Fedora Security Advisories

• perl-Net-IDN-Encode-2.600-1.fc45

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input

• perl-Net-IDN-Encode-2.600-1.fc44

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input

• perl-Net-IDN-Encode-2.600-1.fc43

Version 2.600 of Net::IDN::Encode fixes multiple CVEs: * CVE-2026-74766, a heap use-after-free in the XS decode_punycode * CVE-2026-74765, an integer overflow and out-of-bounds read in the XS encode_punycode * CVE-2026-87078, memory leaks when the XS functions reject input * CVE-2026-87079, quadratic decoding of large labels * CVE-2026-87080, the pure-Perl decoder accepting a truncated label * CVE-2026-87081, quadratic encoding of overlong labels in to_ascii * CVE-2026-87082, the XS encode_punycode looping for ever on malformed UTF-8 input

• perl-Starlet-0.33-1.fc44

Starlet 0.33 fixes several security issues in the Starlet code: * prevent excessive CPU use when parsing malformed chunk-size lines * bound read allocations for large Content-Length values * stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes

• perl-Starlet-0.33-1.fc45

Starlet 0.33 fixes several security issues in the Starlet code: * prevent excessive CPU use when parsing malformed chunk-size lines * bound read allocations for large Content-Length values * stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes

• perl-Starlet-0.33-1.fc43

Starlet 0.33 fixes several security issues in the Starlet code: * prevent excessive CPU use when parsing malformed chunk-size lines * bound read allocations for large Content-Length values * stream chunk data to the body buffer and limit chunk-size lines to 4096 bytes

• perl-Spreadsheet-XLSX-0.20-1.el10_3

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el10_4

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el9

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.fc45

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el8

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.fc44

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.fc43

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• perl-Spreadsheet-XLSX-0.20-1.el10_2

• Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata.
• Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles.
• Security: reject out-of-range date values to prevent excessive CPU usage.
• Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows.
• Improve Readme.

• Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files.
• Add regression tests for numeric conditions and malicious XLSX formats.

• suricata-8.0.7-1.el10_2

upstream bugfix/security release

• suricata-8.0.7-1.el10_3

upstream security/bugfix release

• suricata-8.0.7-1.el10_4

upstream security/bugfix release

• suricata-8.0.8-1.fc44

upstream security/bugfix release

• mingw-qt5-qtdeclarative-5.15.18-4.fc44

Backport fix for CVE-2025-12385.

• mingw-qt5-qtdeclarative-5.15.18-4.fc43

Backport fix for CVE-2025-12385.