Fedora Security Advisories

FEDORA-2026-840b40ef4c Packages in this update:

• util-linux-2.41.4-7.fc43

Update description:

upstream update, fixes security-related bugs

CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device. The SUID mount follows symlinks when resolving loop backing file paths. On systems where non-root users are permitted to mount loop devices (via 'user' option in fstab), this allows access to arbitrary files.

CWE-190 - Integer overflow in libblkid parse_dos_extended(). A crafted MBR disk image can cause uint32_t wraparound in EBR chain processing, causing reported partitions to not match the on-disk layout. Tools like udisks may then register a partition at logical sector 0.

FEDORA-2026-729f84f3b6 Packages in this update:

• doctl-1.154.0-1.fc42

Update description:

update to 1.154.0

FEDORA-2026-6ad76ebb29 Packages in this update:

• doctl-1.154.0-1.fc43

Update description:

update to 1.154.0

FEDORA-2026-9a360acefb Packages in this update:

• doctl-1.154.0-1.fc44

Update description:

update to 1.154.0

FEDORA-2026-9e223ca14f Packages in this update:

• fido-device-onboard-0.5.5-8.fc44

Update description:

Automatic update for fido-device-onboard-0.5.5-8.fc44.

Changelog for fido-device-onboard * Wed Apr 01 2026 Peter Robinson <pbrobinson@fedoraproject.org> - 0.5.5-8 - Rebuild for CVE-2026-25727, CVE-2026-33056 * Sun Mar 15 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 0.5.5-7 - In Fedora, update nix dependency from 0.26 to 0.31

FEDORA-2026-e6237c2efe Packages in this update:

• fido-device-onboard-0.5.5-8.fc43

Update description:

Automatic update for fido-device-onboard-0.5.5-8.fc43.

Changelog for fido-device-onboard * Wed Apr 01 2026 Peter Robinson <pbrobinson@fedoraproject.org> - 0.5.5-8 - Rebuild for CVE-2026-25727, CVE-2026-33056 * Sun Mar 15 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 0.5.5-7 - In Fedora, update nix dependency from 0.26 to 0.31 * Mon Feb 02 2026 Maxwell G <maxwell@gtmx.me> - 0.5.5-6 - Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.5-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Fri Oct 10 2025 Maxwell G <maxwell@gtmx.me> - 0.5.5-4 - Rebuild for golang 1.25.2

FEDORA-2026-1bf9e14627 Packages in this update:

• libpng12-1.2.57-25.fc42

Update description:

fix CVE-2026-25646: heap buffer overflow in png_set_quantize

FEDORA-2026-0192882589 Packages in this update:

• libpng12-1.2.57-25.fc43

Update description:

fix CVE-2026-25646: heap buffer overflow in png_set_quantize

FEDORA-2026-3adf4e38cb Packages in this update:

• libpng12-1.2.57-25.fc44

Update description:

fix CVE-2026-25646: heap buffer overflow in png_set_quantize

FEDORA-2026-60fce94678 Packages in this update:

• libpng15-1.5.30-25.fc43

Update description:

fix CVE-2026-25646: heap buffer overflow in png_set_quantize

FEDORA-2026-4e514c1c36 Packages in this update:

• libpng15-1.5.30-25.fc42

Update description:

fix CVE-2026-25646: heap buffer overflow in png_set_quantize

FEDORA-2026-bcba077d11 Packages in this update:

• libpng15-1.5.30-25.fc44

Update description:

fix CVE-2026-25646: heap buffer overflow in png_set_quantize

FEDORA-2026-e1669a5881 Packages in this update:

• libpng12-1.2.57-25.fc45

Update description:

Automatic update for libpng12-1.2.57-25.fc45.

Changelog * Wed Apr 1 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.2.57-25 - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (rhbz#2438670)

FEDORA-2026-dfa60d30bc Packages in this update:

• libpng15-1.5.30-25.fc45

Update description:

Automatic update for libpng15-1.5.30-25.fc45.

Changelog * Wed Apr 1 2026 Michal Hlavinka <mhlavink@redhat.com> - 1.5.30-25 - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (rhbz#2438683)

FEDORA-2026-7fd284c688 Packages in this update:

• libcgif-0.5.3-1.fc44

Update description:

Version 0.5.3

• Fix potential undefined behavior in cgif_addframe which could have led to an integer overflow CVE-2026-4985

FEDORA-2026-1a9f019f60 Packages in this update:

• libcgif-0.5.3-1.fc43

Update description:

Version 0.5.3

• Fix potential undefined behavior in cgif_addframe which could have led to an integer overflow CVE-2026-4985

FEDORA-2026-7716e480cb Packages in this update:

• libcgif-0.5.3-1.fc42

Update description:

Version 0.5.3

• Fix potential undefined behavior in cgif_addframe which could have led to an integer overflow CVE-2026-4985

FEDORA-2026-8de97987a6 Packages in this update:

• libcap-2.77-3.fc44

Update description:

Version 0.5.3

• Fix potential undefined behavior in cgif_addframe which could have led to an integer overflow

FEDORA-2026-4440b00e25 Packages in this update:

• opensc-0.27.1-1.fc43

Update description:

New upstream release (#2442363) fixing various security issues:

FEDORA-2026-8c5856afbb Packages in this update:

• opensc-0.27.1-1.fc44

Update description:

New upstream release (#2442363) fixing various security issues.