Aggregator

FEDORA-2026-65b6e06c2d Packages in this update:

• libpng12-1.2.57-27.fc44

Update description:

• fixes CVE-2025-64505 and CVE-2026-33416

FEDORA-2026-9d85027cc0 Packages in this update:

• libpng12-1.2.57-27.fc45

Update description:

• fixes CVE-2025-64505 and CVE-2026-33416

FEDORA-2026-d6bf58e7ce Packages in this update:

• libpng12-1.2.57-27.fc43

Update description:

• fixes CVE-2025-64505 and CVE-2026-33416

FEDORA-2026-095025bfaa Packages in this update:

• libpng15-1.5.30-27.fc43

Update description:

• fixes CVE-2025-64505 and CVE-2026-33416

FEDORA-2026-7facd4fad2 Packages in this update:

• libpng15-1.5.30-27.fc44

Update description:

• fixes CVE-2025-64505 and CVE-2026-33416

FEDORA-2026-fe765b13ce Packages in this update:

• libpng15-1.5.30-27.fc45

Update description:

• fixes CVE-2025-64505 and CVE-2026-33416

Version:7.3-rc7 (mainline) Released:2026-10-12 Source:linux-7.3-rc7.tar.gz Patch:full (incremental)

Harsh Raj Singhania discovered that the Perl DBI module did not correctly validate certain attributes. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-78030) Harsh Raj Singhania discovered that the Perl DBI module did not correctly handle certain string operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-88816)

FEDORA-EPEL-2026-602703bf01 Packages in this update:

• ImageMagick-6.9.13.58-1.el9

Update description:

Automatic update for ImageMagick-6.9.13.58-1.el9.

Changelog for ImageMagick * Sun Oct 11 2026 Luya Tshimbalanga <luya@fedoraproject.org> - 1:6.9.13.58-1 - Update to version 6.9.13.58 - Resolves: rhbz#2391125 - Resolves: rhbz#2392773 - Resolves: rhbz#2393600 - Resolves: rhbz#2404847 - Resolves: rhbz#2418553 - Resolves: rhbz#2421113

FEDORA-EPEL-2026-5497815500 Packages in this update:

• ImageMagick-6.9.13.58-1.el8

Update description:

Automatic update for ImageMagick-6.9.13.58-1.el8.

Changelog for ImageMagick * Sun Oct 11 2026 Luya Tshimbalanga <luya@fedoraproject.org> - 1:6.9.13.58-1 - Update to version 6.9.13.58 - Resolves: rhbz#2391124 - Resolves: rhbz#2392772 - Resolves: rhbz#2393599 - Resolves: rhbz#2404847 - Resolves: rhbz#2418552

FEDORA-2026-9729761538 Packages in this update:

• libpng12-1.2.57-27.fc46

Update description:

Automatic update for libpng12-1.2.57-27.fc46.

Changelog * Sun Oct 11 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.2.57-27 - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (rhbz#2452156) - fix CVE-2025-64505: heap buffer overflow via malformed palette index (rhbz#2418423)

FEDORA-2026-bc7bd292d6 Packages in this update:

• kernel-7.2.10-100.fc43

Update description:

The 7.2.10 stable kernel updates contain a number of important fixes across the tree.

FEDORA-2026-7b153c4ce6 Packages in this update:

• kernel-7.2.10-200.fc44

Update description:

The 7.2.10 stable kernel updates contain a number of important fixes across the tree.

FEDORA-2026-a9ca0db4f1 Packages in this update:

• kernel-7.2.10-300.fc45

Update description:

The 7.2.10 stable kernel updates contain a number of important fixes across the tree.

FEDORA-2026-fc041839f8 Packages in this update:

• libpng15-1.5.30-27.fc46

Update description:

Automatic update for libpng15-1.5.30-27.fc46.

Changelog * Sun Oct 11 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.5.30-27 - fix CVE-2025-64505: heap buffer overflow via malformed palette index (rhbz#2418424) - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (rhbz#2452157)

FEDORA-2026-3dbdc5d71d Packages in this update:

• nebula-1.11.2-1.fc44

Update description:

Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871) Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881) Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

FEDORA-2026-1aa327b369 Packages in this update:

• nebula-1.11.2-1.fc45

Update description:

Windows tracks NLMTU per address family and Nebula only ever set it for AF_INET, so the IPv6 MTU on every Windows adapter sat at the adapter default of 65535 regardless of tun.mtu and the stack could hand Nebula packets far larger than configured. An IPv6 enabled overlay with tun.mtu under 1280 now refuses to start, matching the other platforms. (#1871) Android 11+ denies bind() on netlink route sockets inside the app sandbox, so local address discovery failed and an Android node advertised no underlay addresses, leaving peers on the same LAN to reach it only at the address a lighthouse observed. (#1881) Recompute the transport checksum on packets a host sends to its own overlay address. On macOS the kernel leaves the checksum unfinished for hardware offload, which does not survive the trip through userspace, so TCP and UDP to a host's own IPv6 overlay address were dropped as corrupt. (#1862)

FEDORA-2026-1a11502f81 Packages in this update:

• gopass-1.17.4-1.fc44
• gopass-jsonapi-1.17.4-1.fc44

Update description:

Update

FEDORA-2026-3bf1e0b3f9 Packages in this update:

• perl-GD-SecurityImage-1.75-23.fc44

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)

FEDORA-2026-bdeade52d9 Packages in this update:

• perl-GD-SecurityImage-1.75-22.fc43

Update description:

Until now, GD::SecurityImage used Perl's built-in rand function to generate secrets. The rand function is unsuitable for security applications because it is predictable and reversible. With this update, the module is patched to use Crypt::URandom::MonkeyPatch to override built-in rand (CVE-2026-13082)