Back Linuxsecurity

openSUSE Leap 15.4 php-composer2 Vulnerability Fixes SUSE-2026-0935

Linuxsecurity •LinuxSecurity Advisories • March 20, 2026

This update for php-composer2 fixes the following issues: CVE-2025-67746: Fixed ANSI control characters injection in the terminal output of various Composer commands via attacker controlled remote sources. (bsc#1255768)

## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2026-935=1

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

zypper in -t patch SUSE-2026-935=1

* openSUSE Leap 15.4 (noarch) * php-composer2-2.2.3-150400.3.15.1

* openSUSE Leap 15.4 (noarch)

* php-composer2-2.2.3-150400.3.15.1

* bsc#1255768 ## References: * *

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

openSUSE 15.4 php-composer2 Vulnerability Fix Addressed An update for php-composer2 in openSUSE Leap 15.4 has been released to fix CVE-2025-67746, which involves ANSI control characters injection in terminal outputs of Composer commands. This vulnerability allows attackers to exploit remote sources to inject malicious control characters. The affected systems include openSUSE Leap 15.4, and users are advised to apply the patch immediately. The vulnerability was published on December 30, 2025, and has a low CVSS score indicating moderate severity. The patch can be installed using the recommended SUSE installation methods or via the command line. Users should ensure their systems are updated to mitigate potential risks associated with this vulnerability. 2 sources 31

Extracted Entities

openSUSE Leap 15.4 php-composer2 Vulnerability Fixes SUSE-2026-0935

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)