Fedora Security Advisories

hugo-0.169.0-2.fc45

Fedora Security Advisories
38 minutes 21 seconds ago
FEDORA-2026-97aa8e408a Packages in this update:
  • hugo-0.169.0-2.fc45
Update description:

Update to Hugo 0.169.0, which includes a security fix.

Menu pre and post values defined in front matter are no longer rendered as unescaped HTML. Because front matter is untrusted content, a content contributor could previously inject arbitrary HTML, including script, into pages that render menu entries. These values are now HTML escaped unless text/html is allowed in security.allowContent, and a warning-menu-pre-post-html-escaped warning is logged when markup is escaped. Menu entries defined in the site configuration are not affected.

This update also requires Go 1.27.0 and continues to build the extended edition with bundled LibSass, so the package does not depend on a system libsass.

Release notes: https://github.com/gohugoio/hugo/releases/tag/v0.169.0

xen-4.20.4-5.fc43

Fedora Security Advisories
6 hours 44 minutes ago
FEDORA-2026-94fa41e927 Packages in this update:
  • xen-4.20.4-5.fc43
Update description:

arbitrary read/write via grant copy [XSA-523, CVE-2026-102703, CVE-2026-102704]

wrong version of xsa518 patch in last build x86/AMD: ineffectual Zenbleed workaround [XSA-515, CVE-2026-79608] x86: XPTI may break on huge-memory systems [XSA-516, CVE-2026-79609] grant-table: double version change race [XSA-517, CVE-2026-79610] VMX: VMentry failure with branch tracing and blocked states [XSA-518, CVE-2026-79611] Arm: multiple issues with GNTTABOP_cache_flush [XSA-519, CVE-2026-102699, CVE-2026-102702] gnttab: cache-flush handling may cause page reference leak [XSA-520, CVE-2026-102700]

xen-4.21.2-5.fc44

Fedora Security Advisories
7 hours 24 minutes ago
FEDORA-2026-0d1924f837 Packages in this update:
  • xen-4.21.2-5.fc44
Update description:

arbitrary read/write via grant copy [XSA-523, CVE-2026-102703, CVE-2026-102704]

bind-9.18.51^git20261102.973d8646-3.fc44

Fedora Security Advisories
10 hours 1 minute ago
FEDORA-2026-cf9d4ec5e6 Packages in this update:
  • bind-9.18.51^git20261102.973d8646-3.fc44
Update description: Security Fixes:
  • CVE-2026-94300 Fix remote termination of named under concurrent GSS-TSIG traffic (rhbz#2558420)
  • CVE-2026-97313 Fix a bug when resuming from a query initiated by RPZ (rhbz#2558427)
  • CVE-2026-96888 Possible crash with redirect and qname-minimization strict (rhbz#2558424)
  • CVE-2026-19630 Crafted DNS messages could exhaust CPU while being parsed (rhbz#2558488)

bind-9.18.51^git20261102.973d8646-1.fc45

Fedora Security Advisories
10 hours 2 minutes ago
FEDORA-2026-7198802985 Packages in this update:
  • bind-9.18.51^git20261102.973d8646-1.fc45
Update description: Security Fixes:
  • CVE-2026-94300 Fix remote termination of named under concurrent GSS-TSIG traffic (rhbz#2558420)
  • CVE-2026-97313 Fix a bug when resuming from a query initiated by RPZ (rhbz#2558427)
  • CVE-2026-96888 Possible crash with redirect and qname-minimization strict (rhbz#2558424)
  • CVE-2026-19630 Crafted DNS messages could exhaust CPU while being parsed (rhbz#2558488)

sngrep-1.9.0-4.fc43

Fedora Security Advisories
12 hours 32 minutes ago
FEDORA-2026-f194aee07b Packages in this update:
  • sngrep-1.9.0-4.fc43
Update description:

Backport fixes for two memory-safety issues reported upstream (irontec/sngrep#589):

  • CVE-2026-121943: off-by-one length guard in the SIP parser accepts a 10240-byte payload that fills the stack buffer with no NUL terminator, so regexec()/strdup() read past its end (OOB read).
  • CVE-2026-121944: an NFLOG TLV with length < 4 never advances the parse offset, making the capture thread spin forever (DoS).

Submitted upstream as irontec/sngrep#591 and #592.

sngrep-1.9.0-4.fc44

Fedora Security Advisories
12 hours 32 minutes ago
FEDORA-2026-1e72c25706 Packages in this update:
  • sngrep-1.9.0-4.fc44
Update description:

Backport fixes for two memory-safety issues reported upstream (irontec/sngrep#589):

  • CVE-2026-121943: off-by-one length guard in the SIP parser accepts a 10240-byte payload that fills the stack buffer with no NUL terminator, so regexec()/strdup() read past its end (OOB read).
  • CVE-2026-121944: an NFLOG TLV with length < 4 never advances the parse offset, making the capture thread spin forever (DoS).

Submitted upstream as irontec/sngrep#591 and #592.

sngrep-1.9.0-4.fc45

Fedora Security Advisories
12 hours 32 minutes ago
FEDORA-2026-39f14c4384 Packages in this update:
  • sngrep-1.9.0-4.fc45
Update description:

Backport fixes for two memory-safety issues reported upstream (irontec/sngrep#589):

  • CVE-2026-121943: off-by-one length guard in the SIP parser accepts a 10240-byte payload that fills the stack buffer with no NUL terminator, so regexec()/strdup() read past its end (OOB read).
  • CVE-2026-121944: an NFLOG TLV with length < 4 never advances the parse offset, making the capture thread spin forever (DoS).

Submitted upstream as irontec/sngrep#591 and #592.

rust-zstd-0.13.4-1.el10_3 rust-zstd-safe-7.4.0-1.el10_3 rust-zstd-sys-2.0.17-1.el10_3

Fedora Security Advisories
15 hours 58 minutes ago
FEDORA-EPEL-2026-353cc882e0 Packages in this update:
  • rust-zstd-0.13.4-1.el10_3
  • rust-zstd-safe-7.4.0-1.el10_3
  • rust-zstd-sys-2.0.17-1.el10_3
Update description:
  • Update the zstd crate to version 0.13.4.
  • Update the zstd-safe crate to version 7.4.0.
  • Update the zstd-sys crate to version 2.0.17.

This addresses multiple unsoundness and security issues in the zstd-safe and zstd-sys crates (assigned RUSTSEC-2026-0391, RUSTSEC-2026-0392, RUSTSEC-2026-0393, RUSTSEC-2026-0395, RUSTSEC-2026-0396, RUSTSEC-2026-0397, RUSTSEC-2026-0398, RUSTSEC-2026-0399, RUSTSEC-2026-0400, RUSTSEC-2026-0401, RUSTSEC-2026-0402, RUSTSEC-2026-0403, RUSTSEC-2026-0404, RUSTSEC-2026-0405, RUSTSEC-2026-0406).

Rebuilds of affected applications will be tracked and performed separately.

Checked
21 minutes 35 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security