Aggregator

USN-8670-2: curl vulnerability

2 days 9 hours ago
USN-8670-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. Original advisory details: Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations.

USN-8675-1: Perl vulnerabilities

2 days 10 hours ago
It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087) It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221) It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432) It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

emacs-30.2-28.fc44

2 days 12 hours ago
FEDORA-2026-60eff202e7 Packages in this update:
  • emacs-30.2-28.fc44
Update description:

Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader.

emacs-30.2-10.fc43

2 days 12 hours ago
FEDORA-2026-8894da1406 Packages in this update:
  • emacs-30.2-10.fc43
Update description:

Fix CVE-2026-77219: Integer overflow in PBM/PPM/PGM image loader.

curl-8.18.0-9.fc44

2 days 16 hours ago
FEDORA-2026-2f88b83676 Packages in this update:
  • curl-8.18.0-9.fc44
Update description:
  • Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)
  • Fix WS Auto-PONG memory exhaustion (CVE-2026-11586)
  • Fix proto-default skips SSH verification (CVE-2026-12064)
  • Fix wrong STARTTLS connection reuse (CVE-2026-8286)
  • Fix SASL double-free (CVE-2026-8925)
  • Fix env-set cross-proxy Digest auth state leak (CVE-2026-8927)
  • Fix sending old referer (CVE-2026-9546)
  • Fix exposing HTTP/3 early data (CVE-2026-9545)
  • Fix UAF after pause in socket callback (CVE-2026-9080)

proftpd-1.3.9d-2.el10_4

2 days 18 hours ago
FEDORA-EPEL-2026-37261f4ecd Packages in this update:
  • proftpd-1.3.9d-2.el10_4
Update description:

Current upstream maintenance release, with a handful of potentially security-related bugfixes.

python-linkify-it-py-2.1.1-1.fc44

3 days 6 hours ago
FEDORA-2026-7c23b06d74 Packages in this update:
  • python-linkify-it-py-2.1.1-1.fc44
Update description:

Security release: LinkifyIt.match() was quadratic on untrusted input when linkify is enabled (GHSA-8m2q-wq3r-6hq8).

  • Fix quadratic complexity in LinkifyIt.match(), port of linkify-it 5.0.1 and 5.0.2 (upstream CVE-2026-48801, CVE-2026-59887) (#82)
  • Match validators at a position instead of slicing the tail, needed because Python 3.10 does not optimize the ^ anchor (#82)
  • Allow ; in the email name, matching linkify-it. Behavior change: a;b@example.com is now linkified (#82)
  • Update port.yml (linkify-it v5.0.2) (#82)

USN-8671-1: FFmpeg vulnerabilities

3 days 8 hours ago
Adrian Junge was discovered that FFmpeg incorrectly handled certain media files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-66036, CVE-2026-66039) Adrian Junge discovered that FFmpeg incorrectly handled certain media files. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66038)

USN-8670-1: curl vulnerability

3 days 9 hours ago
Joshua Rogers discovered that curl incorrectly handled reusing connections when client certificate settings changed. This could result in the wrong client certificates being used, contrary to expectations.

perl-DBD-Pg-3.21.1-2.fc44

3 days 11 hours ago
FEDORA-2026-bef4b3d7a3 Packages in this update:
  • perl-DBD-Pg-3.21.1-2.fc44
Update description:

Fix missing closing double-quote in su -c commands in dbdpg_test_setup.pl

3.21.0m 3.21.1: - New features: non-blocking async COPY FROM support (pg_putcopydata_async, pg_putcopyend_async, pg_flush); new string-buffer system replacing linked lists with arrays (faster) - Bug fixes: memory leaks fixed (PQclosePrepared cleanup path, bind_param, statement handles); float quoting fixes (NaN); $sth->rows() returns 0 for no-row updates/deletes; safer NUL checking in _dequote_bytea_hex(); allocation fixes in quote_float() / pg_destringify_array() - Fix CVE-2026-78183

chromium-151.0.7922.173-1.el10_2

3 days 12 hours ago
FEDORA-EPEL-2026-9264cd8a7d Packages in this update:
  • chromium-151.0.7922.173-1.el10_2
Update description:

Update to 151.0.7922.173

* CVE-2026-76017: Use after free in Chromoting * CVE-2026-76018: Privilege elevation in Import * CVE-2026-76019: Incorrect authorization in Workers * CVE-2026-76020: Race condition in V8 * CVE-2026-76021: Use after free in DOM * CVE-2026-76022: Buffer overflow in Network * CVE-2026-76023: Improper resource control in Linux Toolkit Theming

chromium-151.0.7922.173-1.fc43

3 days 12 hours ago
FEDORA-2026-129176284e Packages in this update:
  • chromium-151.0.7922.173-1.fc43
Update description:

Update to 151.0.7922.173

* CVE-2026-76017: Use after free in Chromoting * CVE-2026-76018: Privilege elevation in Import * CVE-2026-76019: Incorrect authorization in Workers * CVE-2026-76020: Race condition in V8 * CVE-2026-76021: Use after free in DOM * CVE-2026-76022: Buffer overflow in Network * CVE-2026-76023: Improper resource control in Linux Toolkit Theming