Fedora Security Advisories

FEDORA-2026-7fa12630d5 Packages in this update:

• tmux-3.7b-3.fc43

Update description:

fdf6afc update to 3.7b fixes rhbz#2498485

CHANGES FROM 3.7a TO 3.7b

• Fix so that the end of a synchronized update again triggers a redraw.

CHANGES FROM 3.7 TO 3.7a

• Fix crash in break-pane when no name is provided.

• Scrollbar options are now cached rather than being looked up for every redraw (issue 5298).

• Only forbid #( in names, allow #[, empty names, : and .

FEDORA-2026-f5dd9fb83f Packages in this update:

• tmux-3.7b-2.fc44

Update description:

fdf6afc update to 3.7b fixes rhbz#2498485

CHANGES FROM 3.7a TO 3.7b

• Fix so that the end of a synchronized update again triggers a redraw.

CHANGES FROM 3.7 TO 3.7a

• Fix crash in break-pane when no name is provided.

• Scrollbar options are now cached rather than being looked up for every redraw (issue 5298).

• Only forbid #( in names, allow #[, empty names, : and .

FEDORA-2026-9ab663dcd4 Packages in this update:

• sssd-2.12.0-3.fc43

Update description:

CVE fixes: CVE-2026-12610 CVE-2026-14474 CVE-2026-14476 - rhbz#2494777: CVE-2026-12610 sssd: Use-after-free crash in SSSD' 'sssd_pam' process - rhbz#2497650: CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - rhbz#2497651: CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

FEDORA-2026-5acfb0243b Packages in this update:

• sssd-2.13.1-2.fc44

Update description:

CVE fixes: CVE-2026-12610 CVE-2026-14474 CVE-2026-14476 - rhbz#2494777: CVE-2026-12610 sssd: Use-after-free crash in SSSD' 'sssd_pam' process - rhbz#2497650: CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - rhbz#2497651: CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

FEDORA-2026-7b7c2b373e Packages in this update:

• ruby-3.4.10-31.fc43

Update description:

Ruby 3.4.10 is released. This new version contains severay security bug fixes in zlib, net-imap and erb..

FEDORA-2026-daa458d11d Packages in this update:

• attr-2.6.0-1.fc44

Update description:

rebase to v2.6.0 to fix CVE-2026-54371

FEDORA-2026-b85570f8e4 Packages in this update:

• attr-2.6.0-1.fc43

Update description:

rebase to v2.6.0 to fix CVE-2026-54371

FEDORA-2026-c7aafa6056 Packages in this update:

• attr-2.6.0-1.fc45

Update description:

Automatic update for attr-2.6.0-1.fc45.

Changelog * Thu Jul 9 2026 Lukáš Zaoral <lzaoral@redhat.com> - 2.6.0-1 - rebase to the latest upstream release (rhbz#2494157) - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (rhbz#2494172) - remove a long-overdue workaround for /usr/include/attr/xattr.h

FEDORA-EPEL-2026-383609569a Packages in this update:

• proftpd-1.3.9c-1.el10_3

Update description:

Cumulative bug-fix update, including several buffer overflow fixes.

FEDORA-2026-2f95481529 Packages in this update:

• proftpd-1.3.9c-1.fc44

Update description:

Cumulative bug-fix update, including several buffer overflow fixes.

FEDORA-EPEL-2026-0823d8f73a Packages in this update:

• proftpd-1.3.9c-1.el10_2

Update description:

Cumulative bug-fix update, including several buffer overflow fixes.

FEDORA-2026-75a8969e55 Packages in this update:

• proftpd-1.3.9c-1.fc43

Update description:

Cumulative bug-fix update, including several buffer overflow fixes.

FEDORA-2026-6b9a652463 Packages in this update:

• acl-2.4.0-1.fc44

Update description:

• rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

Resolves: CVE-2026-54369 Resolves: CVE-2026-54370

FEDORA-2026-67504c329b Packages in this update:

• acl-2.4.0-1.fc43

Update description:

• rebase to v2.4.0 to fix CVE-2026-54369 and CVE-2026-54370

Resolves: CVE-2026-54369 Resolves: CVE-2026-54370

FEDORA-EPEL-2026-54c0db57df Packages in this update:

• python-libcst-1.8.6-4.el10_3

Update description:

Update to 1.8.6. Build with PyO3 (fixes RUSTSEC-2026-0176, RUSTSEC-2026-0177).

FEDORA-2026-17c484fafa Packages in this update:

• python-libcst-1.8.6-4.fc44

Update description:

Update to 1.8.6. Build with PyO3 (fixes RUSTSEC-2026-0176, RUSTSEC-2026-0177).

FEDORA-2026-6d5a7be3b9 Packages in this update:

• rust-cargo-rpmstatus-0.2.5-2.fc43

Update description:

Update to 0.2.5 (with dependency updates only), and further update some dependencies. Particularly, quick-xml 0.41 fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195.

FEDORA-2026-5e3ab17662 Packages in this update:

• rust-opendal-0.55.0-2.fc43

Update description:

Update quick-xml to 0.41 (RUSTSEC-2026-0194, RUSTSEC-2026-0195)

FEDORA-2026-08f5aab9ed Packages in this update:

• rust-cargo-rpmstatus-0.2.5-2.fc44

Update description:

Update to 0.2.5 (with dependency updates only), and further update some dependencies. Particularly, quick-xml 0.41 fixes RUSTSEC-2026-0194 and RUSTSEC-2026-0195.

FEDORA-2026-118fdf066a Packages in this update:

• python-uv-build-0.11.28-1.fc45
• rust-astral_async_zip-0.0.20-1.fc45
• uv-0.11.28-1.fc45

Update description:

https://github.com/astral-sh/uv/releases/tag/0.11.28