Aggregator

FEDORA-2026-c1e25a4642 Packages in this update:

• 389-ds-base-3.3.1-1.fc45

Update description:

• Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]
• Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]
• Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]
• Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]
• Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
• Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
• Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]
• Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
• Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
• Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
• Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
• Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]
• Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]
• Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]
• Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

FEDORA-2026-0b8bc362b1 Packages in this update:

• 389-ds-base-3.1.5-2.fc43

Update description:

• Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]
• Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]
• Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]
• Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]
• Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
• Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
• Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]
• Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
• Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
• Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
• Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
• Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]
• Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]
• Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]
• Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

FEDORA-2026-b16c9cbc0f Packages in this update:

• 389-ds-base-3.2.3-3.fc44

Update description:

• Resolves: rhbz#2492927 CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [fedora-all]
• Resolves: rhbz#2497652 CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [fedora-all]
• Resolves: rhbz#2511796 CVE-2026-69152 389-ds-base: brace-expansion: Denial of Service via unbounded intermediate arrays [fedora-all]
• Resolves: rhbz#2529450 CVE-2026-76560 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [fedora-all]
• Resolves: rhbz#2529451 CVE-2026-18453 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [fedora-all]
• Resolves: rhbz#2529452 CVE-2026-18355 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [fedora-all]
• Resolves: rhbz#2494775 CVE-2026-11611 389-ds-base: 389-ds-base: Content Sync plugin unbounded queue growth and race conditions [fedora-all]
• Resolves: rhbz#2494825 CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation [fedora-all]
• Resolves: rhbz#2494894 CVE-2026-11790 389-ds-base: 389-ds-base: PBKDF2 password storage plugin unbounded iteration count denial of service [fedora-all]
• Resolves: rhbz#2494895 CVE-2026-11789 389-ds-base: 389-ds-base: SMD5 password storage plugin salt length integer underflow crash [fedora-all]
• Resolves: rhbz#2509729 CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [fedora-all]
• Resolves: rhbz#2513063 CVE-2026-19404 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance [fedora-all]
• Resolves: rhbz#2494827 CVE-2026-11793 389-ds-base: 389-ds-base: stack buffer overflow in checkPrefix() algorithm ID parsing [fedora-all]
• Resolves: rhbz#2494830 CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) [fedora-all]
• Resolves: rhbz#2498023 CVE-2026-15041 389-ds-base: 389-ds-base: Non-constant-time comparison in PBKDF2-SHA256 password verification [fedora-all]

FEDORA-2026-02481296e8 Packages in this update:

• erlang-26.2.5.21-7.fc43

Update description:

Backported fixes for CVE-2026-58227 and CVE-2026-59251

Fix for CVE-2026-55953

FEDORA-2026-64363fe778 Packages in this update:

• erlang-26.2.5.21-7.fc44

Update description:

Backported fixes for CVE-2026-58227 and CVE-2026-59251

Fix for CVE-2026-55953

FEDORA-2026-044e56d9ff Packages in this update:

• tar-1.35-9.fc44

Update description:

Fix build with libacl 2.4.0, fix CVE-2026-5704, CVE-2026-18508, CVE-2026-18477, and a regression in the fix for CVE-2025-45582.

FEDORA-2026-972718725c Packages in this update:

• environment-modules-5.6.2-1.fc45

Update description:

Update to 5.6.2 (fix CVE-2026-85013)

Version:7.2.4 (stable) Released:2026-09-07 Source:linux-7.2.4.tar.xz PGP Signature:linux-7.2.4.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.2.4

Version:6.18.50 (longterm) Released:2026-09-07 Source:linux-6.18.50.tar.xz PGP Signature:linux-6.18.50.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.50

Version:6.12.109 (longterm) Released:2026-09-07 Source:linux-6.12.109.tar.xz PGP Signature:linux-6.12.109.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.12.109

Version:next-20260907 (linux-next) Released:2026-09-07

FEDORA-2026-728dd9f704 Packages in this update:

• libevent-2.1.13-1.fc43

Update description: Update to 2.1.13.

The following security vulnerabilites are fixed in this update:

• GHSA-fj29-64w6-73h6 CVE-2026-63383 https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6
• GHSA-45c6-qx49-89m8 CVE-2026-63384 https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8
• GHSA-cvq5-vrvr-j338 CVE-2026-63388 https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338
• GHSA-58rx-7448-jw47 CVE-2026-63387 https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47
• GHSA-2gmv-p5m7-98p6 CVE-2026-63379 https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6
• GHSA-c2pj-cg4r-88c8 CVE-2026-63381 https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
• GHSA-q39v-w2g7-gr8j CVE-2026-63382 https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j
• GHSA-jcwh-pvf2-73p2 CVE-2026-63385 https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2

FEDORA-2026-63393c230f Packages in this update:

• erlang-26.2.5.21-6.fc44

Update description:

Fix for CVE-2026-55953

FEDORA-2026-e2b994d140 Packages in this update:

• erlang-26.2.5.21-6.fc43

Update description:

Fix for CVE-2026-55953

FEDORA-2026-72d10c874d Packages in this update:

• libevent-2.1.13-1.fc44

Update description: Update to 2.1.13.

The following security vulnerabilites are fixed in this update:

• GHSA-fj29-64w6-73h6 CVE-2026-63383 https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6
• GHSA-45c6-qx49-89m8 CVE-2026-63384 https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8
• GHSA-cvq5-vrvr-j338 CVE-2026-63388 https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338
• GHSA-58rx-7448-jw47 CVE-2026-63387 https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47
• GHSA-2gmv-p5m7-98p6 CVE-2026-63379 https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6
• GHSA-c2pj-cg4r-88c8 CVE-2026-63381 https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
• GHSA-q39v-w2g7-gr8j CVE-2026-63382 https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j
• GHSA-jcwh-pvf2-73p2 CVE-2026-63385 https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2

FEDORA-2026-0a83f1b852 Packages in this update:

• libevent-2.1.13-1.fc45

Update description: Update to 2.1.13.

The following security vulnerabilites are fixed in this update:

• GHSA-fj29-64w6-73h6 CVE-2026-63383 https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6
• GHSA-45c6-qx49-89m8 CVE-2026-63384 https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8
• GHSA-cvq5-vrvr-j338 CVE-2026-63388 https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338
• GHSA-58rx-7448-jw47 CVE-2026-63387 https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47
• GHSA-2gmv-p5m7-98p6 CVE-2026-63379 https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6
• GHSA-c2pj-cg4r-88c8 CVE-2026-63381 https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
• GHSA-q39v-w2g7-gr8j CVE-2026-63382 https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j
• GHSA-jcwh-pvf2-73p2 CVE-2026-63385 https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2

It was discovered that PHP incorrectly handled Apache map decoding in SOAP servers with a typemap configured. A remote attacker could use this issue to cause a NULL pointer dereference, resulting in a denial of service. (CVE-2026-7262) It was discovered that PHP incorrectly handled signed integer overflow in the metaphone() function. An attacker could use this issue to cause an out-of-bounds read, resulting in a denial of service. (CVE-2026-7568) It was discovered that PHP incorrectly handled circular symbolic links in phar archives. An attacker could use this issue to cause unbounded recursion, resulting in a denial of service. (CVE-2026-7260) It was discovered that PHP incorrectly escaped backslashes in the pgsql extension when standard_conforming_strings is enabled. An attacker could use this issue to perform SQL injection via a backslash breakout. (CVE-2026-17543)

FEDORA-2026-5812baee0f Packages in this update:

• freeipa-4.13.4-1.2.fc43

Update description:

FreeIPA 4.13.4 security release

Upstream release notes: https://www.freeipa.org/release-notes/4-13-4.html

FEDORA-2026-39b07f6dbb Packages in this update:

• gegl04-0.4.72-1.fc43

Update description:

This update contains a new upstream release with bugfixes and improvements, notably it fixes an overflow in parsing RGBE/HDR image files.

For more information, please consult the upstream changelog.

FEDORA-EPEL-2026-ffca0f924a Packages in this update:

• openvpn-2.7.7-1.el10_3

Update description:

Update to upstream 2.7.7 release