Aggregator | Linuxlookup

Fix for CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes. Thanks to Qifan Zhang, Palo Alto Networks for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt
Fix for CVE-2026-12245: If NSD is configured with DNS over TLS, a client that performs a TLS action, closing the connection early, causes a crash and restart of the server process. An attacker can keep all children in a crash-restart loop denying DoT service. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt
Fix for CVE-2026-12246: The RR type APL rdata address, if too large, causes out of bounds write on the stack, when the zonefile is written out. Thanks to Qifan Zhang from Palo Alto Networks, Haruki Oyama from Waseda University and zhangph for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt
Fix for CVE-2026-12490: Secondaries authenticated by a client certificate to transfer a zone over TLS, can bypass verification by transferring over TCP. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt

nsd-4.14.3-1.fc44

Fedora Security Advisories

16 hours 27 minutes ago

FEDORA-2026-dd3a7926a3 Packages in this update:

nsd-4.14.3-1.fc44

Update description:

Fix for CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes. Thanks to Qifan Zhang, Palo Alto Networks for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt
Fix for CVE-2026-12245: If NSD is configured with DNS over TLS, a client that performs a TLS action, closing the connection early, causes a crash and restart of the server process. An attacker can keep all children in a crash-restart loop denying DoT service. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt
Fix for CVE-2026-12246: The RR type APL rdata address, if too large, causes out of bounds write on the stack, when the zonefile is written out. Thanks to Qifan Zhang from Palo Alto Networks, Haruki Oyama from Waseda University and zhangph for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt
Fix for CVE-2026-12490: Secondaries authenticated by a client certificate to transfer a zone over TLS, can bypass verification by transferring over TCP. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt

python-streamlink-8.4.0-1.fc43

Fedora Security Advisories

16 hours 31 minutes ago

FEDORA-2026-4d6aae2d33 Packages in this update:

python-streamlink-8.4.0-1.fc43

Update description: streamlink 8.4.0 (2026-05-06)

SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
Fixed: --interface selection by name on macOS (#6908)
Fixed: --interface not being applied to adapters mounted after session init (#6915)
Updated plugins:
goltelevision: rewritten and fixed plugin (#6916)
twitcasting: improved ad segment filtering (#6910)

Full changelog

streamlink 8.3.0 (2026-04-10)

Added: support for choosing the --interface by name on non-Windows systems, with optional prefixes, similar to curl (#6862)
Added: support for also checking stream segments in HLSStream.parse_variant_playlist() by setting check_streams="segments" (#6878)
Fixed: stdout/stderr streams in ProcessOutput not being fully line-buffered (#6868)
Updated plugins:
cdnbg: rewritten and fixed plugin (#6890)
nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure (#6871)
soop: migrated to sooplive.com (#6876)
telefe: rewritten and fixed plugin (#6891)

Full changelog

python-streamlink-8.4.0-1.fc44

Fedora Security Advisories

16 hours 31 minutes ago

FEDORA-2026-b9232006bb Packages in this update:

python-streamlink-8.4.0-1.fc44

Update description: streamlink 8.4.0 (2026-05-06)

SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
Fixed: --interface selection by name on macOS (#6908)
Fixed: --interface not being applied to adapters mounted after session init (#6915)
Updated plugins:
goltelevision: rewritten and fixed plugin (#6916)
twitcasting: improved ad segment filtering (#6910)

Full changelog

streamlink 8.3.0 (2026-04-10)

Added: support for choosing the --interface by name on non-Windows systems, with optional prefixes, similar to curl (#6862)
Added: support for also checking stream segments in HLSStream.parse_variant_playlist() by setting check_streams="segments" (#6878)
Fixed: stdout/stderr streams in ProcessOutput not being fully line-buffered (#6868)
Updated plugins:
cdnbg: rewritten and fixed plugin (#6890)
nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure (#6871)
soop: migrated to sooplive.com (#6876)
telefe: rewritten and fixed plugin (#6891)

Full changelog

USN-8477-1: tar vulnerability

Ubuntu Security Advisories

1 day 3 hours ago

It was discovered that tar incorrectly handled certain crafted archive files. An attacker could possibly use this to inject hidden files with attacker-controlled content, bypassing pre-extraction inspection mechanisms.