openSUSE-SU-2026:21692-1: moderate: Security update for dhcpcd

openSUSE security update: security update for dhcpcd
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21692-1
Rating: moderate
References:

  * bsc#1268968
  * bsc#1268974
  * bsc#1268976
  * bsc#1268980



Cross-References:

  * CVE-2026-56113
  * CVE-2026-56115
  * CVE-2026-56116
  * CVE-2026-56117



CVSS scores:

  * CVE-2026-56113 ( SUSE ): 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56113 ( SUSE ): 6 CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-56115 ( SUSE ): 5.9 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
  * CVE-2026-56115 ( SUSE ): 6 CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-56116 ( SUSE ): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-56116 ( SUSE ): 7.1 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-56117 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
  * CVE-2026-56117 ( SUSE ): 5.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 4 vulnerabilities and has 4 bug fixes can now be installed.

Description:

This update for dhcpcd fixes the following issues:

Update to 10.5.0.

Security issues fixed:

- CVE-2026-56113: crafted DHCPv6 RENEW reply can lead to a denial of service (bsc#1268980).
- CVE-2026-56115: crafted DHCPv6 ADVERTISE message can cause a one-byte stack out-of-bounds write (bsc#1268976).
- CVE-2026-56116: crafted Router Advertisements containing Route Information options with a zero lifetime can lead to a
  memory leak (bsc#1268974).
- CVE-2026-56117: crafted privileged command sent over a writable control socket can lead to a heap use-after-free
  (bsc#1268968).

Changes for dhcpcd:

- 10.5.0:
  * Add missing SPDX-License tags
  * Format code with clang-format v19
  * privsep: Change IPC to use SOCK_STREAM
  * BPF: Split OS specific code out into own files and add libpcap
    support
  * hooks: Escape interface names and use printf
  * Delete DHCPv6 IA FD from the loop before closing it
  * eloop: Use kqueue or epoll to wait for a fd to become ready
  * Darwin: Add initial support for macOS
  * Import latest pidfile from NetBSD
  * BPF: Improve headers
  * compat: Add support for getprogname(3)
  * route: Rework rt structure so sockaddrs are pointers
  * dhcp-common: Escape ifname for lease file
  * privsep: smaller buffer size without INET6
  * script: add ifxname as the escaped string
  * time.h always pulls in struct timespec
  * route: Use HAVE_RT_MISSFILTER rather than a generic BSD define
  * privsep: Test defines for all ioctls
  * if: if_init inits the interface from the kernel
  * privsep: Add ps_root_gethostname
  * DHCP: Don't really expire the lease when testing
  * DHCP: Don't add a trailing : on vendor if no machine arch
  * privsep: guard setproctitle and only use compat on linux
  * options: Remove some const to fix compile warnings
  * privsep: Don't open PF_INET socket for each ioctl
  * sun: Enable building for privsep
  * script: Use correct buffer length variable
  * privsep: Remove PS_BUFLEN
  * privsep: Simplify readerror
  * timezone: disallow directory traversal
  * privsep: ps_root_readfile should return the real file size
  * linux: Ensure NLA data boundaries are valid
  * options: Fix userclass boundary
  * ND6: fix OOB reject mask for an undefined option.
  * DHCP6: Ensure IA_PD Prefix Lenth is valid
  * ND: Enforce require and reject policy
  * ARP: check we have enough to read the frame header
  * hooks: Quote assignment of compat vars correctly
  * udev: Ensure we have a subsystem, action and ifname
  * Fix CI build
  * DHCP: Santize messages from servers for output
  * ARP: Iterate over states safely as the cb could remove ours
  * privsep: Check data is terminated when a string
  * auth: clear keys with memset_explicit
  * auth: Ensure remaining dlen matches hash digest length
  * hooks: don't read past truncated ip6 address starting fe
  * ipv6: Only regen temp addrs with sufficent pltime
  * eloop: Improve timespecdiff
  * eloop: Fix compile warning where UTIME_MAX is a calculation
  * vsio: Allow zero length options
  * DHCP6: Fix configuring the suffix to delegated prefixes
  * IPv6: Fix numerous issues extending temporary address times
  * capsicum: Avoid some overflow issues in privsep sysctl
  * script: Fix buffer over and under flows in script_buftoenv
  * IPv4: uset old_ia when adding an address causes early removal
  * dhcp: add configurable backoff parameters for DHCPv4
  * options: Introdce policy groups
  * Build all the targets on macos
  * control: remove unprivileged socket
  * DHCP: deconfigure even when state is NULL or NONE


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1548=1

Package List:

- openSUSE Leap 16.0:

  dhcpcd-10.5.0-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-56113.html
  * https://www.suse.com/security/cve/CVE-2026-56115.html
  * https://www.suse.com/security/cve/CVE-2026-56116.html
  * https://www.suse.com/security/cve/CVE-2026-56117.html