Fedora 41 Update: chromium-142.0.7444.175-2.fc41
Fedora 41 Update: sudo-rs-0.2.10-1.fc41
Fedora 42 Update: docker-buildx-0.30.1-1.fc42
Fedora 42 Update: sudo-rs-0.2.10-1.fc42
Fedora 43 Update: docker-buildx-0.30.1-1.fc43
Fedora 43 Update: docker-buildkit-0.26.1-1.fc43
Fedora 43 Update: sudo-rs-0.2.10-1.fc43
[SECURITY] Fedora 41 Update: chromium-142.0.7444.175-2.fc41
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-ee528a170d
2025-11-26 01:21:27.026049+00:00
--------------------------------------------------------------------------------
Name : chromium
Product : Fedora 41
Version : 142.0.7444.175
Release : 2.fc41
URL : http://www.chromium.org/Home
Summary : A WebKit (Blink) powered web browser that Google doesn't want you to use
Description :
Chromium is an open-source web browser, powered by WebKit (Blink).
--------------------------------------------------------------------------------
Update Information:
Update to 142.0.7444.175
* High CVE-2025-13223: Type Confusion in V8
* High CVE-2025-13224: Type Confusion in V8
--------------------------------------------------------------------------------
ChangeLog:
* Wed Nov 19 2025 Than Ngo [than@redhat.com] - 142.0.7444.175-2
- Fix typos in chromium.conf
* Tue Nov 18 2025 Than Ngo [than@redhat.com] - 142.0.7444.175-1
- Update to 142.0.7444.175
* High CVE-2025-13223: Type Confusion in V8
* High CVE-2025-13224: Type Confusion in V8
* Sat Nov 15 2025 LuK1337 [priv.luk@gmail.com] - 142.0.7444.162-2
- Disable LensOverlay feature by default
* Thu Nov 13 2025 Mamoru TASAKA [mtasaka@fedoraproject.org] - 142.0.7444.162-2
- Rebuild for ffmpeg 8 again
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2413748 - [abrt] chromium: ImmediateCrash(): chromium-browser killed by SIGTRAP
https://bugzilla.redhat.com/show_bug.cgi?id=2413748
[ 2 ] Bug #2414369 - CVE-2025-12910 chromium: Inappropriate implementation in Passkeys [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2414369
[ 3 ] Bug #2414371 - CVE-2025-12910 chromium: Inappropriate implementation in Passkeys [epel-9]
https://bugzilla.redhat.com/show_bug.cgi?id=2414371
[ 4 ] Bug #2414374 - CVE-2025-12910 chromium: Inappropriate implementation in Passkeys [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2414374
[ 5 ] Bug #2414376 - CVE-2025-12910 chromium: Inappropriate implementation in Passkeys [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2414376
[ 6 ] Bug #2414378 - CVE-2025-12910 chromium: Inappropriate implementation in Passkeys [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2414378
[ 7 ] Bug #2414380 - CVE-2025-12908 chromium: Insufficient validation of untrusted input in Downloads [epel-10]
https://bugzilla.redhat.com/show_bug.cgi?id=2414380
[ 8 ] Bug #2414381 - CVE-2025-12908 chromium: Insufficient validation of untrusted input in Downloads [epel-8]
https://bugzilla.redhat.com/show_bug.cgi?id=2414381
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-ee528a170d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 41 Update: sudo-rs-0.2.10-1.fc41
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-ada7909175
2025-11-26 01:21:27.026041+00:00
--------------------------------------------------------------------------------
Name : sudo-rs
Product : Fedora 41
Version : 0.2.10
Release : 1.fc41
URL : https://github.com/trifectatechfoundation/sudo-rs
Summary : Memory safe implementation of sudo and su
Description :
A memory safe implementation of sudo and su.
--------------------------------------------------------------------------------
Update Information:
Update to version 0.2.10.
This release includes fixes for CVE-2025-64170 and CVE-2025-64517.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 17 2025 Fabio Valentini [decathorpe@gmail.com] - 0.2.10-1
- Update to version 0.2.10; Fixes RHBZ#2413768
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2414748 - CVE-2025-64170 sudo-rs: sudo-rs: Partial password reveal is possible after timeout [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2414748
[ 2 ] Bug #2414776 - CVE-2025-64517 sudo-rs: Authentication bypass in timestamp [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2414776
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-ada7909175' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 42 Update: docker-buildx-0.30.1-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-04cf139ee2
2025-11-26 01:04:40.661367+00:00
--------------------------------------------------------------------------------
Name : docker-buildx
Product : Fedora 42
Version : 0.30.1
Release : 1.fc42
URL : https://github.com/docker/buildx
Summary : Docker CLI plugin for extended build capabilities with BuildKit
Description :
Docker CLI plugin for extended build capabilities with BuildKit.
--------------------------------------------------------------------------------
Update Information:
Update to release v0.30.1
Upstream fix
Update to release v0.30.0
Resolves: rhbz#2413270
Resolves: rhbz#2407614, rhbz#2407881, rhbz#2408158, rhbz#2409066
Resolves: rhbz#2409350, rhbz#2409628, rhbz#2410014, rhbz#2410300
Resolves: rhbz#2410579, rhbz#2410946, rhbz#2411477, rhbz#2412381
Resolves: rhbz#2412530, rhbz#2412682, rhbz#2412762
Upstream new features and fixes
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 17 2025 Bradley G Smith [bradley.g.smith@gmail.com] - 0.30.1-1
- Update to release v0.30.1
- Upstream fix
* Wed Nov 12 2025 Bradley G Smith [bradley.g.smith@gmail.com] - 0.30.0-1
- Update to release v0.30.0
- Resolves: rhbz#2413270
- Resolves: rhbz#2407614, rhbz#2407881, rhbz#2408158, rhbz#2409066
- Resolves: rhbz#2409350, rhbz#2409628, rhbz#2410014, rhbz#2410300
- Resolves: rhbz#2410579, rhbz#2410946, rhbz#2411477, rhbz#2412381
- Resolves: rhbz#2412530, rhbz#2412682, rhbz#2412762
- Upstream new features and fixes
* Fri Oct 10 2025 Alejandro S??ez [asm@redhat.com] - 0.29.1-2
- rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2407614 - CVE-2025-58189 docker-buildx: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2407614
[ 2 ] Bug #2407881 - CVE-2025-58189 docker-buildx: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2407881
[ 3 ] Bug #2408158 - CVE-2025-58189 docker-buildx: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2408158
[ 4 ] Bug #2409066 - CVE-2025-61723 docker-buildx: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2409066
[ 5 ] Bug #2409350 - CVE-2025-61723 docker-buildx: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2409350
[ 6 ] Bug #2409628 - CVE-2025-61723 docker-buildx: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2409628
[ 7 ] Bug #2410014 - CVE-2025-58185 docker-buildx: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2410014
[ 8 ] Bug #2410300 - CVE-2025-58185 docker-buildx: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2410300
[ 9 ] Bug #2410579 - CVE-2025-58185 docker-buildx: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2410579
[ 10 ] Bug #2410946 - CVE-2025-58188 docker-buildx: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2410946
[ 11 ] Bug #2411477 - CVE-2025-58188 docker-buildx: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2411477
[ 12 ] Bug #2412381 - CVE-2025-58188 docker-buildx: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2412381
[ 13 ] Bug #2412530 - CVE-2025-58183 docker-buildx: Unbounded allocation when parsing GNU sparse map [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2412530
[ 14 ] Bug #2412682 - CVE-2025-58183 docker-buildx: Unbounded allocation when parsing GNU sparse map [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2412682
[ 15 ] Bug #2412762 - CVE-2025-58183 docker-buildx: Unbounded allocation when parsing GNU sparse map [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2412762
[ 16 ] Bug #2413270 - docker-buildx-0.30.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2413270
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-04cf139ee2' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 42 Update: sudo-rs-0.2.10-1.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-4388808bbf
2025-11-26 01:04:40.661352+00:00
--------------------------------------------------------------------------------
Name : sudo-rs
Product : Fedora 42
Version : 0.2.10
Release : 1.fc42
URL : https://github.com/trifectatechfoundation/sudo-rs
Summary : Memory safe implementation of sudo and su
Description :
A memory safe implementation of sudo and su.
--------------------------------------------------------------------------------
Update Information:
Update to version 0.2.10.
This release includes fixes for CVE-2025-64170 and CVE-2025-64517.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 17 2025 Fabio Valentini [decathorpe@gmail.com] - 0.2.10-1
- Update to version 0.2.10; Fixes RHBZ#2413768
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2414749 - CVE-2025-64170 sudo-rs: sudo-rs: Partial password reveal is possible after timeout [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2414749
[ 2 ] Bug #2414777 - CVE-2025-64517 sudo-rs: Authentication bypass in timestamp [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2414777
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-4388808bbf' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 43 Update: docker-buildx-0.30.1-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-b1d7d7f8db
2025-11-26 00:50:04.944097+00:00
--------------------------------------------------------------------------------
Name : docker-buildx
Product : Fedora 43
Version : 0.30.1
Release : 1.fc43
URL : https://github.com/docker/buildx
Summary : Docker CLI plugin for extended build capabilities with BuildKit
Description :
Docker CLI plugin for extended build capabilities with BuildKit.
--------------------------------------------------------------------------------
Update Information:
Update to release v0.30.1
Upstream fix
Update to release v0.30.0
Resolves: rhbz#2413270
Resolves: rhbz#2407614, rhbz#2407881, rhbz#2408158, rhbz#2409066
Resolves: rhbz#2409350, rhbz#2409628, rhbz#2410014, rhbz#2410300
Resolves: rhbz#2410579, rhbz#2410946, rhbz#2411477, rhbz#2412381
Resolves: rhbz#2412530, rhbz#2412682, rhbz#2412762
Upstream new features and fixes
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 17 2025 Bradley G Smith [bradley.g.smith@gmail.com] - 0.30.1-1
- Update to release v0.30.1
- Upstream fix
* Wed Nov 12 2025 Bradley G Smith [bradley.g.smith@gmail.com] - 0.30.0-1
- Update to release v0.30.0
- Resolves: rhbz#2413270
- Resolves: rhbz#2407614, rhbz#2407881, rhbz#2408158, rhbz#2409066
- Resolves: rhbz#2409350, rhbz#2409628, rhbz#2410014, rhbz#2410300
- Resolves: rhbz#2410579, rhbz#2410946, rhbz#2411477, rhbz#2412381
- Resolves: rhbz#2412530, rhbz#2412682, rhbz#2412762
- Upstream new features and fixes
* Fri Oct 10 2025 Alejandro S??ez [asm@redhat.com] - 0.29.1-2
- rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2407614 - CVE-2025-58189 docker-buildx: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2407614
[ 2 ] Bug #2407881 - CVE-2025-58189 docker-buildx: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2407881
[ 3 ] Bug #2408158 - CVE-2025-58189 docker-buildx: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2408158
[ 4 ] Bug #2409066 - CVE-2025-61723 docker-buildx: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2409066
[ 5 ] Bug #2409350 - CVE-2025-61723 docker-buildx: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2409350
[ 6 ] Bug #2409628 - CVE-2025-61723 docker-buildx: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2409628
[ 7 ] Bug #2410014 - CVE-2025-58185 docker-buildx: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2410014
[ 8 ] Bug #2410300 - CVE-2025-58185 docker-buildx: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2410300
[ 9 ] Bug #2410579 - CVE-2025-58185 docker-buildx: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2410579
[ 10 ] Bug #2410946 - CVE-2025-58188 docker-buildx: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2410946
[ 11 ] Bug #2411477 - CVE-2025-58188 docker-buildx: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2411477
[ 12 ] Bug #2412381 - CVE-2025-58188 docker-buildx: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2412381
[ 13 ] Bug #2412530 - CVE-2025-58183 docker-buildx: Unbounded allocation when parsing GNU sparse map [fedora-41]
https://bugzilla.redhat.com/show_bug.cgi?id=2412530
[ 14 ] Bug #2412682 - CVE-2025-58183 docker-buildx: Unbounded allocation when parsing GNU sparse map [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2412682
[ 15 ] Bug #2412762 - CVE-2025-58183 docker-buildx: Unbounded allocation when parsing GNU sparse map [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2412762
[ 16 ] Bug #2413270 - docker-buildx-0.30.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2413270
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-b1d7d7f8db' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 43 Update: docker-buildkit-0.26.1-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-264853458b
2025-11-26 00:50:04.944100+00:00
--------------------------------------------------------------------------------
Name : docker-buildkit
Product : Fedora 43
Version : 0.26.1
Release : 1.fc43
URL : https://github.com/moby/buildkit
Summary : Concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit
Description :
Concurrent, cache-efficient, and Dockerfile-agnostic builder toolkit.
--------------------------------------------------------------------------------
Update Information:
Update to release v0.26.1
Update to release v0.26.0
Resolves: rhbz#2412681, rhbz#2412761
Upstream new features and fixes
dependency override for moby/policy-helper needed for license (default
version does not a a license file)
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 17 2025 Bradley G Smith [bradley.g.smith@gmail.com] - 0.26.1-1
- Update to release v0.26.1
- Upstream fixes
* Thu Nov 13 2025 Bradley G Smith [bradley.g.smith@gmail.com] - 0.26.0-1
- Update to release v0.26.0
- Resolves: rhbz#2412681, rhbz#2412761
- Upstream new features and fixes
- dependency override for moby/policy-helper needed for license (default
version does not a a license file)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2412681 - CVE-2025-58183 docker-buildkit: Unbounded allocation when parsing GNU sparse map [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2412681
[ 2 ] Bug #2412761 - CVE-2025-58183 docker-buildkit: Unbounded allocation when parsing GNU sparse map [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2412761
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-264853458b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 43 Update: sudo-rs-0.2.10-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-a9d9780cbb
2025-11-26 00:50:04.944073+00:00
--------------------------------------------------------------------------------
Name : sudo-rs
Product : Fedora 43
Version : 0.2.10
Release : 1.fc43
URL : https://github.com/trifectatechfoundation/sudo-rs
Summary : Memory safe implementation of sudo and su
Description :
A memory safe implementation of sudo and su.
--------------------------------------------------------------------------------
Update Information:
Update to version 0.2.10.
This release includes fixes for CVE-2025-64170 and CVE-2025-64517.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 17 2025 Fabio Valentini [decathorpe@gmail.com] - 0.2.10-1
- Update to version 0.2.10; Fixes RHBZ#2413768
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2414750 - CVE-2025-64170 sudo-rs: sudo-rs: Partial password reveal is possible after timeout [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2414750
[ 2 ] Bug #2414778 - CVE-2025-64517 sudo-rs: Authentication bypass in timestamp [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id=2414778
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-a9d9780cbb' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
