{"id":"SUSE-SU-2026:23316-1","summary":"Security update for pcp","details":"This update for pcp fixes the following issues:\n\n- CVE-2026-16524: command injection in `linux_sockets` PMDA via `network.persocket.filter` (bsc#1272922).\n- CVE-2026-16526: pmdaroot privilege escalation via `FD_CLOEXEC` fd inheritance and missing peer credentials\n  (bsc#1272923).\n- CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).\n- CVE-2026-16529: integer overflow in `__pmGetPDU` leads to permanent DoS (bsc#1272925).\n- CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).\n- CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).\n- command injection in `pmieconf` `write_pmiefile` via `$HOME` and `-f` (bsc#1272928).\n- command injection in `pmlogcp/pmlogmv` `do_link` via unsanitised filenames (bsc#1272930).\n","modified":"2026-09-10T18:23:09.684160859Z","published":"2026-08-24T20:47:16Z","related":["CVE-2026-16524","CVE-2026-16526","CVE-2026-16527","CVE-2026-16529","CVE-2026-16530","CVE-2026-16531"],"upstream":["CVE-2026-16524","CVE-2026-16526","CVE-2026-16527","CVE-2026-16529","CVE-2026-16530","CVE-2026-16531"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623316-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272922"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272923"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272924"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272925"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272926"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272927"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272928"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272930"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-16524"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-16526"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-16527"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-16529"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-16530"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-16531"}],"affected":[{"package":{"name":"pcp","ecosystem":"SUSE:Linux Enterprise Server 16.0","purl":"pkg:rpm/suse/pcp&distro=SUSE%20Linux%20Enterprise%20Server%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-160000.4.1"}]}],"ecosystem_specific":{"binaries":[{"pcp-pmda-openmetrics":"6.2.0-160000.4.1","pcp-pmda-zswap":"6.2.0-160000.4.1","pcp-pmda-roomtemp":"6.2.0-160000.4.1","pcp-export-pcp2influxdb":"6.2.0-160000.4.1","pcp-pmda-ds389":"6.2.0-160000.4.1","pcp-pmda-news":"6.2.0-160000.4.1","pcp-pmda-zimbra":"6.2.0-160000.4.1","pcp-pmda-openvswitch":"6.2.0-160000.4.1","libpcp-devel":"6.2.0-160000.4.1","libpcp_trace2":"6.2.0-160000.4.1","pcp-pmda-logger":"6.2.0-160000.4.1","perl-PCP-PMDA":"6.2.0-160000.4.1","pcp-pmda-lio":"6.2.0-160000.4.1","pcp-pmda-nvidia-gpu":"6.2.0-160000.4.1","pcp-devel":"6.2.0-160000.4.1","pcp-pmda-netcheck":"6.2.0-160000.4.1","pcp-pmda-named":"6.2.0-160000.4.1","pcp":"6.2.0-160000.4.1","pcp-pmda-shping":"6.2.0-160000.4.1","pcp-pmda-samba":"6.2.0-160000.4.1","pcp-pmda-elasticsearch":"6.2.0-160000.4.1","pcp-import-mrtg2pcp":"6.2.0-160000.4.1","pcp-pmda-rsyslog":"6.2.0-160000.4.1","pcp-export-pcp2spark":"6.2.0-160000.4.1","pcp-pmda-lustre":"6.2.0-160000.4.1","pcp-import-iostat2pcp":"6.2.0-160000.4.1","pcp-pmda-redis":"6.2.0-160000.4.1","pcp-selinux":"6.2.0-160000.4.1","pcp-export-pcp2graphite":"6.2.0-160000.4.1","pcp-pmda-mysql":"6.2.0-160000.4.1","pcp-export-pcp2elasticsearch":"6.2.0-160000.4.1","pcp-pmda-summary":"6.2.0-160000.4.1","pcp-pmda-slurm":"6.2.0-160000.4.1","pcp-pmda-postfix":"6.2.0-160000.4.1","pcp-pmda-mounts":"6.2.0-160000.4.1","pcp-pmda-smart":"6.2.0-160000.4.1","perl-PCP-LogSummary":"6.2.0-160000.4.1","libpcp_web1":"6.2.0-160000.4.1","pcp-pmda-gpfs":"6.2.0-160000.4.1","perl-PCP-LogImport":"6.2.0-160000.4.1","pcp-pmda-dm":"6.2.0-160000.4.1","pcp-pmda-apache":"6.2.0-160000.4.1","pcp-pmda-docker":"6.2.0-160000.4.1","pcp-export-pcp2json":"6.2.0-160000.4.1","libpcp_gui2":"6.2.0-160000.4.1","pcp-pmda-nutcracker":"6.2.0-160000.4.1","pcp-pmda-systemd":"6.2.0-160000.4.1","pcp-pmda-lustrecomm":"6.2.0-160000.4.1","pcp-conf":"6.2.0-160000.4.1","libpcp_import1":"6.2.0-160000.4.1","pcp-pmda-mic":"6.2.0-160000.4.1","pcp-pmda-bonding":"6.2.0-160000.4.1","pcp-import-ganglia2pcp":"6.2.0-160000.4.1","pcp-zeroconf":"6.2.0-160000.4.1","pcp-pmda-rabbitmq":"6.2.0-160000.4.1","pcp-export-pcp2xml":"6.2.0-160000.4.1","pcp-pmda-sockets":"6.2.0-160000.4.1","pcp-pmda-dbping":"6.2.0-160000.4.1","pcp-pmda-bash":"6.2.0-160000.4.1","pcp-pmda-infiniband":"6.2.0-160000.4.1","pcp-pmda-nginx":"6.2.0-160000.4.1","python3-pcp":"6.2.0-160000.4.1","pcp-pmda-nfsclient":"6.2.0-160000.4.1","pcp-pmda-cifs":"6.2.0-160000.4.1","pcp-pmda-gfs2":"6.2.0-160000.4.1","pcp-pmda-perfevent":"6.2.0-160000.4.1","pcp-pmda-hacluster":"6.2.0-160000.4.1","libpcp3":"6.2.0-160000.4.1","pcp-pmda-snmp":"6.2.0-160000.4.1","pcp-pmda-mailq":"6.2.0-160000.4.1","pcp-pmda-weblog":"6.2.0-160000.4.1","perl-PCP-MMV":"6.2.0-160000.4.1","pcp-pmda-ds389log":"6.2.0-160000.4.1","pcp-pmda-unbound":"6.2.0-160000.4.1","pcp-import-collectl2pcp":"6.2.0-160000.4.1","pcp-pmda-resctrl":"6.2.0-160000.4.1","pcp-pmda-sendmail":"6.2.0-160000.4.1","pcp-import-sar2pcp":"6.2.0-160000.4.1","pcp-pmda-lmsensors":"6.2.0-160000.4.1","pcp-pmda-pdns":"6.2.0-160000.4.1","pcp-pmda-cisco":"6.2.0-160000.4.1","pcp-pmda-oracle":"6.2.0-160000.4.1","pcp-export-pcp2zabbix":"6.2.0-160000.4.1","pcp-pmda-trace":"6.2.0-160000.4.1","pcp-system-tools":"6.2.0-160000.4.1","pcp-pmda-memcache":"6.2.0-160000.4.1","pcp-doc":"6.2.0-160000.4.1","pcp-pmda-activemq":"6.2.0-160000.4.1","pcp-pmda-netfilter":"6.2.0-160000.4.1","pcp-pmda-gpsd":"6.2.0-160000.4.1","pcp-pmda-json":"6.2.0-160000.4.1","pcp-pmda-haproxy":"6.2.0-160000.4.1","libpcp_mmv1":"6.2.0-160000.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23316-1.json"}},{"package":{"name":"pcp","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","purl":"pkg:rpm/suse/pcp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-160000.4.1"}]}],"ecosystem_specific":{"binaries":[{"pcp-pmda-cisco":"6.2.0-160000.4.1","pcp-pmda-pdns":"6.2.0-160000.4.1","pcp-pmda-dbping":"6.2.0-160000.4.1","pcp":"6.2.0-160000.4.1","pcp-pmda-dm":"6.2.0-160000.4.1","perl-PCP-PMDA":"6.2.0-160000.4.1","pcp-pmda-bash":"6.2.0-160000.4.1","pcp-pmda-bonding":"6.2.0-160000.4.1","pcp-pmda-docker":"6.2.0-160000.4.1","pcp-export-pcp2spark":"6.2.0-160000.4.1","libpcp_web1":"6.2.0-160000.4.1","pcp-pmda-gpfs":"6.2.0-160000.4.1","pcp-export-pcp2elasticsearch":"6.2.0-160000.4.1","perl-PCP-LogSummary":"6.2.0-160000.4.1","pcp-pmda-smart":"6.2.0-160000.4.1","pcp-pmda-oracle":"6.2.0-160000.4.1","pcp-import-ganglia2pcp":"6.2.0-160000.4.1","pcp-pmda-perfevent":"6.2.0-160000.4.1","pcp-doc":"6.2.0-160000.4.1","pcp-pmda-gfs2":"6.2.0-160000.4.1","pcp-pmda-zswap":"6.2.0-160000.4.1","pcp-pmda-netcheck":"6.2.0-160000.4.1","pcp-pmda-systemd":"6.2.0-160000.4.1","pcp-pmda-openvswitch":"6.2.0-160000.4.1","libpcp_import1":"6.2.0-160000.4.1","pcp-pmda-ds389":"6.2.0-160000.4.1","libpcp_gui2":"6.2.0-160000.4.1","pcp-import-sar2pcp":"6.2.0-160000.4.1","pcp-export-pcp2xml":"6.2.0-160000.4.1","pcp-pmda-redis":"6.2.0-160000.4.1","pcp-pmda-lustre":"6.2.0-160000.4.1","pcp-export-pcp2graphite":"6.2.0-160000.4.1","pcp-pmda-lmsensors":"6.2.0-160000.4.1","pcp-pmda-postfix":"6.2.0-160000.4.1","pcp-pmda-snmp":"6.2.0-160000.4.1","pcp-pmda-sockets":"6.2.0-160000.4.1","pcp-pmda-mic":"6.2.0-160000.4.1","pcp-pmda-infiniband":"6.2.0-160000.4.1","pcp-pmda-nvidia-gpu":"6.2.0-160000.4.1","pcp-pmda-lustrecomm":"6.2.0-160000.4.1","pcp-pmda-news":"6.2.0-160000.4.1","pcp-export-pcp2influxdb":"6.2.0-160000.4.1","pcp-pmda-rsyslog":"6.2.0-160000.4.1","pcp-import-collectl2pcp":"6.2.0-160000.4.1","pcp-pmda-cifs":"6.2.0-160000.4.1","pcp-pmda-mailq":"6.2.0-160000.4.1","pcp-pmda-samba":"6.2.0-160000.4.1","pcp-pmda-mounts":"6.2.0-160000.4.1","pcp-pmda-openmetrics":"6.2.0-160000.4.1","pcp-pmda-resctrl":"6.2.0-160000.4.1","perl-PCP-LogImport":"6.2.0-160000.4.1","pcp-pmda-elasticsearch":"6.2.0-160000.4.1","pcp-export-pcp2zabbix":"6.2.0-160000.4.1","pcp-devel":"6.2.0-160000.4.1","libpcp_trace2":"6.2.0-160000.4.1","pcp-pmda-named":"6.2.0-160000.4.1","pcp-pmda-rabbitmq":"6.2.0-160000.4.1","pcp-pmda-apache":"6.2.0-160000.4.1","pcp-pmda-logger":"6.2.0-160000.4.1","pcp-pmda-shping":"6.2.0-160000.4.1","pcp-pmda-hacluster":"6.2.0-160000.4.1","pcp-pmda-weblog":"6.2.0-160000.4.1","pcp-pmda-memcache":"6.2.0-160000.4.1","libpcp3":"6.2.0-160000.4.1","pcp-pmda-nutcracker":"6.2.0-160000.4.1","pcp-pmda-gpsd":"6.2.0-160000.4.1","pcp-pmda-ds389log":"6.2.0-160000.4.1","pcp-pmda-unbound":"6.2.0-160000.4.1","pcp-pmda-nfsclient":"6.2.0-160000.4.1","pcp-pmda-netfilter":"6.2.0-160000.4.1","pcp-conf":"6.2.0-160000.4.1","pcp-pmda-summary":"6.2.0-160000.4.1","pcp-import-iostat2pcp":"6.2.0-160000.4.1","pcp-zeroconf":"6.2.0-160000.4.1","libpcp-devel":"6.2.0-160000.4.1","pcp-pmda-activemq":"6.2.0-160000.4.1","pcp-pmda-sendmail":"6.2.0-160000.4.1","pcp-pmda-nginx":"6.2.0-160000.4.1","pcp-pmda-roomtemp":"6.2.0-160000.4.1","pcp-system-tools":"6.2.0-160000.4.1","pcp-pmda-json":"6.2.0-160000.4.1","pcp-pmda-slurm":"6.2.0-160000.4.1","pcp-pmda-mysql":"6.2.0-160000.4.1","pcp-pmda-trace":"6.2.0-160000.4.1","pcp-selinux":"6.2.0-160000.4.1","python3-pcp":"6.2.0-160000.4.1","pcp-export-pcp2json":"6.2.0-160000.4.1","pcp-import-mrtg2pcp":"6.2.0-160000.4.1","pcp-pmda-zimbra":"6.2.0-160000.4.1","pcp-pmda-haproxy":"6.2.0-160000.4.1","pcp-pmda-lio":"6.2.0-160000.4.1","perl-PCP-MMV":"6.2.0-160000.4.1","libpcp_mmv1":"6.2.0-160000.4.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23316-1.json"}}],"schema_version":"1.9.0"}