Aggregator

FEDORA-EPEL-2026-8d15051ff1 Packages in this update:

• rust-ppmd-rust-1.5.2-1.el10_2

Update description:

Update ppmd-rust to 1.5.2, fixing a possible denial of service via an infinite loop.

1.5.1 - 2026-10-18 Fixed

• Fixed an infinite loop in the PPMd8 model restoration for a memory size between 2048 and 2063 bytes. PPMD8_MIN_MEM_SIZE is now 2064. The previous value 2048 was the minimum memory size of PPMd7. 7-Zip defines no minimum memory size for PPMd8 and has the same infinite loop for these sizes. The ZIP and .pmd codecs of 7-Zip always use at least 1 MiB and are unaffected.

FEDORA-EPEL-2026-90b6634716 Packages in this update:

• rust-ppmd-rust-1.5.2-1.el10_3

Update description:

Update ppmd-rust to 1.5.2, fixing a possible denial of service via an infinite loop.

1.5.1 - 2026-10-18 Fixed

• Fixed an infinite loop in the PPMd8 model restoration for a memory size between 2048 and 2063 bytes. PPMD8_MIN_MEM_SIZE is now 2064. The previous value 2048 was the minimum memory size of PPMd7. 7-Zip defines no minimum memory size for PPMd8 and has the same infinite loop for these sizes. The ZIP and .pmd codecs of 7-Zip always use at least 1 MiB and are unaffected.

FEDORA-2026-3ee4dad1c6 Packages in this update:

• ca-certificates-2026.2.92_v9.0.319-2.fc43

Update description:

Update ca-certificates to ca-certificates-2026.2.92_v9.0.319-2.fc43

• Remove emSign Root CS CA - G3

Additional code signing certificate that sign 2 of the compromised certificates

FEDORA-2026-0609e13c0d Packages in this update:

• ca-certificates-2026.2.92_v9.0.319-2.fc44

Update description:

Update ca-certificates to ca-certificates-2026.2.92_v9.0.319-2.fc44

• Remove emSign Root CS CA - G3

Additional code signing certificate that sign 2 of the compromised certificates

FEDORA-2026-e57d2527d5 Packages in this update:

• ca-certificates-2026.2.92_v9.0.319-2.fc45

Update description:

Update ca-certificates to ca-certificates-2026.2.92_v9.0.319-2.fc45

• Remove emSign Root CS CA - G3

Additional code signing certificate that sign 2 of the compromised certificates

Update ca-certificates to ca-certificates-2026.2.92_v9.0.319-1.fc45

FEDORA-2026-f7c7c6a7de Packages in this update:

• mingw-python-certifi-2026.10.18-1.fc45

Update description:

Update to certifi-2026.10.18.

FEDORA-2026-746612ff80 Packages in this update:

• mingw-python-certifi-2026.10.18-1.fc44

Update description:

Update to certifi-2026.10.18.

FEDORA-2026-f82897416f Packages in this update:

• mingw-python-certifi-2026.10.18-1.fc43

Update description:

Update to certifi-2026.10.18.

USN-8890-1 fixed vulnerabilities in libsoup. This update provides the corresponding updates for libsoup3 on Ubuntu 26.10. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324) It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339) It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680) It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197) It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

FEDORA-2026-844fdf9ca7 Packages in this update:

• openssh-10.6p1-1.fc45

Update description:

Rebasing OpenSSH to 10.6p1

FEDORA-EPEL-2026-f65970b394 Packages in this update:

• rust-cargo-semver-checks-0.51.0-6.el10_3
• rust-trustfall-rustdoc-adapter57-57.1.3-2.el10_3
• rust-trustfall-rustdoc-adapter60-60.0.3-2.el10_3
• rust-trustfall-rustdoc-adapter-61.0.3-1.el10_3

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349, with faster-hex 0.10.1 for RUSTSEC-2026-0306, and with updated dependencies for the eMudhra intermediate CA compromise. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

It was discovered that c-ares incorrectly parsed certain SOA replies. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-22217) It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2022-4904) It was discovered that c-ares did not properly limit DNS compression pointer hops or assembled name lengths when parsing DNS names. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. (CVE-2026-69184) It was discovered that c-ares did not properly validate record count fields before allocating memory when parsing DNS responses. A remote attacker could possibly use this issue to cause c-ares to use excessive resources, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-69186)

FEDORA-EPEL-2026-7e7a60affc Packages in this update:

• rust-cargo-semver-checks-0.51.0-6.el10_4
• rust-trustfall-rustdoc-adapter57-57.1.3-2.el10_4
• rust-trustfall-rustdoc-adapter60-60.0.3-2.el10_4
• rust-trustfall-rustdoc-adapter-61.0.3-1.el10_4

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349, with faster-hex 0.10.1 for RUSTSEC-2026-0306, and with updated dependencies for the eMudhra intermediate CA compromise. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.

It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.

USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not properly validate certain DHCPv6 option lengths during network boot. An attacker could possibly use this issue to trigger out-of-bounds memory access, resulting in a denial of service. (CVE-2026-74225)

Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (CVE-2026-101258) It was discovered that Ghostscript incorrectly handled memory when converting certain fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause Ghostscript to crash, or possibly execute arbitrary code. (CVE-2026-103226) Paulos Yibelo discovered that Ghostscript did not properly validate certain operands when loading fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (No CVE number)

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)

FEDORA-2026-d5f8446449 Packages in this update:

• php-8.4.27-2.fc43

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-2026-a9354b8a1e Packages in this update:

• php-8.5.12-1.fc45

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619