Aggregator

• mongo-c-driver-1.30.14-1.el8

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645

• mongo-c-driver-1.30.14-1.el10_2

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645

• mongo-c-driver-1.30.14-1.el9

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645

• laszip-3.5.0-6.gita446a0c.fc45

Update to git a446a0c, fixes CVE-2026-110603.

• mongo-c-driver-1.30.14-1.fc44

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645

• mongo-c-driver-1.30.14-1.fc43

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645

• mongo-c-driver-2.5.7-1.el10_3

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645
• Fix container client metadata.

• mongo-c-driver-2.5.7-1.el10_4

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645
• Fix container client metadata.

• mongo-c-driver-2.5.7-1.fc45

Fixes

• Fix handling of large usernames for GSSAPI on Windows. CVE-2026-114645
• Fix container client metadata.

• libmongocrypt-1.21.1-1.fc45

Fixed

• Validate inputs before interpolating them into a KMS HTTP request. CVE-2026-114655

• libmongocrypt-1.21.1-1.el10_3

Fixed

• Validate inputs before interpolating them into a KMS HTTP request. CVE-2026-114655

• libmongocrypt-1.21.1-1.el10_4

Fixed

• Validate inputs before interpolating them into a KMS HTTP request. CVE-2026-114655

• rust-redlib-0.35.1-12.fc43

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-afterburn-5.11.0-2.fc43

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-qemu-rdp-0.1.1-5.fc43

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-redlib-0.35.1-12.fc44

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• rust-app-store-connect-0.5.0-8.fc43

Rebuilt with the latest Rust dependencies, addressing at least RUSTSEC-2026-0190.

• rust-afterburn-5.11.0-2.fc44

Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382.

This provides added protection against trusting the eMudhra intermediate CA certificates, which should already be distrusted system-wide via a ca-certificates update.

• roundcubemail-1.6.20-1.el10_2

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path

• roundcubemail-1.6.20-1.el10_3

• Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
• Security: Fix bug where an alias login wasn't qualified by IMAP host
• Security: Add a size limit to the CSS proxy content processing
• Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
• Security: Fix remote content blocking bypass via SVG SMIL by attribute
• Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
• Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
• Security: Fix mail header injection via the From display-name in the Bounce (resend) action
• Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
• Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
• Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
• Security: Fix CSS scoping bypass in HTML messages using at-rules
• Security: Fix bug where deprecated action aliases bypassed disabled_actions setting
• Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
• Security: Fix CSRF validation bypass in the mark-as-junk action
• Security: Fix XSS issue in handling of password driver error responses
• Security: Fix mail header injection via subject of a message forwarded as attachment
• Security: Fix mail header injection via media type in an inline image data URI
• Security: Fix bug where Password Modoboa driver could change password for another account
• Security: Fix unsafe use of a login name in SquirrelMail import file path