Aggregator

FEDORA-EPEL-2026-b613641941 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.el10_2

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-2fe77b7737 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc45

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-8eb916e28d Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc43

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

FEDORA-2026-d4bdbe1e68 Packages in this update:

• perl-HTTP-Parser-XS-0.18-1.fc44

Update description:

HTTP::Parser::XS versions before 0.18 truncate PATH_INFO at an encoded NUL byte in parse_http_request. The XS parser URL-decodes the request path and measures the result with strlen(), so PATH_INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected.

It was discovered that libvips incorrectly handled certain PDF files with a page that defines a width but not a height. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-59933) It was discovered that libvips incorrectly determined image dimensions in the vipsload operation, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-33327) It was discovered that libvips incorrectly determined image dimensions in the gifload operation on 32-bit systems, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-33328) It was discovered that libvips did not properly validate EXIF tag groups. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-35590) It was discovered that libvips incorrectly determined the number of channels in certain encoded tiles within TIFF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-35591) It was discovered that libvips incorrectly validated scanlines in certain TIFF images with many bands, leading to an integer overflow. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, obtain sensitive information, or possibly execute arbitrary code. (CVE-2026-69242) It was discovered that libvips incorrectly calculated frame heights when loading certain multi-page TIFF images through ImageMagick. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service. (CVE-2026-70651) It was discovered that libvips incorrectly handled certain Radiance images. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-70653) It was discovered that libvips incorrectly calculated read sizes when processing certain uncompressed PPM images from custom sources. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-70654)

It was discovered that SOGo used the client-supplied Origin header when constructing password reset links. A remote attacker could possibly use this issue to obtain password reset tokens and take over user accounts.

It was discovered that the shpsort utility in Shapelib incorrectly handled certain inputs, leading to a double free. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.

It was discovered that rxvt-unicode incorrectly handled certain escape sequences. An attacker could possibly use this issue to execute arbitrary code if a user displayed specially crafted text in the terminal.

It was discovered that Sprockets incorrectly handled certain specially crafted requests when the Sprockets server was used in production. A remote attacker could possibly use this issue to access files outside of the application's root directory.

It was discovered that Relax-and-Recover created a world-readable initrd when GRUB_RESCUE was enabled. A local attacker could possibly use this issue to obtain sensitive information.

It was discovered that libuser did not properly validate the GECOS field when changing user information. A local attacker could possibly use this issue to corrupt the passwd file, resulting in a denial of service. (CVE-2015-3245) It was discovered that libuser modified the passwd file in place when updating user information. A local attacker could possibly use this issue to cause an inconsistent file state, resulting in a denial of service, or possibly escalate privileges. (CVE-2015-3246)

Dawid Golunski discovered that Swift Mailer did not properly sanitize e-mail addresses in the mail transport. A remote attacker could possibly use this issue to pass extra parameters to the mail command and execute arbitrary code.

It was discovered that Net::EasyTCP used the built-in Perl rand() function to generate encryption keys when no strong randomization module was present. An attacker could possibly use this issue to predict the keys and obtain sensitive information.

It was discovered that jabberd2 allowed SASL ANONYMOUS authentication even when it was not enabled in the configuration. A remote attacker could possibly use this issue to bypass authentication.

Dawid Golunski discovered that CakePHP incorrectly trusted the CLIENT-IP HTTP header when determining the client IP address. A remote attacker could possibly use this issue to spoof their IP address.

It was discovered that BitlBee incorrectly handled file transfer connections that expired when built with libpurple. A remote attacker could possibly use this issue to cause BitlBee to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10188) It was discovered that BitlBee incorrectly handled file transfer requests for contacts that were not in the contact list. A remote attacker could possibly use this issue to cause BitlBee to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10189)

It was discovered that Apt-Cacher did not properly handle encoded newline characters in requests. A remote attacker could possibly use this issue to perform HTTP response splitting attacks.

It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-12478) It was discovered that libsoup incorrectly handled certain data URIs. A remote attacker could possibly use this issue to cause an application to crash or expose sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102555) It was discovered that libsoup incorrectly handled certain WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102556) It was discovered that libsoup incorrectly handled fragmented WebSocket messages. A remote attacker could possibly use this issue to cause an application to crash. (CVE-2026-102557) It was discovered that libsoup incorrectly handled certain WebSocket frames. A remote attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102558) It was discovered that libsoup incorrectly handled large WebSocket messages. An attacker could possibly use this issue to cause an application to crash. (CVE-2026-102559) It was discovered that libsoup incorrectly handled compressed WebSocket messages. An attacker could possibly use this issue to cause an application to crash. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-102560) It was discovered that libsoup did not properly handle certain HTTP requests. A remote attacker could possibly use this issue to inject arbitrary HTTP requests. (CVE-2026-103399) It was discovered that libsoup incorrectly handled proxy credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-12547) It was discovered that libsoup incorrectly handled multipart messages. A remote attacker could possibly use this issue to cause an application to crash or obtain sensitive information. (CVE-2026-12548)

Version:next-20261103 (linux-next) Released:2026-11-03

FEDORA-2026-e3b4074098 Packages in this update:

• ignition-2.28.0-2.fc45

Update description:

Rebuild against the patched Go toolchain (golang 1.27.3) to pick up the fix for CVE-2026-111943. Go's crypto/x509 now rejects certificate chains that use any of eight compromised eMudhra intermediate CA public keys. There are no source changes to ignition itself -- this rebuild simply links the fixed standard library into the binary.

Update to Ignition 2.28.0, including Butane OpenShift 5.0 support. See https://github.com/coreos/ignition/issues/2336.

Patch build to resolve home_dir symlinks to avoid an issue with a recent libselinux update leading to relabelling failures.