Aggregator

It was discovered that Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker could possibly use this issue to cause Net-SNMP to block indefinitely, resulting in a denial of service.

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Original advisory details: It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.

FEDORA-2026-93ccf43a01 Packages in this update:

• mtools-4.0.50-1.fc43

Update description:

Update to 4.0.50 (#2564411)

Version:next-20261104 (linux-next) Released:2026-11-04

Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.

FEDORA-2026-69a77954cf Packages in this update:

• gimp-3.2.8-1.fc43

Update description:

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

FEDORA-2026-e55621607b Packages in this update:

• gimp-3.2.8-1.fc45

Update description:

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

FEDORA-2026-32431829f1 Packages in this update:

• gimp-3.2.8-1.fc44

Update description:

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

FEDORA-EPEL-2026-c167d2d2d7 Packages in this update:

• python-loguru-0.7.3-9.el10_3

Update description:

Backport fix for CVE-2026-120217

FEDORA-2026-4701fdc782 Packages in this update:

• mongo-c-driver-2.5.8-1.fc45

Update description: libbson version 2.5.8

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

libmongoc version 2.5.8

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-0da73d1b5b Packages in this update:

• mongo-c-driver-2.5.8-1.el10_4

Update description: libbson version 2.5.8

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

libmongoc version 2.5.8

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-8663de05d3 Packages in this update:

• mongo-c-driver-2.5.8-1.el10_3

Update description: libbson version 2.5.8

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

libmongoc version 2.5.8

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-2026-43d95b04a7 Packages in this update:

• mongo-c-driver-1.30.15-1.fc44

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-a98d3339c8 Packages in this update:

• mongo-c-driver-1.30.15-1.el8

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-8865b24891 Packages in this update:

• mongo-c-driver-1.30.15-1.el10_2

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-2026-be6a432dc3 Packages in this update:

• mongo-c-driver-1.30.15-1.fc43

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-318de46435 Packages in this update:

• mongo-c-driver-1.30.15-1.el9

Update description: libmongoc 1.30.15

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

FEDORA-EPEL-2026-2035b2e21b Packages in this update:

• python-loguru-0.7.3-9.el10_4

Update description:

Backport fix for CVE-2026-120217

FEDORA-2026-a04615c725 Packages in this update:

• perl-CGI-5.02-1.fc45

Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

FEDORA-2026-516e427bac Packages in this update:

• perl-CGI-5.02-1.fc44

Update description:

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)