Security update for sccache SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:3944-1 Final 1 1 2025-11-05T08:16:30Z current 2025-11-05T08:16:30Z 2025-11-05T08:16:30Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sccache This update for sccache fixes the following issues: - CVE-2025-55159 - updated slab with the uninit memory access fix (bsc#1248003) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-3944,SUSE-SLE-Module-Development-Tools-15-SP6-2025-3944,SUSE-SLE-Module-Development-Tools-15-SP7-2025-3944,openSUSE-SLE-15.6-2025-3944 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-20253944-1/ Link for SUSE-SU-2025:3944-1 https://lists.suse.com/pipermail/sle-security-updates/2025-November/023158.html E-Mail link for SUSE-SU-2025:3944-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1248003 SUSE Bug 1248003 https://www.suse.com/security/cve/CVE-2025-55159/ SUSE CVE CVE-2025-55159 page SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP7 openSUSE Leap 15.6 sccache-0.4.2~4-150600.10.6.1 sccache-0.4.2~4-150600.10.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 sccache-0.4.2~4-150600.10.6.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 sccache-0.4.2~4-150600.10.6.1 as a component of openSUSE Leap 15.6 slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length. CVE-2025-55159 SUSE Linux Enterprise Module for Development Tools 15 SP6:sccache-0.4.2~4-150600.10.6.1 SUSE Linux Enterprise Module for Development Tools 15 SP7:sccache-0.4.2~4-150600.10.6.1 openSUSE Leap 15.6:sccache-0.4.2~4-150600.10.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253944-1/ https://www.suse.com/security/cve/CVE-2025-55159.html CVE-2025-55159 https://bugzilla.suse.com/1248000 SUSE Bug 1248000