Aggregator

• rust-redlib-0.35.1-12.fc44

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-app-store-connect-0.5.0-8.fc43

Rebuilt with the latest Rust dependencies, addressing at least RUSTSEC-2026-0190.

• rust-afterburn-5.11.0-2.fc44

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• roundcubemail-1.6.20-1.el10_2

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.6.20-1.el10_3

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.6.20-1.fc43

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.6.20-1.el10_4

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.7.5-1.fc45

• Installer: Add possibility to detsroy the installer session/cookie
• Enigma: Fix db_sync() never restoring keyring files (#10343)
• Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
• Password: Replace SQL query placeholders in a single pass (#10345)
• Fix exit code of the healthcheck.sh script (#10337)
• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.7.5-1.fc44

• Installer: Add possibility to detsroy the installer session/cookie
• Enigma: Fix db_sync() never restoring keyring files (#10343)
• Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
• Password: Replace SQL query placeholders in a single pass (#10345)
• Fix exit code of the healthcheck.sh script (#10337)
• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• libsoup3-3.6.6-11.fc44

Fixes a few CVEs:

• CVE-2026-102560
• CVE-2026-102559
• CVE-2026-102558
• CVE-2026-102555
• CVE-2026-102556
• CVE-2026-102557
• CVE-2026-85197
• CVE-2026-103399
• CVE-2026-85534
• CVE-2026-3633
• CVE-2026-3099

• libsoup3-3.6.6-6.fc43

Fixes a few CVEs:

• CVE-2026-102560
• CVE-2026-102559
• CVE-2026-102558
• CVE-2026-102555
• CVE-2026-102556
• CVE-2026-102557
• CVE-2026-85197
• CVE-2026-103399
• CVE-2026-85534
• CVE-2026-3633
• CVE-2026-3099

• kernel-7.2.13-100.fc43

The 7.2.13 stable kernel update contains a number of important fixes across the tree.

• kernel-7.2.13-200.fc44

The 7.2.13 stable kernel update contains a number of important fixes across the tree.

• kernel-7.2.13-300.fc45

The 7.2.13 stable kernel update contains a number of important fixes across the tree.

• ags-3.6.2.22-1.fc43

Latest upstream bugfix release from 3.6.2 branch. Changes: https://github.com/adventuregamestudio/ags/releases/tag/v3.6.2.22 .

Also fixes CVE-2026-95512 in bundled FreeType.