Aggregator

FEDORA-2026-d015d281d3 Packages in this update:

• sgx-pccs-1.27-2.fc43

Update description:

Update to 1.27 release, and update NPM module dependencies

FEDORA-2026-bf0e682c10 Packages in this update:

• strongswan-6.1.0-2.fc43

Update description:

Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135

FEDORA-2026-357d4a65d4 Packages in this update:

• strongswan-6.1.0-1.fc44

Update description:

Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135

FEDORA-2026-7277fc13ac Packages in this update:

• sgx-pccs-1.27-2.fc44

Update description:

Update to 1.27 release, and update NPM module dependencies

FEDORA-2026-069bc15d81 Packages in this update:

• sgx-pccs-1.27-2.fc45

Update description:

Update to 1.27 release, and update NPM module dependencies

Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-36386) It was discovered that the Fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-61962) Tristan Madani discovered that Fetchmail incorrectly handled certain NTLM authentication challenges. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2026-94184)

It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59884) It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59885) It was discovered that pyasn1 incorrectly handled conversion of decoded REAL values to Python float types. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU and memory resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59886) It was discovered that pyasn1 incorrectly handled tracking component types when decoding containers without a schema. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119194) It was discovered that pyasn1 processed fragmented constructed strings and indefinite-length ANY values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue was only addressed in Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-119195) It was discovered that pyasn1 processed fragmented constructed BIT STRING values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119196) It was discovered that pyasn1 processed binary-encoded REAL values with large mantissas in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119197)

It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the JAAS component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JDBC component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91451, CVE-2026-91452) It was discovered that the RMI component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87293) It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91381) It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382) It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91395, CVE-2026-91396) It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411) It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the CORBA component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91417) It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Lightweight HTTP Server component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the JAAS component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JDBC component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91332, CVE-2026-91451, CVE-2026-91452) It was discovered that the JAXP component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 11 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 11 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 11 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382) It was discovered that the Networking component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Utility component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91395, CVE-2026-91396) It was discovered that the Serviceability component of OpenJDK 11 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411) It was discovered that the 2D component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Lightweight HTTP Server component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Compiler component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

FEDORA-EPEL-2026-090b14f20e Packages in this update:

• afflib-3.7.23-2.el10_3

Update description:

Update to 3.7.23

FEDORA-EPEL-2026-471da89f6b Packages in this update:

• afflib-3.7.23-2.el9

Update description:

Update to 3.7.23

FEDORA-EPEL-2026-5e143948c7 Packages in this update:

• afflib-3.7.23-2.el10_2

Update description:

Update to 3.7.23

FEDORA-2026-23ca9c3b2f Packages in this update:

• mingw-gstreamer1-1.28.9-1.fc44
• mingw-gstreamer1-plugins-bad-free-1.28.9-1.fc44
• mingw-gstreamer1-plugins-base-1.28.9-1.fc44
• mingw-gstreamer1-plugins-good-1.28.9-1.fc44

Update description:

Update to gstreamer-1.28.9.

Version:next-20261109 (linux-next) Released:2026-11-09

It was discovered that libnfs did not properly enforce the maximum size bound during ZDR decoding, resulting in an out-of-bounds write. An attacker could possibly use this issue to cause libnfs to crash, resulting in a denial of service, or execute arbitrary code.

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.

USN-9001-1 fixed a vulnerability in ca-certificates, ca-certificates-java. This update provides the corresponding fix for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.

FEDORA-2026-e7fefff936 Packages in this update:

• fluxbox-1.3.7-31.20261104git9aeb2a8e.fc43

Update description:

Fixes CVE-2026-123784: OS command injection via style backgrounds (CWE-78) (rhbz#2568284)

FEDORA-EPEL-2026-d6ca430c93 Packages in this update:

• fluxbox-1.3.7-31.20261104git9aeb2a8e.el8

Update description:

Fixes CVE-2026-123784: OS command injection via style backgrounds (CWE-78) (rhbz#2568284)

FEDORA-2026-add58dcae1 Packages in this update:

• fluxbox-1.3.7-31.20261104git9aeb2a8e.fc45

Update description:

Fixes CVE-2026-123784: OS command injection via style backgrounds (CWE-78) (rhbz#2568284)