FERRAMENTAS LINUX: Protect Your SUSE Linux: The mozjs60 JavaScript Engine Vulnerabilities (CVE-2026-32776, CVE-2026-32777, CVE-2026-32778)

SUSE mozjs60 security update: permanent guide for CVE-2026-32776, CVE-2026-32777, CVE-2026-32778. Check vulnerability with commands, apply patches with Bash script, mitigation alternatives (iptables, AppArmor), and build your own lab with a Raspberry Pi kit.

A set of important security vulnerabilities were discovered in the package, , which is a core component in many SUSE Linux distributions.

These flaws could allow a remote, unauthenticated attacker to cause a Denial of Service (DoS), leading to system instability or crashes.

This guide provides a permanent reference to check, patch, and mitigate these issues, ensuring your systems remain secure long after the original announcemen.

How to Check If You Are Vulnerable

Use these commands on your (SLES) or system to verify if you are running a vulnerable version of mozjs60.

1. Check the Installed Version:

rpm -q mozjs60

Example output: mozjs60-60.9.0-150400.3.8.1.x86_64

2. Identify if Your System is Affected:

To see which specific SUSE product version you are running, use:

cat /etc/os-release

The primary affected versions include SUSE Linux Enterprise Server 15 SP4, SP5, SP7, SUSE Linux Enterprise Desktop 15 SP7, and openSUSE Leap 15.5 and 15.6.

Automation Script to Apply the Fix

Never manually patch critical systems again. Use this idempotent Bash script to automatically detect and apply the security update across all major SUSE distributions.

#!/bin/bash
# mozjs60 Security Update Auto-Patcher for SUSE Linux

# Check for root privileges
if [ "$EUID" -ne 0 ]; then
  echo "❌ Please run as root (use sudo)."
  exit 1
fi

echo "🔄 Updating package repository metadata..."
zypper refresh

echo "🔍 Checking for mozjs60 security update..."
# Check if the security update is available
UPDATE_CHECK=$(zypper list-updates | grep mozjs60)

if [[ -z "$UPDATE_CHECK" ]]; then
    echo "✅ No security update found for mozjs60. Your system may already be patched."
    echo "   You can verify your installed version with: rpm -q mozjs60"
else
    echo "⚠️  Security update detected. Applying patch now..."
    # Apply the specific update. The '--auto-agree-with-licenses' flag handles EULAs.
    zypper patch --cve="CVE-2026-32776" --cve="CVE-2026-32777" --cve="CVE-2026-32778" --auto-agree-with-licenses

    if [ $? -eq 0 ]; then
        echo "✅ Patch applied successfully."
        echo "ℹ️  Note: Services using the mozjs60 library may need a restart."
    else
        echo "❌ An error occurred while applying the update."
        exit 1
    fi
fi

Save this script as patch-mozjs60.sh, make it executable with chmod +x patch-mozjs60.sh, and run it with sudo ./patch-mozjs60.sh.

Building a Secure Testing Laboratory: Recommended Hardware

The Raspberry Pi 4 (4GB or 8GB) is a perfect tool for this—it’s low-cost, energy-efficient, and robust enough to run SUSE Linux Enterprise Server.

We recommend the CanaKit Raspberry Pi 4 Complete Starter Kit (8GB RAM). It includes everything you need to get started:

Raspberry Pi 4 Board (8GB)

High-speed microSD card (pre-loaded with NOOBS)

Premium case with a cooling fan

Power supply with a power switch

HDMI cable and microSD card reader

Canakit Rasppberry Pi Adversiting -> https://amzn.to/4tCImTZ

I earn a comission with you make a purchase

Alternative Mitigation If You Can't Update Now

If you are unable to apply the update immediately, implement these temporary defense-in-depth measures to significantly reduce your attack surface.

Option 1: IPTables Rate Limiting

Block brute-force crash attempts by limiting incoming connections from any single IP.

# Limit new connections to 5 per second from any source IP
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 5/second --limit-burst 10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m state --state NEW -m limit --limit 5/second --limit-burst 10 -j ACCEPT
iptables -A INPUT -j DROP

Note: This is a basic rate-limit. Adjust the ports (80, 443) and limits according to your application's normal traffic patterns.

Option 2: Hardening with AppArmor

SUSE Linux comes with AppArmor, a powerful kernel security module. You can confine the applications that load the mozjs60 library.

1. Enable AppArmor:

bash
```
sudo systemctl enable apparmor --now
```

2. Put a Profile in 'Complain' Mode to Test: AppArmor profiles restrict what a program can do. Use aa-genprof to generate a profile for your specific application (e.g., your web server or database process) and enforce it.

Option 3: Restrict Library Loading via System-wide ld.so configuration

As a last resort, you can completely block the loading of the vulnerable library for all processes. Proceed with extreme caution as this will break any application that depends on it.

echo "block /usr/lib64/libmozjs-60.so" | sudo tee /etc/ld.so.preload

This should only be used on test systems as it will cause massive disruption.

Final Action Plan

Don't just read about the vulnerability—act on it. Security is a process, not a one-time event. By implementing the scripts and strategies in this guide, you're building a resilient infrastructure.