Aggregator

FEDORA-EPEL-2026-7e7a60affc Packages in this update:

• rust-cargo-semver-checks-0.51.0-6.el10_4
• rust-trustfall-rustdoc-adapter57-57.1.3-2.el10_4
• rust-trustfall-rustdoc-adapter60-60.0.3-2.el10_4
• rust-trustfall-rustdoc-adapter-61.0.3-1.el10_4

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349, with faster-hex 0.10.1 for RUSTSEC-2026-0306, and with updated dependencies for the eMudhra intermediate CA compromise. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.

It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to cause a denial of service.

USN-8930-1 fixed some vulnerabilities in U-Boot. This update provides the corresponding fix for U-Boot on Ubuntu 26.10. Original advisory details: Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain NFS READ and NFS READLINK responses. An attacker could possibly use this issue to trigger a buffer overflow, resulting in a denial of service or arbitrary code execution. (CVE-2026-74220, CVE-2026-74221) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot incorrectly handled certain HTTP data storage failures in its lwIP implementation. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service. (CVE-2026-74222) Shahriyar Jalayeri and Mehrun P. Hunter discovered that U-Boot did not properly validate certain DHCPv6 option lengths during network boot. An attacker could possibly use this issue to trigger out-of-bounds memory access, resulting in a denial of service. (CVE-2026-74225)

Rick de Jager discovered that Ghostscript incorrectly handled memory under certain circumstances when processing PostScript documents. If a user or automated system were tricked into processing a specially crafted document, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (CVE-2026-101258) It was discovered that Ghostscript incorrectly handled memory when converting certain fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to cause Ghostscript to crash, or possibly execute arbitrary code. (CVE-2026-103226) Paulos Yibelo discovered that Ghostscript did not properly validate certain operands when loading fonts. If a user or automated system were tricked into processing a specially crafted file, an attacker could possibly use this issue to bypass the sandbox and execute arbitrary code. (No CVE number)

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)

FEDORA-2026-d5f8446449 Packages in this update:

• php-8.4.27-2.fc43

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-2026-a9354b8a1e Packages in this update:

• php-8.5.12-1.fc45

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

FEDORA-2026-a9eba4bbc3 Packages in this update:

• php-8.5.12-1.fc44

Update description:

Security update: - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619

It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618) It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)

Version:next-20261021 (linux-next) Released:2026-10-21

FEDORA-EPEL-2026-1d3c013156 Packages in this update:

• ntpsec-1.2.6-1.el10_3

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-18321 CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-EPEL-2026-077c9d1631 Packages in this update:

• ntpsec-1.2.6-1.el9

Update description:

Update to the latest upstream release, which has security fixes for CVE-2026-18321 CVE-2026-102483 CVE-2026-102484 CVE-2026-102485 CVE-2026-102486.

FEDORA-2026-ed3c0a9bce Packages in this update:

• libmspack-0.11-0.1.alpha.fc46

Update description:

Automatic update for libmspack-0.11-0.1.alpha.fc46.

Changelog * Wed Oct 21 2026 Dan Horák <dan[at]danny.cz> - 0.11-0.1.alpha - updated to 0.11alpha - fix CVE-2026-110602 (rhbz#2558186) - add %check section

FEDORA-2026-6b7650cc3c Packages in this update:

• rust-cargo-semver-checks-0.51.0-6.fc43
• rust-trustfall-rustdoc-adapter57-57.1.3-2.fc43
• rust-trustfall-rustdoc-adapter60-60.0.3-2.fc43
• rust-trustfall-rustdoc-adapter-61.0.3-1.fc43

Update description:

Rebuild cargo-semver-checks with rustls 0.23.46 for RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, and RUSTSEC-2026-0349, with faster-hex 0.10.1 for RUSTSEC-2026-0306, and with updated dependencies for the eMudhra intermediate CA compromise. Update trustfall-rustdoc-adapter to 61.0.3/60.0.3/57.1.3.

It was discovered that Unbound incorrectly handled certain TCP connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-80225) It was discovered that Unbound incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-81634) It was discovered that Unbound incorrectly handled certain DNS responses during DNSSEC validation. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. (CVE-2026-85501) It was discovered that Unbound incorrectly handled outgoing network ports. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. (CVE-2026-50252) It was discovered that Unbound incorrectly handled certain DNSCrypt packets. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2026-40691) It was discovered that Unbound incorrectly handled certain cached DNS responses. A remote attacker could possibly use this issue to poison Unbound's cache. This issue only affected Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-44690) It was discovered that Unbound incorrectly handled certain DNS-over-QUIC connections. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-32665) It was discovered that Unbound incorrectly handled certain EDNS options. A remote attacker could possibly use this issue to crash Unbound, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-55973) Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Unbound incorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50387) It was discovered that Unbound incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Unbound to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 16.04 LTS and Ubuntu 14.04 LTS. (CVE-2023-50868)

FEDORA-2026-b86561a89a Packages in this update:

• clevis-24-1.fc45

Update description:

Add new sources (release 24)

FEDORA-2026-9379466325 Packages in this update:

• clevis-24-1.fc44

Update description:

Add new sources (release 24)

Version:7.2.12 (stable) Released:2026-10-21 Source:linux-7.2.12.tar.xz PGP Signature:linux-7.2.12.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.2.12

Version:6.18.58 (longterm) Released:2026-10-21 Source:linux-6.18.58.tar.xz PGP Signature:linux-6.18.58.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.58