openSUSE-SU-2026:21636-1: moderate: Security update for pcp

[email protected]
Newsgroups gmane.linux.suse.security.announce
Message-ID <[email protected]> 
openSUSE security update: security update for pcp
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21636-1
Rating: moderate
References:

  * bsc#1272922
  * bsc#1272923
  * bsc#1272924
  * bsc#1272925
  * bsc#1272926
  * bsc#1272927
  * bsc#1272928
  * bsc#1272930



Cross-References:

  * CVE-2026-16524
  * CVE-2026-16526
  * CVE-2026-16527
  * CVE-2026-16529
  * CVE-2026-16530
  * CVE-2026-16531



CVSS scores:

  * CVE-2026-16524 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16524 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-16526 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16526 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-16527 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  * CVE-2026-16527 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-16529 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-16529 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-16530 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
  * CVE-2026-16530 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-16531 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  * CVE-2026-16531 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 6 vulnerabilities and has 8 bug fixes can now be installed.

Description:

This update for pcp fixes the following issues:

- CVE-2026-16524: command injection in `linux_sockets` PMDA via `network.persocket.filter` (bsc#1272922).
- CVE-2026-16526: pmdaroot privilege escalation via `FD_CLOEXEC` fd inheritance and missing peer credentials
  (bsc#1272923).
- CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
- CVE-2026-16529: integer overflow in `__pmGetPDU` leads to permanent DoS (bsc#1272925).
- CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
- CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
- command injection in `pmieconf` `write_pmiefile` via `$HOME` and `-f` (bsc#1272928).
- command injection in `pmlogcp/pmlogmv` `do_link` via unsanitised filenames (bsc#1272930).


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1495=1

Package List:

- openSUSE Leap 16.0:

  libpcp-devel-6.2.0-160000.4.1
  libpcp3-6.2.0-160000.4.1
  libpcp_gui2-6.2.0-160000.4.1
  libpcp_import1-6.2.0-160000.4.1
  libpcp_mmv1-6.2.0-160000.4.1
  libpcp_trace2-6.2.0-160000.4.1
  libpcp_web1-6.2.0-160000.4.1
  pcp-6.2.0-160000.4.1
  pcp-conf-6.2.0-160000.4.1
  pcp-devel-6.2.0-160000.4.1
  pcp-doc-6.2.0-160000.4.1
  pcp-export-pcp2elasticsearch-6.2.0-160000.4.1
  pcp-export-pcp2graphite-6.2.0-160000.4.1
  pcp-export-pcp2influxdb-6.2.0-160000.4.1
  pcp-export-pcp2json-6.2.0-160000.4.1
  pcp-export-pcp2spark-6.2.0-160000.4.1
  pcp-export-pcp2xml-6.2.0-160000.4.1
  pcp-export-pcp2zabbix-6.2.0-160000.4.1
  pcp-gui-6.2.0-160000.4.1
  pcp-import-collectl2pcp-6.2.0-160000.4.1
  pcp-import-ganglia2pcp-6.2.0-160000.4.1
  pcp-import-iostat2pcp-6.2.0-160000.4.1
  pcp-import-mrtg2pcp-6.2.0-160000.4.1
  pcp-import-sar2pcp-6.2.0-160000.4.1
  pcp-pmda-activemq-6.2.0-160000.4.1
  pcp-pmda-apache-6.2.0-160000.4.1
  pcp-pmda-bash-6.2.0-160000.4.1
  pcp-pmda-bonding-6.2.0-160000.4.1
  pcp-pmda-cifs-6.2.0-160000.4.1
  pcp-pmda-cisco-6.2.0-160000.4.1
  pcp-pmda-dbping-6.2.0-160000.4.1
  pcp-pmda-dm-6.2.0-160000.4.1
  pcp-pmda-docker-6.2.0-160000.4.1
  pcp-pmda-ds389-6.2.0-160000.4.1
  pcp-pmda-ds389log-6.2.0-160000.4.1
  pcp-pmda-elasticsearch-6.2.0-160000.4.1
  pcp-pmda-gfs2-6.2.0-160000.4.1
  pcp-pmda-gluster-6.2.0-160000.4.1
  pcp-pmda-gpfs-6.2.0-160000.4.1
  pcp-pmda-gpsd-6.2.0-160000.4.1
  pcp-pmda-hacluster-6.2.0-160000.4.1
  pcp-pmda-haproxy-6.2.0-160000.4.1
  pcp-pmda-infiniband-6.2.0-160000.4.1
  pcp-pmda-json-6.2.0-160000.4.1
  pcp-pmda-lio-6.2.0-160000.4.1
  pcp-pmda-lmsensors-6.2.0-160000.4.1
  pcp-pmda-logger-6.2.0-160000.4.1
  pcp-pmda-lustre-6.2.0-160000.4.1
  pcp-pmda-lustrecomm-6.2.0-160000.4.1
  pcp-pmda-mailq-6.2.0-160000.4.1
  pcp-pmda-memcache-6.2.0-160000.4.1
  pcp-pmda-mic-6.2.0-160000.4.1
  pcp-pmda-mounts-6.2.0-160000.4.1
  pcp-pmda-mysql-6.2.0-160000.4.1
  pcp-pmda-named-6.2.0-160000.4.1
  pcp-pmda-netcheck-6.2.0-160000.4.1
  pcp-pmda-netfilter-6.2.0-160000.4.1
  pcp-pmda-news-6.2.0-160000.4.1
  pcp-pmda-nfsclient-6.2.0-160000.4.1
  pcp-pmda-nginx-6.2.0-160000.4.1
  pcp-pmda-nutcracker-6.2.0-160000.4.1
  pcp-pmda-nvidia-gpu-6.2.0-160000.4.1
  pcp-pmda-openmetrics-6.2.0-160000.4.1
  pcp-pmda-openvswitch-6.2.0-160000.4.1
  pcp-pmda-oracle-6.2.0-160000.4.1
  pcp-pmda-pdns-6.2.0-160000.4.1
  pcp-pmda-perfevent-6.2.0-160000.4.1
  pcp-pmda-postfix-6.2.0-160000.4.1
  pcp-pmda-rabbitmq-6.2.0-160000.4.1
  pcp-pmda-redis-6.2.0-160000.4.1
  pcp-pmda-resctrl-6.2.0-160000.4.1
  pcp-pmda-roomtemp-6.2.0-160000.4.1
  pcp-pmda-rsyslog-6.2.0-160000.4.1
  pcp-pmda-samba-6.2.0-160000.4.1
  pcp-pmda-sendmail-6.2.0-160000.4.1
  pcp-pmda-shping-6.2.0-160000.4.1
  pcp-pmda-slurm-6.2.0-160000.4.1
  pcp-pmda-smart-6.2.0-160000.4.1
  pcp-pmda-snmp-6.2.0-160000.4.1
  pcp-pmda-sockets-6.2.0-160000.4.1
  pcp-pmda-summary-6.2.0-160000.4.1
  pcp-pmda-systemd-6.2.0-160000.4.1
  pcp-pmda-trace-6.2.0-160000.4.1
  pcp-pmda-unbound-6.2.0-160000.4.1
  pcp-pmda-weblog-6.2.0-160000.4.1
  pcp-pmda-zimbra-6.2.0-160000.4.1
  pcp-pmda-zswap-6.2.0-160000.4.1
  pcp-selinux-6.2.0-160000.4.1
  pcp-system-tools-6.2.0-160000.4.1
  pcp-testsuite-6.2.0-160000.4.1
  pcp-zeroconf-6.2.0-160000.4.1
  perl-PCP-LogImport-6.2.0-160000.4.1
  perl-PCP-LogSummary-6.2.0-160000.4.1
  perl-PCP-MMV-6.2.0-160000.4.1
  perl-PCP-PMDA-6.2.0-160000.4.1
  python3-pcp-6.2.0-160000.4.1

References:

  * https://www.suse.com/security/cve/CVE-2026-16524.html
  * https://www.suse.com/security/cve/CVE-2026-16526.html
  * https://www.suse.com/security/cve/CVE-2026-16527.html
  * https://www.suse.com/security/cve/CVE-2026-16529.html
  * https://www.suse.com/security/cve/CVE-2026-16530.html
  * https://www.suse.com/security/cve/CVE-2026-16531.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.