Fedora Security Advisories

xen-4.21.2-1.fc44

Fedora Security Advisories
1 day 3 hours ago
FEDORA-2026-bf1da84dfc Packages in this update:
  • xen-4.21.2-1.fc44
Update description:

update to xen 4.21.2 includes security fixes x86 shadow paging is deprecated [XSA-495, CVE-2026-42493] vIRQ event channel binding may break Xenstore [XSA-496, CVE-2026-42492] buffer overruns in libfsimage iso9660 handling [XSA-497, CVE-2026-42494, CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425] sysctl and platform-op locks open to abuse [XSA-499, CVE-2026-62426, CVE-2026-62427] grant-table: type confusion in grant-copy [XSA-500, CVE-2026-62428] grant-table: version change racing with other operations [XSA-501, CVE-2026-62435, CVE-2026-62436] vNUMA domain cleanup may race other operations [XSA-502, CVE-2026-62429] x86: Out-of-bounds read in vRTC emulation [XSA-503, CVE-2026-62430] Viridian STIMER division by zero [XSA-504, CVE-2026-62431] evtchn: Race between FIFO expand and reset [XSA-505, CVE-2026-62432] correct buffer checks for DM_OP hypercalls [XSA-506, CVE-2026-62433] PoD: Don't try to reclaim special pages [XSA-507, CVE-2026-62434] pygrub is only supported in de-privileged mode [XSA-508]

fuse-overlayfs-1.17-1.fc43

Fedora Security Advisories
1 day 4 hours ago
FEDORA-2026-40ce06e46e Packages in this update:
  • fuse-overlayfs-1.17-1.fc43
Update description:

Update to fuse-overlayfs 1.17 to fix CVE-2026-52791: privilege escalation via SUID/SGID bit preservation on file truncation. When a file with SUID/SGID bits is truncated, those privilege bits should be cleared but were not in versions prior to 1.17, allowing potential privilege escalation in rootless containers.

fuse-overlayfs-1.17-1.fc44

Fedora Security Advisories
1 day 4 hours ago
FEDORA-2026-4e0490640f Packages in this update:
  • fuse-overlayfs-1.17-1.fc44
Update description:

Update to fuse-overlayfs 1.17 to fix CVE-2026-52791: privilege escalation via SUID/SGID bit preservation on file truncation. When a file with SUID/SGID bits is truncated, those privilege bits should be cleared but were not in versions prior to 1.17, allowing potential privilege escalation in rootless containers.

docker-buildx-0.36.0-1.fc45

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-c37317fdde Packages in this update:
  • docker-buildx-0.36.0-1.fc45
Update description:

Automatic update for docker-buildx-0.36.0-1.fc45.

Changelog * Wed Jul 29 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 0.36.0-1 - Update to release v0.36.0 - Resolves: rhbz#2506339 - Upstream new features and fixes - Resolves CVE-2026-53492 - rhbz#2496553 - Resolves CVE-2026-47262 - rhbz#2496436

isns-utils-0.103-8.fc45

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-c1c3dda3cd Packages in this update:
  • isns-utils-0.103-8.fc45
Update description:

Automatic update for isns-utils-0.103-8.fc45.

Changelog * Wed Jul 29 2026 Chris Leech <cleech@redhat.com> - 0.103-8 - CVE-2026-55995: Denial of Service via double-free in iSNS attribute decoder (rhbz#2508456)

iscsi-initiator-utils-6.2.1.12-1.fc45

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-004b11bc1e Packages in this update:
  • iscsi-initiator-utils-6.2.1.12-1.fc45
Update description:

Automatic update for iscsi-initiator-utils-6.2.1.12-1.fc45.

Changelog * Wed Jul 29 2026 Chris Leech <cleech@redhat.com> - 6.2.1.12-1 - rebase to Open-iSCSI 2.1.12 - CVE-2026-44943: Privilege Escalation via Path Traversal (rhbz#2508458) - CVE-2026-44944: Authentication bypass in iscsiuio control socket (rhbz#2508457)

goss-0.4.10-1.fc45

Fedora Security Advisories
1 day 19 hours ago
FEDORA-2026-68c59bf226 Packages in this update:
  • goss-0.4.10-1.fc45
Update description:

Automatic update for goss-0.4.10-1.fc45.

Changelog * Wed Jul 29 2026 Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> - 0.4.10-1 - Update to 0.4.10 (rhbz#2494364,rhbz#2494459,rhbz#2494611,rhbz#2494911,rhbz#2495296)

php-8.4.24-1.fc43

Fedora Security Advisories
2 days 12 hours ago
FEDORA-2026-d755ca77c4 Packages in this update:
  • php-8.4.24-1.fc43
Update description:

PHP version 8.4.24 (30 Jul 2026)

BCMath:

Calendar:

  • Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year). (arshidkv12)

Date:

  • Update timelib to 2022.17. (Derick)
  • Fixed bug GH-19803 (Parsing a string with a single white space does create an error). (Derick)
  • Fixed Unix timestamps in February of the year 0 are misparsed with @-notation. (LukasGelbmann)
  • Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes). (Derick)

DBA:

  • Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)

DOM:

  • Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument). (iliaal)

Exif:

  • Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)

Hash:

  • Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment). (iliaal)

Intl:

  • Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized. (Weilin Du)
  • Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice. (Weilin Du)
  • Fixed IntlChar methods leaving stale global error state after successful calls. (Xuyang Zhang)

ODBC:

  • Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)

OpenSSL:

  • Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper. (ilutov)

PDO_ODBC:

  • Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials). (iliaal)
  • Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)
  • Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen). (iliaal)
  • Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer). (iliaal)

PGSQL:

  • Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543) (ilutov)

Phar:

  • Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction. (Weilin Du)
  • Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260) (Jakub Zelenka)

PHPDBG:

  • Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
  • Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break. (jorgsowa)
  • Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path. (jorgsowa)

Reflection:

  • Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()). (jorgsowa)
  • Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property). (iliaal)
  • Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output). (DanielEScherzer)
  • Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes). (DanielEScherzer)

Session:

  • Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5). (jorgsowa)

SPL:

  • Fix class_parents for classes with leading slash in non-autoload mode. (jorgsowa)
  • Ignore leading back-slash in class_parents(), class_implements(), and class_uses(). (jorgsowa)
  • Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults). (iliaal)

Standard:

  • Fixed bug GH-22360 (convert.base64-encode corruption on incremental flush). (David Carlier)
  • Fixed bug GH-22395 (base_convert() outputs at most 64 characters). (Weilin Du)
  • Fixed integer overflow in getimagesize() and getimagesizefromstring() when parsing an IFF chunk with a size of INT_MAX. (David Carlier, Weilin Du)
  • Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted). (azchin, iliaal)

Streams:

  • Fixed bug GH-22617 (persistent stream keys truncated at null bytes, causing distinct abstract unix domain sockets to share a resource). (David Carlier)

trafficserver-10.1.4-1.fc44

Fedora Security Advisories
2 days 20 hours ago
FEDORA-2026-5bec7441bb Packages in this update:
  • trafficserver-10.1.4-1.fc44
Update description:

Update to upstream 10.1.4 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 - Hop-by-hop and internal headers from untrusted peers are not stripped - CVE-2026-58150 - HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling - CVE-2026-58151 - Abusive HTTP/2 framing can exhaust resources and crash the server - CVE-2026-58154 - Memory-safety errors in MIME and header parsing - CVE-2026-58155 - Header-name length truncation enables header aliasing and request smuggling - CVE-2026-58157 - Improper server-session reuse can expose data across client connections - CVE-2026-58161 - Memory-safety errors in TLS and SNI handling can crash the server - CVE-2026-58177 - Memory-safety and path-traversal errors in the Cripts framework - CVE-2026-65324 - HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion - CVE-2026-24033 - Chunked extension quoted-string parsing allows request smuggling - CVE-2026-33930 - Buffer overflow via Host field that has a long string value - CVE-2026-41920 - SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass - CVE-2026-57834 - Malformed chunked message body allows request smuggling - CVE-2026-58152 - Integer-handling errors in HPACK/XPACK decoding corrupt memory - CVE-2026-58153 - HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely - CVE-2026-58156 - URL and port parsing errors allow access-control bypass - CVE-2026-58158 - PROXY protocol parsing has port truncation and a stack overflow - CVE-2026-58159 - Listener and ACL handling allow access-control bypass - CVE-2026-58160 - Out-of-bounds reads while parsing DNS responses - CVE-2026-58162 - Certifier plugin trusts client SNI when generating certificates - CVE-2026-58163 - Cache deserialization and lifetime errors can corrupt state or crash the server - CVE-2026-58164 - Remap configuration lifetime and TOCTOU errors cause use-after-free - CVE-2026-58175 - HostDB SRV handling leaks memory - CVE-2026-58178 - ESI plugin allows uncontrolled recursion and server-side request forgery - CVE-2026-58179 - regex_remap plugin overflows the stack from attacker input - CVE-2026-58180 - txn_box plugin overflows the stack from attacker input - CVE-2026-58181 - uri_signing and url_sig plugins can exhaust the stack or crash - CVE-2026-58182 - ts_lua plugin has initialization and resource-handling errors - CVE-2026-58183 - prefetch plugin can crash on attacker-influenced input - CVE-2026-58184 - header_rewrite plugin cookie handling can corrupt memory - CVE-2026-58185 - Use-after-free in the intercept plugin - CVE-2026-58186 - webp_transform plugin decodes unsafely and mislabels degraded responses - CVE-2026-58187 - Multiplexer plugin chunk decoder enables a denial of service - CVE-2026-58188 - Memory-safety and limit-bypass errors across experimental plugins - CVE-2026-58189 - Plugins resetting the redirect counter enable SSRF amplification - CVE-2026-65100 - HPACK encoder desynchronizes from the decoder after a failed header encode - CVE-2026-65325 - HTTP/2 multiplexed origin sessions are reused without certificate re-verification

trafficserver-10.1.4-1.fc43

Fedora Security Advisories
2 days 20 hours ago
FEDORA-2026-144d6c9bcc Packages in this update:
  • trafficserver-10.1.4-1.fc43
Update description:

Update to upstream 10.1.4 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 - Hop-by-hop and internal headers from untrusted peers are not stripped - CVE-2026-58150 - HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling - CVE-2026-58151 - Abusive HTTP/2 framing can exhaust resources and crash the server - CVE-2026-58154 - Memory-safety errors in MIME and header parsing - CVE-2026-58155 - Header-name length truncation enables header aliasing and request smuggling - CVE-2026-58157 - Improper server-session reuse can expose data across client connections - CVE-2026-58161 - Memory-safety errors in TLS and SNI handling can crash the server - CVE-2026-58177 - Memory-safety and path-traversal errors in the Cripts framework - CVE-2026-65324 - HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion - CVE-2026-24033 - Chunked extension quoted-string parsing allows request smuggling - CVE-2026-33930 - Buffer overflow via Host field that has a long string value - CVE-2026-41920 - SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass - CVE-2026-57834 - Malformed chunked message body allows request smuggling - CVE-2026-58152 - Integer-handling errors in HPACK/XPACK decoding corrupt memory - CVE-2026-58153 - HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely - CVE-2026-58156 - URL and port parsing errors allow access-control bypass - CVE-2026-58158 - PROXY protocol parsing has port truncation and a stack overflow - CVE-2026-58159 - Listener and ACL handling allow access-control bypass - CVE-2026-58160 - Out-of-bounds reads while parsing DNS responses - CVE-2026-58162 - Certifier plugin trusts client SNI when generating certificates - CVE-2026-58163 - Cache deserialization and lifetime errors can corrupt state or crash the server - CVE-2026-58164 - Remap configuration lifetime and TOCTOU errors cause use-after-free - CVE-2026-58175 - HostDB SRV handling leaks memory - CVE-2026-58178 - ESI plugin allows uncontrolled recursion and server-side request forgery - CVE-2026-58179 - regex_remap plugin overflows the stack from attacker input - CVE-2026-58180 - txn_box plugin overflows the stack from attacker input - CVE-2026-58181 - uri_signing and url_sig plugins can exhaust the stack or crash - CVE-2026-58182 - ts_lua plugin has initialization and resource-handling errors - CVE-2026-58183 - prefetch plugin can crash on attacker-influenced input - CVE-2026-58184 - header_rewrite plugin cookie handling can corrupt memory - CVE-2026-58185 - Use-after-free in the intercept plugin - CVE-2026-58186 - webp_transform plugin decodes unsafely and mislabels degraded responses - CVE-2026-58187 - Multiplexer plugin chunk decoder enables a denial of service - CVE-2026-58188 - Memory-safety and limit-bypass errors across experimental plugins - CVE-2026-58189 - Plugins resetting the redirect counter enable SSRF amplification - CVE-2026-65100 - HPACK encoder desynchronizes from the decoder after a failed header encode - CVE-2026-65325 - HTTP/2 multiplexed origin sessions are reused without certificate re-verification

trafficserver-9.2.15-1.el9

Fedora Security Advisories
2 days 20 hours ago
FEDORA-EPEL-2026-943e511d48 Packages in this update:
  • trafficserver-9.2.15-1.el9
Update description:

Update to upstream 9.2.15 Resolves: - CVE-2026-22068 - Unanchored regular-expression matching allows ACL and policy bypass - CVE-2026-33267 - Hop-by-hop and internal headers from untrusted peers are not stripped - CVE-2026-58150 - HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling - CVE-2026-58151 - Abusive HTTP/2 framing can exhaust resources and crash the server - CVE-2026-58154 - Memory-safety errors in MIME and header parsing - CVE-2026-58155 - Header-name length truncation enables header aliasing and request smuggling - CVE-2026-58157 - Improper server-session reuse can expose data across client connections - CVE-2026-58161 - Memory-safety errors in TLS and SNI handling can crash the server - CVE-2026-58177 - Memory-safety and path-traversal errors in the Cripts framework - CVE-2026-65324 - HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion - CVE-2026-24033 - Chunked extension quoted-string parsing allows request smuggling - CVE-2026-33930 - Buffer overflow via Host field that has a long string value - CVE-2026-41920 - SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass - CVE-2026-57834 - Malformed chunked message body allows request smuggling - CVE-2026-58152 - Integer-handling errors in HPACK/XPACK decoding corrupt memory - CVE-2026-58153 - HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely - CVE-2026-58156 - URL and port parsing errors allow access-control bypass - CVE-2026-58158 - PROXY protocol parsing has port truncation and a stack overflow - CVE-2026-58159 - Listener and ACL handling allow access-control bypass - CVE-2026-58160 - Out-of-bounds reads while parsing DNS responses - CVE-2026-58162 - Certifier plugin trusts client SNI when generating certificates - CVE-2026-58163 - Cache deserialization and lifetime errors can corrupt state or crash the server - CVE-2026-58164 - Remap configuration lifetime and TOCTOU errors cause use-after-free - CVE-2026-58175 - HostDB SRV handling leaks memory - CVE-2026-58178 - ESI plugin allows uncontrolled recursion and server-side request forgery - CVE-2026-58179 - regex_remap plugin overflows the stack from attacker input - CVE-2026-58180 - txn_box plugin overflows the stack from attacker input - CVE-2026-58181 - uri_signing and url_sig plugins can exhaust the stack or crash - CVE-2026-58182 - ts_lua plugin has initialization and resource-handling errors - CVE-2026-58183 - prefetch plugin can crash on attacker-influenced input - CVE-2026-58184 - header_rewrite plugin cookie handling can corrupt memory - CVE-2026-58185 - Use-after-free in the intercept plugin - CVE-2026-58186 - webp_transform plugin decodes unsafely and mislabels degraded responses - CVE-2026-58187 - Multiplexer plugin chunk decoder enables a denial of service - CVE-2026-58188 - Memory-safety and limit-bypass errors across experimental plugins - CVE-2026-58189 - Plugins resetting the redirect counter enable SSRF amplification - CVE-2026-65100 - HPACK encoder desynchronizes from the decoder after a failed header encode - CVE-2026-65325 - HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Checked
1 minute 51 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security