Fedora Security Advisories

FEDORA-2026-743387fdbe Packages in this update:

• libxmp-4.7.3-1.fc45

Update description:

Latest bugfix release. Full changelog: https://sourceforge.net/p/xmp/libxmp/ci/libxmp-4.7.3/tree/docs/Changelog .

Fixes a medium-rated security issue: https://github.com/libxmp/libxmp/issues/1029 .

FEDORA-2026-5db1745c4f Packages in this update:

• strongswan-6.1.0-1.fc45

Update description:

• Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135

FEDORA-2026-a387125860 Packages in this update:

• thunderbird-156.0-2.fc43

Update description:

Update to latest upstream version.

Update to latest stable upstream version.

FEDORA-2026-f5733c1dd0 Packages in this update:

• rootlesskit-3.2.0-1.fc43

Update description:

• Update to release v3.2.0
• Resolves: rhbz#2530874
• Resolves CVE-2026-56855: rhbz#2530631
• Resolves CVE-2026-78662: rhbz#2530678
• Upstream enhancements and fixes

FEDORA-2026-019108693f Packages in this update:

• sngrep-1.8.4-4.fc45

Update description:

Fixed CVE-2026-90558

FEDORA-2026-e5174fc4cf Packages in this update:

• sngrep-1.8.4-4.fc43

Update description:

Fixed CVE-2026-90558

FEDORA-2026-3ff086aa2a Packages in this update:

• sngrep-1.8.4-4.fc44

Update description:

Fixed CVE-2026-90558

FEDORA-2026-9b73fdb8e6 Packages in this update:

• flatpak-builder-1.4.12-1.fc44

Update description:

Update to 1.4.12

FEDORA-2026-8e3688d489 Packages in this update:

• perl-Imager-1.036-1.fc45

Update description:

1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)

FEDORA-2026-12f0a70554 Packages in this update:

• perl-Imager-1.036-1.fc44

Update description:

1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)

FEDORA-2026-625ab5c382 Packages in this update:

• perl-Imager-1.036-1.fc43

Update description:

1.036 bump - Fix CVE-2026-93019 (TGA large color map size interpreted as negative) - Fix CVE-2026-93018 (paletted images: out-of-range color index returned uninitialized palette data)

FEDORA-2026-fc27f09459 Packages in this update:

• tesseract-5.5.3-2.fc44

Update description:

Backport fixes for CVE-2026-{88047-88054}

FEDORA-2026-4585aba520 Packages in this update:

• tesseract-5.5.3-2.fc43

Update description:

Backport fixes for CVE-2026-{88047-88054}

FEDORA-2026-e3bf7f4ecb Packages in this update:

• tesseract-5.5.3-2.fc45

Update description:

Backport fixes for CVE-2026-{88047-88054}

FEDORA-2026-3e60aed77e Packages in this update:

• rootlesskit-3.2.0-1.fc44

Update description:

• Update to release v3.2.0
• Resolves: rhbz#2530874
• Resolves CVE-2026-56855: rhbz#2530631
• Resolves CVE-2026-78662: rhbz#2530678
• Upstream enhancements and fixes

FEDORA-2026-6b8872b8ac Packages in this update:

• rootlesskit-3.2.0-1.fc45

Update description:

• Update to release v3.2.0
• Resolves: rhbz#2530874
• Resolves CVE-2026-56855: rhbz#2530631
• Resolves CVE-2026-78662: rhbz#2530678
• Upstream enhancements and fixes

FEDORA-2026-ec725c24c1 Packages in this update:

• rootlesskit-3.2.0-1.fc46

Update description:

Automatic update for rootlesskit-3.2.0-1.fc46.

Changelog * Sun Sep 20 2026 Bradley G Smith <bradley.g.smith@gmail.com> - 3.2.0-1 - Update to release v3.2.0 - Resolves: rhbz#2530874 - Resolves CVE-2026-56855: rhbz#2530631 - Resolves CVE-2026-78662: rhbz#2530678 - Upstream enhancements and fixes

FEDORA-2026-66894499b7 Packages in this update:

• freeipmi-1.6.19-1.fc43

Update description:

Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode

FEDORA-2026-3b893ccf2d Packages in this update:

• perl-Dancer2-2.2.1-1.fc44

Update description:

Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.

deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.

FEDORA-2026-5e3eab9a07 Packages in this update:

• perl-Dancer2-2.2.1-1.fc45

Update description:

Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary blessed object — the entry point for DESTROY/AUTOLOAD/overload gadget chains — and !!perl/code could ask for a string eval.

deserialize now sets $YAML::LoadBlessed = 0 and $YAML::LoadCode = 0 itself (localised) before loading, rather than relying on YAML.pm's ambient defaults, and the minimum YAML is raised to 1.30.