Aggregator

FEDORA-2026-f7c7c6a7de Packages in this update:

• mingw-python-certifi-2026.10.18-1.fc45

Update description:

Update to certifi-2026.10.18.

FEDORA-2026-746612ff80 Packages in this update:

• mingw-python-certifi-2026.10.18-1.fc44

Update description:

Update to certifi-2026.10.18.

FEDORA-2026-f82897416f Packages in this update:

• mingw-python-certifi-2026.10.18-1.fc43

Update description:

Update to certifi-2026.10.18.

USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324) It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339) It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680) It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197) It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

FEDORA-2026-844fdf9ca7 Packages in this update:

• openssh-10.6p1-1.fc45

Update description:

Rebasing OpenSSH to 10.6p1

FEDORA-EPEL-2026-f65970b394 Packages in this update:

• rust-cargo-semver-checks-0.51.0-5.el10_3
• rust-trustfall-rustdoc-adapter57-57.1.3-2.el10_3
• rust-trustfall-rustdoc-adapter60-60.0.3-2.el10_3
• rust-trustfall-rustdoc-adapter-61.0.3-1.el10_3

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349 and with faster-hex 0.10.1 for RUSTSEC-2026-0306. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-4904) It was discovered that c-ares did not properly limit DNS compression pointer hops or assembled name lengths when parsing DNS names. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. (CVE-2026-69184) It was discovered that c-ares did not properly validate record count fields before allocating memory when parsing DNS responses. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-69186)

FEDORA-EPEL-2026-7e7a60affc Packages in this update:

• rust-cargo-semver-checks-0.51.0-5.el10_4
• rust-trustfall-rustdoc-adapter57-57.1.3-2.el10_4
• rust-trustfall-rustdoc-adapter60-60.0.3-2.el10_4
• rust-trustfall-rustdoc-adapter-61.0.3-1.el10_4

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349 and with faster-hex 0.10.1 for RUSTSEC-2026-0306. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.

It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.

USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not properly validate certain DHCPv6 option lengths during network boot. An attacker could possibly use this issue to trigger out-of-bounds memory access, resulting in a denial of service. (CVE-2026-74225)

Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (CVE-2026-101258) It was discovered that Ghostscript incorrectly handled memory when converting certain fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause Ghostscript to crash, or possibly execute arbitrary code. (CVE-2026-103226) Paulos Yibelo discovered that Ghostscript did not properly validate certain operands when loading fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (No CVE number)

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)

FEDORA-2026-d5f8446449 Packages in this update:

• php-8.4.27-2.fc43

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-2026-a9354b8a1e Packages in this update:

• php-8.5.12-1.fc45

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-2026-a9eba4bbc3 Packages in this update:

• php-8.5.12-1.fc44

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)

Version:next-20261021 (linux-next) Released:2026-10-21

FEDORA-EPEL-2026-1d3c013156 Packages in this update:

• ntpsec-1.2.6-1.el10_3

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-18321 CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-EPEL-2026-077c9d1631 Packages in this update:

• ntpsec-1.2.6-1.el9

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-18321 CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.