Fedora Security Advisories

FEDORA-EPEL-2025-5b153890b5 Packages in this update:

• yarnpkg-1.22.22-11.el9

Update description:

Apply fixes for CVE-2025-8262 and CVE-2025-7783.

FEDORA-2025-30f3152e31 Packages in this update:

• mingw-opencv-4.10.0-6.fc42

Update description:

Backport fix for CVE-2025-53644.

FEDORA-2025-d308a84c10 Packages in this update:

• mingw-opencv-4.10.0-6.fc41

Update description:

Backport fix for CVE-2025-53644.

FEDORA-2025-113fc513c3 Packages in this update:

• moby-engine-28.3.3-1.fc41

Update description:

Update to release v28.3.3

FEDORA-2025-9e2840094a Packages in this update:

• moby-engine-28.3.3-1.fc42

Update description:

Update to release v28.3.3

FEDORA-2025-1f41505af2 Packages in this update:

• libsoup3-3.6.5-2.fc41

Update description:

This update fixes these CVEs: CVE-2025-4948 CVE-2025-32908 CVE-2025-32907 CVE-2025-4969 CVE-2025-4945 CVE-2025-4476

FEDORA-2025-99768b0fab Packages in this update:

• libsoup3-3.6.5-2.fc42

Update description:

This update fixes these CVEs: CVE-2025-4948 CVE-2025-32908 CVE-2025-32907 CVE-2025-4969 CVE-2025-4945 CVE-2025-4476

FEDORA-2025-525d870026 Packages in this update:

• varnish-7.6.1-6.fc42

Update description:

Security: This update includes fixes for CVE-2025-47905 aka VSV00016: A client-side desync vulnerability can be triggered in Varnish Cache. This vulnerability can be triggered under specific circumstances involving malformed HTTP/1 chunked requests.

FEDORA-2025-7d08872494 Packages in this update:

• libtiff-4.7.0-6.fc42

Update description:

• fix CVE-2025-8176: use after free in tiffmedian (rhbz#2383821)
• fix CVE-2025-8177: buffer oveflow in thumbnail setrow when processing malformed TIFF (rhbz#2383827)

FEDORA-2025-be254abbfe Packages in this update:

• libtiff-4.7.0-5.fc43

Update description:

Automatic update for libtiff-4.7.0-5.fc43.

Changelog * Tue Jul 29 2025 Michal Hlavinka <mhlavink@redhat.com> - 4.7.0-5 - fix CVE-2025-8177: buffer oveflow in thumbnail setrow when processing malformed TIFF (rhbz#2383827)

FEDORA-2025-2ea6a30958 Packages in this update:

• python3.13-3.13.5-4.fc41

Update description:

This update contains fix for https://www.cve.org/CVERecord?id=CVE-2025-8194

FEDORA-2025-11bba426af Packages in this update:

• python3.13-3.13.5-4.fc42

Update description:

This update contains fix for https://www.cve.org/CVERecord?id=CVE-2025-8194

FEDORA-EPEL-2025-4545fe5ab5 Packages in this update:

• python3.13-3.13.5-4.el10_1

Update description:

This update contains fix for https://www.cve.org/CVERecord?id=CVE-2025-8194

FEDORA-EPEL-2025-c0a44d2c63 Packages in this update:

• python3.13-3.13.5-4.el9

Update description:

This update contains fix for https://www.cve.org/CVERecord?id=CVE-2025-8194

FEDORA-2025-c5b7a12d2d Packages in this update:

• binutils-2.44-6.fc42

Update description:

Backports patch to fix non-CVE 2025-8224

FEDORA-EPEL-2025-3ad6d2fe5c Packages in this update:

• rclone-1.70.3-1.el9

Update description:

Update to 1.70.3 and adopt go-vendor-tools

FEDORA-EPEL-2025-d79f9b7270 Packages in this update:

• perl-Crypt-CBC-2.33-26.el8

Update description:

This update includes a backported fix for CVE-2025-2814 from upstream version 3.07, in which Crypt::URandom is used to read random bytes rather than falling back to Perl's insecure rand() function if using /dev/urandom directly wasn't possible.-

FEDORA-EPEL-2025-e0c2088c0b Packages in this update:

• perl-Crypt-CBC-3.07-1.el9

Update description:

This update, to the current upstream release version, includes a fix to source random numbers using the Crypt::URandom module rather than trying to read /dev/urandom and falling back to Perl's insecure rand() function if /dev/urandom is not usable (CVE-2025-2814).

FEDORA-2025-1d22f55c40 Packages in this update:

• perl-Crypt-CBC-3.07-1.fc41

Update description:

This update, to the current upstream release version, includes a fix to source random numbers using the Crypt::URandom module rather than trying to read /dev/urandom and falling back to Perl's insecure rand() function if /dev/urandom is not usable (CVE-2025-2814).

FEDORA-2025-f7bc7b789f Packages in this update:

• perl-Crypt-CBC-3.07-1.fc42

Update description:

This update, to the current upstream release version, includes a fix to source random numbers using the Crypt::URandom module rather than trying to read /dev/urandom and falling back to Perl's insecure rand() function if /dev/urandom is not usable (CVE-2025-2814).