Aggregator

FEDORA-2026-013922e1cc Packages in this update:

• xorg-x11-server-21.1.25-1.fc44

Update description:

Update to xserver 21.1.24, Security fixes for CVE-2026-88812, CVE-2026-93515, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

FEDORA-2026-232ffc1325 Packages in this update:

• socat-1.8.1.3-1.fc43

Update description:

• Update to 1.8.1.3 (rhbz#2492929)
• Fix for CVE-2026-56123 (rhbz#2535043)

FEDORA-2026-4172dae890 Packages in this update:

• socat-1.8.1.3-1.fc44

Update description:

• Update to 1.8.1.3 (rhbz#2492929)
• Fix for CVE-2026-56123 (rhbz#2535043)

FEDORA-2026-ddab5501ea Packages in this update:

• socat-1.8.1.3-1.fc45

Update description:

• Update to 1.8.1.3 (rhbz#2492929)
• Fix for CVE-2026-56123 (rhbz#2535043)

FEDORA-2026-3bb7b0bc5a Packages in this update:

• socat-1.8.1.3-1.fc46

Update description:

Automatic update for socat-1.8.1.3-1.fc46.

Changelog * Tue Oct 6 2026 Martin Osvald <mosvald@redhat.com> - 1.8.1.3-1 - Update to 1.8.1.3 (rhbz#2492929) - Fix for CVE-2026-56123 (rhbz#2535043)

FEDORA-2026-11378d4ce0 Packages in this update:

• xorg-x11-server-21.1.25-1.fc45

Update description:

Update to xserver 21.1.24, Security fixes for CVE-2026-88812, CVE-2026-93515, CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536

FEDORA-2026-da6797fbc8 Packages in this update:

• sudo-1.9.17-17.p2.fc46

Update description:

Automatic update for sudo-1.9.17-17.p2.fc46.

Changelog * Tue Oct 6 2026 Alejandro López <allopez@redhat.com> - 1.9.17-17.p2 - Fix CVE-2026-96512 - Resolves: rhbz#2539401

Darshan U discovered that Ubuntu Pro for WSL exposed the attach token in command-line arguments when enabling a subscription on a WSL instance. An attacker could possibly use this issue to obtain sensitive information and gain unauthorized access to Ubuntu Pro repositories.

FEDORA-EPEL-2026-0f7d08267e Packages in this update:

• 7zip-26.04-1.el10_2

Update description:

Some bugs and vulnerabilities were fixed

FEDORA-EPEL-2026-29947f7caa Packages in this update:

• 7zip-26.04-1.el9

Update description:

Some bugs and vulnerabilities were fixed

7-Zip 26.03

• Improved support for Joliet ISO images and Compound archives.
• Some bugs and vulnerabilities were fixed.

Irrelevant to us, listing for completeness as it affects only decompressing RAR archives (which we disable) on Windows (which we're not)

• CVE-2026-58052 : 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive.

https://github.com/ip7z/7zip/releases/tag/26.03

FEDORA-2026-626a028878 Packages in this update:

• 7zip-26.04-1.fc43

Update description:

Some bugs and vulnerabilities were fixed

FEDORA-2026-b846e78baf Packages in this update:

• 7zip-26.04-1.fc45

Update description:

Some bugs and vulnerabilities were fixed

FEDORA-EPEL-2026-e527d77d36 Packages in this update:

• 7zip-26.04-1.el10_3

Update description:

Some bugs and vulnerabilities were fixed

7-Zip 26.03

• Improved support for Joliet ISO images and Compound archives.
• Some bugs and vulnerabilities were fixed.

Irrelevant to us, listing for completeness as it affects only decompressing RAR archives (which we disable) on Windows (which we're not)

• CVE-2026-58052 : 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive.

https://github.com/ip7z/7zip/releases/tag/26.03

FEDORA-2026-b92ecada92 Packages in this update:

• 7zip-26.04-1.fc44

Update description:

Some bugs and vulnerabilities were fixed

FEDORA-EPEL-2026-7b07dd12c9 Packages in this update:

• 7zip-26.04-1.el10_4

Update description:

Some bugs and vulnerabilities were fixed

7-Zip 26.03

• Improved support for Joliet ISO images and Compound archives.
• Some bugs and vulnerabilities were fixed.

Irrelevant to us, listing for completeness as it affects only decompressing RAR archives (which we disable) on Windows (which we're not)

• CVE-2026-58052 : 7-Zip failed to preserve the Mark-of-the-Web when extracting a crafted archive.

https://github.com/ip7z/7zip/releases/tag/26.03

It was discovered that librsvg incorrectly handled duplicate XML entity declarations while processing SVG documents containing nested XML inclusions. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324) It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339) It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680) It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197) It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

Timo Preißl discovered that U-Boot incorrectly handled certain malformed ZFS file system metadata. An attacker could possibly use this issue to trigger an integer overflow and out-of-bounds memory access, resulting in arbitrary code execution or a denial of service. (CVE-2025-70290) Timo Preißl discovered that U-Boot incorrectly calculated buffer sizes when processing certain ext4 file systems. An attacker could possibly use this issue to trigger an integer overflow and out-of-bounds memory access, resulting in arbitrary code execution or a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2025-70293) Mateusz Furdyna discovered that U-Boot incorrectly handled certain fragmented IP traffic when IP defragmentation was enabled. An attacker could possibly use this issue to corrupt memory by sending crafted IP fragments, resulting in arbitrary code execution. (CVE-2026-15390) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain fragmented IP traffic during network boot when IP defragmentation was enabled. An attacker could possibly use this issue to trigger an out-of-bounds write, resulting in a denial of service. (CVE-2026-71971)

FEDORA-EPEL-2026-71b80f48fa Packages in this update:

• exim-4.100.1-1.el8

Update description:

This is new version of exim fixing CVE-2026-94054, CVE-2026-94055, CVE-2026-94056, CVE-2026-94057.