Aggregator

FEDORA-2026-7ac5fb031f Packages in this update:

• nagios-plugins-2.5-2.fc43

Update description:

Update to upstream (bz#2453492). check_icmp: host-count overflow leads to heap buffer overflow (bz#2513957) Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase hostnames (bz#2500542) Added perl-Math-BigInt as dependency for nagios-plugins-ssl_validity (bz#2439960)

FEDORA-2026-c2fbd942bc Packages in this update:

• nagios-plugins-2.5-2.fc44

Update description:

Update to upstream (bz#2453492). check_icmp: host-count overflow leads to heap buffer overflow (bz#2513957) Update 0012-fix-perl-ntp-ipv6.patch to allow uppercase hostnames (bz#2500542) Added perl-Math-BigInt as dependency for nagios-plugins-ssl_validity (bz#2439960)

It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-64830) It was discovered that FFmpeg incorrectly handled certain crafted DTS audio streams in the S/PDIF muxer. An attacker could possibly use this issue to cause a denial of service or expose sensitive information. (CVE-2026-64833) It was discovered that FFmpeg incorrectly handled certain crafted RTP/ASF streams. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-64834) It was discovered that FFmpeg incorrectly handled certain crafted ADX audio files. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-64835) It was discovered that FFmpeg incorrectly handled certain crafted AVI files in the TDSC video decoder. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-65703) It was discovered that FFmpeg incorrectly handled certain crafted ffconcat files processed via the TY demuxer. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-65704) It was discovered that FFmpeg incorrectly handled certain crafted video streams in the vf_floodfill video filter. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-65705) It was discovered that FFmpeg incorrectly handled certain crafted NV12 video frames in the vf_swaprect video filter. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-65706) It was discovered that FFmpeg incorrectly handled certain crafted hvcC NAL arrays in the HEVC parser. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-75141) It was discovered that FFmpeg incorrectly handled certain crafted MPEG system headers. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-75142) It was discovered that FFmpeg incorrectly handled certain crafted network input in the librist protocol handler. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-75143) It was discovered that FFmpeg incorrectly handled certain crafted Dirac data units in the VC2 HQ RTP packetizer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-75144) It was discovered that FFmpeg incorrectly handled certain crafted DASH manifests. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-75146)

It was discovered that Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who could place files in a directory that Tika subsequently parses could use this issue to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output.

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. (CVE-2025-27558) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - NVME drivers; - Ext4 file system; - SMB network file system; - IPv4 networking; - Network traffic control; - TCP network protocol; - Locking primitives; - IPv6 networking; - Multipath TCP; - Netfilter; - Open vSwitch; - SCTP protocol; - SMC sockets; (CVE-2026-31414, CVE-2026-31448, CVE-2026-31705, CVE-2026-43198, CVE-2026-43378, CVE-2026-43499, CVE-2026-46266, CVE-2026-46331, CVE-2026-52924, CVE-2026-52989, CVE-2026-53086, CVE-2026-53176, CVE-2026-53212, CVE-2026-53215, CVE-2026-53224, CVE-2026-53225, CVE-2026-53228, CVE-2026-53246, CVE-2026-53359, CVE-2026-64531)

Siebe Devroe, Héloïse Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not properly handle aggregated frames in mesh networks, due to an incorrect fix for CVE-2020-24588. A physically proximate attacker could use this issue to inject packets. (CVE-2025-27558) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - Cryptographic API; - InfiniBand drivers; - Media drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - NVME drivers; - File systems infrastructure; - Ext4 file system; - OCFS2 file system; - IPv4 networking; - Network traffic control; - TCP network protocol; - Locking primitives; - B.A.T.M.A.N. meshing protocol; - Ceph Core library; - IPv6 networking; - Multipath TCP; - Netfilter; - SCTP protocol; - SMC sockets; - TIPC protocol; (CVE-2021-47378, CVE-2026-23392, CVE-2026-31405, CVE-2026-31414, CVE-2026-31448, CVE-2026-31657, CVE-2026-31668, CVE-2026-43071, CVE-2026-43198, CVE-2026-43493, CVE-2026-43499, CVE-2026-46266, CVE-2026-46331, CVE-2026-52914, CVE-2026-52924, CVE-2026-52931, CVE-2026-52955, CVE-2026-52958, CVE-2026-52982, CVE-2026-52986, CVE-2026-52989, CVE-2026-52993, CVE-2026-52999, CVE-2026-53002, CVE-2026-53006, CVE-2026-53043, CVE-2026-53045, CVE-2026-53088, CVE-2026-53176, CVE-2026-53212, CVE-2026-53224, CVE-2026-53225, CVE-2026-53228, CVE-2026-53246, CVE-2026-53309, CVE-2026-53359)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - OCFS2 file system; - SCTP protocol; (CVE-2026-53043, CVE-2026-53224, CVE-2026-53225, CVE-2026-53246, CVE-2026-53309)

FEDORA-2026-046b69d591 Packages in this update:

• dokuwiki-20250514b-6.fc43

Update description:

Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752

FEDORA-2026-9bbb604ea2 Packages in this update:

• dokuwiki-20250514b-8.fc44

Update description:

Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752

FEDORA-2026-2ec7f70c76 Packages in this update:

• dokuwiki-20260714c-1.fc45

Update description:

Update to version 2026-07-14c (security hotfix update) - see https://github.com/dokuwiki/dokuwiki/issues/4752

FEDORA-2026-628af192f5 Packages in this update:

• kernel-7.2.3-300.fc45

Update description:

The 7.2.3 stable kernel update contains a number of important fixes across the tree.

The 7.2.2 stable kernel update contains a single fix for CVE-2026-80590

The 7.2.1 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream will assign CVEs, but we will not know what those are until a bit after this update ships.

FEDORA-2026-0d885c0533 Packages in this update:

• kernel-7.1.13-200.fc44

Update description:

The 7.1.13 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream will assign CVEs, but we will not know what those are until a bit after this update ships.

FEDORA-2026-a7b1ccd14c Packages in this update:

• kernel-7.1.13-100.fc43

Update description:

The 7.1.13 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream will assign CVEs, but we will not know what those are until a bit after this update ships.

FEDORA-2026-79e569db98 Packages in this update:

• python-asteval-1.0.10-1.fc45

Update description:

Update to 1.0.10

Resolves: rhbz#2413249

Mark Bereza and Lilith Wyatt discovered that BioSig incorrectly handled certain crafted input files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-22891, CVE-2026-20777)

Version:7.2.3 (stable) Released:2026-09-02 Source:linux-7.2.3.tar.xz PGP Signature:linux-7.2.3.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.2.3

Version:7.1.13 (EOL) (stable) Released:2026-09-02 Source:linux-7.1.13.tar.xz PGP Signature:linux-7.1.13.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.1.13

Version:6.18.49 (longterm) Released:2026-09-02 Source:linux-6.18.49.tar.xz PGP Signature:linux-6.18.49.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.49

Version:6.12.108 (longterm) Released:2026-09-02 Source:linux-6.12.108.tar.xz PGP Signature:linux-6.12.108.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.12.108