Aggregator

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - SMB network file system; (CVE-2025-22037, CVE-2025-37899)

FEDORA-2026-57cd5704e9 Packages in this update:

• libsixel-1.10.5-5.fc42

Update description:

Apply fix for CVE-2025-61146

FEDORA-2026-b227fad171 Packages in this update:

• libsixel-1.10.5-5.fc43

Update description:

Apply fix for CVE-2025-61146

FEDORA-2026-a800d3417b Packages in this update:

• libsixel-1.10.5-6.fc44

Update description:

Apply fix for CVE-2025-61146

FEDORA-2026-814a1deec8 Packages in this update:

• libmaxminddb-1.13.1-1.fc43

Update description: libmaxminddb 1.13.1

• Re-release for Ubuntu PPA, no code changes.

libmaxminddb 1.13.0

• MMDB_get_entry_data_list() now validates that the claimed array/map size is plausible given the remaining bytes in the data section. A crafted database could previously claim millions of array elements while only having a few bytes of data, causing disproportionate memory allocation (memory amplification DoS).
• Fixed integer overflow in MMDB_read_node() and find_ipv4_start_node() pointer arithmetic. The node_number * record_length multiplication was performed in uint32_t, which could overflow for very large databases. Now cast to uint64_t before multiplying, matching the pattern already used in find_address_in_search_tree().
• Fixed printf format specifier mismatches in mmdblookup's metadata dump. %i was used for unsigned types and %llu for uint64_t, which is technically undefined behavior. Now uses the portable PRIu32, PRIu16, and PRIu64 macros from <inttypes.h>.
• Fixed an integer overflow in the search tree bounds check in find_address_in_search_tree(). The addition of node_count and data_section_size was performed in uint32_t arithmetic, which could wrap on very large databases, causing valid lookups to be incorrectly rejected as corrupt.
• Fixed a NULL pointer dereference in mmdblookup when displaying metadata for a database with an out-of-range build_epoch. The gmtime() return value is now checked before passing to strftime().
• MMDB_close() now NULLs the file_content, data_section, and metadata_section pointers and zeroes file_size, data_section_size, and metadata_section_size after unmapping. Previously, calling MMDB_close() twice on the same struct (or calling it after a failed MMDB_open() that succeeded at mapping) would double-munmap the file content, which is undefined behavior.
• Fixed a stack buffer overflow in print_indentation() when MMDB_dump_entry_data_list() was called with a negative indent value. The negative integer was cast to size_t, producing a massive value passed to memset(). Negative indent values are now clamped to 0.
• MMDB_lookup_string() now sets *mmdb_error to MMDB_SUCCESS when getaddrinfo fails (non-zero *gai_error). Previously, *mmdb_error was left uninitialized in this case, which could cause callers to read an indeterminate value.
• Added a recursion depth limit to skip_map_or_array(), matching the existing MAXIMUM_DATA_STRUCTURE_DEPTH (512) limit already used by get_entry_data_list(). A crafted MMDB file with deeply nested maps or arrays could previously cause a stack overflow via unbounded recursion in the MMDB_aget_value / MMDB_get_value code path.
• Fixed an off-by-one error in MMDB_read_node() that allowed reading one node past the end of the search tree when called with node_number == node_count. This caused the function to read from the data section separator and return an invalid record with an underflowed data offset. The check now correctly rejects node_number >= node_count.
• The handling of float and double types was rewritten to fix compiler errors and to eliminate the use of volatile.
• Improved endian preprocessor check if MMDB_LITTLE_ENDIAN is not set.

FEDORA-2026-1e497526c7 Packages in this update:

• libmaxminddb-1.13.1-1.fc42

Update description: libmaxminddb 1.13.1

• Re-release for Ubuntu PPA, no code changes.

libmaxminddb 1.13.0

• MMDB_get_entry_data_list() now validates that the claimed array/map size is plausible given the remaining bytes in the data section. A crafted database could previously claim millions of array elements while only having a few bytes of data, causing disproportionate memory allocation (memory amplification DoS).
• Fixed integer overflow in MMDB_read_node() and find_ipv4_start_node() pointer arithmetic. The node_number * record_length multiplication was performed in uint32_t, which could overflow for very large databases. Now cast to uint64_t before multiplying, matching the pattern already used in find_address_in_search_tree().
• Fixed printf format specifier mismatches in mmdblookup's metadata dump. %i was used for unsigned types and %llu for uint64_t, which is technically undefined behavior. Now uses the portable PRIu32, PRIu16, and PRIu64 macros from <inttypes.h>.
• Fixed an integer overflow in the search tree bounds check in find_address_in_search_tree(). The addition of node_count and data_section_size was performed in uint32_t arithmetic, which could wrap on very large databases, causing valid lookups to be incorrectly rejected as corrupt.
• Fixed a NULL pointer dereference in mmdblookup when displaying metadata for a database with an out-of-range build_epoch. The gmtime() return value is now checked before passing to strftime().
• MMDB_close() now NULLs the file_content, data_section, and metadata_section pointers and zeroes file_size, data_section_size, and metadata_section_size after unmapping. Previously, calling MMDB_close() twice on the same struct (or calling it after a failed MMDB_open() that succeeded at mapping) would double-munmap the file content, which is undefined behavior.
• Fixed a stack buffer overflow in print_indentation() when MMDB_dump_entry_data_list() was called with a negative indent value. The negative integer was cast to size_t, producing a massive value passed to memset(). Negative indent values are now clamped to 0.
• MMDB_lookup_string() now sets *mmdb_error to MMDB_SUCCESS when getaddrinfo fails (non-zero *gai_error). Previously, *mmdb_error was left uninitialized in this case, which could cause callers to read an indeterminate value.
• Added a recursion depth limit to skip_map_or_array(), matching the existing MAXIMUM_DATA_STRUCTURE_DEPTH (512) limit already used by get_entry_data_list(). A crafted MMDB file with deeply nested maps or arrays could previously cause a stack overflow via unbounded recursion in the MMDB_aget_value / MMDB_get_value code path.
• Fixed an off-by-one error in MMDB_read_node() that allowed reading one node past the end of the search tree when called with node_number == node_count. This caused the function to read from the data section separator and return an invalid record with an underflowed data offset. The check now correctly rejects node_number >= node_count.
• The handling of float and double types was rewritten to fix compiler errors and to eliminate the use of volatile.
• Improved endian preprocessor check if MMDB_LITTLE_ENDIAN is not set.

FEDORA-2026-814fe58971 Packages in this update:

• libmaxminddb-1.13.1-1.fc44

Update description: libmaxminddb 1.13.1

• Re-release for Ubuntu PPA, no code changes.

libmaxminddb 1.13.0

• MMDB_get_entry_data_list() now validates that the claimed array/map size is plausible given the remaining bytes in the data section. A crafted database could previously claim millions of array elements while only having a few bytes of data, causing disproportionate memory allocation (memory amplification DoS).
• Fixed integer overflow in MMDB_read_node() and find_ipv4_start_node() pointer arithmetic. The node_number * record_length multiplication was performed in uint32_t, which could overflow for very large databases. Now cast to uint64_t before multiplying, matching the pattern already used in find_address_in_search_tree().
• Fixed printf format specifier mismatches in mmdblookup's metadata dump. %i was used for unsigned types and %llu for uint64_t, which is technically undefined behavior. Now uses the portable PRIu32, PRIu16, and PRIu64 macros from <inttypes.h>.
• Fixed an integer overflow in the search tree bounds check in find_address_in_search_tree(). The addition of node_count and data_section_size was performed in uint32_t arithmetic, which could wrap on very large databases, causing valid lookups to be incorrectly rejected as corrupt.
• Fixed a NULL pointer dereference in mmdblookup when displaying metadata for a database with an out-of-range build_epoch. The gmtime() return value is now checked before passing to strftime().
• MMDB_close() now NULLs the file_content, data_section, and metadata_section pointers and zeroes file_size, data_section_size, and metadata_section_size after unmapping. Previously, calling MMDB_close() twice on the same struct (or calling it after a failed MMDB_open() that succeeded at mapping) would double-munmap the file content, which is undefined behavior.
• Fixed a stack buffer overflow in print_indentation() when MMDB_dump_entry_data_list() was called with a negative indent value. The negative integer was cast to size_t, producing a massive value passed to memset(). Negative indent values are now clamped to 0.
• MMDB_lookup_string() now sets *mmdb_error to MMDB_SUCCESS when getaddrinfo fails (non-zero *gai_error). Previously, *mmdb_error was left uninitialized in this case, which could cause callers to read an indeterminate value.
• Added a recursion depth limit to skip_map_or_array(), matching the existing MAXIMUM_DATA_STRUCTURE_DEPTH (512) limit already used by get_entry_data_list(). A crafted MMDB file with deeply nested maps or arrays could previously cause a stack overflow via unbounded recursion in the MMDB_aget_value / MMDB_get_value code path.
• Fixed an off-by-one error in MMDB_read_node() that allowed reading one node past the end of the search tree when called with node_number == node_count. This caused the function to read from the data section separator and return an invalid record with an underflowed data offset. The check now correctly rejects node_number >= node_count.
• The handling of float and double types was rewritten to fix compiler errors and to eliminate the use of volatile.
• Improved endian preprocessor check if MMDB_LITTLE_ENDIAN is not set.

It was discovered that curl incorrectly handled cookies when redirected from secure to insecure connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2025-9086) Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148) Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563) Stanislav Fort discovered that curl did not properly validate pinned public keys under certain circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 25.10.(CVE-2025-13034) Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS transfers in multi-threaded environments. Under certain circumstances, certificate verification could be unintentionally and unknowingly disabled. (CVE-2025-14017) It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote attacker could possibly use this issue to obtain authentication credentials. (CVE-2025-14524) Stanislav Fort discovered that curl did not properly validate TLS certificates when reusing connections. A remote attacker could possibly use this issue to bypass expected certificate verification. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819) Harry Sintonen discovered that curl did not properly validate SSH host keys when performing SSH-based file transfers. This issue could lead to unintended bypass of custom known_hosts file. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079) Harry Sintonen discovered that curl built with libssh did not properly handle authentication when performing SSH-based file transfers. This could result in unintended authentication operations. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)

FEDORA-EPEL-2026-fcf962a7f1 Packages in this update:

• coturn-4.9.0-1.el10_2

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-EPEL-2026-d588880428 Packages in this update:

• coturn-4.9.0-1.el10_3

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-2026-2a1aa1f57f Packages in this update:

• coturn-4.9.0-1.fc42

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-2026-379e214a37 Packages in this update:

• coturn-4.9.0-1.fc44

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-EPEL-2026-5537969548 Packages in this update:

• coturn-4.9.0-1.el8

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-EPEL-2026-4bec57d964 Packages in this update:

• coturn-4.9.0-1.el10_1

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-EPEL-2026-524119fe6b Packages in this update:

• coturn-4.9.0-1.el9

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-2026-8cb5571ddc Packages in this update:

• coturn-4.9.0-1.fc43

Update description: Coturn 4.9.0

• Multiple security fixes
• Fix to Web Admin password check
• Cleanup of deprecated OpenSSL APIs
• Fix for CVE-2026-27624: Bypass localhost and IP range block using IPv4-mapped IPv6

FEDORA-EPEL-2026-514cb99c8f Packages in this update:

• openbao-2.5.1-1.el8

Update description:

Update to upstream 2.5.1 Also fixes CVE-2025-58189, CVE-2025-61723, CVE-2025-61725, CVE-2025-58183, CVE-2025-58185, CVE-2025-58188 on epel-8.

Martin Schobert discovered that Ceph did not properly verify SSL certificates when using Pybind for secure mail connections, which could result in accepting invalid certificates. An attacker could possibly use this issue to perform an intermediary attack and access mail server credentials or message contents. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2024-31884) It was discovered that Ceph's RADOS Gateway (RGW) did not properly handle certain header parameters. An attacker could possibly use this issue to cause the RGW service to crash, leading to a denial of service. (CVE-2024-47866)

FEDORA-2026-937e768833 Packages in this update:

• yt-dlp-2026.02.21-1.fc44

Update description:

• Update to 2026.02.21. Fixes rhbz#2441709.
• Mitigates CVE-2026-26331 / GHSA-g3gw-q23r-pgqm (rhbz#2442244)

* Sat Feb 21 2026 Dominik 'Rathann' Mierzejewski <dominik@greysector.net> - 2026.02.04-2 - fix FTBFS with python 3.14.3