Fedora Security Advisories

• udns-0.7-1.fc45

Update to 0.7

• udns-0.7-1.el10_3

Update to 0.7

• udns-0.7-1.el10_4

Update to 0.7

• python-robotframework-7.5.1-1.fc45

Upgrade to 7.5.1 (rhbz#2548546 and rhbz#2548558)

• php-getid3-1.9.28-1.fc43

• GHSA-4pp3-6hmx-mfmg memory exhaustion in Quicktime
• DTS typo
• keep composer.json in dist archives
• copy replaygain_album_peak
• TIPL/TMCL/IPL/IPLS ID3v2 consistency

• php-getid3-1.9.28-1.fc44

• GHSA-4pp3-6hmx-mfmg memory exhaustion in Quicktime
• DTS typo
• keep composer.json in dist archives
• copy replaygain_album_peak
• TIPL/TMCL/IPL/IPLS ID3v2 consistency

• php-getid3-1.9.28-1.fc45

• GHSA-4pp3-6hmx-mfmg memory exhaustion in Quicktime
• DTS typo
• keep composer.json in dist archives
• copy replaygain_album_peak
• TIPL/TMCL/IPL/IPLS ID3v2 consistency

• udns-0.7-1.el9

Update to 0.7

• curl-8.21.0-9.fc45

• multi: adjust the cleanup order in multi_done (CVE-2026-92392)

• luksmeta-11-1.fc45

New upstream release v11

• luksmeta-11-1.fc44

New upstream release v11

• pipx-1.18.12-1.fc45

Update to 1.18.12 upstream release, fixing GHSA-jpqf-qh96-2pqf.

• fuse-sshfs-3.7.6-1.el10_2

Security update: update SSHFS to 3.7.6.

• CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
• CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

• fuse-sshfs-3.7.6-1.el10_3

Security update: update SSHFS to 3.7.6.

• CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
• CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

• fuse-sshfs-3.7.6-1.el10_4

Security update: update SSHFS to 3.7.6.

• CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
• CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

• fuse-sshfs-3.7.6-1.el9

Security update: update SSHFS to 3.7.6.

• CVE-2026-47187: a rogue SFTP server could return absolute symlink targets or targets containing "..", which the local kernel then resolved against the client's filesystem, so ordinary operations (cp, rsync, editors, backup tools) could disclose or overwrite local files. The new contain_symlinks option, enabled by default, rejects such targets with EPERM; use -o no_contain_symlinks for trusted servers that rely on them.
• CVE-2026-48711: a bracketed mount source such as [-oProxyCommand=CMD]:/path could inject options into the ssh command line and run arbitrary commands. Host names starting with "-" are now rejected and "--" is passed before the host name.

Other changes since 3.7.3 include IPv6 support for direct_port connections, fixes for malformed SFTP replies, a statfs divide-by-zero and a cache memory leak. Note that the -v/--verbose command-line flag was removed; use -o sshfs_verbose instead.

• rubygem-nokogiri-1.19.7-1.fc45

New versioin 1.19.7 is released. This version fixes several security isses.

• rubygem-nokogiri-1.19.7-1.fc44

New versioin 1.19.7 is released. This version fixes several security isses.

• rubygem-nokogiri-1.19.7-1.fc43

New versioin 1.19.7 is released. This version fixes several security isses.

• vyper-0.4.3-9.fc43

Security update: backport fixes for Vyper compiler issues that can silently miscompile contracts.

• CVE-2026-114114, CVE-2026-114116 (GHSA-wvx7-39qj-2g9v): multi-byte characters (e.g. non-ASCII identifiers), line-separator characters such as form feed or U+2028, or a leading byte-order mark could shift the compiler's source lookups, so numeric and address literals compiled to values other than the ones written. Source spans are now computed the way the Python parser reports them.
• CVE-2026-114118: create_from_blueprint accepted a code_offset that wraps around 2**256 and deployed a contract with empty code instead of reverting. The offset is now checked against the blueprint size before subtracting.
• CVE-2026-114115 (GHSA-cw3h-xwxq-8cx2): a ternary choosing between nested arrays with different inner bounds could read the narrower array with the wider layout and produce corrupted values.

Contracts compiled with earlier builds may need to be recompiled and redeployed if they are affected.