Fedora Security Advisories

• mongo-c-driver-1.30.11-1.fc44

Fixes

• Fix length check in bson_new_from_buffer.

Fixes

• Fix allocation in Windows Secure Channel.
• Fix error handling in SCRAM authentication.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.4-1.fc45

Fixes

• Fix allocation in Windows Secure Channel.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.4-1.el10_3

Fixes

• Fix allocation in Windows Secure Channel.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• mongo-c-driver-2.5.4-1.el10_4

Fixes

• Fix allocation in Windows Secure Channel.

Fixes

• Use exact match for file ID in GridFS methods CVE-2026-88036
• Validate SASL username CVE-2026-88035

• wordpress-6.9.8-1.el9

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-6.9.8-1.fc43

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-6.9.8-1.el10_2

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-6.9.8-1.fc44

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-7.1.1-1.el10_3

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-7.1.1-1.fc45

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• wordpress-7.1.1-1.el10_4

Security updates included in this release

• Stored cross-site scripting in wpautop() allows an unauthenticated visitor to inject script (subject to comment approval), reported by Rafie Muhammad (Awesome Motive, Inc.).
• HTML API: set_modifiable_text() allows breaking out of a comment via abrupt-closing sequences, reported by Jeremy Felt of the WordPress Security Team.
• Stored XSS in some themes that support custom headers, reported by Jeremy Felt of the WordPress Security Team.
• Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org, reported by Paulos Yibelo and pwn.ai.
• Site Administrator can network-activate an installed Network-only plugin, reported by Jesse McNeil.
• Authenticated Path Traversal in WP REST Templates Controller, reported by Anthropic.
• XML-RPC can be used to publish customize_changeset posts that bypass checks for edit_css, reported by Ben Bidner of the WordPress Security Team.
• Contributor+ Arbitrary Post Overwrite, reported by Anthropic.
• Missing read_post check in attachment_submitbox_metadata() leaks a private parent-post title, reported by HDWSec.
• Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+, reported by hermanhms.
• Comments, including notes, can be reparented by any authenticated user, reported by viridis.

• ckermit-11.0.509-2.fc45

Update to 11.0.509 with security fix

• xen-4.20.4-2.fc43

x86: DMs may cause mem leak by IRQ binding [XSA-509, CVE-2026-62437] x86: improper handling of HVM emulation return codes [XSA-510, CVE-2026-79602] Unconditionally do TLB flushing ahead of page scrubbing [XSA-511, CVE-2026-79603] oxenstored: Unbounded accumulation of watches [XSA-512, CVE-2026-79604]

• webkitgtk-2.54.0-1.fc43

Update to 2.54.0:

• Switch web process compositor to use Skia instead of TextureMapper.
• Improved damage handling that is now also used during the composition to limit the composited areas.
• Implement GPU atlas creation and replay substitution for batched raster image uploads.
• Media capability reporting is more accurate.
• Video decoding limits are now respected in media capabilities queries.
• Add new improved API for page favicons.
• Add magnification property to WebKitWebView to handle visual scaling.
• Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
• Remove the option to use cairo for 2D rendering.

WebKit Security fixes from 2.54.0: CVE-2026-84635, CVE-2026-64753, CVE-2026-64715, CVE-2026-64778, CVE-2026-64779, CVE-2026-64780, CVE-2026-64782, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338, CVE-2026-65340, CVE-2026-65341, CVE-2026-65351, CVE-2026-78376, CVE-2026-83596.

WebKit security fixes from 2.52.6: CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64757, CVE-2026-64783

This update also fixes a couple hundred or so ANGLE CVEs and several dozen Skia CVEs.

This update breaks some styles in Evolution and likely crashes Eclipse on startup. Sorry about that.

• webkitgtk-2.54.0-1.fc44

Update to 2.54.0:

• Switch web process compositor to use Skia instead of TextureMapper.
• Improved damage handling that is now also used during the composition to limit the composited areas.
• Implement GPU atlas creation and replay substitution for batched raster image uploads.
• Media capability reporting is more accurate.
• Video decoding limits are now respected in media capabilities queries.
• Add new improved API for page favicons.
• Add magnification property to WebKitWebView to handle visual scaling.
• Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
• Remove the option to use cairo for 2D rendering.

WebKit Security fixes from 2.54.0: CVE-2026-84635, CVE-2026-64753, CVE-2026-64715, CVE-2026-64778, CVE-2026-64779, CVE-2026-64780, CVE-2026-64782, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332, CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338, CVE-2026-65340, CVE-2026-65341, CVE-2026-65351, CVE-2026-78376, CVE-2026-83596.

WebKit security fixes from 2.52.6: CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64757, CVE-2026-64783

This update also fixes a couple hundred or so ANGLE CVEs and several dozen Skia CVEs.

This update breaks some styles in Evolution and likely crashes Eclipse on startup. Sorry about that.

• sipp-3.7.7-5.fc43

Fixed a bunch of CVEs

• sipp-3.7.7-5.fc45

Fixed a bunch of CVEs

• sipp-3.7.7-5.fc44

Fixed a bunch of CVEs

• webkitgtk-2.54.0-1.fc45

Update to 2.54.0

• fetchmail-6.6.7-1.fc43

Update to fetchmail-6.6.7