Aggregator

FEDORA-2026-d5bf5d11a8 Packages in this update:

• runc-1.5.3-1.fc44

Update description:

Update to 1.5.3 upstream release

FEDORA-2026-531ddf5058 Packages in this update:

• runc-1.5.3-1.fc45

Update description:

Update to 1.5.3 upstream release

FEDORA-2026-b8fd91440f Packages in this update:

• qpid-proton-0.41.1-1.fc45

Update description:

Rebased to 0.41

FEDORA-2026-c85076ba3e Packages in this update:

• qpid-proton-0.41.1-1.fc44

Update description:

Rebased to 0.41

FEDORA-EPEL-2026-10ea15bf0a Packages in this update:

• qpid-proton-0.41.1-1.el10_4

Update description:

Rebased to 0.41

FEDORA-2026-faa459c7ef Packages in this update:

• perl-Text-JSContact-0.07-1.fc45

Update description:

Changes:

0.07 2026-11-10

- security: a vCard nested more than 16 deep is refused before Text::VCardFast sees it (its parser recurses in C once per BEGIN: tens of thousands of levels killed the process) - a backslash in a parameter value is dropped: RFC 6350 gives it no meaning there, but Text::VCardFast reads \; \: \" as escapes, and a SORT-AS or TZ ending in one made the card unreadable - add t/hostile.t - patching a card with a large folded property (a PHOTO) is several times faster: its lines are split with one match per logical line

0.06 2026-11-07

- writing is deterministic: the same Card gives the same bytes in every process. Text::VCardFast's hash2vcard wrote parameters in Perl's hash order, so every save of an unchanged contact had a new CardDAV ETag. The module now writes content lines itself, with parameters in a fixed order (PROP-ID, VALUE, TYPE, PREF, then by name), folded at 75 octets without splitting a character or an escape; Text::VCardFast is still the parser - add t/deterministic.t - a conversion keeps its counters in a context made for that call, not in package variables. An id allocated to a property without PROP-ID skips every PROP-ID the vCard has, so EMAIL;PROP-ID=1 and an unnumbered EMAIL no longer both become emails{1}, one lost. A label group allocated by patch_vcard skips every group the original vCard has, so a new label no longer takes item1 from a property that already has one - patch_vcard patches the original line by line instead of re-serialising the whole vCard: a line for an entry the change does not touch keeps its bytes, group, folding and place, as does every line JSContact cannot represent. A changed entry is written over its own line, keeping its group, the parameters the reader does not interpret and the TYPE values it does not map; a removed entry takes its line, its label and the rest of its group with it; a new entry goes after the lines of the same map. Labels are patched for every property the reader labels, Apple addresses keep X-ABADR/GEO/TZ in their group, an Apple relation change is written as its X-ABLabel, and X-ABDATE and X-SOCIALPROFILE keep their names - patch_vcard keeps a vCard 3 card vCard 3: lines patched into it have no PROP-ID, TYPE=pref for PREF=1, ENCODING=b for an inline data: URI, X-SERVICE-TYPE/X-USER, Apple's X-ADDRESSBOOKSERVER-KIND/-MEMBER, X- forms of the other vCard 4 parameters (which the reader now also reads) and 1604 for a date without a year - UTF-8: a vCard is decoded once, before parsing, so every value is characters (the ORG name, EMAIL, CATEGORIES, IMPP, RELATED and several parameters were left as bytes and double-encoded when written), and patch_vcard returns bytes for bytes and characters for characters instead of splicing characters into bytes - jscontact_to_vcard($card, original => $vcard) writes the Card as a patch of the vCard it was read from, reading the old Card from $vcard itself, so a caller no longer has to keep (and not touch) the Card it first read; an unparseable original gives a new vCard, as without original. patch_vcard still works - add t/original.t - several values of one N or ADR component, and the keywords in CATEGORIES, are written as a list (comma-separated) instead of one value with its commas escaped; a comma inside one value is still escaped - a TEL whose number is a URI (tel:...) is written with VALUE=uri, so it is not escaped as TEXT (tel:+1-555\;ext=5); in a vCard 3 patch it is written as a phone number - a RELATED that is free text, not a URI, is written with VALUE=text

0.05 2026-11-07

- JSContact version 2.0 (RFC 9982): vcard_to_jscontact writes version "2.0", and a vCard without UID gives a Card without uid instead of one with a random uuid (which changed on every conversion, so nothing could refer to it); jscontact_to_vcard already wrote no UID for a Card without uid - write URI values (PHOTO, MEMBER, URL, ...) unescaped - read a vCard 3 inline photo once, including one whose TYPE is a list; skip a Media with no uri instead of writing an empty PHOTO - add t/rfc9982.t

FEDORA-2026-5a90f8090a Packages in this update:

• python3.6-3.6.15-60.fc44

Update description:

• Security fixes for CVE-2026-12345, CVE-2026-19445, CVE-2026-19553

FEDORA-2026-eaec9934c0 Packages in this update:

• python3.6-3.6.15-60.fc45

Update description:

• Security fixes for CVE-2026-12345, CVE-2026-19445, CVE-2026-19553

FEDORA-2026-848bbd442b Packages in this update:

• python3.6-3.6.15-60.fc43

Update description:

• Security fixes for CVE-2026-12345, CVE-2026-19445, CVE-2026-19553

Zhenpeng Lin discovered that Apache HTTP Server's mod_dav module incorrectly calculated memory sizes when handling WebDAV locks. An attacker with permission to create WebDAV locks could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. (CVE-2026-42528) It was discovered that Apache HTTP Server's mod_vhost_alias module incorrectly handled certain requests, leading to a one-byte stack buffer overflow. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-109163) It was discovered that Apache HTTP Server's mod_md module incorrectly handled certain conditions, leading to a NULL pointer dereference. An attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-106023) It was discovered that Apache HTTP Server's mod_http2 module incorrectly handled certain request headers, leading to heap corruption. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119618) Feliks Penconek, Yang Song, and JiaSheng He discovered that Apache HTTP Server could treat the target of some internal redirects from CGI programs as a CGI program. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-42356)

FEDORA-2026-e4e90c5ff2 Packages in this update:

• aws-26.0.0-6.fc45

Update description:

This is a backported fix for the path traversal vulnerability AWS-0175.

Wolfgang Schweer discovered that Debian-LAN configured overly permissive ACLs for the Kerberos admin server. An authenticated user could possibly use this issue to change the credentials of other users, leading to privilege escalation.

It was discovered that x11vnc created shared memory segments with insecure permissions. A local attacker could possibly use this issue to obtain sensitive information or modify screen contents.

It was discovered that the TigerVNC viewer stored TLS certificate exceptions as trusted certificate authorities. A remote attacker could possibly use this issue to impersonate any VNC server after a user had added a certificate exception for the attacker's server.

It was discovered that the gpg-key2ps tool in signing-party did not properly sanitize user IDs before passing them to a shell. If a user were tricked into processing a specially crafted OpenPGP key, an attacker could possibly use this issue to execute arbitrary commands.

It was discovered that SA-Exim unsafely evaluated the parameters of its greylisting SpamAssassin rule. An attacker able to write SpamAssassin configuration files or rules could possibly use this issue to execute arbitrary code.

It was discovered that Ruby OpenID sent a request to the claimed identifier URL before verifying the signature of an OpenID response. A remote attacker could possibly use this issue to perform server-side request forgery attacks.

It was discovered that Radicale did not delay failed authentication attempts when using htpasswd authentication. A remote attacker could possibly use this issue to obtain user passwords through timing or brute-force attacks.

It was discovered that the gevent WSGI server incorrectly validated chunked transfer encoding trailers in HTTP requests. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks, leading to privilege escalation.