Fedora Security Advisories

• exim-4.100.1-1.el8

This is new version of exim fixing CVE-2026-94054, CVE-2026-94055, CVE-2026-94056, CVE-2026-94057.

• exim-4.100.1-1.el9

This is new version of exim fixing CVE-2026-94054, CVE-2026-94055, CVE-2026-94056, CVE-2026-94057.

• exim-4.100.1-1.el10_4

This is new version of exim fixing CVE-2026-94054, CVE-2026-94055, CVE-2026-94056, CVE-2026-94057.

• exim-4.100.1-1.fc43

This is new version of exim fixing CVE-2026-94054, CVE-2026-94055, CVE-2026-94056, CVE-2026-94057.

• exim-4.100.1-1.fc44

This is new version of exim fixing CVE-2026-94054, CVE-2026-94055, CVE-2026-94056, CVE-2026-94057.

• exim-4.100.1-1.fc45

This is new version of exim fixing CVE-2026-94054, CVE-2026-94055, CVE-2026-94056, CVE-2026-94057.

• curl-8.18.0-12.fc44

• fix secure cookie attribute bypass with tab (CVE-2026-80255)
• fix OpenSSL provider use-after-free (CVE-2026-80229)

• Fix HTTP/2 server push UAF (CVE-2026-18924)

• curl-8.21.0-7.fc45

• fix secure cookie attribute bypass with tab (CVE-2026-80255)
• fix OpenSSL provider use-after-free (CVE-2026-80229)

• chromium-154.0.8037.97-1.el10_4

Update to 154.0.8037.97, includes 11 security fixes

• CVE-2026-103621: Integer overflow in Compositing
• CVE-2026-103622: Use after free in SVG
• CVE-2026-103623: Use after free in MediaStream
• CVE-2026-103624: Use after free in Contextual Tasks
• CVE-2026-103625: Type confusion in V8
• CVE-2026-103626: Incorrect authorization in FileSystem
• CVE-2026-103627: Information leak in SVG
• CVE-2026-103628: Out of bounds write in WebGL
• CVE-2026-103629: Integer overflow in Skia
• CVE-2026-103630: Use after free in FedCM
• CVE-2026-103631: Buffer overflow in WebRTC

• chromium-154.0.8037.97-1.el9

Update to 154.0.8037.97, includes 11 security fixes

• CVE-2026-103621: Integer overflow in Compositing
• CVE-2026-103622: Use after free in SVG
• CVE-2026-103623: Use after free in MediaStream
• CVE-2026-103624: Use after free in Contextual Tasks
• CVE-2026-103625: Type confusion in V8
• CVE-2026-103626: Incorrect authorization in FileSystem
• CVE-2026-103627: Information leak in SVG
• CVE-2026-103628: Out of bounds write in WebGL
• CVE-2026-103629: Integer overflow in Skia
• CVE-2026-103630: Use after free in FedCM
• CVE-2026-103631: Buffer overflow in WebRTC

• chromium-154.0.8037.97-1.el10_3

Update to 154.0.8037.97, includes 11 security fixes

• CVE-2026-103621: Integer overflow in Compositing
• CVE-2026-103622: Use after free in SVG
• CVE-2026-103623: Use after free in MediaStream
• CVE-2026-103624: Use after free in Contextual Tasks
• CVE-2026-103625: Type confusion in V8
• CVE-2026-103626: Incorrect authorization in FileSystem
• CVE-2026-103627: Information leak in SVG
• CVE-2026-103628: Out of bounds write in WebGL
• CVE-2026-103629: Integer overflow in Skia
• CVE-2026-103630: Use after free in FedCM
• CVE-2026-103631: Buffer overflow in WebRTC

• chromium-154.0.8037.97-1.el10_2

Update to 154.0.8037.97, includes 11 security fixes

• CVE-2026-103621: Integer overflow in Compositing
• CVE-2026-103622: Use after free in SVG
• CVE-2026-103623: Use after free in MediaStream
• CVE-2026-103624: Use after free in Contextual Tasks
• CVE-2026-103625: Type confusion in V8
• CVE-2026-103626: Incorrect authorization in FileSystem
• CVE-2026-103627: Information leak in SVG
• CVE-2026-103628: Out of bounds write in WebGL
• CVE-2026-103629: Integer overflow in Skia
• CVE-2026-103630: Use after free in FedCM
• CVE-2026-103631: Buffer overflow in WebRTC

• chromium-154.0.8037.97-1.fc43

Update to 154.0.8037.97, includes 11 security fixes

• CVE-2026-103621: Integer overflow in Compositing
• CVE-2026-103622: Use after free in SVG
• CVE-2026-103623: Use after free in MediaStream
• CVE-2026-103624: Use after free in Contextual Tasks
• CVE-2026-103625: Type confusion in V8
• CVE-2026-103626: Incorrect authorization in FileSystem
• CVE-2026-103627: Information leak in SVG
• CVE-2026-103628: Out of bounds write in WebGL
• CVE-2026-103629: Integer overflow in Skia
• CVE-2026-103630: Use after free in FedCM
• CVE-2026-103631: Buffer overflow in WebRTC

• chromium-154.0.8037.97-1.fc45

Update to 154.0.8037.97, includes 11 security fixes

• CVE-2026-103621: Integer overflow in Compositing
• CVE-2026-103622: Use after free in SVG
• CVE-2026-103623: Use after free in MediaStream
• CVE-2026-103624: Use after free in Contextual Tasks
• CVE-2026-103625: Type confusion in V8
• CVE-2026-103626: Incorrect authorization in FileSystem
• CVE-2026-103627: Information leak in SVG
• CVE-2026-103628: Out of bounds write in WebGL
• CVE-2026-103629: Integer overflow in Skia
• CVE-2026-103630: Use after free in FedCM
• CVE-2026-103631: Buffer overflow in WebRTC

• chromium-154.0.8037.97-1.fc44

Update to 154.0.8037.97, includes 11 security fixes

• CVE-2026-103621: Integer overflow in Compositing
• CVE-2026-103622: Use after free in SVG
• CVE-2026-103623: Use after free in MediaStream
• CVE-2026-103624: Use after free in Contextual Tasks
• CVE-2026-103625: Type confusion in V8
• CVE-2026-103626: Incorrect authorization in FileSystem
• CVE-2026-103627: Information leak in SVG
• CVE-2026-103628: Out of bounds write in WebGL
• CVE-2026-103629: Integer overflow in Skia
• CVE-2026-103630: Use after free in FedCM
• CVE-2026-103631: Buffer overflow in WebRTC

• flocq-4.2.2-3.fc44
• gappalib-coq-1.11.0-1.fc44
• rocq-9.3.0-1.fc44
• rocq-stdlib-9.2.0-1.fc44
• why3-1.8.2-11.fc44
• zenon-0.8.5-41.fc44

See https://rocq-prover.org/doc/v9.3/refman/changes.html#version-9-3 for changes in rocq 9.3.0.

See https://rocq-prover.org/doc/v9.2/refman-stdlib/changes.html for changes in rocq-stdlib 9.2.0.

See https://gitlab.inria.fr/gappa/coq/-/blob/master/NEWS.md for changes in gappalib-coq 1.11.0.

The other builds are rebuilds due to the above changes.

• python-jupytext-1.19.6-1.fc43

See https://github.com/jupytext/jupytext/blob/main/CHANGELOG.md for changes in versions 1.19.5 and 1.19.6. For this update, a patch has been applied that reverses the jupyterlab → jupyter-builder change for Fedora releases ≤ 45, since jupyter-builder is only available in F46 and later. Many CVEs have been fixed in this release.

• aegisub-3.5.0-1.fc43

Update to Aegisub 3.5.0, fixing CVE-2026-92705: arbitrary code execution when opening crafted ASS subtitle files containing associated Automation script references. The fix requires confirmation before loading associated scripts, makes extension validation consistent with filesystem path interpretation, and sanitizes embedded NUL characters in project metadata. Upstream advisory: https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23

• aegisub-3.5.0-2.fc44

Update to Aegisub 3.5.0, fixing CVE-2026-92705: arbitrary code execution when opening crafted ASS subtitle files containing associated Automation script references. The fix requires confirmation before loading associated scripts, makes extension validation consistent with filesystem path interpretation, and sanitizes embedded NUL characters in project metadata. Upstream advisory: https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23

• aegisub-3.5.0-1.fc45

Update to Aegisub 3.5.0, fixing CVE-2026-92705: arbitrary code execution when opening crafted ASS subtitle files containing associated Automation script references. The fix requires confirmation before loading associated scripts, makes extension validation consistent with filesystem path interpretation, and sanitizes embedded NUL characters in project metadata. Upstream advisory: https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23