Fedora Security Advisories

• librabbitmq-0.17.0-1.fc43

• Fix size_t overflow in amqp_decode_bytes bounds check leading to out-of-bounds read (GHSA-jgjf-7fwf-f3c7, #888)
• Fix heap buffer overflow in amqp_frame_to_bytes for oversized body frames (GHSA-hfjv-vcp3-39wh, #892)

• librabbitmq-tools fall back to the AMQP_URL environment variable when no connection options are given on the command line (#887)

• Fix undefined behavior in amqp_decode_properties when decoding content-header property flags (#883, #885)
• Fix ioctlsocket type mismatch on Windows (#890)
• Document buffer lifetime requirement of amqp_decode_table's encoded buffer to prevent use-after-free misuse (#895)

• librabbitmq-tools now enable default SSL certificate verification paths unless --no-default-cert-paths is passed (fixes #868, #893)
• Building the tools now requires POPT v1.14 or newer (#889)

• librabbitmq-0.17.0-1.fc44

• Fix size_t overflow in amqp_decode_bytes bounds check leading to out-of-bounds read (GHSA-jgjf-7fwf-f3c7, #888)
• Fix heap buffer overflow in amqp_frame_to_bytes for oversized body frames (GHSA-hfjv-vcp3-39wh, #892)

• librabbitmq-tools fall back to the AMQP_URL environment variable when no connection options are given on the command line (#887)

• Fix undefined behavior in amqp_decode_properties when decoding content-header property flags (#883, #885)
• Fix ioctlsocket type mismatch on Windows (#890)
• Document buffer lifetime requirement of amqp_decode_table's encoded buffer to prevent use-after-free misuse (#895)

• librabbitmq-tools now enable default SSL certificate verification paths unless --no-default-cert-paths is passed (fixes #868, #893)
• Building the tools now requires POPT v1.14 or newer (#889)

• composer-2.10.2-1.el9

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

• composer-2.10.2-1.el10_3

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

• composer-2.10.2-1.fc44

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

• composer-2.10.2-1.fc43

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

• composer-2.10.2-1.el10_2

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

• OpenImageIO-3.1.15.0-1.fc44

https://github.com/AcademySoftwareFoundation/OpenImageIO/releases/tag/v3.1.15.0

• openvpn-2.5.11-2.el9

Update to upstream git 37160ee8408150990787eef4a76e0299230ed8d8

• openvpn-2.7.5-1.el10_2

Update to upstream 2.7.5 release

• openvpn-2.7.5-1.el10_3

Update to upstream 2.7.5 release

• 7zip-26.02-1.fc44

7-zip 26.02

• Some bugs and vulnerabilities were fixed.

• 7zip-26.02-1.el9

7-zip 26.02

• Some bugs and vulnerabilities were fixed.

• 7zip-26.02-1.fc43

7-zip 26.02

• Some bugs and vulnerabilities were fixed.

• 7zip-26.02-1.el10_2

7-zip 26.02

• Some bugs and vulnerabilities were fixed.

• 7zip-26.02-1.el10_3

7-zip 26.02

• Some bugs and vulnerabilities were fixed.

• openvpn-2.6.21-1.fc43

Update to upstream 2.6.21 release

• openvpn-2.7.5-1.fc44

Update to upstream 2.7.5 release

• kernel-7.0.14-201.fc44

The 7.0.14-101/201 kernel builds contain a fix for an unprivileged container / jail escape. This has not been assigned a CVE number yet, but a POC is in the wild.

The 7.0.14 stable kernel update contains a number of important fixes across the tree.

• kernel-7.0.14-101.fc43

The 7.0.14-101/201 kernel builds contain a fix for an unprivileged container / jail escape. This has not been assigned a CVE number yet, but a POC is in the wild.

The 7.0.14 stable kernel update contains a number of important fixes across the tree.