Fedora Security Advisories

mariadb10.11-10.11.18-2.fc44

Fedora Security Advisories
1 hour 28 minutes ago
FEDORA-2026-0b7d84b1d6 Packages in this update:
  • mariadb10.11-10.11.18-2.fc44
Update description:

MariaDB 10.11.18

Upstream Release notes: https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18 Upstream Changelog: https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.18 Fixes CVEs: CVE-2026-49261 CVE-2026-48165 CVE-2026-48163 CVE-2026-44173 CVE-2026-44172 CVE-2026-44171 CVE-2026-44170 CVE-2026-44168

mariadb10.11-10.11.18-2.fc43

Fedora Security Advisories
1 hour 28 minutes ago
FEDORA-2026-efc64a64ec Packages in this update:
  • mariadb10.11-10.11.18-2.fc43
Update description:

MariaDB 10.11.18

Upstream Release notes: https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18 Upstream Changelog: https://mariadb.com/docs/release-notes/community-server/changelogs/10.11/10.11.18 Fixes CVEs: CVE-2026-49261 CVE-2026-48165 CVE-2026-48163 CVE-2026-44173 CVE-2026-44172 CVE-2026-44171 CVE-2026-44170 CVE-2026-44168

tmux-3.6b-5.fc44

Fedora Security Advisories
3 hours 53 minutes ago
FEDORA-2026-8a9e99315d Packages in this update:
  • tmux-3.6b-5.fc44
Update description:

fix for bug 2487530 - CVE-2026-11623 tmux: tmux: Use-after-free vulnerability [fedora-all]

tmux-3.6b-6.fc43

Fedora Security Advisories
3 hours 53 minutes ago
FEDORA-2026-50308b152f Packages in this update:
  • tmux-3.6b-6.fc43
Update description:

fix for bug 2487530 - CVE-2026-11623 tmux: tmux: Use-after-free vulnerability [fedora-all]

mariadb11.8-11.8.8-1.fc43

Fedora Security Advisories
12 hours 50 minutes ago
FEDORA-2026-c39d84e105 Packages in this update:
  • mariadb11.8-11.8.8-1.fc43
Update description:

MariaDB 11.8.8

Upstream Release notes: https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8 Upstream Changelog: https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8 Fixes CVEs: CVE-2026-49261 CVE-2026-48165 CVE-2026-48163 CVE-2026-44173 CVE-2026-44172 CVE-2026-44171 CVE-2026-44170 CVE-2026-44169 CVE-2026-44168

mariadb11.8-11.8.8-3.fc44

Fedora Security Advisories
12 hours 50 minutes ago
FEDORA-2026-3fdd0e930d Packages in this update:
  • mariadb11.8-11.8.8-3.fc44
Update description:

MariaDB 11.8.8

Upstream Release notes: https://mariadb.com/docs/release-notes/community-server/11.8/11.8.8 Upstream Changelog: https://mariadb.com/docs/release-notes/community-server/changelogs/11.8/11.8.8 Fixes CVEs: CVE-2026-49261 CVE-2026-48165 CVE-2026-48163 CVE-2026-44173 CVE-2026-44172 CVE-2026-44171 CVE-2026-44170 CVE-2026-44169 CVE-2026-44168

nsd-4.14.3-1.fc43

Fedora Security Advisories
13 hours 24 minutes ago
FEDORA-2026-2843bb1cc8 Packages in this update:
  • nsd-4.14.3-1.fc43
Update description:
  • Fix for CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes. Thanks to Qifan Zhang, Palo Alto Networks for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt
  • Fix for CVE-2026-12245: If NSD is configured with DNS over TLS, a client that performs a TLS action, closing the connection early, causes a crash and restart of the server process. An attacker can keep all children in a crash-restart loop denying DoT service. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt
  • Fix for CVE-2026-12246: The RR type APL rdata address, if too large, causes out of bounds write on the stack, when the zonefile is written out. Thanks to Qifan Zhang from Palo Alto Networks, Haruki Oyama from Waseda University and zhangph for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt
  • Fix for CVE-2026-12490: Secondaries authenticated by a client certificate to transfer a zone over TLS, can bypass verification by transferring over TCP. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt

nsd-4.14.3-1.fc44

Fedora Security Advisories
13 hours 24 minutes ago
FEDORA-2026-dd3a7926a3 Packages in this update:
  • nsd-4.14.3-1.fc44
Update description:
  • Fix for CVE-2026-12244: A specially crafted SVCB RR can cause a heap overflow of up to 65509 attacker controlled bytes. Thanks to Qifan Zhang, Palo Alto Networks for the report https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12244.txt
  • Fix for CVE-2026-12245: If NSD is configured with DNS over TLS, a client that performs a TLS action, closing the connection early, causes a crash and restart of the server process. An attacker can keep all children in a crash-restart loop denying DoT service. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12245.txt
  • Fix for CVE-2026-12246: The RR type APL rdata address, if too large, causes out of bounds write on the stack, when the zonefile is written out. Thanks to Qifan Zhang from Palo Alto Networks, Haruki Oyama from Waseda University and zhangph for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12246.txt
  • Fix for CVE-2026-12490: Secondaries authenticated by a client certificate to transfer a zone over TLS, can bypass verification by transferring over TCP. Thanks to Qifan Zhang, Palo Alto Networks for the report. https://www.nlnetlabs.nl/downloads/nsd/CVE-2026-12490.txt

python-streamlink-8.4.0-1.fc43

Fedora Security Advisories
13 hours 27 minutes ago
FEDORA-2026-4d6aae2d33 Packages in this update:
  • python-streamlink-8.4.0-1.fc43
Update description: streamlink 8.4.0 (2026-05-06)
  • SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
  • Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
  • Fixed: --interface selection by name on macOS (#6908)
  • Fixed: --interface not being applied to adapters mounted after session init (#6915)
  • Updated plugins:
  • goltelevision: rewritten and fixed plugin (#6916)
  • twitcasting: improved ad segment filtering (#6910)

Full changelog

streamlink 8.3.0 (2026-04-10)
  • Added: support for choosing the --interface by name on non-Windows systems, with optional prefixes, similar to curl (#6862)
  • Added: support for also checking stream segments in HLSStream.parse_variant_playlist() by setting check_streams="segments" (#6878)
  • Fixed: stdout/stderr streams in ProcessOutput not being fully line-buffered (#6868)
  • Updated plugins:
  • cdnbg: rewritten and fixed plugin (#6890)
  • nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure (#6871)
  • soop: migrated to sooplive.com (#6876)
  • telefe: rewritten and fixed plugin (#6891)

Full changelog

python-streamlink-8.4.0-1.fc44

Fedora Security Advisories
13 hours 27 minutes ago
FEDORA-2026-b9232006bb Packages in this update:
  • python-streamlink-8.4.0-1.fc44
Update description: streamlink 8.4.0 (2026-05-06)
  • SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
  • Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
  • Fixed: --interface selection by name on macOS (#6908)
  • Fixed: --interface not being applied to adapters mounted after session init (#6915)
  • Updated plugins:
  • goltelevision: rewritten and fixed plugin (#6916)
  • twitcasting: improved ad segment filtering (#6910)

Full changelog

streamlink 8.3.0 (2026-04-10)
  • Added: support for choosing the --interface by name on non-Windows systems, with optional prefixes, similar to curl (#6862)
  • Added: support for also checking stream segments in HLSStream.parse_variant_playlist() by setting check_streams="segments" (#6878)
  • Fixed: stdout/stderr streams in ProcessOutput not being fully line-buffered (#6868)
  • Updated plugins:
  • cdnbg: rewritten and fixed plugin (#6890)
  • nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure (#6871)
  • soop: migrated to sooplive.com (#6876)
  • telefe: rewritten and fixed plugin (#6891)

Full changelog

chromium-149.0.7827.196-1.el10_3

Fedora Security Advisories
1 day 1 hour ago
FEDORA-EPEL-2026-b2d0fa716d Packages in this update:
  • chromium-149.0.7827.196-1.el10_3
Update description:

149.0.7827.196 security release

* CVE-2026-13028: Use after free in WebGL * CVE-2026-13032: Use after free in WebGL * CVE-2026-13033: Out of bounds read in Blink>InterestGroups * CVE-2026-13038: Use after free in Autofill * CVE-2026-13021: Inappropriate implementation in DeviceBoundSessionCredentials * CVE-2026-13022: Inappropriate implementation in Autofill * CVE-2026-13023: Uninitialized Use in GPU * CVE-2026-13024: Insufficient validation of untrusted input in Navigation * CVE-2026-13025: Insufficient validation of untrusted input in DevTools * CVE-2026-13026: Use after free in Digital Credentials * CVE-2026-13027: Use after free in FileSystem * CVE-2026-13029: Use after free in Web Authentication * CVE-2026-13030: Uninitialized Use in GPU * CVE-2026-13031: Use after free in Blink * CVE-2026-13034: Inappropriate implementation in Passwords * CVE-2026-13035: Use after free in Bluetooth * CVE-2026-13036: Use after free in Blink * CVE-2026-13037: Use after free in WebView

chromium-149.0.7827.196-1.el9

Fedora Security Advisories
1 day 1 hour ago
FEDORA-EPEL-2026-262f68b5b5 Packages in this update:
  • chromium-149.0.7827.196-1.el9
Update description:

149.0.7827.196 security release

* CVE-2026-13028: Use after free in WebGL * CVE-2026-13032: Use after free in WebGL * CVE-2026-13033: Out of bounds read in Blink>InterestGroups * CVE-2026-13038: Use after free in Autofill * CVE-2026-13021: Inappropriate implementation in DeviceBoundSessionCredentials * CVE-2026-13022: Inappropriate implementation in Autofill * CVE-2026-13023: Uninitialized Use in GPU * CVE-2026-13024: Insufficient validation of untrusted input in Navigation * CVE-2026-13025: Insufficient validation of untrusted input in DevTools * CVE-2026-13026: Use after free in Digital Credentials * CVE-2026-13027: Use after free in FileSystem * CVE-2026-13029: Use after free in Web Authentication * CVE-2026-13030: Uninitialized Use in GPU * CVE-2026-13031: Use after free in Blink * CVE-2026-13034: Inappropriate implementation in Passwords * CVE-2026-13035: Use after free in Bluetooth * CVE-2026-13036: Use after free in Blink * CVE-2026-13037: Use after free in WebView

chromium-149.0.7827.196-1.el10_2

Fedora Security Advisories
1 day 1 hour ago
FEDORA-EPEL-2026-b9cf5268bd Packages in this update:
  • chromium-149.0.7827.196-1.el10_2
Update description:

149.0.7827.196 security release

* CVE-2026-13028: Use after free in WebGL * CVE-2026-13032: Use after free in WebGL * CVE-2026-13033: Out of bounds read in Blink>InterestGroups * CVE-2026-13038: Use after free in Autofill * CVE-2026-13021: Inappropriate implementation in DeviceBoundSessionCredentials * CVE-2026-13022: Inappropriate implementation in Autofill * CVE-2026-13023: Uninitialized Use in GPU * CVE-2026-13024: Insufficient validation of untrusted input in Navigation * CVE-2026-13025: Insufficient validation of untrusted input in DevTools * CVE-2026-13026: Use after free in Digital Credentials * CVE-2026-13027: Use after free in FileSystem * CVE-2026-13029: Use after free in Web Authentication * CVE-2026-13030: Uninitialized Use in GPU * CVE-2026-13031: Use after free in Blink * CVE-2026-13034: Inappropriate implementation in Passwords * CVE-2026-13035: Use after free in Bluetooth * CVE-2026-13036: Use after free in Blink * CVE-2026-13037: Use after free in WebView
Checked
3 minutes 51 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security