Fedora Security Advisories

• perl-Spreadsheet-XLSX-0.20-1.el10_3

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el10_4

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el9

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.fc45

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el8

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.fc44

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.fc43

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el10_2

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• suricata-8.0.7-1.el10_2

upstream bugfix/security release

• suricata-8.0.7-1.el10_3

upstream security/bugfix release

• suricata-8.0.7-1.el10_4

upstream security/bugfix release

• suricata-8.0.8-1.fc44

upstream security/bugfix release

• mingw-qt5-qtdeclarative-5.15.18-4.fc44

Backport fix for CVE-2025-12385.

• mingw-qt5-qtdeclarative-5.15.18-4.fc43

Backport fix for CVE-2025-12385.

• mingw-qt5-qtdeclarative-5.15.18-4.fc45

Backport fix for CVE-2025-12385.

• mingw-qt5-qtbase-5.15.18-5.fc44

Backport fixes for CVE-2026-101021 and CVE-2026-107157.

Backport fixes for CVE-2026-19248 and CVE-2026-11573

• mingw-qt5-qtbase-5.15.18-5.fc43

Backport fixes for CVE-2026-101021 and CVE-2026-107157.

• mingw-qt5-qtbase-5.15.18-5.fc45

Backport fixes for CVE-2026-101021 and CVE-2026-107157.

Backport fixes for CVE-2026-19248 and CVE-2026-11573

• suricata-8.0.8-1.fc45

Upstream bugfix/security release.

• grafana-10.2.6-23.fc43

Rebuild with Go 1.26.10 to fix Go standard library vulnerabilities.

The previous build (grafana-10.2.6-22.fc43) was compiled with go1.25.4 and contained 48 known Go standard library issues. golang 1.26.10 is now the F43 buildroot toolchain and fixes all of them, so this is a pure rebuild with no source, spec logic or vendored dependency changes.

Not addressed by this update: the bundled Go modules (golang.org/x/net, go-jose, kin-openapi) and the prebuilt frontend bundle, which need separate vendor/frontend regeneration.