Fixed issues

Last published : Nov 05, 2026
Related information
What's new

UniconOS 2603 LTSR CU2 Security Hotfix

Release date 2026-11-04
Important:
The UniconOS 2603 LTSR CU2 Security Hotfix fixes the security vulnerabilities CVE-2026-98432 in the Linux kernel and CVE-2026-111497 in the Qt WebEngine library. The vulnerabilities affect UniconOS 2603 LTSR CU2 and 2609. If you run UniconOS 2603 LTSR CU2, install this hotfix.

Security hardening

  • The Linux kernel was updated to 6.18.59, which fixes the vulnerability CVE-2026-98432.
  • The copy of the Brotli decoder bundled with Qt WebEngine was patched, which fixes the vulnerability CVE-2026-111497.

eLux 7 2603 LTSR CU2

Display, monitors & graphics

  • Monitor clone mode did not work.
  • A single physical monitor showed two display-ID badges.
  • Monitors went black when the display layout was changed.
  • Application windows moved around when the monitor setup was changed.
  • Windows on different displays moved around after the display layout was changed.
  • The screen went blank when an external monitor was rotated.
  • Addressed external-monitor rotation issues.
  • Rotating a display moved the windows off screen.
  • A 5120×1440 monitor offered only 3440×1440 instead of its full resolution.
  • There was no option to show all resolutions supported by a display.
  • 32" monitors did not offer selectable resolutions.
  • External displays were lost when the laptop lid was closed in a docking-station scenario.
  • The desktop disappeared when arranging two monitor positions.
  • Active session became unusable when changing the monitor layout or reconnecting.
  • Active session was unresponsive for a long time when the monitor layout changed before login.

Audio & peripherals

  • The volume/extended keys did not work on the Dell OptiPlex 3000.
  • The internal microphone did not work on the Lenovo ThinkPad L14 (Intel).
  • AWS Connect calls were interrupted due to audio detection issues.

Input & IME

  • Japanese input did not work in launched apps when the desktop language was Japanese.
  • The JP/KR hardware keys did not work in desktop apps.

Printing

  • Printers were sporadically unavailable in the Citrix® session.

Networking, VPN & certificates

  • Asterisk (*) and semicolon (;) could not be used in the proxy exception list.
  • DNS resolution and SCEP did not work over a Cisco VPN connection.
  • Device status did not change in Scout on shutdown when a VPN was active.
  • Cisco Secure Client caused high CPU load.
  • Client certificates could not be created using SCEP.
  • scep2tpm2.sh failed with a "tpm2_nvlist not found" error.
  • Split DNS did not work after upgrades/downgrades.
  • wpa_supplicant service did not start when IEEE 802.1X was enabled.
  • Writing the parameter DisableConnectivityCheck=true in terminal.ini had no effect.

Device management

  • Advanced file entries were not cleaned up on configuration changes.
  • The Scout Server was shown as an IP address instead of an FQDN.
  • Devices lost communication with Scout and ran into update issues.
  • Active session did not reset StoreFront/CWA state when the authenticated eLux user changed.
  • Viewing and renewing licenses locally could not be disabled.

Boot, shutdown & session stability

  • Shutdown times could be prolonged due to DNS name resolution issues.
  • UniconOS booted in a loop when est.ini contained a wrong password.
  • A TPM lock reset retry loop added ~30 s to every boot.
  • The screen did not turn off after the configured idle time.
  • The screensaver slideshow and HTML5 screensaver did not work.
  • The desktop disappeared intermittently when the Version Info dialog was opened.
  • The taskbar flashed briefly when the setting StorebrowseIPCDisabled=true was activated.
  • The wrong Power Management profile was selected under User Rights.

Firmware & updates

  • Firmware updates showed a misleading "Update failed: Denied due to missing Maintenance" error.
  • Updates failed sporadically when partition encryption was deactivated.

Security

  • The Linux kernel has been updated to 6.18.48.
  • SAML authentication-response validation has been strengthened.
  • OpenID Connect token validation has been strengthened.
  • Per-user isolation of the shared home directory has been strengthened.
  • Access-control enforcement for privileged device commands has been strengthened.
  • Validation of administrator-supplied authentication-server settings has been strengthened.
  • Input validation in the login component has been strengthened.
  • A local privilege-escalation vulnerability in the on-device diagnostics functionality has been fixed.
  • A vulnerability that could allow unauthorized persistent code execution on the device has been fixed.
  • A vulnerability in network connectivity handling that could affect on-device file integrity has been fixed.
  • A vulnerability that could allow redirection of the built-in browser on an untrusted network has been fixed.
  • A vulnerability in certificate handling has been fixed.
  • Memory-safety vulnerabilities in data parsing, configuration/variable handling, network configuration handling, in the print service and credential handling have been fixed.
  • Input-validation vulnerabilities during device power-on, package signature verification, network hostname handling, print-file handling, StoreFront™ resource handling and application launch have been fixed.
  • A kiosk-mode escape vulnerability in the print functionality has been fixed.
  • Security updates for cifs-utils due to the critical vulnerabilities CVE-2026-12505
  • Security updates for gstreamer1.0-gtk3, gstreamer1.0-plugins-good, libgstreamer-plugins-good1.0-0 due to the critical vulnerabilities CVE-2026-39043–39044, CVE-2026-46469–46470, CVE-2026-53705
  • Security updates for gzip due to the critical vulnerabilities CVE-2026-41991–41992
  • Security updates for libarchive13 due to the critical vulnerabilities CVE-2026-4424, CVE-2026-4426, CVE-2026-5121, CVE-2026-5745, CVE-2026-14164
  • Security updates for libavahi-common-data, libavahi-client3, libavahi-common3, avahi-daemon, avahi-utils, libavahi-core7, libavahi-glib1, libavahi-gobject0 due to the critical vulnerabilities CVE-2026-24401, CVE-2026-34933
  • Security updates for libc-bin, libc6, locales, libc6-dbg, nscd due to the critical vulnerabilities CVE-2026-4046, CVE-2026-5435, CVE-2026-5450, CVE-2026-5928, CVE-2026-6238
  • Security updates for libcaca0 due to the critical vulnerabilities CVE-2026-42046
  • Security updates for libcurl3-gnutls, libcurl4 due to the critical vulnerabilities CVE-2026-4873, CVE-2026-5545, CVE-2026-5773, CVE-2026-6253, CVE-2026-6276, CVE-2026-6429, CVE-2026-7168, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924–8925, CVE-2026-8927, CVE-2026-9547
  • Security updates for libevdocument3-4, libevview3-3 due to the critical vulnerabilities CVE-2026-46529
  • Security updates for libexif12 due to the critical vulnerabilities CVE-2026-32775, CVE-2026-40385–40386
  • Security updates for libgcrypt20 due to the critical vulnerabilities CVE-2026-41989
  • Security updates for libgnutls30 due to the critical vulnerabilities CVE-2026-3832–3833, CVE-2026-5260, CVE-2026-33845–33846, CVE-2026-42009–42015
  • Security updates for libgphoto2-6, libgphoto2-port12 due to the critical vulnerabilities CVE-2026-40333–40335, CVE-2026-40338–40341
  • Security updates for libgraphite2-3 due to the critical vulnerabilities CVE-2026-50593
  • Security updates for libgssapi-krb5-2, libk5crypto3, libkrb5-3, libkrb5support0 due to the critical vulnerabilities CVE-2026-4035, CVE-2026-11850, CVE-2026-40355–40356
  • Security updates for libidn12 due to the critical vulnerabilities CVE-2026-57053
  • Security updates for libinput-bin, libinput10 due to the critical vulnerabilities CVE-2026-50292
  • Security updates for libjbig2dec0 due to the critical vulnerabilities CVE-2023-46361, CVE-2026-38076
  • Security updates for liblzma5, xz-utils due to the critical vulnerabilities CVE-2026-34743
  • Security updates for libncurses6, libncursesw6, libtinfo6, ncurses-base, ncurses-bin, ncurses-term, libncurses5, libncursesw5, libtinfo5 due to the critical vulnerabilities CVE-2025-69720
  • Security updates for libnfs13 due to the critical vulnerabilities CVE-2026-53689
  • Security updates for libnghttp2-14 due to the critical vulnerabilities CVE-2026-27135, CVE-2026-58055
  • Security updates for libnss-resolve, libpam-systemd, libsystemd0, libudev1, systemd, systemd-timesyncd, udev due to the critical vulnerabilities CVE-2023-7008, CVE-2026-40226
  • Security updates for libnss3, libnss3-tools due to the critical vulnerabilities CVE-2026-12318
  • Security updates for libntfs-3g89, ntfs-3g, ntfs-3g-dev due to the critical vulnerabilities CVE-2026-42616–42618, CVE-2026-46569–46572, CVE-2026-56135–56136
  • Security updates for libopenjp2-7 due to the critical vulnerabilities CVE-2026-6192
  • Security updates for libpam0g, libpam-modules due to the critical vulnerabilities CVE-2026-54411
  • Security updates for libperl5.34, perl-base, perl-modules-5.34 due to the critical vulnerabilities CVE-2026-8376, CVE-2026-42496
  • Security updates for libpng16-16 due to the critical vulnerabilities CVE-2026-33416, CVE-2026-33636, CVE-2026-34757
  • Security updates for libpoppler-glib8, libpoppler118, poppler-utils due to the critical vulnerabilities CVE-2026-10118
  • Security updates for libpython3.10, libpython3.10-minimal, libpython3.10-stdlib, python3.10, python3.10-minimal due to the critical vulnerabilities CVE-2021-4189, CVE-2025-13462, CVE-2025-69534, CVE-2026-0672, CVE-2026-1299, CVE-2026-1502, CVE-2026-2297, CVE-2026-3276, CVE-2026-3644, CVE-2026-4224, CVE-2026-4519, CVE-2026-4786, CVE-2026-6019, CVE-2026-6100, CVE-2026-8328, CVE-2026-9669
  • Security updates for librabbitmq4 due to the critical vulnerabilities CVE-2023-35789, CVE-2026-44235–44236
  • Security updates for libsmbclient, libwbclient0, samba-libs due to the critical vulnerabilities CVE-2026-2340, CVE-2026-3012, CVE-2026-3238, CVE-2026-4408, CVE-2026-4480, CVE-2026-6949, CVE-2026-15779, CVE-2026-58216, CVE-2026-58218, CVE-2026-58221–58222, CVE-2026-58224
  • Security updates for libsoup-gnome2.4-1, libsoup2.4-1 due to the critical vulnerabilities CVE-2026-2369, CVE-2026-5119
  • Security updates for libsqlite3-0 due to the critical vulnerabilities CVE-2026-11822, CVE-2026-11824, CVE-2026-50812–50813
  • Security updates for libssl3, openssl due to the critical vulnerabilities CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34182, CVE-2026-42766–42767, CVE-2026-42770, CVE-2026-45445–45447
  • Security updates for libxfont2 due to the critical vulnerabilities CVE-2026-56001–56003
  • Security updates for libxml2, libxml2-utils due to the critical vulnerabilities CVE-2026-6653
  • Security updates for libxpm4 due to the critical vulnerabilities CVE-2026-4367
  • Security updates for mailcap due to the critical vulnerabilities CVE-2026-10037
  • Security updates for openssh-client, ssh-askpass-gnome, openssh-server, openssh-sftp-server due to the critical vulnerabilities CVE-2026-59995–60002
  • Security updates for rsync due to the critical vulnerabilities CVE-2025-10158, CVE-2026-29518, CVE-2026-41035, CVE-2026-43617–43620, CVE-2026-45232
  • Security updates for tar due to the critical vulnerabilities CVE-2025-45582, CVE-2026-5704
  • Security updates for vim, vim-common, vim-runtime, xxd due to the critical vulnerabilities CVE-2026-35177, CVE-2026-41411, CVE-2026-42307, CVE-2026-43961, CVE-2026-44656, CVE-2026-45130, CVE-2026-46483, CVE-2026-47162, CVE-2026-47167, CVE-2026-52858–52860, CVE-2026-55693, CVE-2026-55892, CVE-2026-55895, CVE-2026-57452, CVE-2026-57455–57456, CVE-2026-59856–59858
  • Security updates for wget due to the critical vulnerabilities CVE-2026-15146, CVE-2026-58469–58472