Fedora Security Advisories

FEDORA-2026-884a9f0fc3 Packages in this update:

• vorbis-tools-1.4.3-5.fc44

Update description:

CVE-2026-34253 - fix arbitrary code execution via buffer underflow

FEDORA-2026-cbf4cd18d1 Packages in this update:

• vorbis-tools-1.4.3-4.fc43

Update description:

CVE-2026-34253 - fix arbitrary code execution via buffer underflow

FEDORA-2026-9c00940406 Packages in this update:

• vorbis-tools-1.4.3-5.fc45

Update description:

Automatic update for vorbis-tools-1.4.3-5.fc45.

Changelog * Tue Jun 9 2026 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.3-5 - CVE-2026-34253 - fix arbitrary code execution via buffer underflow (rhbz#2479549)

FEDORA-EPEL-2026-02d92ea412 Packages in this update:

• nextcloud-33.0.5-1.el10_2

Update description:

33.0.5 Release

FEDORA-EPEL-2026-988ec151d8 Packages in this update:

• nextcloud-33.0.5-1.el10_3

Update description:

33.0.5 Release

FEDORA-2026-cb3feafe41 Packages in this update:

• nextcloud-33.0.5-1.fc43

Update description:

33.0.5 Release

FEDORA-2026-86fab2703b Packages in this update:

• nextcloud-33.0.5-1.fc44

Update description:

33.0.5 Release

FEDORA-EPEL-2026-ad8e45665d Packages in this update:

• openslide-3.4.1-20.el8

Update description:

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

FEDORA-EPEL-2026-ec3d774387 Packages in this update:

• openslide-3.4.1-20.el9

Update description:

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

FEDORA-EPEL-2026-1ee658d973 Packages in this update:

• openslide-4.0.0-8.el10_3

Update description:

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

FEDORA-2026-3c93ea23b5 Packages in this update:

• openslide-4.0.0-14.fc43

Update description:

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

FEDORA-2026-e31dda6e44 Packages in this update:

• openslide-4.0.0-14.fc44

Update description:

Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).

FEDORA-2026-45190a3b6b Packages in this update:

• ack-3.10.0-1.fc43

Update description:

Update to version 3.10.0

FEDORA-2026-bb708e11d7 Packages in this update:

• ack-3.10.0-1.fc44

Update description:

Update to version 3.10.0

FEDORA-2026-6f3d11bdc6 Packages in this update:

• hugo-0.162.1-1.fc43

Update description:

Update to 0.162.1 (rhbz#2455512)

FEDORA-2026-7fe2bb8a08 Packages in this update:

• hugo-0.162.1-1.fc44

Update description:

Update to 0.162.1 (rhbz#2455512)

FEDORA-2026-80333f8f56 Packages in this update:

• perl-Mojo-JWT-1.02-1.fc44

Update description:

This release of Mojo::JWT Improves the security of decode to prevent timing side-channel attacks in symmetric signatures

FEDORA-2026-1da54e6cb8 Packages in this update:

• perl-Mojo-JWT-1.02-1.fc43

Update description:

This release of Mojo::JWT Improves the security of decode to prevent timing side-channel attacks in symmetric signatures

FEDORA-EPEL-2026-4d0b588a17 Packages in this update:

• python-django4.2-4.2.30-2.el9

Update description:

• Backport fix for CVE-2026-35192 (low): Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
• Django 4.2.30 fixes one security issue with severity “moderate” and four security issues with severity “low” in 4.2.29
• CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload [moderate]
• CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
• CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin
• CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable
• CVE-2026-33034: Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypass
• Django 4.2.29 fixes a security issue with severity “moderate” and a security issue with severity “low” in 4.2.28
• CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows [moderate]
• CVE-2026-25674: Potential incorrect permissions on newly created file system objects

FEDORA-EPEL-2026-8d575a466a Packages in this update:

• chromium-149.0.7827.53-1.el10_2

Update description:

Update to 149.0.7827.53

• fix 429 CVEs ( CVE-2026-10881 through CVE-2026-11309)