Fedora Security Advisories

fasterxml-oss-parent-69-1.fc44 jackson-annotations-2.18.12-1.fc44 jackson-bom-2.18.12-1.fc44 jackson-core-2.18.12-1.fc44 jackson-databind-2.18.12-1.fc44 jackson-jaxrs-providers-2.18.12-1.fc44 jackson-modules-base-2.18.12-1.fc44 jackson-parent-2.18.4-1…

Fedora Security Advisories
2 days 3 hours ago
FEDORA-2026-b7ad391dd5 Packages in this update:
  • fasterxml-oss-parent-69-1.fc44
  • jackson-annotations-2.18.12-1.fc44
  • jackson-bom-2.18.12-1.fc44
  • jackson-core-2.18.12-1.fc44
  • jackson-databind-2.18.12-1.fc44
  • jackson-jaxrs-providers-2.18.12-1.fc44
  • jackson-modules-base-2.18.12-1.fc44
  • jackson-parent-2.18.4-1.fc44
Update description:

Fix CVE-2026-89407 CVE-2026-89425 CVE-2026-68497 CVE-2026-68498 CVE-2026-83557 CVE-2026-19032 CVE-2026-91777 across aligned packages updated to version 2.18.12

python-pillow-12.3.0-7.fc44

Fedora Security Advisories
2 days 9 hours ago
FEDORA-2026-719fffc96a Packages in this update:
  • python-pillow-12.3.0-7.fc44
Update description:

Backport fix for CVE-2026-112900.

Backport fix for CVE-2026-112398

Backport fix for CVE-2026-112393.

python-pillow-12.3.0-7.fc45

Fedora Security Advisories
2 days 9 hours ago
FEDORA-2026-be73b9861d Packages in this update:
  • python-pillow-12.3.0-7.fc45
Update description:

Backport fix for CVE-2026-112900.

Backport fix for CVE-2026-112398

Backport fix for CVE-2026-112393.

Backport fix for CVE-2026-112892.

tpm2-tss-4.1.5-1.fc44

Fedora Security Advisories
2 days 9 hours ago
FEDORA-2026-efb1f85550 Packages in this update:
  • tpm2-tss-4.1.5-1.fc44
Update description:

Security

GHSA-h664-qxhh-gx3w CVE-2026-109545 GHSA-2q8j-chww-3pcq CVE-ID requested GHSA-5mqr-9575-x89w CVE-ID requested GHSA-rjg6-phr3-3rxw CVE-ID requested GHSA-g73j-fj87-wmqq CVE-ID requested GHSA-v965-wr7f-xw6w CVE-ID requested GHSA-5p93-qmch-h65j CVE-ID requested GHSA-x33j-3x4g-f32j CVE-ID requested GHSA-xvmm-58jj-c6gf CVE-ID requested

Fixes

MAINTAINERS: add Moritz TCTI: validate the response header length TCTI: add missing size checks for response buffers FAPI: fix quoting of empty event logs FAPI: check the number of branches for policy lists FAPI: validate key size before extracting the public key FAPI: add a missing bounds check on PCR_Select deserialization FAPI: check buffer size in RSASSA and RSAPSS signature conversion FAPI: reject eventlog entries with an empty template value FAPI: bound eventlog entry name reads by the template size FAPI: verify the eventlog digest window fits the template buffer FAPI: fix file leak on read error FAPI: fix tests failing with physical TPMs FAPI: fix buffer overflow in ifapi_set_auth_primary ESYS: fix compilation without SM4 support ESYS: fix OpenSSL 3.X engine context handling for internal crypto SYS: harden the response size checks SYS: validate the length of no-session responses SYS: validate the length of encrypted parameter responses SYS: validate the length of response authorization parameters SYS: use response size instead of buffer size during unmarshalling MU: bound subtype unmarshalling to the TPM2B size field IO: retry poll calls on EINTR and EAGAIN

tpm2-tss-4.1.5-1.fc43

Fedora Security Advisories
2 days 9 hours ago
FEDORA-2026-3941b8db92 Packages in this update:
  • tpm2-tss-4.1.5-1.fc43
Update description:

Security

GHSA-h664-qxhh-gx3w CVE-2026-109545 GHSA-2q8j-chww-3pcq CVE-ID requested GHSA-5mqr-9575-x89w CVE-ID requested GHSA-rjg6-phr3-3rxw CVE-ID requested GHSA-g73j-fj87-wmqq CVE-ID requested GHSA-v965-wr7f-xw6w CVE-ID requested GHSA-5p93-qmch-h65j CVE-ID requested GHSA-x33j-3x4g-f32j CVE-ID requested GHSA-xvmm-58jj-c6gf CVE-ID requested

Fixes

MAINTAINERS: add Moritz TCTI: validate the response header length TCTI: add missing size checks for response buffers FAPI: fix quoting of empty event logs FAPI: check the number of branches for policy lists FAPI: validate key size before extracting the public key FAPI: add a missing bounds check on PCR_Select deserialization FAPI: check buffer size in RSASSA and RSAPSS signature conversion FAPI: reject eventlog entries with an empty template value FAPI: bound eventlog entry name reads by the template size FAPI: verify the eventlog digest window fits the template buffer FAPI: fix file leak on read error FAPI: fix tests failing with physical TPMs FAPI: fix buffer overflow in ifapi_set_auth_primary ESYS: fix compilation without SM4 support ESYS: fix OpenSSL 3.X engine context handling for internal crypto SYS: harden the response size checks SYS: validate the length of no-session responses SYS: validate the length of encrypted parameter responses SYS: validate the length of response authorization parameters SYS: use response size instead of buffer size during unmarshalling MU: bound subtype unmarshalling to the TPM2B size field IO: retry poll calls on EINTR and EAGAIN

tpm2-tss-4.2.1-1.fc45

Fedora Security Advisories
2 days 9 hours ago
FEDORA-2026-14beb0815b Packages in this update:
  • tpm2-tss-4.2.1-1.fc45
Update description:

Security

GHSA-h664-qxhh-gx3w CVE-2026-109545 GHSA-2q8j-chww-3pcq CVE-ID requested GHSA-5mqr-9575-x89w CVE-ID requested GHSA-rjg6-phr3-3rxw CVE-ID requested GHSA-g73j-fj87-wmqq CVE-ID requested GHSA-v965-wr7f-xw6w CVE-ID requested GHSA-5p93-qmch-h65j CVE-ID requested GHSA-x33j-3x4g-f32j CVE-ID requested GHSA-xvmm-58jj-c6gf CVE-ID requested

Fixed

MAINTAINERS: add Moritz TEST: use SHA-256 in EVP signing integration test TCTI: validate the response header length TCTI: add missing size checks for response buffers FAPI: fix quoting of empty event logs FAPI: check the number of branches for policy lists FAPI: validate key size before extracting the public key FAPI: add a missing bounds check on PCR_Select deserialization FAPI: check buffer size in RSASSA and RSAPSS signature conversion FAPI: reject eventlog entries with an empty template value FAPI: bound eventlog entry name reads by the template size FAPI: verify the eventlog digest window fits the template buffer FAPI: fix file leak on read error FAPI: fix tests failing with physical TPMs ESYS: fix compilation without SM4 support ESYS: fix OpenSSL 3.X engine context handling for internal crypto FAPI: fix buffer overflow in ifapi_set_auth_primary SYS: harden the response size checks SYS: validate the length of no-session responses SYS: validate the length of encrypted parameter responses SYS: validate the length of response authorization parameters SYS: use response size instead of buffer size during unmarshalling MU: bound subtype unmarshalling to the TPM2B size field IO: retry poll calls on EINTR and EAGAIN

dhcpcd-10.5.2-2.fc43

Fedora Security Advisories
2 days 10 hours ago
FEDORA-2026-1201e2555d Packages in this update:
  • dhcpcd-10.5.2-2.fc43
Update description:
  • Fix daemonising broken by RLIMIT_NOFILE of 0 on Linux (rhbz#2547780)
  • Update to 10.5.2 (rhbz#2511521)

The upstream release contains fixes for the following CVE BZ reports:

  • Bug 2492035 - CVE-2026-56113 dhcpcd: dhcpcd: Denial of Service via crafted DHCPv6 RENEW reply
  • Bug 2492033 - CVE-2026-56114 dhcpcd: dhcpcd: Denial of Service due to stack out-of-bounds write via crafted DHCPv6 message
  • Bug 2492038 - CVE-2026-56115 dhcpcd: dhcpcd: Denial of Service via crafted DHCPv6 ADVERTISE message
  • Bug 2492036 - CVE-2026-56116 dhcpcd: dhcpcd: Denial of Service via IPv6 Router Advertisement memory leak
  • Bug 2492027 - CVE-2026-56117 dhcpcd: dhcpcd: Local heap use-after-free vulnerability leads to denial of service

chromium-156.0.8078.73-1.el10_4

Fedora Security Advisories
2 days 10 hours ago
FEDORA-EPEL-2026-523ec537c6 Packages in this update:
  • chromium-156.0.8078.73-1.el10_4
Update description:

Update to 156.0.8078.73, include 52 security fixes

  • CVE-2026-118304: Improper input validation in SVG
  • CVE-2026-118305: Memory corruption in Turbolev
  • CVE-2026-118306: Memory corruption in FileSystem
  • CVE-2026-118307: Use after free in Paint
  • CVE-2026-118308: Use after free in SVG
  • CVE-2026-118309: Improper input validation in UI
  • CVE-2026-118310: Improper input validation in Views
  • CVE-2026-118311: Memory corruption in Media
  • CVE-2026-118312: Memory corruption in Paint
  • CVE-2026-118313: Use after free in Video
  • CVE-2026-118314: Improper input validation in UI
  • CVE-2026-118315: Improper input validation in SVG
  • CVE-2026-118316: Improper input validation in V8
  • CVE-2026-118317: Memory corruption in HTML
  • CVE-2026-118318: Improper access control in V8
  • CVE-2026-118319: Memory corruption in Skia
  • CVE-2026-118320: Memory corruption in V8
  • CVE-2026-118321: Improper input validation in Core
  • CVE-2026-118322: Memory corruption in ANGLE
  • CVE-2026-118327: Memory corruption in Media
  • CVE-2026-118328: Improper input validation in WebRTC
  • CVE-2026-118329: Improper input validation in ANGLE
  • CVE-2026-118330: Use after free in Browser
  • CVE-2026-118331: Improper input validation in FileAPI
  • CVE-2026-118332: Improper input validation in Compositing
  • CVE-2026-118333: Missing authorization in Video
  • CVE-2026-118334: Use after free in ImageCapture
  • CVE-2026-118335: Improper input validation in Metrics
  • CVE-2026-118336: Improper input validation in Headless
  • CVE-2026-118337: Improper access control in Forms
  • CVE-2026-118338: Use after free in Animation
  • CVE-2026-118339: Use after free in Animation
  • CVE-2026-118340: Memory corruption in Skia
  • CVE-2026-118341: Use after free in Modularization
  • CVE-2026-118342: Out of bounds write in Editing
  • CVE-2026-118343: Improper input validation in ReadingList
  • CVE-2026-118344: Use after free in Layout
  • CVE-2026-118345: Use after free in PDFium
  • CVE-2026-118346: Use after free in Compositing
  • CVE-2026-118347: Use after free in FileSystem
  • CVE-2026-118348: Improper input validation in Skia
  • CVE-2026-118349: Memory corruption in Payments
  • CVE-2026-118350: Use after free in Turbolev
  • CVE-2026-118351: Memory corruption in Skia
  • CVE-2026-118352: Memory corruption in Cache
  • CVE-2026-118353: Use after free in Paint
  • CVE-2026-118354: Improper input validation in Skia
  • CVE-2026-118355: Improper input validation in Command
  • CVE-2026-118356: Use after free in WTF
  • CVE-2026-118357: Use after free in FileSystem
  • CVE-2026-118358: Memory corruption in WebAudio
  • CVE-2026-118359: Memory corruption in V8

chromium-156.0.8078.73-1.fc44

Fedora Security Advisories
2 days 10 hours ago
FEDORA-2026-9418af6472 Packages in this update:
  • chromium-156.0.8078.73-1.fc44
Update description:

Update to 156.0.8078.73, include 52 security fixes

  • CVE-2026-118304: Improper input validation in SVG
  • CVE-2026-118305: Memory corruption in Turbolev
  • CVE-2026-118306: Memory corruption in FileSystem
  • CVE-2026-118307: Use after free in Paint
  • CVE-2026-118308: Use after free in SVG
  • CVE-2026-118309: Improper input validation in UI
  • CVE-2026-118310: Improper input validation in Views
  • CVE-2026-118311: Memory corruption in Media
  • CVE-2026-118312: Memory corruption in Paint
  • CVE-2026-118313: Use after free in Video
  • CVE-2026-118314: Improper input validation in UI
  • CVE-2026-118315: Improper input validation in SVG
  • CVE-2026-118316: Improper input validation in V8
  • CVE-2026-118317: Memory corruption in HTML
  • CVE-2026-118318: Improper access control in V8
  • CVE-2026-118319: Memory corruption in Skia
  • CVE-2026-118320: Memory corruption in V8
  • CVE-2026-118321: Improper input validation in Core
  • CVE-2026-118322: Memory corruption in ANGLE
  • CVE-2026-118327: Memory corruption in Media
  • CVE-2026-118328: Improper input validation in WebRTC
  • CVE-2026-118329: Improper input validation in ANGLE
  • CVE-2026-118330: Use after free in Browser
  • CVE-2026-118331: Improper input validation in FileAPI
  • CVE-2026-118332: Improper input validation in Compositing
  • CVE-2026-118333: Missing authorization in Video
  • CVE-2026-118334: Use after free in ImageCapture
  • CVE-2026-118335: Improper input validation in Metrics
  • CVE-2026-118336: Improper input validation in Headless
  • CVE-2026-118337: Improper access control in Forms
  • CVE-2026-118338: Use after free in Animation
  • CVE-2026-118339: Use after free in Animation
  • CVE-2026-118340: Memory corruption in Skia
  • CVE-2026-118341: Use after free in Modularization
  • CVE-2026-118342: Out of bounds write in Editing
  • CVE-2026-118343: Improper input validation in ReadingList
  • CVE-2026-118344: Use after free in Layout
  • CVE-2026-118345: Use after free in PDFium
  • CVE-2026-118346: Use after free in Compositing
  • CVE-2026-118347: Use after free in FileSystem
  • CVE-2026-118348: Improper input validation in Skia
  • CVE-2026-118349: Memory corruption in Payments
  • CVE-2026-118350: Use after free in Turbolev
  • CVE-2026-118351: Memory corruption in Skia
  • CVE-2026-118352: Memory corruption in Cache
  • CVE-2026-118353: Use after free in Paint
  • CVE-2026-118354: Improper input validation in Skia
  • CVE-2026-118355: Improper input validation in Command
  • CVE-2026-118356: Use after free in WTF
  • CVE-2026-118357: Use after free in FileSystem
  • CVE-2026-118358: Memory corruption in WebAudio
  • CVE-2026-118359: Memory corruption in V8
Checked
13 minutes 4 seconds ago
URL
https://bodhi.fedoraproject.org/rss/updates/?type=security