Aggregator

USN-8757-1: cgit vulnerability

3 days 20 hours ago
It was discovered that cgit incorrectly handled repository paths when HTTP cloning was enabled. A remote attacker could possibly use this issue to access files outside the repository and obtain sensitive information.

USN-8756-1: Yelp vulnerability

3 days 20 hours ago
It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into opening a specially crafted help document and obtain sensitive information.

USN-8755-1: libvips vulnerability

3 days 20 hours ago
It was discovered that libvips incorrectly handled specially crafted TIFF images when saving them as HEIF images. An attacker could possibly use this issue to cause libvips to crash, resulting in a denial of service.

USN-8754-1: Freeciv vulnerability

3 days 20 hours ago
It was discovered that Freeciv incorrectly handled certain network packets, resulting in a stack overflow. A remote attacker could possibly use this issue to cause Freeciv clients or servers to crash, resulting in a denial of service.

freeipmi-1.6.19-1.fc44

3 days 21 hours ago
FEDORA-2026-febfd10293 Packages in this update:
  • freeipmi-1.6.19-1.fc44
Update description:

Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode

postgresql16-anonymizer-3.2.2-1.fc45

3 days 21 hours ago
FEDORA-2026-bc7408de42 Packages in this update:
  • postgresql16-anonymizer-3.2.2-1.fc45
Update description:

Upstream changelog: https://gitlab.com/dalibo/postgresql_anonymizer/-/releases

  • [core] CVE-2026-19633: Escalation via custom types, operators and rangevars
  • [core] update dependencies
  • [static] Define masking policy with parallel static masking
  • [pseudo] Add seeded_street_name
  • [static] CVE-2026-83534: Elevation in parallel masking
  • [make] call extension+install before regress
  • [pseudo] new panel of seeded_* functions
  • [impexp] CVE-2026-19634: SQL injection via import functions
  • [partial] Add anon.array_remove_regex()
  • [static] Ignore a TABLESAMPLE sampling ratio on non-plain-table relations
  • [parallel] Reject a materialized view before parallel masking
  • [dynamic] Proper error message on write operations
  • [static] Optionally drop indexes during static masking (beta)
  • [doc] update the permission matrix
  • [tests] Gate the impexp unit tests on cfg(test) only
  • [doc] split Load and Support out of the Install page
  • [docker] make the image ready for replica masking
  • [tests] Introduce cargo pgrx regress
  • [core] Upgrade dependencies
  • [core] Remove useless compatibility function
  • [image] Define a default value for the sigma parameter
  • [doc] Add the "Anonymized Replica" tutorial
  • [docker] disable fsync during initdb
  • [static] Improve performance and correctness for parallel masking
  • [doc] how to fix cargo audit warnings
  • [doc] Install on Fedora
  • [core] Support PostgreSQL 19 (beta)
  • [core] Upgrade to PGRX 0.19

postgresql16-anonymizer-3.2.2-1.fc44

3 days 21 hours ago
FEDORA-2026-58a319c686 Packages in this update:
  • postgresql16-anonymizer-3.2.2-1.fc44
Update description:

Upstream changelog: https://gitlab.com/dalibo/postgresql_anonymizer/-/releases

  • [core] CVE-2026-19633: Escalation via custom types, operators and rangevars
  • [core] update dependencies
  • [static] Define masking policy with parallel static masking
  • [pseudo] Add seeded_street_name
  • [static] CVE-2026-83534: Elevation in parallel masking
  • [make] call extension+install before regress
  • [pseudo] new panel of seeded_* functions
  • [impexp] CVE-2026-19634: SQL injection via import functions
  • [partial] Add anon.array_remove_regex()
  • [static] Ignore a TABLESAMPLE sampling ratio on non-plain-table relations
  • [parallel] Reject a materialized view before parallel masking
  • [dynamic] Proper error message on write operations
  • [static] Optionally drop indexes during static masking (beta)
  • [doc] update the permission matrix
  • [tests] Gate the impexp unit tests on cfg(test) only
  • [doc] split Load and Support out of the Install page
  • [docker] make the image ready for replica masking
  • [tests] Introduce cargo pgrx regress
  • [core] Upgrade dependencies
  • [core] Remove useless compatibility function
  • [image] Define a default value for the sigma parameter
  • [doc] Add the "Anonymized Replica" tutorial
  • [docker] disable fsync during initdb
  • [static] Improve performance and correctness for parallel masking
  • [doc] how to fix cargo audit warnings
  • [doc] Install on Fedora
  • [core] Support PostgreSQL 19 (beta)
  • [core] Upgrade to PGRX 0.19

USN-8563-5: nginx vulnerability

3 days 22 hours ago
USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was backed out in USN-8563-2 because it could cause a regression. This update includes a better fix for CVE-2026-42533. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533) It was discovered that nginx had a use-after-free vulnerability in the ngx_http_ssi_module module when configured with Server-Side Includes, proxy_pass, and proxy buffering disabled directives. An attacker able to intercept traffic and control responses from an upstream server could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-56434) It was discovered that nginx incorrectly handled certain requests in the ngx_http_slice_module module. A remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash, resulting in a denial of service. (CVE-2026-60005)

freeipmi-1.6.19-1.fc45

3 days 22 hours ago
FEDORA-2026-abe39f1809 Packages in this update:
  • freeipmi-1.6.19-1.fc45
Update description:

Updates to 1.6.19, also fixes CVE-2026-33554 CVE-2026-50031 CVE-2026-85504 CVE-2026-85505 CVE-2026-85506 CVE-2026-85507 CVE-2026-85508 CVE-2026-85509, and adds tmpfiles configs for image mode

perl-Net-DNS-1.57-1.el10_4

3 days 23 hours ago
FEDORA-EPEL-2026-0f5b361fa5 Packages in this update:
  • perl-Net-DNS-1.57-1.el10_4
Update description:

Update to 1.57 to fix CVE-2026-81928 (Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records)

perl-Net-DNS-1.57-1.el10_3

3 days 23 hours ago
FEDORA-EPEL-2026-8a37d4d02f Packages in this update:
  • perl-Net-DNS-1.57-1.el10_3
Update description:

Update to 1.57 to fix CVE-2026-81928 (Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records)