Aggregator

USN-8958-1: .NET vulnerabilities

Ubuntu Security Advisories
2 days 12 hours ago
It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via USN-8942-1, but it was found to be incomplete. This issue only affected dotnet10 and dotnet11. (CVE-2026-102870) It was discovered that the Brotli decompression library used by .NET incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-111497) Alen Cheung discovered that .NET did not properly handle file ownership in certain circumstances. An attacker could possibly use this issue to elevate local privileges. (CVE-2026-114148)

jupyterlab-4.6.3-1.fc44 python-jupyter-builder-1.2.3-1.fc44 python-jupyterlab-server-2.28.1-2.fc44 python-jupytext-1.19.6-2.fc44 python-nbdime-4.0.4-7.fc44 python-notebook-7.6.3-1.fc44

Fedora Security Advisories
2 days 12 hours ago
FEDORA-2026-34aa0f144e Packages in this update:
  • jupyterlab-4.6.3-1.fc44
  • python-jupyter-builder-1.2.3-1.fc44
  • python-jupyterlab-server-2.28.1-2.fc44
  • python-jupytext-1.19.6-2.fc44
  • python-nbdime-4.0.4-7.fc44
  • python-notebook-7.6.3-1.fc44
Update description:

New versions of packages in Jupyter stack including Jupyterlab and Notebook.

composer-2.11.0-1.fc44

Fedora Security Advisories
2 days 17 hours ago
FEDORA-2026-467e26c90c Packages in this update:
  • composer-2.11.0-1.fc44
Update description: Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.0-1.el10_4

Fedora Security Advisories
2 days 17 hours ago
FEDORA-EPEL-2026-cb08b2f71b Packages in this update:
  • composer-2.11.0-1.el10_4
Update description: Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)

composer-2.11.0-1.el10_2

Fedora Security Advisories
2 days 17 hours ago
FEDORA-EPEL-2026-780d22d64f Packages in this update:
  • composer-2.11.0-1.el10_2
Update description: Version 2.11.0 - 2026-10-29
  • Security: Fixed package names in vendor/composer/installed.json being able to escape the vendor directory during install and reinstall (GHSA-c968-33g3-wh7p)
  • Security: Fixed inline repository HTTP headers, such as API tokens, being written into composer.lock (GHSA-fm2w-xgf2-f9fh)
  • Security: Fixed additional arguments passed to @composer scripts not being escaped (#13169)
  • Security: Fixed svn passwords not being redacted from debug output (#13171)
  • Security: Sanitize URL-embedded credentials in hg and fossil error output (#13172)
  • Improved dependency resolution performance and memory usage (#13174)
  • Fixed config corrupting composer.json when modifying extra or scripts entries which are JSON arrays (#13167)
  • Fixed archives not being unwrapped correctly when OS/editor metadata entries like __MACOSX or Thumbs.db sit next to the package's top-level dir (#13168)
  • Fixed @script references with quoted arguments being split on spaces when passed to @composer scripts (#13169)