Back Linuxsecurity

SUSE OpenSSL-1_1-Livepatches Important Heap Overflow Fix 2026-4037

Linuxsecurity •LinuxSecurity Advisories • September 8, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

## This update for openssl-1_1-livepatches fixes the following issue: * CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1275133, bsc#1274788). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP7 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP7-2026-4037=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP7 (ppc64le x86_64) * openssl-1_1-livepatches-debuginfo-0.8-150700.13.12.1 * openssl-1_1-livepatches-debugsource-0.8-150700.13.12.1 * openssl-1_1-livepatches-0.8-150700.13.12.1

* CVE-2026-63072 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

* CVE-2026-63072 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* SUSE Linux Enterprise Live Patching 15-SP7

* SUSE Linux Enterprise Real Time 15 SP7

* SUSE Linux Enterprise Server 15 SP7

* SUSE Linux Enterprise Server for SAP Applications 15 SP7

An update that solves one vulnerability and has one security fix can now be

Announcement ID: SUSE-SU-2026:4037-1 Release Date: 2026-09-07T08:28:58Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OpenSSL Vulnerabilities Affecting openSUSE and SUSE snphost Two important advisories were released addressing multiple vulnerabilities in OpenSSL affecting openSUSE and SUSE snphost. The advisories detail several CVEs, including CVE-2026-54874 and CVE-2026-63072 for openSUSE, and CVE-2026-41677 and CVE-2026-41898 for SUSE snphost. The vulnerabilities range from buffer overflows to out-of-bounds reads, potentially allowing attackers to exploit these flaws for unauthorized access or denial of service. The patches are critical for systems running SUSE Linux Enterprise Server and openSUSE Leap. Administrators are urged to apply the patches immediately to mitigate risks. The vulnerabilities were disclosed between April and August 2026, with some having proof-of-concept code available. Current status indicates that while some vulnerabilities are patched, others may still pose a risk if not addressed promptly. 18 sources 65

Extracted Entities

SUSE OpenSSL-1_1-Livepatches Important Heap Overflow Fix 2026-4037

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (2)