Aggregator

FEDORA-EPEL-2026-a8d4620d5c Packages in this update:

• scribus-1.6.7-1.el9

Update description:

1.6.7

FEDORA-2026-c4245c7166 Packages in this update:

• python-PyMuPDF-1.28.2-2.fc44

Update description:

fix CVE-2026-120752 (rhbz#2567075) (rhbz#2567076)

FEDORA-EPEL-2026-ba6e61f1d3 Packages in this update:

• asterisk-18.26.4-3.el8

Update description:

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

FEDORA-EPEL-2026-4e6e6af48a Packages in this update:

• asterisk-18.26.4-3.el9

Update description:

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

FEDORA-2026-011a22de5e Packages in this update:

• asterisk-18.26.4-3.fc43

Update description:

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

FEDORA-2026-715e85a80b Packages in this update:

• asterisk-18.26.4-3.fc44

Update description:

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

Security update: backport upstream Asterisk security fixes to 18.26.4.

Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp

Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user

/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.

FEDORA-2026-5c698a4358 Packages in this update:

• python-PyMuPDF-1.28.2-2.fc45

Update description:

fix CVE-2026-120752 (rhbz#2567075) (rhbz#2567076)

FEDORA-2026-4a2913750e Packages in this update:

• python-PyMuPDF-1.28.2-2.fc46

Update description:

Automatic update for python-PyMuPDF-1.28.2-2.fc46.

Changelog * Wed Nov 4 2026 Michael J Gruber <mjg@fedoraproject.org> - 1.28.2-2 - fix CVE-2026-120752 (rhbz#2567075) (rhbz#2567076)

FEDORA-2026-64d3a7301a Packages in this update:

• erlang-ssl_verify_fun-1.1.9-1.fc45

Update description:

ssl_verify_fun ver. 1.1.9

FEDORA-2026-294100aaf6 Packages in this update:

• erlang-ssl_verify_fun-1.1.9-1.fc44

Update description:

ssl_verify_fun ver. 1.1.9

FEDORA-2026-ea1afc0a7b Packages in this update:

• rabbitmq-server-4.0.9-7.fc43

Update description:

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

Management UI and HTTP API: - CVE-2026-67421: HTML injection on the OAuth 2 login page via an attacker-controlled queue name; the error reason is now escaped and the default CSP gains base-uri 'none'. - CVE-2026-67239: stored XSS via TLS peer certificate fields in the stream connection page. - CVE-2026-66073, CVE-2026-67226, CVE-2026-67227: atom table exhaustion via the "node" field, the user tags list and global parameter names. - CVE-2026-61837: the AMQP 1.0 management GET /bindings endpoint now checks permissions like the other binding operations.

Authentication and authorisation: - CVE-2026-67223: LDAP user DN templates now RFC 4514-escape the username. - CVE-2026-44838, CVE-2026-67407: regex metacharacters (including "-") in topic permission variables are now escaped. - CVE-2026-67411: MQTT and Web MQTT behind a PROXY protocol frontend now check loopback_users against the real client address. - CVE-2026-67412: Federation upstream URIs now require access to the target virtual host. - CVE-2026-66071: OAuth 2 tag scopes no longer create new atoms. - CVE-2026-67222: AMQP URI auth_mechanism values are limited to known mechanisms and no longer create atoms.

Denial of service: - CVE-2026-67413: JMS topic exchange LIKE selectors run with regex match limits. - CVE-2026-67230: Web STOMP enforces the login timeout and a frame size limit before authentication. - CVE-2026-67225: the stream protocol rejects frames larger than the negotiated frame_max.

This update also includes the fixes from 4.0.9-6 (CVE-2026-67409, CVE-2026-67416, CVE-2026-67418, CVE-2026-67420).

Security update: backport upstream RabbitMQ security fixes to 4.0.9.

• CVE-2026-67409: JWKS signing keys are now only replaced from a successful (HTTP 200), well-formed response, so an error reply from the OAuth 2 provider can no longer wipe the cached keys and deny all OAuth 2 logins.
• CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
• CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
• CVE-2026-67420: user tags are rebuilt on OAuth 2 credential refresh, so a revoked impersonator tag no longer survives on an existing connection.

FEDORA-2026-296b2865ba Packages in this update:

• rabbitmq-server-4.2.9-5.fc44

Update description:

Fix for CVE-2026-67421

Security update: backport upstream RabbitMQ security fixes to 4.2.9.

• CVE-2026-67414: an authenticated AMQP 1.0 client could exhaust broker memory with arrays of zero-width elements; such arrays are now kept as opaque values.
• CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
• CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.

Also includes the CVE-2026-67420 fix from 4.2.9-3 (stale impersonator tag kept after OAuth token refresh). CVE-2026-67409 and CVE-2026-67410 are fixed upstream in 4.2.9.

Fix for CVE-2026-67420 (RabbitMQ: unauthorized user impersonation via stale OAuth token refresh). On a JWT/OAuth token refresh, rabbit_access_control:update_state/2 discarded the refreshed user tags, so a revoked 'impersonator' tag could survive on an existing connection. Backported from upstream v4.3.x (commit 5de287d).

It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources, leading to a denial of service.

It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service. (CVE-2026-54058) It was discovered that Pillow did not properly check for decompression bombs when processing font files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379) It was discovered that Pillow did not properly check for decompression bombs when loading GD image files. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-55380) It was discovered that Pillow incorrectly validated filter sizes in the rank filter implementation. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59197) It was discovered that Pillow incorrectly handled image coordinate calculations. An attacker could possibly use this issue to cause Pillow to crash. (CVE-2026-59199) It was discovered that Pillow did not properly limit the size of decompressed PDF stream data. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59200) It was discovered that Pillow incorrectly parsed EPS files containing a negative byte count in the BeginBinary directive. An attacker could possibly use this issue to cause Pillow to hang, resulting in a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59203) It was discovered that Pillow incorrectly accumulated JPEG2000 tile component widths. An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service. (CVE-2026-59204) It was discovered that Pillow incorrectly validated image mode compatibility in color management transforms. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code. (CVE-2026-59205)

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches.

It was discovered that Net-SNMP incorrectly handled newly accepted connections in the SMUX module. An unauthenticated remote attacker could possibly use this issue to cause Net-SNMP to block indefinitely, resulting in a denial of service.

USN-7530-1 fixed a vulnerability in ADOdb. This update provides the corresponding updates for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. Original advisory details: It was discovered that ADOdb incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands.

FEDORA-2026-93ccf43a01 Packages in this update:

• mtools-4.0.50-1.fc43

Update description:

Update to 4.0.50 (#2564411)

Version:next-20261104 (linux-next) Released:2026-11-04

Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use this issue to trick APT into installing an unverified package and achieve remote code execution with root privileges.