{"id":"openSUSE-SU-2026:22220-1","summary":"Security update for libosmocore","details":"This update for libosmocore fixes the following issues:\n\nChanges in libosmocore:\n\n- Update to release 1.14.2\n  * Fix buffer overflows/overreads in `bssgp_rx_paging`,\n    `parse_process_uss_req`, `osmo_dec_gcr`, `osmo_pbit2ubit`, in\n    the CBSP WRITE-REPLACE decoder, and in TLV tag logging.\n    [boo#1289028, CVE-2026-104592]\n  * iuup: Cure stack buffer-overflow rx IuUP with payload\n    larger than 1024 bytes. [boo#1289027, CVE-2026-104591]\n    [boo#1288875, CVE-2026-104597]\n  * gsm: Reject BSSMAP Encryption Information IE with no selected\n    algo or key length != 8.\n  * Resolve [boo#1289029, CVE-2026-104594]\n\n- Update to release 1.14.1\n  * socket: osmo_sockaddr_from_str_and_uint(): fix memleak\n  * osmo_io: Rewrite iofd_handle_send_completion() to fix multiple\n    issues\n  * osmo_io: Fix msgb memleak if iofd is unregistered during\n    write_cb with \u003e1 io buffers\n  * netdev: Add API osmo_netdev_del_addr()\n\n- Update to release 1.13.1\n  * socket: Introduce API osmo_sock_set_nonblock()\n  * gsm/rsl: add definition for TFO transparent container IE\n  * vty/test: Validate optional-multi-choice param followed by optional-multi-choice param\n  * gsmtap_util: Avoid sink_fd leak gsmtap_source_add_sinki() called multiple times\n  * logging_vty: Allow setting gsmtap log tgt as (blocking-io|nonblocking-io|wq)\n  * gsmtap_util: Increase source_fd's SO_SNDBUF to 4MB\n  * osmo_io: Support rx of segments up to ~UINT16_MAX\n  * osmo_io: Propagate segment_cb errors to the read_cb\n  * Use same queue length for gsmtap_log and gsmtap_file\n\n- Update to release 1.12.0\n  * iuup: Explicitly discard Iu-UP-DATA.req in Initialization state\n  * protocol/gsm_04_08.h: Add GSM 04.08 message types for SI21/22/23\n  * vty: Add 'show runtime' command\n  * Send multiple read/recvfrom/recvmsg SQEs in advance\n  * Register OSMO_EXT protocol number for TCAP routing\n  * AMR codec: add conversion between s-bits and codec parameters\n  * AMR codec: add decoder homing frame const patterns\n\n- Update to release 1.11.2\n  * VTY: Initialize fields of struct cmd_element in order of declaration\n\n- Update to release 1.11.1\n  * lapd, lapdm: Take talloc msgb ownership when enqueueing it\n","modified":"2026-11-04T17:23:23.838396848Z","published":"2026-11-02T16:41:39Z","related":["CVE-2026-104591","CVE-2026-104592","CVE-2026-104594","CVE-2026-104597"],"upstream":["CVE-2026-104591","CVE-2026-104592","CVE-2026-104594","CVE-2026-104597"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288875"},{"type":"REPORT","url":"https://bugzilla.suse.com/1289027"},{"type":"REPORT","url":"https://bugzilla.suse.com/1289028"},{"type":"REPORT","url":"https://bugzilla.suse.com/1289029"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-104591"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-104592"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-104594"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-104597"}],"affected":[{"package":{"name":"libosmocore","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/libosmocore&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"libosmoisdn-devel":"1.14.2-bp160.1.1","libosmosim2":"1.14.2-bp160.1.1","libosmogsm20":"1.14.2-bp160.1.1","libosmousb0":"1.14.2-bp160.1.1","libosmoctrl0":"1.14.2-bp160.1.1","libosmocodec-devel":"1.14.2-bp160.1.1","libosmogb14":"1.14.2-bp160.1.1","libosmocore-tools":"1.14.2-bp160.1.1","libosmocoding-devel":"1.14.2-bp160.1.1","libosmovty13":"1.14.2-bp160.1.1","libosmoctrl-devel":"1.14.2-bp160.1.1","libosmogsm-devel":"1.14.2-bp160.1.1","libosmocodec4":"1.14.2-bp160.1.1","libosmosim-devel":"1.14.2-bp160.1.1","libosmocore22":"1.14.2-bp160.1.1","libosmovty-devel":"1.14.2-bp160.1.1","libosmoisdn0":"1.14.2-bp160.1.1","libosmocoding0":"1.14.2-bp160.1.1","libosmogb-devel":"1.14.2-bp160.1.1","libosmousb-devel":"1.14.2-bp160.1.1","libosmocore-devel":"1.14.2-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22220-1.json"}}],"schema_version":"1.9.2"}