Aggregator

FEDORA-2026-9f63ee951e Packages in this update:

• asterisk-23.5.0-3.fc45

Update description:

Fix for CVE-2026-57160

FEDORA-2026-572a0f4178 Packages in this update:

• gegl04-0.4.72-3.fc43
• gimp-3.2.6-1.fc43

Update description:

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes an overflow in parsing RGBE/HDR image files.

For more information, please consult the GIMP 3.2.6 release announcement and the more detailed changelogs of gimp and gegl04.

Version:next-20260911 (linux-next) Released:2026-09-11

Version:7.2.5 (stable) Released:2026-09-11 Source:linux-7.2.5.tar.xz PGP Signature:linux-7.2.5.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.2.5

Version:6.18.51 (longterm) Released:2026-09-11 Source:linux-6.18.51.tar.xz PGP Signature:linux-6.18.51.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.51

FEDORA-EPEL-2026-44dc853e3c Packages in this update:

• stb-0-0.61.20260802.2c980bb.el8

Update description:

Patch stb_sprintf: security fix for CVE-2026-79516

FEDORA-EPEL-2026-cdddb2a578 Packages in this update:

• stb-0^20260802.2c980bb-2.el9

Update description:

Patch stb_sprintf: security fix for CVE-2026-79516

USN-8571-1 fixed vulnerabilities in Apache HTTP Server. That fix was incomplete due to a missing library symbol, resulting in a regression that could cause Apache HTTP Server to fail to start when HTTP/2 proxying was enabled. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Pavel Kohout and Arkadi Vainbrand discovered that Apache HTTP Server incorrectly handled certain memory operations in mod_authn_socache. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33007) Haruki Oyama, Merih Mengisteab, and Dawit Jeong discovered that Apache HTTP Server had an HTTP response splitting vulnerability in multiple modules when used with untrusted or compromised backend servers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-33523) Elhanan Haenel discovered that Apache HTTP Server incorrectly handled certain memory operations in mod_proxy_ajp. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33857) Tianshuo Han and Jérôme Djouder discovered that Apache HTTP Server incorrectly handled certain string operations in mod_proxy_ajp. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-34032) It was discovered that Apache HTTP Server's mod_proxy_html module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-34355) It was discovered that Apache HTTP Server incorrectly handled ProxyPassReverseCookie directives with a malicious backend server. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-34356) It was discovered that Apache HTTP Server's mod_dav_fs module incorrectly handled certain path operations. An authenticated user could possibly use this issue to manipulate trusted WebDAV property databases or cause a denial of service. (CVE-2026-42535) It was discovered that Apache HTTP Server's mod_xml2enc module incorrectly handled certain content from an untrusted backend. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-42536) It was discovered that Apache HTTP Server incorrectly handled response headers when multiple content languages were configured. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-43951) It was discovered that Apache HTTP Server incorrectly restricted certain file functions in expressions within .htaccess files. A local attacker with .htaccess write access could possibly use this issue to obtain sensitive information. (CVE-2026-44119) It was discovered that Apache HTTP Server's mod_ssl module incorrectly handled OCSP responses from an attacker-controlled server. A remote attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-44185) It was discovered that Apache HTTP Server's mod_proxy_ftp module incorrectly handled responses from an attacker-controlled backend FTP server. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-44186) It was discovered that Apache HTTP Server incorrectly handled crafted regular expressions in the server configuration. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-44631) It was discovered that Apache HTTP Server's mod_http2 module had a use-after-free vulnerability when file handles were exhausted. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-48913)

FEDORA-EPEL-2026-30f5385d0c Packages in this update:

• stb-0^20260802.2c980bb-2.el10_3

Update description:

Patch stb_sprintf: security fix for CVE-2026-79516

FEDORA-2026-e9a6f74bd2 Packages in this update:

• forgejo-15.0.8-1.fc45

Update description:

This is an upstream bug and security fix release.

Please consult the upstream release notes for more details.

Version:next-20260910 (linux-next) Released:2026-09-10

FEDORA-2026-1ea9bbcb29 Packages in this update:

• evolution-3.58.3-2.fc43

Update description:

Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859.

FEDORA-2026-99a4ff5552 Packages in this update:

• evolution-3.60.2-2.fc44

Update description:

Add a patch to validate clickable preview elements in the Mail. Fixes CVE-2026-88859.

It was discovered that Beets incorrectly escaped untrusted media metadata in its web interface. An attacker could possibly use this issue to inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser.

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service.

It was discovered that KissFFT incorrectly handled certain large Fourier transform sizes on 32-bit architectures. An attacker could possibly use this issue to cause KissFFT to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2025-34297) It was discovered that KissFFT incorrectly handled certain multidimensional Fourier transform sizes. An attacker could possibly use this issue to cause KissFFT to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-41445)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Hardware crypto device drivers; - NVIDIA Tegra memory controller driver; - Network drivers; - GFS2 file system; - OCFS2 file system; - SMB network file system; - B.A.T.M.A.N. meshing protocol; - Ceph Core library; - IPv4 networking; - IPv6 networking; - Netfilter; - Open vSwitch; - RxRPC session sockets; - SCTP protocol; - TIPC protocol; (CVE-2026-52914, CVE-2026-52931, CVE-2026-52955, CVE-2026-52958, CVE-2026-52982, CVE-2026-52986, CVE-2026-52993, CVE-2026-52999, CVE-2026-53002, CVE-2026-53006, CVE-2026-53010, CVE-2026-53043, CVE-2026-53045, CVE-2026-53046, CVE-2026-53049, CVE-2026-53055, CVE-2026-53088, CVE-2026-53151, CVE-2026-53175, CVE-2026-53215, CVE-2026-53216, CVE-2026-53224, CVE-2026-53246, CVE-2026-53247, CVE-2026-53260, CVE-2026-53309, CVE-2026-64531)