Fedora Security Advisories

• nix-2.31.6-1.fc43

Update to 2.31.6 which addresses:

• CVE-2026-110450 (High, https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56) and other Moderate issues:
• see https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

bugfixes:

• nix.fish and nix-daemon.fish should live in fish/vendor_conf.d
• switch back to editline from readline to fix repl history (#2536840)

• nix-2.35.3-2.fc44

• Update to 2.35: https://nix.dev/manual/nix/2.35/release-notes/rl-2.35.html

Version 2.35.3 addresses:

• CVE-2026-110450 (High, https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56) and other Moderate issues
• see https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

bugfixes:

• nix.fish and nix-daemon.fish should live in fish/vendor_conf.d
• switch back to editline from readline to fix repl history (#2536840)

• libinstpatch-1.1.7-4.el10_2

Apply a proposed fix for CVE-2026-111136

• libinstpatch-1.1.7-4.el10_3

Apply a proposed fix for CVE-2026-111136

• libinstpatch-1.1.7-4.el10_4

Apply a proposed fix for CVE-2026-111136

• nix-2.35.3-2.fc45

Update to 2.35.3 which addresses:

• CVE-2026-110450 (High, https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56) and other Moderate issues:
• see https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

bugfixes:

• nix.fish and nix-daemon.fish should live in fish/vendor_conf.d
• switch back to editline from readline to fix repl history (#2536840)

• libinstpatch-1.1.7-4.fc43

Apply a proposed fix for CVE-2026-111136

• mingw-LibRaw-0.22.2-2.fc45

Backport fix for CVE-2026-88387.

• mingw-LibRaw-0.22.2-2.fc44

Backport fix for CVE-2026-88387.

• libinstpatch-1.1.7-11.fc44

Apply a proposed fix for CVE-2026-111136

• libinstpatch-1.1.7-11.fc45

Apply a proposed fix for CVE-2026-111136

• mingw-python-lxml-6.1.1-1.fc44

Update to python-lxml-6.1.1.

• mingw-expat-2.8.5-1.fc44

Update to expat-2.8.5.

• mingw-expat-2.8.5-1.fc45

Update to expat-2.8.5.

• mingw-libpng-1.6.59-1.fc44

Update to libpng-1.6.59, fixes CVE-2026-46675.

• mingw-libpng-1.6.59-1.fc45

Update to libpng-1.6.59, fixes CVE-2026-46675.

• podofo-1.0.4-2.fc44

Backport fix for CVE-2026-54633.

• aom-3.15.2-1.el10_2

Update to version 3.15.2.

Release notes since 3.13.3:

• https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.0
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.1
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.0
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.1
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.2

• aom-3.15.2-1.el10_3

Update to version 3.15.2.

Release notes since 3.13.3:

• https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.0
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.1
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.0
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.1
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.2

• aom-3.15.2-1.el10_4

Update to version 3.15.2.

Release notes since 3.13.3:

• https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.0
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.14.1
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.0
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.1
• https://aomedia.googlesource.com/aom/+/refs/tags/v3.15.2