Aggregator

FEDORA-2026-8eeffa4c43 Packages in this update:

• rust-rustls-webpki-0.103.16-1.fc44
• rust-webpki-root-certs-1.0.10-1.fc44
• rust-webpki-roots-1.0.10-1.fc44

Update description:

• Update the rustls-webpki crate to version 0.103.16.
• Update the webpki-roots and webpki-root-certs crates to version 1.0.10.

This addresses security advisories RUSTSEC-2026-0382, RUSTSEC-2026-0381, and RUSTSEC-2026-0383 - also known as CVE-2026-111943 (i.e. the eMudhra Intermediate CA Compromise).

Rebuilds of affected packages are tracked in rust/backlog#46.

FEDORA-2026-ec2ce9d2ef Packages in this update:

• rust-rustls-webpki-0.103.16-1.fc45
• rust-webpki-root-certs-1.0.10-1.fc45
• rust-webpki-roots-1.0.10-1.fc45

Update description:

• Update the rustls-webpki crate to version 0.103.16.
• Update the webpki-roots and webpki-root-certs crates to version 1.0.10.

This addresses security advisories RUSTSEC-2026-0382, RUSTSEC-2026-0381, and RUSTSEC-2026-0383 - also known as CVE-2026-111943 (i.e. the eMudhra Intermediate CA Compromise).

Rebuilds of affected packages are tracked in rust/backlog#46.

FEDORA-EPEL-2026-d3ec7f00e2 Packages in this update:

• rust-rustls-webpki-0.103.16-1.el10_3
• rust-webpki-root-certs-1.0.10-1.el10_3
• rust-webpki-roots-1.0.10-1.el10_3

Update description:

• Update the rustls-webpki crate to version 0.103.16.
• Update the webpki-roots and webpki-root-certs crates to version 1.0.10.

This addresses security advisories RUSTSEC-2026-0382, RUSTSEC-2026-0381, and RUSTSEC-2026-0383 - also known as CVE-2026-111943 (i.e. the eMudhra Intermediate CA Compromise).

Rebuilds of affected packages are tracked in rust/backlog#46.

FEDORA-EPEL-2026-2d8a0ed237 Packages in this update:

• rust-rustls-webpki-0.103.16-1.el10_4
• rust-webpki-root-certs-1.0.10-1.el10_4
• rust-webpki-roots-1.0.10-1.el10_4

Update description:

• Update the rustls-webpki crate to version 0.103.16.
• Update the webpki-roots and webpki-root-certs crates to version 1.0.10.

This addresses security advisories RUSTSEC-2026-0382, RUSTSEC-2026-0381, and RUSTSEC-2026-0383 - also known as CVE-2026-111943 (i.e. the eMudhra Intermediate CA Compromise).

Rebuilds of affected packages are tracked in rust/backlog#46.

FEDORA-2026-8e6e09deb9 Packages in this update:

• rust-cargo-semver-checks-0.51.0-5.fc44
• rust-trustfall-rustdoc-adapter57-57.1.3-2.fc44
• rust-trustfall-rustdoc-adapter60-60.0.3-2.fc44
• rust-trustfall-rustdoc-adapter-61.0.3-1.fc44

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349 and with faster-hex 0.10.1 for RUSTSEC-2026-0306. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.

This update removes the "emSign ECC Root CA - G3" CA certificate due to intermediate CA certificates being compromised. In addition, in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS, the ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.90 version of the Mozilla certificate authority bundle.

FEDORA-2026-85f07f4f1b Packages in this update:

• dolphin-26.08.1-2.fc44

Update description:

• CVE-2026-110236 Arbitrary command execution via crafted folder name

FEDORA-2026-2add2065d0 Packages in this update:

• dolphin-26.04.3-2.fc43

Update description:

• CVE-2026-110236 Arbitrary command execution via crafted folder name

FEDORA-2026-b022206824 Packages in this update:

• dolphin-26.08.1-2.fc45

Update description:

• CVE-2026-110236 Arbitrary command execution via crafted folder name

Multiple security issues were discovered in .NET and this update includes new upstream .NET versions to fix these issues. .NET 8 has been updated to 8.0.32 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. .NET 10 has been updated to 10.0.13 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. .NET 11 has been updated to 11.0.0~rc2 in Ubuntu 26.10. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

It was discovered that Protocol Buffers did not properly handle negative varint lengths or enforce recursion limits when parsing input in the PHP library. An attacker could possibly use this issue to cause applications using Protocol Buffers to crash or consume resources, resulting in a denial of service.

FEDORA-2026-77dc014196 Packages in this update:

• dolphin-26.08.2-2.fc46

Update description:

Automatic update for dolphin-26.08.2-2.fc46.

Changelog * Fri Oct 16 2026 Than Ngo <than@redhat.com> - 26.08.2-2 - Fix rhbz#2553643 - CVE-2026-110236 dolphin: dolphin: Arbitrary command execution via crafted folder name

USN-8708-1 fixed a vulnerability in sudo-rs. This update provides the corresponding fix for Ubuntu 26.10. Original advisory details: It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only affected systems configured to grant fine-grained sudoedit file editing permissions, which is not the default configuration.

Version:next-20261020 (linux-next) Released:2026-10-20

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. (CVE-2026-61642) It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-50012) It was discovered that Squid incorrectly handled parsing certain FTP directory listings. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-47729) It was discovered that Squid incorrectly handled certain ICP traffic. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-32748, CVE-2026-33526) It was discovered that Squid incorrectly handled certain ICP requests. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33515)

FEDORA-2026-13d6a67e0d Packages in this update:

• libical-3.0.20-6.fc43

Update description:

Add a patch for CVE-2026-111269: Denial of Service via out-of-bounds read in icalvalue_decode_ical_string()

FEDORA-2026-feebb9861c Packages in this update:

• libical-3.0.20-9.fc44

Update description:

Add a patch for CVE-2026-111269: Denial of Service via out-of-bounds read in icalvalue_decode_ical_string()

FEDORA-2026-05c27bbf4d Packages in this update:

• rust-sccache-0.17.0-5.fc46
• rust-typed-path-0.13.0-1.fc46
• rust-zip-8.6.0-12.fc46

Update description:

Update typed-path to version 0.13.0.

Rebuild sccache with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349.

FEDORA-EPEL-2026-9b6d85f62d Packages in this update:

• libmodplug-0.8.9.0-14.el9

Update description:

Fix CVE-2026-75904, CVE-2026-108577, CVE-2026-111270, CVE-2026-111271 and additional hardening