Fedora Security Advisories

389-ds-base-3.3.1-1.fc45

2 hours 48 minutes ago
FEDORA-2026-c1e25a4642 Packages in this update:
  • 389-ds-base-3.3.1-1.fc45
Update description:
  • Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]
  • Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]
  • Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]
  • Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]
  • Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
  • Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
  • Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]
  • Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
  • Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
  • Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
  • Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
  • Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]
  • Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]
  • Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]
  • Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

389-ds-base-3.1.5-2.fc43

2 hours 48 minutes ago
FEDORA-2026-0b8bc362b1 Packages in this update:
  • 389-ds-base-3.1.5-2.fc43
Update description:
  • Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]
  • Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]
  • Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]
  • Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]
  • Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
  • Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
  • Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]
  • Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
  • Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
  • Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
  • Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
  • Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]
  • Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]
  • Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]
  • Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

389-ds-base-3.2.3-2.fc44

2 hours 48 minutes ago
FEDORA-2026-b16c9cbc0f Packages in this update:
  • 389-ds-base-3.2.3-2.fc44
Update description:
  • Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]
  • Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]
  • Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]
  • Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]
  • Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
  • Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
  • Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]
  • Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
  • Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
  • Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
  • Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
  • Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]
  • Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]
  • Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]
  • Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

erlang-26.2.5.21-7.fc43

4 hours 32 minutes ago
FEDORA-2026-02481296e8 Packages in this update:
  • erlang-26.2.5.21-7.fc43
Update description:

Backported fixes for CVE-2026-58227 and CVE-2026-59251

Fix for CVE-2026-55953

erlang-26.2.5.21-7.fc44

4 hours 32 minutes ago
FEDORA-2026-64363fe778 Packages in this update:
  • erlang-26.2.5.21-7.fc44
Update description:

Backported fixes for CVE-2026-58227 and CVE-2026-59251

Fix for CVE-2026-55953

tar-1.35-9.fc44

5 hours 49 minutes ago
FEDORA-2026-044e56d9ff Packages in this update:
  • tar-1.35-9.fc44
Update description:

Fix build with libacl 2.4.0, fix CVE-2026-5704, CVE-2026-18508, CVE-2026-18477, and a regression in the fix for CVE-2025-45582.

libevent-2.1.13-1.fc43

9 hours 52 minutes ago
FEDORA-2026-728dd9f704 Packages in this update:
  • libevent-2.1.13-1.fc43
Update description: Update to 2.1.13.

The following security vulnerabilites are fixed in this update:

libevent-2.1.13-1.fc44

10 hours 3 minutes ago
FEDORA-2026-72d10c874d Packages in this update:
  • libevent-2.1.13-1.fc44
Update description: Update to 2.1.13.

The following security vulnerabilites are fixed in this update:

libevent-2.1.13-1.fc45

10 hours 8 minutes ago
FEDORA-2026-0a83f1b852 Packages in this update:
  • libevent-2.1.13-1.fc45
Update description: Update to 2.1.13.

The following security vulnerabilites are fixed in this update:

gegl04-0.4.72-1.fc43

10 hours 35 minutes ago
FEDORA-2026-39b07f6dbb Packages in this update:
  • gegl04-0.4.72-1.fc43
Update description:

This update contains a new upstream release with bugfixes and improvements, notably it fixes an overflow in parsing RGBE/HDR image files.

For more information, please consult the upstream changelog.

libcupsfilters-2.2.1-3.fc46

11 hours 32 minutes ago
FEDORA-2026-5cce49502a Packages in this update:
  • libcupsfilters-2.2.1-3.fc46
Update description:

Automatic update for libcupsfilters-2.2.1-3.fc46.

Changelog * Fri Sep 4 2026 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.1-3 - fix multiple copies not working for raster drivers (rhbz#2312145)
Checked
1 minute 3 seconds ago