Aggregator

FEDORA-2026-3d50e0ef85 Packages in this update:

• python-loguru-0.7.3-23.fc46

Update description:

Automatic update for python-loguru-0.7.3-23.fc46.

Changelog * Wed Nov 4 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 0.7.3-23 - Backport fix for CVE-2026-120217; Fixes RHBZ#2565692

FEDORA-2026-d52e740b90 Packages in this update:

• rust-routinator-0.15.2-5.fc43

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-d284dab04d Packages in this update:

• rust-routinator-0.15.2-5.fc44

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-ba69e92e04 Packages in this update:

• rust-routinator-0.15.2-5.fc45

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

FEDORA-2026-981a830ea5 Packages in this update:

• nginx-1.30.6-1.fc46
• nginx-mod-brotli-1.0.0~rc-15.fc46
• nginx-mod-fancyindex-0.6.0-10.fc46
• nginx-mod-headers-more-0.40-5.fc46
• nginx-mod-js-challenge-0^20230517.gitda6852d-13.fc46
• nginx-mod-modsecurity-1.0.4-19.fc46
• nginx-mod-naxsi-1.6-23.fc46
• nginx-mod-vts-0.2.7-3.fc46

Update description:

Update nginx stack to 1.30.6 to fix some CVEs: https://nginx.org/en/CHANGES-1.30

FEDORA-EPEL-2026-79b7b2864a Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el10_3

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-EPEL-2026-c4e44302ce Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el10_4

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-EPEL-2026-0389d75dbd Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el9

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-EPEL-2026-b613641941 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el10_2

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-2fe77b7737 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc45

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-8eb916e28d Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc43

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-d4bdbe1e68 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc44

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-59933) It was discovered that libvips incorrectly determined image dimensions in the vipsload operation, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-33327) It was discovered that libvips incorrectly determined image dimensions in the gifload operation on 32-bit systems, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-33328) It was discovered that libvips did not properly validate EXIF tag groups. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-35590) It was discovered that libvips incorrectly determined the number of channels in certain encoded tiles within TIFF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591) It was discovered that libvips incorrectly validated scanlines in certain TIFF images with many bands, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, obtain sensitive information, or possibly execute arbitrary code. (CVE-2026-69242) It was discovered that libvips incorrectly calculated frame heights when loading certain multi-page TIFF images through ImageMagick. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-70651) It was discovered that libvips incorrectly handled certain Radiance images. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-70653) It was discovered that libvips incorrectly calculated read sizes when processing certain uncompressed PPM images from custom sources. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70654)

It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.