Aggregator

sngrep-1.9.0-4.fc45

Fedora Security Advisories
3 days 15 hours ago
FEDORA-2026-39f14c4384 Packages in this update:
  • sngrep-1.9.0-4.fc45
Update description:

Backport fixes for two memory-safety issues reported upstream (irontec/sngrep#589):

  • CVE-2026-121943: off-by-one length guard in the SIP parser accepts a 10240-byte payload that fills the stack buffer with no NUL terminator, so regexec()/strdup() read past its end (OOB read).
  • CVE-2026-121944: an NFLOG TLV with length < 4 never advances the parse offset, making the capture thread spin forever (DoS).

Submitted upstream as irontec/sngrep#591 and #592.

USN-9001-1: ca-certificates update

Ubuntu Security Advisories
3 days 16 hours ago
It was discovered that the ca-certificates JKS integration was not working properly, resulting in CA certificates removed from the system bundle not being removed from the JKS keystore. This update corrects the feature and resyncs the keystore with the system CA certificates list.

USN-8955-2: nginx vulnerabilities

Ubuntu Security Advisories
3 days 16 hours ago
USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. In addition, this update fixes CVE-2026-42533 for these releases. It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could possibly use this issue to crash nginx, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533) Original advisory details: It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479) It was discovered that nginx incorrectly handled HTTP/3 requests when proxy_request_buffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101) It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205) It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)

USN-7230-3: FRR regression

Ubuntu Security Advisories
3 days 17 hours ago
USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for CVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop processing RPKI updates after the first one, so routes were not revalidated when RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to start when the RPKI module was enabled. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Iggy Frankovic discovered that FRR incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2024-44070) It was discovered that FRR re-validated all routes in certain instances when the internal socket's buffer size overflowed. A remote attacker could possibly use this issue to impact the performance of FRR, resulting in a denial of service. (CVE-2024-55553)

rust-zstd-0.13.4-1.el10_3 rust-zstd-safe-7.4.0-1.el10_3 rust-zstd-sys-2.0.17-1.el10_3

Fedora Security Advisories
3 days 18 hours ago
FEDORA-EPEL-2026-353cc882e0 Packages in this update:
  • rust-zstd-0.13.4-1.el10_3
  • rust-zstd-safe-7.4.0-1.el10_3
  • rust-zstd-sys-2.0.17-1.el10_3
Update description:
  • Update the zstd crate to version 0.13.4.
  • Update the zstd-safe crate to version 7.4.0.
  • Update the zstd-sys crate to version 2.0.17.

This addresses multiple unsoundness and security issues in the zstd-safe and zstd-sys crates (assigned RUSTSEC-2026-0391, RUSTSEC-2026-0392, RUSTSEC-2026-0393, RUSTSEC-2026-0395, RUSTSEC-2026-0396, RUSTSEC-2026-0397, RUSTSEC-2026-0398, RUSTSEC-2026-0399, RUSTSEC-2026-0400, RUSTSEC-2026-0401, RUSTSEC-2026-0402, RUSTSEC-2026-0403, RUSTSEC-2026-0404, RUSTSEC-2026-0405, RUSTSEC-2026-0406).

Rebuilds of affected applications will be tracked and performed separately.

USN-8972-2: HAProxy regression

Ubuntu Security Advisories
3 days 18 hours ago
USN-8972-1 fixed vulnerabilities in HAProxy. On Ubuntu 22.04 LTS, the update caused a regression when processing certain chunked requests. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that HAProxy incorrectly handled truncated HTTP/2 PING frames. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110353) It was discovered that HAProxy incorrectly handled certain HTTP/1.1 chunked requests. A remote attacker could possibly use this issue to cause HAProxy to consume excessive CPU resources, leading to a denial of service. (CVE-2026-110354)

rust-crypto-bigint-0.7.10-1.el9 rust-ctutils-0.4.8-1.el9 rust-elliptic-curve-0.14.3-1.el9 rust-num-bigint-0.5.1-1.el9 rust-num-bigint0.4-0.4.8-1.el9 rust-num-modular-0.7.0-1.el9 rust-num-modular0.6-0.6.5-1.el9 rust-num-prime-0.5.0-3.el9 rust-zmij-1.0.23…

Fedora Security Advisories
4 days 8 hours ago
FEDORA-EPEL-2026-4c3a95074e Packages in this update:
  • rust-crypto-bigint-0.7.10-1.el9
  • rust-ctutils-0.4.8-1.el9
  • rust-elliptic-curve-0.14.3-1.el9
  • rust-num-bigint0.4-0.4.8-1.el9
  • rust-num-bigint-0.5.1-1.el9
  • rust-num-modular0.6-0.6.5-1.el9
  • rust-num-modular-0.7.0-1.el9
  • rust-num-prime-0.5.0-3.el9
  • rust-zmij-1.0.23-1.el9
Update description:
  • Update the crypto-bigint crate to version 0.7.10.
  • Update the ctutils crate to version 0.4.8.
  • Update the elliptic-curve crate to version 0.14.3.
  • Update the num-bigint crate to version 0.5.1 and add a compat package for version 0.4.
  • Update the num-modular crate to version 0.7.0 and add a compat package for version 0.6.
  • Update the zmij crate to version 1.0.23.

This update includes improvements to constant-time implementations in the crypto-bigint crate (assigned RUSTSEC-2026-0387).

Update to version 0.4.7.

rust-crypto-bigint-0.7.10-1.el10_4 rust-ctutils-0.4.8-1.el10_4 rust-elliptic-curve-0.14.3-1.el10_4 rust-num-bigint-0.5.1-1.el10_4 rust-num-bigint0.4-0.4.8-1.el10_4 rust-num-modular-0.7.0-1.el10_4 rust-num-modular0.6-0.6.5-1.el10_4 rust-num-prime-0.5.0-3…

Fedora Security Advisories
4 days 8 hours ago
FEDORA-EPEL-2026-9de0336e50 Packages in this update:
  • rust-crypto-bigint-0.7.10-1.el10_4
  • rust-ctutils-0.4.8-1.el10_4
  • rust-elliptic-curve-0.14.3-1.el10_4
  • rust-num-bigint0.4-0.4.8-1.el10_4
  • rust-num-bigint-0.5.1-1.el10_4
  • rust-num-modular0.6-0.6.5-1.el10_4
  • rust-num-modular-0.7.0-1.el10_4
  • rust-num-prime-0.5.0-3.el10_4
  • rust-zmij-1.0.23-1.el10_4
Update description:
  • Update the crypto-bigint crate to version 0.7.10.
  • Update the ctutils crate to version 0.4.8.
  • Update the elliptic-curve crate to version 0.14.3.
  • Update the num-bigint crate to version 0.5.1 and add a compat package for version 0.4.
  • Update the num-modular crate to version 0.7.0 and add a compat package for version 0.6.
  • Update the zmij crate to version 1.0.23.

This update includes improvements to constant-time implementations in the crypto-bigint crate (assigned RUSTSEC-2026-0387).

Update to version 0.4.7.

rust-crypto-bigint-0.7.10-1.fc43 rust-ctutils-0.4.8-1.fc43 rust-elliptic-curve-0.14.3-1.fc43 rust-num-bigint-0.5.1-1.fc43 rust-num-bigint0.4-0.4.8-1.fc43 rust-num-modular-0.7.0-1.fc43 rust-num-modular0.6-0.6.5-1.fc43 rust-num-prime-0.5.0-3.fc43 rust-zmij…

Fedora Security Advisories
4 days 8 hours ago
FEDORA-2026-49adf7234d Packages in this update:
  • rust-crypto-bigint-0.7.10-1.fc43
  • rust-ctutils-0.4.8-1.fc43
  • rust-elliptic-curve-0.14.3-1.fc43
  • rust-num-bigint0.4-0.4.8-1.fc43
  • rust-num-bigint-0.5.1-1.fc43
  • rust-num-modular0.6-0.6.5-1.fc43
  • rust-num-modular-0.7.0-1.fc43
  • rust-num-prime-0.5.0-3.fc43
  • rust-zmij-1.0.23-1.fc43
Update description:
  • Update the crypto-bigint crate to version 0.7.10.
  • Update the ctutils crate to version 0.4.8.
  • Update the elliptic-curve crate to version 0.14.3.
  • Update the num-bigint crate to version 0.5.1 and add a compat package for version 0.4.
  • Update the num-modular crate to version 0.7.0 and add a compat package for version 0.6.
  • Update the zmij crate to version 1.0.23.

This update includes improvements to constant-time implementations in the crypto-bigint crate (assigned RUSTSEC-2026-0387).

Update to version 0.4.7.

rust-crypto-bigint-0.7.10-1.fc44 rust-ctutils-0.4.8-1.fc44 rust-elliptic-curve-0.14.3-1.fc44 rust-num-bigint-0.5.1-1.fc44 rust-num-bigint0.4-0.4.8-1.fc44 rust-num-modular-0.7.0-1.fc44 rust-num-modular0.6-0.6.5-1.fc44 rust-num-prime-0.5.0-3.fc44 rust-zmij…

Fedora Security Advisories
4 days 8 hours ago
FEDORA-2026-666aa95b1b Packages in this update:
  • rust-crypto-bigint-0.7.10-1.fc44
  • rust-ctutils-0.4.8-1.fc44
  • rust-elliptic-curve-0.14.3-1.fc44
  • rust-num-bigint0.4-0.4.8-1.fc44
  • rust-num-bigint-0.5.1-1.fc44
  • rust-num-modular0.6-0.6.5-1.fc44
  • rust-num-modular-0.7.0-1.fc44
  • rust-num-prime-0.5.0-3.fc44
  • rust-zmij-1.0.23-1.fc44
Update description:
  • Update the crypto-bigint crate to version 0.7.10.
  • Update the ctutils crate to version 0.4.8.
  • Update the elliptic-curve crate to version 0.14.3.
  • Update the num-bigint crate to version 0.5.1 and add a compat package for version 0.4.
  • Update the num-modular crate to version 0.7.0 and add a compat package for version 0.6.
  • Update the zmij crate to version 1.0.23.

This update includes improvements to constant-time implementations in the crypto-bigint crate (assigned RUSTSEC-2026-0387).

Update to version 0.4.7.

rust-crypto-bigint-0.7.10-1.fc45 rust-ctutils-0.4.8-1.fc45 rust-elliptic-curve-0.14.3-1.fc45 rust-num-bigint-0.5.1-1.fc45 rust-num-bigint0.4-0.4.8-1.fc45 rust-num-modular-0.7.0-1.fc45 rust-num-modular0.6-0.6.5-1.fc45 rust-num-prime-0.5.0-3.fc45 rust-zmij…

Fedora Security Advisories
4 days 8 hours ago
FEDORA-2026-45268841b3 Packages in this update:
  • rust-crypto-bigint-0.7.10-1.fc45
  • rust-ctutils-0.4.8-1.fc45
  • rust-elliptic-curve-0.14.3-1.fc45
  • rust-num-bigint0.4-0.4.8-1.fc45
  • rust-num-bigint-0.5.1-1.fc45
  • rust-num-modular0.6-0.6.5-1.fc45
  • rust-num-modular-0.7.0-1.fc45
  • rust-num-prime-0.5.0-3.fc45
  • rust-zmij-1.0.23-1.fc45
Update description:
  • Update the crypto-bigint crate to version 0.7.10.
  • Update the ctutils crate to version 0.4.8.
  • Update the elliptic-curve crate to version 0.14.3.
  • Update the num-bigint crate to version 0.5.1 and add a compat package for version 0.4.
  • Update the num-modular crate to version 0.7.0 and add a compat package for version 0.6.
  • Update the zmij crate to version 1.0.23.

This update includes improvements to constant-time implementations in the crypto-bigint crate (assigned RUSTSEC-2026-0387).

Update to version 0.4.7.