Fedora Security Advisories

• mtools-4.0.50-1.fc43

Update to 4.0.50 (#2564411)

• gimp-3.2.8-1.fc43

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

• gimp-3.2.8-1.fc45

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

• gimp-3.2.8-1.fc44

This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.

For more information, please consult the GIMP 3.2.8 release announcement.

• python-loguru-0.7.3-9.el10_3

Backport fix for CVE-2026-120217

• mongo-c-driver-2.5.8-1.fc45

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• mongo-c-driver-2.5.8-1.el10_4

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• mongo-c-driver-2.5.8-1.el10_3

Fixes

• Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• mongo-c-driver-1.30.15-1.fc44

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• mongo-c-driver-1.30.15-1.el8

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• mongo-c-driver-1.30.15-1.el10_2

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• mongo-c-driver-1.30.15-1.fc43

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• mongo-c-driver-1.30.15-1.el9

Fixes

• Fix abort when parsing a cursor namespace without a dot separator.
• Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955
• Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
• Fix a missing bounds check when reading GridFS files. CVE-2026-120684
• Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
• Report writeConcernError consistently, as mandated by the CRUD spec.

• python-loguru-0.7.3-9.el10_4

Backport fix for CVE-2026-120217

• perl-CGI-5.02-1.fc45

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

• perl-CGI-5.02-1.fc44

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

• perl-CGI-5.02-1.fc43

5.02 bump - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex) - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type) - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits) - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS) - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups) - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references) - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values) - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ";" injected attributes) - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes) - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host) - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it) - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs) - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical) - Fix CVE-2026-120648 (comment() text could end HTML comment) - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs) - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling) - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk) - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field) - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values) - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

• python-loguru-0.7.3-23.fc43

Backport fix for CVE-2026-120217

• rust-routinator-0.15.2-5.el9

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

• python-loguru-0.7.3-23.fc44

Backport fix for CVE-2026-120217