{"id":"CVE-2026-13412","aliases":["SUSE-SU-2026:22843-1","SUSE-SU-2026:3108-1","SUSE-SU-2026:3196-1","openSUSE-SU-2026:11293-1","openSUSE-SU-2026:21408-1"],"status":"published","title":"Security update for joe","description":"This update for joe fixes the following issue\n\n- CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution (bsc#1269379).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-17T00:00:00Z","modified":"2026-07-28T18:24:09Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"joe","fixed_in":["4.6-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"joe","fixed_in":["4.6-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"joe","fixed_in":["4.4-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"joe","fixed_in":["3.7-30.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"joe","fixed_in":["3.7-30.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"joe","fixed_in":["4.6-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"joe","fixed_in":["4.6-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"joe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"joe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"joe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"joe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-30.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"joe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7-30.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"joe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"joe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-160000.4.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622843-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269379","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13412","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263108-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263196-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"openSUSE-SU-2026:11293-1","title":"joe-4.6-4.1 on GA media","description":"These are all security issues fixed in the joe-4.6-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-17T00:00:00Z","modified":"2026-07-18T08:45:05.89914145Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21408-1","title":"Security update for joe","description":"This update for joe fixes the following issue\n\n- CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution (bsc#1269379).\n","status":"published","published":"2026-07-22T08:23:18Z","modified":"2026-07-24T18:24:25.497361072Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22843-1","title":"Security update for joe","description":"This update for joe fixes the following issue\n\n- CVE-2026-13412: improper validation in tag-file parser can lead to arbitrary command execution (bsc#1269379).\n","status":"published","published":"2026-07-22T08:18:52Z","modified":"2026-07-28T18:24:09.52813073Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3108-1","title":"Security update for joe","description":"This update for joe fixes the following issue\n\n- CVE-2026-13412: arbitrary command execution via malicious tags file (bsc#1269379).\n","status":"published","published":"2026-07-17T14:12:49Z","modified":"2026-07-18T08:45:09.96649053Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3196-1","title":"Security update for joe","description":"This update for joe fixes the following issue\n\n- CVE-2026-13412: arbitrary command execution via malicious tags file (bsc#1269379).\n","status":"published","published":"2026-07-22T14:34:47Z","modified":"2026-07-23T09:45:07.933623343Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}