Fedora Security Advisories

• ckermit-11.0.509-1.fc45

Update to 11.0.509 with security fix

• xen-4.20.4-2.fc43

x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437] x86: improper handling of HVM emulation return codes [XSA-510, CVE-2026-79602] Unconditionally do TLB flushing ahead of page scrubbing [XSA-511, CVE-2026-79603] oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]

• webkitgtk-2.54.0-1.fc43

Update to 2.54.0:

• Switch web process compositor to use Skia instead of TextureMapper.
• Improved damage handling that is now also used during the composition to limit the composited areas.
• Implement GPU atlas creation and replay substitution for batched raster image uploads.
• Media capability reporting is more accurate.
• Video decoding limits are now respected in media capabilities queries.
• Add new improved API for page favicons.
• Add magnification property to WebKitWebView to handle visual scaling.
• Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
• Remove the option to use cairo for 2D rendering.

WebKit Security fixes from 2.54.0: CVE-2026-84635, CVE-2026-64753, CVE-2026-64715, CVE-2026-64778, CVE-2026-64779, CVE-2026-64780, CVE-2026-64782, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338, CVE-2026-65340, CVE-2026-65341, CVE-2026-65351, CVE-2026-78376, CVE-2026-83596.

WebKit security fixes from 2.52.6: CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64757, CVE-2026-64783

This update also fixes a couple hundred or so ANGLE CVEs and several dozen Skia CVEs.

This update breaks some styles in Evolution and likely crashes Eclipse on startup. Sorry about that.

• webkitgtk-2.54.0-1.fc44

Update to 2.54.0:

• Switch web process compositor to use Skia instead of TextureMapper.
• Improved damage handling that is now also used during the composition to limit the composited areas.
• Implement GPU atlas creation and replay substitution for batched raster image uploads.
• Media capability reporting is more accurate.
• Video decoding limits are now respected in media capabilities queries.
• Add new improved API for page favicons.
• Add magnification property to WebKitWebView to handle visual scaling.
• Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
• Remove the option to use cairo for 2D rendering.

WebKit Security fixes from 2.54.0: CVE-2026-84635, CVE-2026-64753, CVE-2026-64715, CVE-2026-64778, CVE-2026-64779, CVE-2026-64780, CVE-2026-64782, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338, CVE-2026-65340, CVE-2026-65341, CVE-2026-65351, CVE-2026-78376, CVE-2026-83596.

WebKit security fixes from 2.52.6: CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64757, CVE-2026-64783

This update also fixes a couple hundred or so ANGLE CVEs and several dozen Skia CVEs.

This update breaks some styles in Evolution and likely crashes Eclipse on startup. Sorry about that.

• sipp-3.7.7-5.fc43

Fixed a bunch of CVEs

• sipp-3.7.7-5.fc45

Fixed a bunch of CVEs

• sipp-3.7.7-5.fc44

Fixed a bunch of CVEs

• webkitgtk-2.54.0-1.fc45

Update to 2.54.0

• fetchmail-6.6.7-1.fc43

Update to fetchmail-6.6.7

• fetchmail-6.6.7-1.fc44

Update to fetchmail-6.6.7

• fetchmail-6.6.7-1.fc45

Update to fetchmail-6.6.7

• chromium-153.0.8010.36-1.el10_3

Update to 153.0.8010.36, it fixes 230 CVEs: CVE-2026-87429 - CVE-2026-87658

• chromium-153.0.8010.36-1.el10_2

Update to 153.0.8010.36, it fixes 230 CVEs: CVE-2026-87429 - CVE-2026-87658

• chromium-153.0.8010.36-1.fc44

Update to 153.0.8010.36, it fixes 230 CVEs: CVE-2026-87429 - CVE-2026-87658

• chromium-153.0.8010.36-1.fc43

Update to 153.0.8010.36, it fixes 230 CVEs: CVE-2026-87429 - CVE-2026-87658

• chromium-153.0.8010.36-1.el10_4

Update to 153.0.8010.36, it fixes 230 CVEs: CVE-2026-87429 - CVE-2026-87658

• chromium-153.0.8010.36-1.fc45

Update to 153.0.8010.36, it fixes 230 CVEs: CVE-2026-87429 - CVE-2026-87658

• gssntlmssp-1.3.2-1.fc44

Update to 1.3.2, fixes a Low security issue

• gssntlmssp-1.3.2-1.fc45

Update to 1.3.2, fixes a Low security issue

• xen-4.21.2-2.fc44

x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437] x86: improper handling of HVM emulation return codes [XSA-510, CVE-2026-79602] Unconditionally do TLB flushing ahead of page scrubbing [XSA-511, CVE-2026-79603] oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]