pylint-4.0.5-3.fc44
FEDORA-2026-cd3aa9b176
Packages in this update:
- pylint-4.0.5-3.fc44
Patch for CVE-2026-114608
Fedora Security Advisories
scribus-1.6.7-1.el9
FEDORA-EPEL-2026-a8d4620d5c
Packages in this update:
- scribus-1.6.7-1.el9
1.6.7
python-PyMuPDF-1.28.2-2.fc44
FEDORA-2026-c4245c7166
Packages in this update:
- python-PyMuPDF-1.28.2-2.fc44
fix CVE-2026-120752 (rhbz#2567075) (rhbz#2567076)
asterisk-18.26.4-3.el8
FEDORA-EPEL-2026-ba6e61f1d3
Packages in this update:
- asterisk-18.26.4-3.el8
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
asterisk-18.26.4-3.el9
FEDORA-EPEL-2026-4e6e6af48a
Packages in this update:
- asterisk-18.26.4-3.el9
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
asterisk-18.26.4-3.fc43
FEDORA-2026-011a22de5e
Packages in this update:
- asterisk-18.26.4-3.fc43
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
asterisk-18.26.4-3.fc44
FEDORA-2026-715e85a80b
Packages in this update:
- asterisk-18.26.4-3.fc44
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes for the bundled pjproject 2.15.1: - CVE-2026-41415: out-of-bounds read on a malformed Content-ID URI in SIP multipart bodies - CVE-2026-41416: integer overflow in the audio stream buffer size with an asymmetric ptime configuration - CVE-2026-57160: one-byte heap overflow when printing generic array headers - CVE-2026-84975: TLS server impersonation via an embedded NUL in a DNS SubjectAltName (OpenSSL and GnuTLS backends) - CVE-2026-25994: heap buffer overflow in ICE with a long username - CVE-2026-28799: use-after-free in presence subscription termination - CVE-2026-32942: ICE session use-after-free race conditions - CVE-2026-33069: out-of-bounds read in SIP multipart parsing
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57191: PJSIP MWI NOTIFY Message-Account stack buffer overflow - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
Security update: backport upstream Asterisk security fixes to 18.26.4.
Fixes from the Asterisk 20.20.1 security release: - CVE-2026-57185: PJSIP MWI NOTIFY body over-read (DoS) - CVE-2026-57187: PJSIP use-after-free on early disconnect during INVITE - CVE-2026-57189, CVE-2026-57198: T.140 RED heap buffer overflows in res_rtp_asterisk - CVE-2026-57190: SQL injection via CELGenUserEvent in cel_pgsql / cel_tds - CVE-2026-57193: LDAP filter injection in res_config_ldap - CVE-2026-57194: chan_unistim out-of-bounds write - CVE-2026-57195: AMI HTTP digest authentication NULL dereference - CVE-2026-57196: reflected XSS in HTTP error pages - CVE-2026-57197: format_ogg_speex heap buffer overflow - CVE-2026-57199: app_sms buffer overflow - CVE-2026-57202: ARI setChannelVar bypassed live_dangerously - CVE-2026-57203: ast_loggrabber executed a helper script from /tmp
Fixes from the Asterisk 20.18.2 security release: - CVE-2026-23738: reflected XSS in /httpstatus (the page is now disabled by default) - CVE-2026-23739: XML parsing with external entity expansion - CVE-2026-23740: ast_coredumper created gdbinit/output files insecurely - CVE-2026-23741: ast_coredumper sourced a config file writable by the asterisk user
/etc/asterisk/ast_debug_tools.conf is now owned by root:asterisk. The debug scripts (ast_coredumper, ast_loggrabber, ast_logescalator) refuse to source it as root unless it is root-owned and not group- or world-writable.
python-PyMuPDF-1.28.2-2.fc45
FEDORA-2026-5c698a4358
Packages in this update:
- python-PyMuPDF-1.28.2-2.fc45
fix CVE-2026-120752 (rhbz#2567075) (rhbz#2567076)
python-PyMuPDF-1.28.2-2.fc46
FEDORA-2026-4a2913750e
Packages in this update:
- python-PyMuPDF-1.28.2-2.fc46
Automatic update for python-PyMuPDF-1.28.2-2.fc46.
Changelog * Wed Nov 4 2026 Michael J Gruber <mjg@fedoraproject.org> - 1.28.2-2 - fix CVE-2026-120752 (rhbz#2567075) (rhbz#2567076)erlang-ssl_verify_fun-1.1.9-1.fc45
FEDORA-2026-64d3a7301a
Packages in this update:
- erlang-ssl_verify_fun-1.1.9-1.fc45
ssl_verify_fun ver. 1.1.9
erlang-ssl_verify_fun-1.1.9-1.fc44
FEDORA-2026-294100aaf6
Packages in this update:
- erlang-ssl_verify_fun-1.1.9-1.fc44
ssl_verify_fun ver. 1.1.9
rabbitmq-server-4.0.9-7.fc43
FEDORA-2026-ea1afc0a7b
Packages in this update:
- rabbitmq-server-4.0.9-7.fc43
Security update: backport upstream RabbitMQ security fixes to 4.0.9.
Management UI and HTTP API: - CVE-2026-67421: HTML injection on the OAuth 2 login page via an attacker-controlled queue name; the error reason is now escaped and the default CSP gains base-uri 'none'. - CVE-2026-67239: stored XSS via TLS peer certificate fields in the stream connection page. - CVE-2026-66073, CVE-2026-67226, CVE-2026-67227: atom table exhaustion via the "node" field, the user tags list and global parameter names. - CVE-2026-61837: the AMQP 1.0 management GET /bindings endpoint now checks permissions like the other binding operations.
Authentication and authorisation: - CVE-2026-67223: LDAP user DN templates now RFC 4514-escape the username. - CVE-2026-44838, CVE-2026-67407: regex metacharacters (including "-") in topic permission variables are now escaped. - CVE-2026-67411: MQTT and Web MQTT behind a PROXY protocol frontend now check loopback_users against the real client address. - CVE-2026-67412: Federation upstream URIs now require access to the target virtual host. - CVE-2026-66071: OAuth 2 tag scopes no longer create new atoms. - CVE-2026-67222: AMQP URI auth_mechanism values are limited to known mechanisms and no longer create atoms.
Denial of service: - CVE-2026-67413: JMS topic exchange LIKE selectors run with regex match limits. - CVE-2026-67230: Web STOMP enforces the login timeout and a frame size limit before authentication. - CVE-2026-67225: the stream protocol rejects frames larger than the negotiated frame_max.
This update also includes the fixes from 4.0.9-6 (CVE-2026-67409, CVE-2026-67416, CVE-2026-67418, CVE-2026-67420).
Security update: backport upstream RabbitMQ security fixes to 4.0.9.
- CVE-2026-67409: JWKS signing keys are now only replaced from a successful (HTTP 200), well-formed response, so an error reply from the OAuth 2 provider can no longer wipe the cached keys and deny all OAuth 2 logins.
- CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
- CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
- CVE-2026-67420: user tags are rebuilt on OAuth 2 credential refresh, so a revoked impersonator tag no longer survives on an existing connection.
rabbitmq-server-4.2.9-5.fc44
FEDORA-2026-296b2865ba
Packages in this update:
- rabbitmq-server-4.2.9-5.fc44
Fix for CVE-2026-67421
Security update: backport upstream RabbitMQ security fixes to 4.2.9.
- CVE-2026-67414: an authenticated AMQP 1.0 client could exhaust broker memory with arrays of zero-width elements; such arrays are now kept as opaque values.
- CVE-2026-67416: AMQP 1.0 body section descriptors are now matched by exact symbol length, so crafted descriptors can no longer crash consumers.
- CVE-2026-67418: MQTT 5 properties that are not valid for the packet type are now rejected, so a publisher can no longer disconnect matching subscribers.
Also includes the CVE-2026-67420 fix from 4.2.9-3 (stale impersonator tag kept after OAuth token refresh). CVE-2026-67409 and CVE-2026-67410 are fixed upstream in 4.2.9.
Fix for CVE-2026-67420 (RabbitMQ: unauthorized user impersonation via stale OAuth token refresh). On a JWT/OAuth token refresh, rabbit_access_control:update_state/2 discarded the refreshed user tags, so a revoked 'impersonator' tag could survive on an existing connection. Backported from upstream v4.3.x (commit 5de287d).
mtools-4.0.50-1.fc43
FEDORA-2026-93ccf43a01
Packages in this update:
- mtools-4.0.50-1.fc43
Update to 4.0.50 (#2564411)
gimp-3.2.8-1.fc43
FEDORA-2026-69a77954cf
Packages in this update:
- gimp-3.2.8-1.fc43
This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.
For more information, please consult the GIMP 3.2.8 release announcement.
gimp-3.2.8-1.fc45
FEDORA-2026-e55621607b
Packages in this update:
- gimp-3.2.8-1.fc45
This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.
For more information, please consult the GIMP 3.2.8 release announcement.
gimp-3.2.8-1.fc44
FEDORA-2026-32431829f1
Packages in this update:
- gimp-3.2.8-1.fc44
This update contains new upstream releases containing bugfixes and improvements. Notably, it fixes security flaws in various file format plugins.
For more information, please consult the GIMP 3.2.8 release announcement.
python-loguru-0.7.3-9.el10_3
FEDORA-EPEL-2026-c167d2d2d7
Packages in this update:
- python-loguru-0.7.3-9.el10_3
Backport fix for CVE-2026-120217
mongo-c-driver-2.5.8-1.fc45
FEDORA-2026-4701fdc782
Packages in this update:
- mongo-c-driver-2.5.8-1.fc45
Fixes
- Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954
Fixes
- Fix abort when parsing a cursor namespace without a dot separator.
- Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
- Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
- Fix a missing bounds check when reading GridFS files. CVE-2026-120684
- Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
- Report writeConcernError consistently, as mandated by the CRUD spec.
mongo-c-driver-2.5.8-1.el10_4
FEDORA-EPEL-2026-0da73d1b5b
Packages in this update:
- mongo-c-driver-2.5.8-1.el10_4
Fixes
- Fix possible truncation in BSON binary vector on 32-bit builds. CVE-2026-120954
Fixes
- Fix abort when parsing a cursor namespace without a dot separator.
- Fix possible abort in mongoc_gridfs_bucket_download_to_stream on invalid file metadata. CVE-2026-120955*
- Fix handling of embedded NUL bytes in namespaces. CVE-2026-120956
- Fix a missing bounds check when reading GridFS files. CVE-2026-120684
- Fix a memory leak when an OP_COMPRESSED reply fails to parse. CVE-2026-120678
- Report writeConcernError consistently, as mandated by the CRUD spec.