Aggregator

FEDORA-2026-a0cb1e1e61 Packages in this update:

• exiv2-0.28.9-1.fc45

Update description:

Exiv2 0.28.9 bugfix release.

FEDORA-2026-2854e48ee4 Packages in this update:

• exiv2-0.28.9-1.fc43

Update description:

Exiv2 0.28.9 bugfix release.

It was discovered that the JSSE component of OpenJDK 26 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-46968) It was discovered that the JSSE component of OpenJDK 26 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-46917) It was discovered that the ImageIO component of OpenJDK 26 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47010) It was discovered that the 2D component of OpenJDK 26 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47021, CVE-2026-47059) It was discovered that the Libraries component of OpenJDK 26 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47027) It was discovered that the Security component of OpenJDK 26 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-60147) It was discovered that the Libraries component of OpenJDK 26 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47063) Lian Owen discovered that the 2D (Little CMS) component of OpenJDK 26 did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41254)

FEDORA-EPEL-2026-baa01fe3db Packages in this update:

• baresip-4.11.0-1.el8
• libre-4.11.0-1.el8

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-EPEL-2026-fe7f0afd86 Packages in this update:

• baresip-4.11.0-1.el9
• libre-4.11.0-1.el9

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-EPEL-2026-cd90eb246c Packages in this update:

• baresip-4.11.0-1.el10_2
• libre-4.11.0-1.el10_2

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-EPEL-2026-b83833c59a Packages in this update:

• baresip-4.11.0-1.el10_3
• libre-4.11.0-1.el10_3

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-EPEL-2026-8250797b7b Packages in this update:

• baresip-4.11.0-1.el10_4
• libre-4.11.0-1.el10_4

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-2026-3edf59885d Packages in this update:

• baresip-4.11.0-1.fc43
• libre-4.11.0-1.fc43

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-2026-27c291e67c Packages in this update:

• baresip-4.11.0-1.fc44
• libre-4.11.0-1.fc44

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-2026-c70f6e6ebc Packages in this update:

• baresip-4.11.0-1.fc45
• libre-4.11.0-1.fc45

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

FEDORA-2026-3a803930eb Packages in this update:

• baresip-4.11.0-1.fc46
• libre-4.11.0-1.fc46

Update description: Baresip v4.11.0 (2026-08-25)

• core: cleanup stream_rtp_h ignore handling
• audio: increase RTP timestamp also for underruns
• aubuf: remove adaptive mode
• webrtc_aec: fix system cmake include
• call: avoid call progress if media is inactive
• conf: remove unused conf_aubuf_adaptive()
• audio: reuse mbuf for telephony events
• call: add callback for incoming SIP INFO
• test: check fixture error and fix call progress
• aureceiver: fix return on error case in aurecv_start_player()
• audio: fix warning() %d format in encode_rtp_send()
• opus,aureceiver: fix PLC/FEC handling
• l16: refactor NR_CODECS by RE_ARRAY_SIZE
• config: remove unused config option audio_silence
• echo: refactor call_event_handler closed with bevent

libre v4.11.0 (2026-08-25)

• libre's HTTP Basic auth verifier accept empty or prefix credential blindly
• libre allows one spoofed UDP packet forges RTCP control messages
• btrace: optimize addr2line handling
• aubuf: remove adaptive mode
• httpauth/basic: fix mem_seccmp cmp length
• srtcp: fix/add AES-GCM no encryption flag auth
• mem_pool: fix mem_pool_flush free list handling
• mem/mem_pool: check mem_pool_borrow_extend empty pool param
• json/decode_odict: fix possible container dangling pointer

Version:7.3-rc1 (mainline) Released:2026-08-30 Source:linux-7.3-rc1.tar.gz Patch:full

FEDORA-2026-a05d65f5fa Packages in this update:

• gegl04-0.4.70-5.fc43

Update description:

This update fixes an overflow in parsing RGBE/HDR image files.

FEDORA-2026-03ea7c5707 Packages in this update:

• gegl04-0.4.70-5.fc45

Update description:

This update fixes an overflow in parsing RGBE/HDR image files.

FEDORA-2026-79b351972c Packages in this update:

• gegl04-0.4.70-5.fc44

Update description:

This update fixes an overflow in parsing RGBE/HDR image files.

FEDORA-2026-e33554bf9f Packages in this update:

• perl-Net-OAuth-0.33-1.fc44

Update description:

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. This update fixes the issue.

FEDORA-2026-370bd8b5f0 Packages in this update:

• perl-Net-OAuth-0.33-1.fc43

Update description:

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. This update fixes the issue.

FEDORA-2026-27bab0e213 Packages in this update:

• perl-Net-OAuth-0.33-2.fc45

Update description:

Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. This update fixes the issue.

FEDORA-2026-5c3f4c8337 Packages in this update:

• perl-XML-Bare-0.53-45.fc44

Update description:

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue.

Fixes CVE-2026-57074 and CVE-2026-13401.