Aggregator

It was discovered that cgit incorrectly handled repository paths when HTTP cloning was enabled. A remote attacker could possibly use this issue to access files outside the repository and obtain sensitive information.

It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information.

It was discovered that libvips incorrectly handled specially crafted TIFF images when saving them as HEIF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service.

It was discovered that Freeciv incorrectly handled certain network packets, resulting in a stack overflow. A remote attacker could possibly use this issue to cause Freeciv clients or servers to crash, resulting in a denial of service.

It was discovered that libinput did not properly escape device properties. A local attacker could possibly use this issue to inject arbitrary udev properties and execute arbitrary code as root.

FEDORA-2026-febfd10293 Packages in this update:

• freeipmi-1.6.19-1.fc44

Update description:

Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode

FEDORA-2026-bc7408de42 Packages in this update:

• postgresql16-anonymizer-3.2.2-1.fc45

Update description:

Upstream changelog: https://gitlab.com/dalibo/postgresql_anonymizer/-/releases

• [core] CVE-2026-19633: Escalation via custom types, operators and rangevars
• [core] update dependencies
• [static] Define masking policy with parallel static masking
• [pseudo] Add seeded_street_name
• [static] CVE-2026-83534: Elevation in parallel masking
• [make] call extension+install before regress
• [pseudo] new panel of seeded_* functions
• [impexp] CVE-2026-19634: SQL injection via import functions
• [partial] Add anon.array_remove_regex()
• [static] Ignore a TABLESAMPLE sampling ratio on non-plain-table relations
• [parallel] Reject a materialized view before parallel masking
• [dynamic] Proper error message on write operations
• [static] Optionally drop indexes during static masking (beta)
• [doc] update the permission matrix
• [tests] Gate the impexp unit tests on cfg(test) only
• [doc] split Load and Support out of the Install page
• [docker] make the image ready for replica masking
• [tests] Introduce cargo pgrx regress
• [core] Upgrade dependencies
• [core] Remove useless compatibility function
• [image] Define a default value for the sigma parameter
• [doc] Add the "Anonymized Replica" tutorial
• [docker] disable fsync during initdb
• [static] Improve performance and correctness for parallel masking
• [doc] how to fix cargo audit warnings
• [doc] Install on Fedora
• [core] Support PostgreSQL 19 (beta)
• [core] Upgrade to PGRX 0.19

FEDORA-2026-58a319c686 Packages in this update:

• postgresql16-anonymizer-3.2.2-1.fc44

Update description:

Upstream changelog: https://gitlab.com/dalibo/postgresql_anonymizer/-/releases

• [core] CVE-2026-19633: Escalation via custom types, operators and rangevars
• [core] update dependencies
• [static] Define masking policy with parallel static masking
• [pseudo] Add seeded_street_name
• [static] CVE-2026-83534: Elevation in parallel masking
• [make] call extension+install before regress
• [pseudo] new panel of seeded_* functions
• [impexp] CVE-2026-19634: SQL injection via import functions
• [partial] Add anon.array_remove_regex()
• [static] Ignore a TABLESAMPLE sampling ratio on non-plain-table relations
• [parallel] Reject a materialized view before parallel masking
• [dynamic] Proper error message on write operations
• [static] Optionally drop indexes during static masking (beta)
• [doc] update the permission matrix
• [tests] Gate the impexp unit tests on cfg(test) only
• [doc] split Load and Support out of the Install page
• [docker] make the image ready for replica masking
• [tests] Introduce cargo pgrx regress
• [core] Upgrade dependencies
• [core] Remove useless compatibility function
• [image] Define a default value for the sigma parameter
• [doc] Add the "Anonymized Replica" tutorial
• [docker] disable fsync during initdb
• [static] Improve performance and correctness for parallel masking
• [doc] how to fix cargo audit warnings
• [doc] Install on Fedora
• [core] Support PostgreSQL 19 (beta)
• [core] Upgrade to PGRX 0.19

It was discovered that Konsole incorrectly handled certain URLs under specific circumstances. A remote attacker could possibly use this issue to execute arbitrary code.

Version:7.2.6 (stable) Released:2026-09-14 Source:linux-7.2.6.tar.xz PGP Signature:linux-7.2.6.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.2.6

Version:6.18.52 (longterm) Released:2026-09-14 Source:linux-6.18.52.tar.xz PGP Signature:linux-6.18.52.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.52

USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was backed out in USN-8563-2 because it could cause a regression. This update includes a better fix for CVE-2026-42533. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533) It was discovered that nginx had a use-after-free vulnerability in the ngx_http_ssi_module module when configured with Server-Side Includes, proxy_pass, and proxy buffering disabled directives. An attacker able to intercept traffic and control responses from an upstream server could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-56434) It was discovered that nginx incorrectly handled certain requests in the ngx_http_slice_module module. A remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash, resulting in a denial of service. (CVE-2026-60005)

Version:6.12.110 (longterm) Released:2026-09-14 Source:linux-6.12.110.tar.xz PGP Signature:linux-6.12.110.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.12.110

Version:6.6.157 (longterm) Released:2026-09-14 Source:linux-6.6.157.tar.xz PGP Signature:linux-6.6.157.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.6.157

Version:6.1.188 (longterm) Released:2026-09-14 Source:linux-6.1.188.tar.xz PGP Signature:linux-6.1.188.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.1.188

Version:5.15.221 (longterm) Released:2026-09-14 Source:linux-5.15.221.tar.xz PGP Signature:linux-5.15.221.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.15.221

Version:5.10.270 (longterm) Released:2026-09-14 Source:linux-5.10.270.tar.xz PGP Signature:linux-5.10.270.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.10.270

FEDORA-2026-abe39f1809 Packages in this update:

• freeipmi-1.6.19-1.fc45

Update description:

Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode

FEDORA-EPEL-2026-0f5b361fa5 Packages in this update:

• perl-Net-DNS-1.57-1.el10_4

Update description:

Update to 1.57 to fix CVE-2026-81928 (Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records)

FEDORA-EPEL-2026-8a37d4d02f Packages in this update:

• perl-Net-DNS-1.57-1.el10_3

Update description:

Update to 1.57 to fix CVE-2026-81928 (Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records)