openSUSE-SU-2026:22220-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22220-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22220-1
Upstream
CVE (4)
Related
CVE (4)
Published
2026-11-02T16:41:39Z
Modified
2026-11-04T17:23:23Z
Summary
Security update for libosmocore
Details

This update for libosmocore fixes the following issues:

Changes in libosmocore:

  • Update to release 1.14.2

    • Fix buffer overflows/overreads in bssgp_rx_paging, parse_process_uss_req, osmo_dec_gcr, osmo_pbit2ubit, in the CBSP WRITE-REPLACE decoder, and in TLV tag logging. [boo#1289028, CVE-2026-104592]
    • iuup: Cure stack buffer-overflow rx IuUP with payload larger than 1024 bytes. [boo#1289027, CVE-2026-104591] [boo#1288875, CVE-2026-104597]
    • gsm: Reject BSSMAP Encryption Information IE with no selected algo or key length != 8.
    • Resolve [boo#1289029, CVE-2026-104594]

  • Update to release 1.14.1

    • socket: osmo_sockaddr_from_str_and_uint(): fix memleak
    • osmo_io: Rewrite iofd_handle_send_completion() to fix multiple issues
    • osmo_io: Fix msgb memleak if iofd is unregistered during write_cb with >1 io buffers
    • netdev: Add API osmo_netdev_del_addr()

  • Update to release 1.13.1

    • socket: Introduce API osmo_sock_set_nonblock()
    • gsm/rsl: add definition for TFO transparent container IE
    • vty/test: Validate optional-multi-choice param followed by optional-multi-choice param
    • gsmtap_util: Avoid sink_fd leak gsmtap_source_add_sinki() called multiple times
    • logging_vty: Allow setting gsmtap log tgt as (blocking-io|nonblocking-io|wq)
    • gsmtap_util: Increase source_fd's SO_SNDBUF to 4MB
    • osmo_io: Support rx of segments up to ~UINT16_MAX
    • osmo_io: Propagate segment_cb errors to the read_cb
    • Use same queue length for gsmtap_log and gsmtap_file

  • Update to release 1.12.0

    • iuup: Explicitly discard Iu-UP-DATA.req in Initialization state
    • protocol/gsm_04_08.h: Add GSM 04.08 message types for SI21/22/23
    • vty: Add 'show runtime' command
    • Send multiple read/recvfrom/recvmsg SQEs in advance
    • Register OSMO_EXT protocol number for TCAP routing
    • AMR codec: add conversion between s-bits and codec parameters
    • AMR codec: add decoder homing frame const patterns

  • Update to release 1.11.2

    • VTY: Initialize fields of struct cmd_element in order of declaration

  • Update to release 1.11.1

    • lapd, lapdm: Take talloc msgb ownership when enqueueing it
References

Affected packages

openSUSE:Leap 16.0 / libosmocore

Package

Name
libosmocore
Purl
pkg:rpm/opensuse/libosmocore&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.14.2-bp160.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "libosmocodec-devel": "1.14.2-bp160.1.1",
            "libosmocodec4": "1.14.2-bp160.1.1",
            "libosmocoding-devel": "1.14.2-bp160.1.1",
            "libosmocoding0": "1.14.2-bp160.1.1",
            "libosmocore-devel": "1.14.2-bp160.1.1",
            "libosmocore-tools": "1.14.2-bp160.1.1",
            "libosmocore22": "1.14.2-bp160.1.1",
            "libosmoctrl-devel": "1.14.2-bp160.1.1",
            "libosmoctrl0": "1.14.2-bp160.1.1",
            "libosmogb-devel": "1.14.2-bp160.1.1",
            "libosmogb14": "1.14.2-bp160.1.1",
            "libosmogsm-devel": "1.14.2-bp160.1.1",
            "libosmogsm20": "1.14.2-bp160.1.1",
            "libosmoisdn-devel": "1.14.2-bp160.1.1",
            "libosmoisdn0": "1.14.2-bp160.1.1",
            "libosmosim-devel": "1.14.2-bp160.1.1",
            "libosmosim2": "1.14.2-bp160.1.1",
            "libosmousb-devel": "1.14.2-bp160.1.1",
            "libosmousb0": "1.14.2-bp160.1.1",
            "libosmovty-devel": "1.14.2-bp160.1.1",
            "libosmovty13": "1.14.2-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22220-1.json"