Aggregator

USN-9007-1: FreeRDP vulnerabilities

Ubuntu Security Advisories
2 days 18 hours ago
It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code.

USN-9001-2: ca-certificates update

Ubuntu Security Advisories
2 days 19 hours ago
USN-9001-1 fixed a vulnerability in ca-certificates, ca-certificates-java. This update provides the corresponding fix for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.

USN-9005-1: OpenJDK 27 vulnerabilities

Ubuntu Security Advisories
3 days 4 hours ago
It was discovered that the 2D component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the Networking component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Networking component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the Security component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JAXP component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the JDBC component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the JGSS component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the Security component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the Libraries component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the Networking component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91332, CVE-2026-91451, CVE-2026-91452) It was discovered that the JSSE component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the JAAS component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the JAXP component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JGSS component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Lightweight HTTP Server component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the ImageIO component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Compiler component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Serviceability component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 27 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 27 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 27 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the ImageIO component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the JAXP component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the JSSE component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the Serviceability component of OpenJDK 27 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Sound component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the AWT component of OpenJDK 27 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the Networking component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Networking component of OpenJDK 27 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87291) It was discovered that the Compiler component of OpenJDK 27 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83378) It was discovered that the Compiler component of OpenJDK 27 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87255) It was discovered that the Security component of OpenJDK 27 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91333) It was discovered that the JSSE component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Compiler component of OpenJDK 27 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-101737) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

python-httplib2-0.32.1-1.fc46

Fedora Security Advisories
3 days 5 hours ago
FEDORA-2026-c0681b6157 Packages in this update:
  • python-httplib2-0.32.1-1.fc46
Update description:

Automatic update for python-httplib2-0.32.1-1.fc46.

Changelog * Sun Nov 8 2026 Kevin Fenzi <kevin@scrye.com> - 0.32.1-1 - Update to 0.32.1. Fixes rhbz#2391904 - Drop cacert.txt doc file to avoid confusion ( rhbz#2563344 )

USN-9004-1: OpenJDK 25 vulnerabilities

Ubuntu Security Advisories
3 days 5 hours ago
It was discovered that the 2D component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the Networking component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the 2D component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382) It was discovered that the JGSS component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411) It was discovered that the Networking component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the Security component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JAXP component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the JDBC component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the JGSS component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the Security component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the Libraries component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the Networking component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91332, CVE-2026-91451, CVE-2026-91452) It was discovered that the JSSE component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the JAAS component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the JAXP component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JGSS component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Lightweight HTTP Server component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the ImageIO component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Compiler component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Serviceability component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 25 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 25 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 25 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the ImageIO component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the JAXP component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the JSSE component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the Serviceability component of OpenJDK 25 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Sound component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the AWT component of OpenJDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the Networking component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Networking component of OpenJDK 25 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87291) It was discovered that the Compiler component of OpenJDK 25 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83378) It was discovered that the Compiler component of OpenJDK 25 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87255) It was discovered that the Security component of OpenJDK 25 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91333) It was discovered that the JSSE component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

python-pymdown-extensions-12.3-1.fc46

Fedora Security Advisories
3 days 22 hours ago
FEDORA-2026-de1da3cf3b Packages in this update:
  • python-pymdown-extensions-12.3-1.fc46
Update description:

Automatic update for python-pymdown-extensions-12.3-1.fc46.

Changelog * Sun Nov 8 2026 Mattia Verga <mattia.verga@proton.me> - 12.3-1 - Update to 12.3 (Fedora#2383999) - Fix CVE-2026-61632 (Fedora#2512418) - Fix CVE-2026-67422 (Fedora#2512405)

maturin-1.16.0-1.el10_4 ruff-0.17.4-2.el10_4 rust-astral_async_zip-0.0.22-2.el10_4 rust-coreutils-0.7.0-13.el10_4 rust-lzma-rust2-0.25.0-1.el10_4 rust-mailparse-0.18.0-1.el10_4 rust-pyo3-introspection-0.30.1-1.el10_4 rust-python-pkginfo-0.7.0-1.el10_4…

Fedora Security Advisories
3 days 23 hours ago
FEDORA-EPEL-2026-14d0b10244 Packages in this update:
  • maturin-1.16.0-1.el10_4
  • ruff-0.17.4-2.el10_4
  • rust-astral_async_zip-0.0.22-2.el10_4
  • rust-coreutils-0.7.0-13.el10_4
  • rust-lzma-rust2-0.25.0-1.el10_4
  • rust-mailparse-0.18.0-1.el10_4
  • rust-pyo3-introspection-0.30.1-1.el10_4
  • rust-python-pkginfo-0.7.0-1.el10_4
  • rust-serde_json-1.0.154-1.el10_4
  • rust-zip-9.4.1-1.el10_4
Update description:

Update ruff to 0.17.4. Update pyo3-introspection to version 0.30.1. Update maturin to 1.16.0.

Update the zip crate to version 9, fixing RUSTSEC-2026-0367, RUSTSEC-2026-0368, and RUSTSEC-2026-0369. Rebuild various applications with the updated zip crate.

Update the serde_json crate to version 1.0.154: support preserve_order in no_std builds and report invalid UTF-8 at the first bad byte.

Update various other Rust crates, including updating lzma-rust2 to 0.25.0, python-pkginfo to 0.7.0, and mailparse to 0.18.0.

perl-Catalyst-Plugin-Authentication-0.10029-1.fc45

Fedora Security Advisories
4 days ago
FEDORA-2026-345313f259 Packages in this update:
  • perl-Catalyst-Plugin-Authentication-0.10029-1.fc45
Update description:

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. This package updates the module to version 0.10029 that uses secure comparison for the legacy verifying.

perl-Catalyst-Plugin-Authentication-0.10029-1.fc44

Fedora Security Advisories
4 days ago
FEDORA-2026-a6a25dc737 Packages in this update:
  • perl-Catalyst-Plugin-Authentication-0.10029-1.fc44
Update description:

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. This package updates the module to version 0.10029 that uses secure comparison for the legacy verifying.

perl-Catalyst-Plugin-Authentication-0.10029-1.fc43

Fedora Security Advisories
4 days ago
FEDORA-2026-fb10daefa7 Packages in this update:
  • perl-Catalyst-Plugin-Authentication-0.10029-1.fc43
Update description:

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. This package updates the module to version 0.10029 that uses secure comparison for the legacy verifying.