Fedora Security Advisories

FEDORA-2026-0f070b8878 Packages in this update:

• nodejs22-22.23.4-4.fc44

Update description:

Security release. Update to 22.23.4

Changelog * Thu Oct 15 2026 Andrei Radchenko <aradchen@redhat.com> - 1:22.23.3-2 - Update internal brace-expansion package to 2.1.6

• Closing previously addressed bugs

FEDORA-2026-743263799b Packages in this update:

• nodejs26-26.12.1-2.fc45

Update description:

Security release. Update to 26.12.1

FEDORA-2026-5c08945adb Packages in this update:

• nodejs24-24.22.1-3.fc44

Update description:

Rebase to 24.22.1 with additional downstream patches

Rebase to Node.js 24.21.0, pulling in the upstream security releases and refreshed bundled dependencies: undici 7.29.1, nghttp2 1.70.0, npm 11.19.0, tar 7.5.19, pacote 21.5.1, brace-expansion 5.0.7.

FEDORA-2026-d6c2df6970 Packages in this update:

• nodejs24-24.22.1-3.fc45

Update description:

Rebase to 24.22.1 with additional downstream patches

Rebase to Node.js 24.21.0, pulling in the upstream security releases and refreshed bundled dependencies: undici 7.29.1, nghttp2 1.70.0, npm 11.19.0, tar 7.5.19, pacote 21.5.1, brace-expansion 5.0.7.

FEDORA-2026-2ce86ea8f8 Packages in this update:

• rust-siguldry-fedora-autopen-0.2.2-4.fc45

Update description:

Rebuilt with webpki-roots 1.0.11 (removed emSign Root CA - C1/C3)

This provides added protection against trusting compromised certificates.

FEDORA-2026-d39bedb422 Packages in this update:

• gpsd-3.27.5-8.fc45

Update description:

Security fix for CVE-2026-60122

FEDORA-2026-85f1c692b7 Packages in this update:

• gpsd-3.27.5-8.fc44

Update description:

Security fix for CVE-2026-60122

FEDORA-2026-81337e9cbe Packages in this update:

• kernel-7.2.15-100.fc43

Update description:

The 7.2.15 stable kernel update contains a number of important fixes across the tree.

FEDORA-2026-7a0f444c64 Packages in this update:

• kernel-7.2.15-300.fc45

Update description:

The 7.2.15 stable kernel update contains a number of important fixes across the tree.

FEDORA-2026-778424cb43 Packages in this update:

• kernel-7.2.15-200.fc44

Update description:

The 7.2.15 stable kernel update contains a number of important fixes across the tree.

FEDORA-EPEL-2026-4194d9df6f Packages in this update:

• libopenmpt-0.8.10-1.el10_2

Update description: libopenmpt 0.8.10 (2026-10-31)

• [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
• [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
• Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.

libopenmpt 0.8.9 (2026-08-19)

• [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
• [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

libopenmpt 0.8.8 (2026-08-15)

• IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
• XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
• STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.

• GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.

• mpg123: Update to v1.33.7 (2026-08-03).

• miniz: Update to v3.1.2 (2026-07-01).
• pugixml: Update to v1.16 (2026-06-16).

FEDORA-EPEL-2026-3423413067 Packages in this update:

• libopenmpt-0.8.10-1.el8

Update description: libopenmpt 0.8.10 (2026-10-31)

• [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
• [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
• Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.

libopenmpt 0.8.9 (2026-08-19)

• [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
• [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

libopenmpt 0.8.8 (2026-08-15)

• IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
• XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
• STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.

• GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.

• mpg123: Update to v1.33.7 (2026-08-03).

• miniz: Update to v3.1.2 (2026-07-01).
• pugixml: Update to v1.16 (2026-06-16).

FEDORA-EPEL-2026-a0734f2f20 Packages in this update:

• libopenmpt-0.8.10-1.el9

Update description: libopenmpt 0.8.10 (2026-10-31)

• [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
• [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
• Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.

libopenmpt 0.8.9 (2026-08-19)

• [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
• [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

libopenmpt 0.8.8 (2026-08-15)

• IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
• XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
• STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.

• GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.

• mpg123: Update to v1.33.7 (2026-08-03).

• miniz: Update to v3.1.2 (2026-07-01).
• pugixml: Update to v1.16 (2026-06-16).

FEDORA-EPEL-2026-ba693411ed Packages in this update:

• libopenmpt-0.8.10-1.el10_4

Update description: libopenmpt 0.8.10 (2026-10-31)

• [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
• [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
• Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.

libopenmpt 0.8.9 (2026-08-19)

• [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
• [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

libopenmpt 0.8.8 (2026-08-15)

• IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
• XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
• STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.

• GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.

• mpg123: Update to v1.33.7 (2026-08-03).

• miniz: Update to v3.1.2 (2026-07-01).
• pugixml: Update to v1.16 (2026-06-16).

FEDORA-EPEL-2026-6d0b6ab2fd Packages in this update:

• libopenmpt-0.8.10-1.el10_3

Update description: libopenmpt 0.8.10 (2026-10-31)

• [Sec] SymMOD: Potential divison by 0 when trying to decode an embedded IMA ADPCM WAV sample claiming to contain 0 audio channels (r25831).
• [Bug] SymMOD: It was possible that a fact chunk of an embedded WAV file claimed an impossibly big sample length for an IMA ADPCM sample, causing unnecessarily large memory allocations.
• Volume column portamento effect memory was not updated properly during seeking, causing notes to continue playing at the wrong pitch.

libopenmpt 0.8.9 (2026-08-19)

• [Sec] Possible heap out-of-bounds write when loading SymMOD files containing WAV IMA ADPCM samples (r25623, r25645). See also https://github.com/OpenMPT/openmpt/security/advisories/GHSA-fxf7-wc37-p2cx
• [Sec] Possible heap out-of-bounds read when loading custom tunings from MPTM files (r25609, r25615).

libopenmpt 0.8.8 (2026-08-15)

• IT: Due to an Impulse Tracker bug in Compatible Gxx mode, Envelope Carry may not resume the envelope from the correct position when there is both an instrument number and tone portamento next to a note.
• XM: NitroTracker ignores instrument numbers where there is no note next to them, so they are no longer imported. Fixes various NitroTracker-made XMs such as notominous-a19.xm.
• STK: Loosen heuristics a bit to allow STK.CRB-GreatMuzaxs6 to load.

• GT2: Loading file versions 6 and later was broken since libopenmpt 0.8.0.

• mpg123: Update to v1.33.7 (2026-08-03).

• miniz: Update to v3.1.2 (2026-07-01).
• pugixml: Update to v1.16 (2026-06-16).

FEDORA-EPEL-2026-0892a8382c Packages in this update:

• partclone-0.3.52-1.el10_4

Update description: partclone v0.3.52

• fix(btrfs): deduplicate extents scanned more than once when building the bitmap

partclone v0.3.51

• chore(btrfs): sync with btrfs-progs v6.17.1
• Fix static linking by renaming internal crc32 to pc_crc32
• exfat: clone the last two clusters of a volume
• Add JSON status output for progress monitoring
• Fix/ntfs backup bootsector

FEDORA-2026-f6acaf8756 Packages in this update:

• perl-Net-IDN-Encode-2.600-1.fc45

Update description:

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input

FEDORA-2026-effb380a7c Packages in this update:

• perl-Net-IDN-Encode-2.600-1.fc44

Update description:

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input

FEDORA-2026-3cb8ce0117 Packages in this update:

• perl-Net-IDN-Encode-2.600-1.fc43

Update description:

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input

FEDORA-2026-bd36d053a1 Packages in this update:

• perl-Starlet-0.33-1.fc44

Update description:

Starlet 0.33 fixes several security issues in the Starlet code: * prevent excessive CPU use when parsing malformed chunk-size lines * bound read allocations for large Content-Length values * stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes