Security update for sccache SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:3955-1 Final 1 1 2025-11-05T14:47:29Z current 2025-11-05T14:47:29Z 2025-11-05T14:47:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for sccache This update for sccache fixes the following issues: - CVE-2025-55159: updated slab with the uninit memory access fix (bsc#1248003) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-3955 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-20253955-1/ Link for SUSE-SU-2025:3955-1 https://lists.suse.com/pipermail/sle-security-updates/2025-November/023163.html E-Mail link for SUSE-SU-2025:3955-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1248003 SUSE Bug 1248003 https://www.suse.com/security/cve/CVE-2025-55159/ SUSE CVE CVE-2025-55159 page sccache-0.4.2~4-150400.3.9.1 slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length. CVE-2025-55159 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253955-1/ https://www.suse.com/security/cve/CVE-2025-55159.html CVE-2025-55159 https://bugzilla.suse.com/1248000 SUSE Bug 1248000