thunderbird-156.0-2.fc43
- thunderbird-156.0-2.fc43
Update to latest upstream version.
Update to latest stable upstream version.
Update to latest upstream version.
Update to latest stable upstream version.
Fixed CVE-2026-90558
Fixed CVE-2026-90558
Fixed CVE-2026-90558
Update to 1.4.12
1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)
1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)
1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)
Backport fixes for CVE-2026-{88047-88054}
Backport fixes for CVE-2026-{88047-88054}
Backport fixes for CVE-2026-{88047-88054}
Automatic update for rootlesskit-3.2.0-1.fc46.
Changelog * Sun Sep 20 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 3.2.0-1 - Update to release v3.2.0 - Resolves: rhbz#2530874 - Resolves CVE-2026-56855: rhbz#2530631 - Resolves CVE-2026-78662: rhbz#2530678 - Upstream enhancements and fixesUpdates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode
Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.
deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.
Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.
deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.
Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.
In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the Expires header to be set to 0.
Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.
In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the Expires header to be set to 0.