Fedora Security Advisories

FEDORA-2026-a387125860 Packages in this update:

• thunderbird-156.0-2.fc43

Update description:

Update to latest upstream version.

Update to latest stable upstream version.

FEDORA-2026-f5733c1dd0 Packages in this update:

• rootlesskit-3.2.0-1.fc43

Update description:

• Update to release v3.2.0
• Resolves: rhbz#2530874
• Resolves CVE-2026-56855: rhbz#2530631
• Resolves CVE-2026-78662: rhbz#2530678
• Upstream enhancements and fixes

FEDORA-2026-019108693f Packages in this update:

• sngrep-1.8.4-4.fc45

Update description:

Fixed CVE-2026-90558

FEDORA-2026-e5174fc4cf Packages in this update:

• sngrep-1.8.4-4.fc43

Update description:

Fixed CVE-2026-90558

FEDORA-2026-3ff086aa2a Packages in this update:

• sngrep-1.8.4-4.fc44

Update description:

Fixed CVE-2026-90558

FEDORA-2026-9b73fdb8e6 Packages in this update:

• flatpak-builder-1.4.12-1.fc44

Update description:

Update to 1.4.12

FEDORA-2026-8e3688d489 Packages in this update:

• perl-Imager-1.036-1.fc45

Update description:

1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)

FEDORA-2026-12f0a70554 Packages in this update:

• perl-Imager-1.036-1.fc44

Update description:

1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)

FEDORA-2026-625ab5c382 Packages in this update:

• perl-Imager-1.036-1.fc43

Update description:

1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)

FEDORA-2026-fc27f09459 Packages in this update:

• tesseract-5.5.3-2.fc44

Update description:

Backport fixes for CVE-2026-{88047-88054}

FEDORA-2026-4585aba520 Packages in this update:

• tesseract-5.5.3-2.fc43

Update description:

Backport fixes for CVE-2026-{88047-88054}

FEDORA-2026-e3bf7f4ecb Packages in this update:

• tesseract-5.5.3-2.fc45

Update description:

Backport fixes for CVE-2026-{88047-88054}

FEDORA-2026-3e60aed77e Packages in this update:

• rootlesskit-3.2.0-1.fc44

Update description:

• Update to release v3.2.0
• Resolves: rhbz#2530874
• Resolves CVE-2026-56855: rhbz#2530631
• Resolves CVE-2026-78662: rhbz#2530678
• Upstream enhancements and fixes

FEDORA-2026-6b8872b8ac Packages in this update:

• rootlesskit-3.2.0-1.fc45

Update description:

• Update to release v3.2.0
• Resolves: rhbz#2530874
• Resolves CVE-2026-56855: rhbz#2530631
• Resolves CVE-2026-78662: rhbz#2530678
• Upstream enhancements and fixes

FEDORA-2026-ec725c24c1 Packages in this update:

• rootlesskit-3.2.0-1.fc46

Update description:

Automatic update for rootlesskit-3.2.0-1.fc46.

Changelog * Sun Sep 20 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 3.2.0-1 - Update to release v3.2.0 - Resolves: rhbz#2530874 - Resolves CVE-2026-56855: rhbz#2530631 - Resolves CVE-2026-78662: rhbz#2530678 - Upstream enhancements and fixes

FEDORA-2026-66894499b7 Packages in this update:

• freeipmi-1.6.19-1.fc43

Update description:

Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode

FEDORA-2026-3b893ccf2d Packages in this update:

• perl-Dancer2-2.2.1-1.fc44

Update description:

Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.

deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.

FEDORA-2026-5e3eab9a07 Packages in this update:

• perl-Dancer2-2.2.1-1.fc45

Update description:

Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.

deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.

FEDORA-2026-2d96cf2594 Packages in this update:

• perl-Catalyst-Plugin-Static-Simple-0.38-2.fc44

Update description:

Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.

In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the Expires header to be set to 0.

FEDORA-2026-4d5a716383 Packages in this update:

• perl-Catalyst-Plugin-Static-Simple-0.38-2.fc45

Update description:

Catalyst::Plugin::Static::Simple for Perl sets the Cache‑Control header to "public" for every static asset served. Consequently, intermediaries such as shared reverse proxies or CDN edge caches may store and later serve content that was intended to be private, thereby exposing sensitive data to unintended recipients.

In this package, the plugin's code is changed to allow the Cache-Control header to be overridden and the Expires header to be set to 0.