2064644 - ml_dsat.h: portable comments should use block comment style * bmo#1983320 - ml-dsa tls tests * bmo#2056787 - hold handshake locks longer in SSL_ResetHandshake * bmo#1983320 - ML-DSA tests for Sign/Verify, certificates and pkcs12 * bmo#2056786 - take smime profile lock while updating profile data * bmo#2062824 - add defensive null checks in PK11_Encapsulate and PK11_Decapsulate * bmo#2062822 - nulled slot in pk11_loadPrivKeyWithFlags leads to token object leak * bmo#2062802 - handle ML-KEM in stfk_CopyTokenPrivateKey and stfk_CopyTokenPublicKey * bmo#2062450 - Allow unknown hashAlg with ML-DSA in VFY_VerifyDataDirect * bmo#2062379 - additional ML-KEM tests * bmo#2062375 - handle unknown ML-KEM parameter sets in PK11_ExtractPublicKey * bmo#2062373 - missing CKP_NSS_ML_KEM_768 branches in seckey helper functions * bmo#2062372 - remove unused sftk_kyber_AllocCiphertextItem function * bmo#2060302 - additional ML-DSA tests * bmo#2060358 - add wycheproof tests for ML-KEM and ML-DSA * bmo#2060302 - vendor libcrux ML-DSA and enable the ML-DSA freebl backend * bmo#2060301 - bump libcrux and re-vendor ML-KEM from the combined C extraction * bmo#2027352 - validate IV length for CKM_RC2_CBC in pk11_ParamFromIVWithLen * bmo#1983320 - ml-dsa tls patch * bmo#2056775 - protect nssPKIObject.cryptoContext with a lock - rebase add-relro-linker-option.patch ==== openSUSE-release ==== Version update (20260919 -> 20260921) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== qt6-webengine ==== Subpackages: libQt6WebEngineCore6 libQt6WebEngineQuick6 libQt6WebEngineWidgets6 qt6-webengine-imports - Add upstream patch to fix renderer crash on sites that use encodings other than utf-8 (QTBUG-149435, QTBUG-149946): * Fix-renderer-crash-when-registering-ICU-encoding-names.patch - Add upstream patch to fix huge memory usage due to an ineffective garbage collector (QTBUG-150026): * enable-memory-barriers.patch ==== xxhash ==== Version update (0.8.3 -> 0.8.4) - Update to release 0.8.4 * This release adds vectorized implementations for the RISC-V Vector extension and LoongArch LASX. * Prefer NEON over SVE on AArch64, improving XXH3 speed by 25â40%. * `xxhsum` can now receive a full 64-bit seed through option `-s`. * When processing a list of files, read errors no longer prevent subsequent files from being processed.
