Fedora Security Advisories

• kernel-7.2.14-200.fc44

The 7.2.14 stable kernel update contains a number of important fixes across the tree.

• kernel-7.2.14-300.fc45

The 7.2.14 stable kernel update contains a number of important fixes across the tree.

• kernel-7.2.14-100.fc43

The 7.2.14 stable kernel update contains a number of important fixes across the tree.

• epiphany-49.9.1-6.fc43

Fixes CVE-2026-115683

Fix CVE-2026-118598 and CVE-2026-118599

Fix for CVE-2026-18487 and CVE-2026-94291

• epiphany-51.2-1.fc45

Fixes CVE-2026-115683

Fix CVE-2026-118598 and CVE-2026-118599

• epiphany-50.6-6.fc44

Fixes CVE-2026-115683

Fix CVE-2026-118598 and CVE-2026-118599

Fix for CVE-2026-18487 and CVE-2026-94291

• glib-networking-2.80.1-8.fc44

Fixes CVE-2026-103963

• glib-networking-2.80.1-4.fc43

Fixes CVE-2026-103963

• nautilus-51.1-2.fc45

Fix CVE-2026-111802

• nautilus-50.4-2.fc44

Fix CVE-2026-111802

• libheif-1.23.7-1.fc43

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.el10_3

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.fc44

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.el10_4

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.el10_2

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• libheif-1.23.7-1.fc45

Latest upstream security bugfix release. Changes: https://github.com/strukturag/libheif/releases/tag/v1.23.7 .

• python-boto3-1.43.122-1.fc43
• python-botocore-1.43.122-1.fc43
• python-s3transfer-0.19.3-1.fc43

Latest updates.

• composer-2.11.1-1.fc45

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.el9

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

• composer-2.11.1-1.el10_2

• Added a warning when the cache dir is on a Windows drive while running in WSL, as this makes filesystem operations very slow (#13175)
• Fixed GitLab CI job tokens failing to authenticate against the GitLab Composer package registry, which requires HTTP Basic auth rather than the JOB-TOKEN header (#13180)
• Fixed every update aborting with a SecurityException when a PHP extension reports a name that is not a valid platform package name (#13184)
• Fixed require and remove dropping empty require/require-dev/repositories keys from composer.json when the command had not emptied them itself (#13178)
• Fixed a PHP 8.6 deprecation warning from composer/ca-bundle (8bf8c27)
• Fixed invalid custom-headers auth entries being sent as-is, they are now ignored with a warning (#13181)

• Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
• Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
• Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
• Security: Fixed svn passwords not being redacted from debug output (#13171)
• Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
• Improved dependency resolution performance and memory usage (#13174)
• Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
• Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
• Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)