openSUSE 2026-3947-1 yast2

Back Linuxsecurity

openSUSE 2026-3947-1 yast2

Linuxsecurity •LinuxSecurity Advisories • September 3, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

This update for yast2-users fixes the following issue:

Update to version 4.5.8.

* CVE-2026-59680: OS command injection via LDAP-supplied

`shadowLastChange`/`shadowExpire` attribute (bsc#1272839).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 15 SP5 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3947=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-3947=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5

zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3947=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-3947=1

zypper in -t patch SUSE-2026-3947=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)

* yast2-users-4.5.8-150500.3.11.1

* yast2-users-debuginfo-4.5.8-150500.3.11.1

* yast2-users-debugsource-4.5.8-150500.3.11.1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64

* yast2-users-4.5.8-150500.3.11.1

* yast2-users-debuginfo-4.5.8-150500.3.11.1

* yast2-users-debugsource-4.5.8-150500.3.11.1

* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)

* yast2-users-4.5.8-150500.3.11.1

* yast2-users-debuginfo-4.5.8-150500.3.11.1

* yast2-users-debugsource-4.5.8-150500.3.11.1

* openSUSE Leap 15.5 (aarch64 i586 ppc64le s390x x86_64)

* yast2-users-4.5.8-150500.3.11.1

* yast2-users-debuginfo-4.5.8-150500.3.11.1

* yast2-users-debugsource-4.5.8-150500.3.11.1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64

* yast2-users-4.5.8-150500.3.11.1

* yast2-users-debuginfo-4.5.8-150500.3.11.1

* yast2-users-debugsource-4.5.8-150500.3.11.1

*

*

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple SUSE yast2-users Vulnerabilities Addressed in September 2026 Updates On September 1, 2026, SUSE released updates addressing a critical OS command injection vulnerability (CVE-2026-59680) affecting yast2-users. This vulnerability allows attackers to exploit LDAP-supplied attributes, potentially leading to unauthorized command execution. Multiple versions of SUSE Linux Enterprise Server and openSUSE are affected, with updates released for versions 12 SP5, 15 SP4, 15 SP5, 15 SP6, and 15 SP7. The updates are crucial for maintaining system security and preventing exploitation. Another vulnerability, CVE-2026-37458, related to the Quagga routing software, was also disclosed, allowing for denial-of-service attacks. The updates are rated important, and users are urged to apply them promptly to mitigate risks. 11 sources 61

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CWE Weaknesses (1)

CWE-78 - OS Command Injection

MITRE ATT&CK (1)

T1059 - Command and Scripting Interpreter