openSUSE-SU-2026:21166-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21166-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21166-1
Upstream
CVE (3)
Related
Published
2026-06-29T08:14:36Z
Modified
2026-06-30T09:15:07Z
Summary
Security update for nano
Details

This update for nano fixes the following issues:

Changes in nano:

  • Update to version 9.1:

    • When searching, the viewport is placed snug left where possible.
    • The ability to read and write files in old Mac format (a lone carriage return as line ending) was removed.
    • The ^T toggle between WhereIs and GotoLine was dropped.
    • Fix backups that were missing or had a wrong timestamp when --backup is active.
    • On a crash or kill, a .save file is no longer chmodded or chowned to the base file's permissions and owner.
    • The history code now creates the ~/.local directory with limited access rights (boo#1263437; the referenced CVE-2026-40556 was rejected upstream).
    • M-Ins and M-Del have become rebindable.
  • GNU nano 9.0:

    • When the cursor almost goes offscreen to the right, all lines are now scrolled sideways together, by just the amount needed to keep the cursor in view. Use --solosidescroll or 'set solosidescroll' to get back the old, jerky, single-line horizontal scrolling.
    • The viewport can be scrolled sideways (in steps of one tabsize) with M-< and M->. See man nanorc if M-< and M-> should switch between buffers (as they did earlier).
    • M-Left, M-Right, M-Up, and M-Down have become rebindable.
    • Stopping the recording of a macro immediately after starting it cancels the recording and leaves an existing macro in place.
    • Feature toggles no longer break a chain of ^K cuts or M-6 copies, except the M-K cut-from-cursor toggle.
    • With --mouse and --indicator, one can click in the scrollbar area to roughly navigate within the buffer.
    • CVE-2026-6843: format string vulnerability leads to denial of service (boo#1262643)
    • create the ~/.local directory with limited access rights (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)
  • GNU nano 8.7.1:

    • fix build against glibc-2.43 (boo#1258260)
  • GNU nano 8.7:

    • At the Execute prompt, preceding the command with two pipe symbols allows implementing a copy-to-clipboard feature in nanorc on terminals that support OSC 52. See doc/sample.nanorc
References

Affected packages

openSUSE:Leap 16.0 / nano

Package

Name
nano
Purl
pkg:rpm/opensuse/nano&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.1-bp160.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "nano":  "9.1-bp160.1.1",
            "nano-lang":  "9.1-bp160.1.1"
        }
    ]
}

Database specific

source
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21166-1.json"