Aggregator

FEDORA-2026-c3351f4ae4 Packages in this update:

• roundcubemail-1.6.17-1.fc43

Update description: Release 1.6.17

• Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
• Enigma: Kolab WOAT Support (#8626)
• Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
• Security: Fix various vulnerabilities in the password plugin using session-injected username
• Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
• Security: Fix SSRF bypass via specific local address URLs - two new cases
• Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
• Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file

FEDORA-EPEL-2026-a54f17adc3 Packages in this update:

• roundcubemail-1.6.17-1.el10_2

Update description: Release 1.6.17

• Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
• Enigma: Kolab WOAT Support (#8626)
• Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
• Security: Fix various vulnerabilities in the password plugin using session-injected username
• Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
• Security: Fix SSRF bypass via specific local address URLs - two new cases
• Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
• Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file

FEDORA-EPEL-2026-44b1dd565d Packages in this update:

• roundcubemail-1.6.17-1.el10_3

Update description: Release 1.6.17

• Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
• Enigma: Kolab WOAT Support (#8626)
• Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
• Security: Fix various vulnerabilities in the password plugin using session-injected username
• Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
• Security: Fix SSRF bypass via specific local address URLs - two new cases
• Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
• Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file

FEDORA-2026-8abedbcc4f Packages in this update:

• python-tiktoken-0.13.0-2.fc43

Update description:

Update to upstream release 0.13.0; update PyO3 to 0.29, fixing RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-2026-e0bcb90c9f Packages in this update:

• python-tiktoken-0.13.0-2.fc44

Update description:

Update to upstream release 0.13.0; update PyO3 to 0.29, fixing RUSTSEC-2026-0176 and RUSTSEC-2026-0177.

FEDORA-EPEL-2026-cf4968c198 Packages in this update:

• cjson-1.7.19-1.el10_3

Update description:

Update to version 1.7.19.

https://github.com/DaveGamble/cJSON/blob/v1.7.19/CHANGELOG.md

FEDORA-2026-0c3f6c7c67 Packages in this update:

• cjson-1.7.19-1.fc44

Update description:

Update to version 1.7.19.

https://github.com/DaveGamble/cJSON/blob/v1.7.19/CHANGELOG.md

FEDORA-2026-90dbff48ca Packages in this update:

• cifs-utils-7.6-2.fc45

Update description:

Automatic update for cifs-utils-7.6-2.fc45.

Changelog * Mon Jul 6 2026 Paulo Alcantara <paalcant@redhat.com> - 7.6-2 - cifs.upcall: fix regression with kerberos mounts - Resolves: rhbz#2497446 - Resolves: rhbz#2496963 - Resolves: rhbz#2489808 - CVE-2026-12505

Version:next-20260706 (linux-next) Released:2026-07-06

It was discovered that OpenSSH incorrectly handled file permissions when downloading files as root using the legacy scp protocol without the preserve-mode option. An attacker could use this to install setuid or setgid files on a system, possibly leading to privilege escalation.

It was discovered that GnuTLS had a timing side-channel when processing malformed ciphertexts in RSA-PSK ClientKeyExchange. A remote attacker could possibly use this issue to recover sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-0553) Bing Shi discovered that GnuTLS incorrectly handled decoding certain DER-encoded certificates. A remote attacker could possibly use this issue to cause GnuTLS to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2024-12243) Luigino Camastra discovered that GnuTLS incorrectly handled certain PKCS11 token labels. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2025-9820) Tim Scheckenbach discovered that GnuTLS incorrectly handled malicious certificates containing a large number of name constraints and subject alternative names. A remote attacker could possibly use this issue to cause GnuTLS to consume resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-14831) Oleh Konko and Joshua Rogers discovered that GnuTLS did not properly handle case-insensitive name constraints in certain cases. A remote attacker could possibly use this issue to bypass certificate validation, leading to a machine-in-the-middle attack. (CVE-2026-3833) Joshua Rogers discovered that GnuTLS did not properly handle very short premaster secrets in certain RSA key exchange cases with PKCS#11-backed server keys. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-5260) Joshua Rogers discovered that GnuTLS did not properly handle malformed DTLS handshake fragments in certain cases. A remote attacker could possibly use this issue to obtain sensitive information, or cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-33845) Haruto Kimura, Oscar Reparaz, and Zou Dikai discovered that GnuTLS did not properly validate DTLS handshake fragment lengths in certain cases. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-33846) Joshua Rogers discovered that GnuTLS did not properly order DTLS packets with duplicate sequence numbers in certain cases. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service. (CVE-2026-42009) Joshua Rogers discovered that GnuTLS did not properly handle usernames containing NUL characters in certain RSA-PSK configurations. A remote attacker could possibly use this issue to bypass authentication and gain unintended access to services. This issue only affected Ubuntu 20.04 LTS. (CVE-2026-42010)

It was discovered that PHP incorrectly handled SOAP object deduplication when processing apache:Map nodes with duplicate keys. An attacker could possibly use this to cause a use-after-free, resulting in remote code execution. (CVE-2026-6722) It was discovered that PHP incorrectly handled SOAP request persistence when configured with SOAP_PERSISTENCE_SESSION. An attacker could possibly use this to cause a use-after-free, resulting in memory corruption, information disclosure, or a denial of service. (CVE-2026-7261) It was discovered that the PDO Firebird driver in PHP improperly handled NUL bytes when quoting SQL query strings. An attacker could possibly use this to perform SQL injection when attacker-controlled values are embedded in SQL statements. (CVE-2025-14179)

It was discovered that Gzip's gzexe utility handled temporary files in an insecure manner. When the mktemp utility was not available, gzexe constructed a temporary file path based on the process ID, which could be predicted. A local attacker could possibly use this issue to overwrite arbitrary files via a symlink attack. (CVE-2026-41991) It was discovered that Gzip incorrectly handled certain compressed files. An attacker could possibly use this issue to obtain sensitive information or cause Gzip to crash, resulting in a denial of service. (CVE-2026-41992)

It was discovered that socat incorrectly handled the SOCKS5 proxy server reply parser. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-56123) It was discovered that socat incorrectly handled a sample script. A local attacker could possibly use this issue to overwrite arbitrary files. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-54661)

It was discovered that tar incorrectly handled symlinks when extracting archives. An attacker could possibly use this issue to overwrite arbitrary files.

It was discovered that Python incorrectly normalized paths in the tarfile module. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-13462) It was discovered that Python's HTMLParser incorrectly handled certain malformed HTML input. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534) It was discovered that Python's email module incorrectly quoted newlines in headers. An attacker could possibly use this issue to inject arbitrary email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-1299) It was discovered that Python's http.client module did not properly sanitize carriage return and linefeed characters when handling HTTP CONNECT tunnel request headers. An attacker could possibly use this issue to inject arbitrary HTTP headers. (CVE-2026-1502) It was discovered that Python's importlib module did not generate an audit event when loading legacy .pyc files. An attacker could possibly use this issue to bypass auditing mechanisms. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297) It was discovered that Python's unicodedata.normalize() function had incorrect algorithmic complexity. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2026-3276) It was discovered that Python's http.cookies module incorrectly handled control characters in certain cookie operations. An attacker could possibly use this issue to inject arbitrary content. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644) It was discovered that the Python pyexpat module was vulnerable to unbounded recursion in the Expat XML parser. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224) It was discovered that Python's webbrowser module accepted leading dashes in URLs, which could be interpreted as command-line options. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519) It was discovered that Python incorrectly handled webbrowser.open() handlers. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-4786) It was discovered that Python's remote debugging module did not properly validate offset tables when loading debug information. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713) It was discovered that Python's http.cookies module incorrectly escaped values in the js_output() method. An attacker could possibly use this issue to inject arbitrary JavaScript. (CVE-2026-6019) It was discovered that Python's lzma, bz2, and gzip decompressor objects had a use-after-free vulnerability. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100) It was discovered that Python's tarfile module did not properly validate link targets when using the data filter. An attacker could possibly use this issue to bypass path restrictions. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774) It was discovered that the fix for CVE-2021-4189 in Python's ftplib module was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An attacker could possibly use this issue to perform server-side request forgery attacks. (CVE-2026-8328) It was discovered that Python's bz2 module allowed reuse of a BZ2Decompressor object after a decompression error. An attacker could possibly use this issue to cause Python to crash or execute arbitrary code. (CVE-2026-9669)

Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search "Page" URL parameter. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-6841) It was discovered that Request Tracker did not properly sanitize user- controlled data written to spreadsheet exports of search results. A remote attacker could possibly use this issue to conduct a spreadsheet (CSV/formula) injection attack, causing spreadsheet applications to interpret crafted values as formulas or macros when the file is opened. (CVE-2026-41073) It was discovered that Request Tracker did not properly validate input incorporated into database queries via the entry_aggregator parameter in JSON search. An authenticated user could possibly use this issue to perform SQL injection attacks and read or modify data in the RT database. (CVE-2026-41075) It was discovered that Request Tracker contained an authentication bypass when configured to authenticate users against an LDAP or Active Directory server. Under certain LDAP server configurations, a remote attacker could possibly use this issue to authenticate as any LDAP-backed RT user without supplying valid credentials. (CVE-2026-41076) It was discovered that Request Tracker served certain uploaded content inline rather than as an attachment. A remote attacker could possibly use this issue to conduct a cross-site scripting attack. (CVE-2026-44229) It was discovered that Request Tracker did not properly sanitize input on search-results chart pages. A remote attacker could possibly use this issue to conduct a reflected cross-site scripting attack. (CVE-2026-44230) Jeroen Gui discovered that Request Tracker did not properly restrict access to the REST 2.0 user collection endpoint. A privileged user could possibly use this issue to obtain authentication credentials belonging to other users, including administrators, resulting in privilege escalation and information disclosure. (CVE-2026-44231)

It was discovered that Parsl incorrectly constructed SQL queries using unsafe string formatting with user-supplied input in the parsl-visualize component. A remote attacker could possibly use this issue to perform SQL injection attacks, leading to data exfiltration or a denial of service.