Fedora 43 Update: python-pillow-11.3.0-10.fc43
Fedora 43 Update: libseccomp-2.6.1-2.fc43
Fedora 43 Update: openssh-10.0p1-11.fc43
Fedora 43 Update: dnsx-1.3.0-1.fc43
Fedora 43 Update: freerdp-3.30.0-1.fc43
Fedora 43 Update: libtiff-4.7.2-1.fc43
Fedora 43 Update: mingw-python-pip-26.1.2-1.fc43
Fedora 43 Update: mingw-python-idna-3.18-1.fc43
Fedora 43 Update: c-ares-1.34.8-1.fc43
Fedora 44 Update: dnsx-1.3.0-1.fc44
Fedora 44 Update: libreswan-5.3.2-2.fc44
Fedora 44 Update: freerdp-3.30.0-1.fc44
Fedora 44 Update: wget1-1.25.0-4.fc44
Fedora 44 Update: wireshark-4.6.7-1.fc44
Fedora 44 Update: gpsd-3.27.5-5.fc44
Fedora 44 Update: mingw-python-pip-26.1.2-1.fc44
Fedora 44 Update: mingw-python-idna-3.18-1.fc44
[SECURITY] Fedora 43 Update: python-pillow-11.3.0-10.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-fc2ded926e
2026-07-21 01:13:08.976757+00:00
--------------------------------------------------------------------------------
Name : python-pillow
Product : Fedora 43
Version : 11.3.0
Release : 10.fc43
URL : http://python-pillow.github.io/
Summary : Python image processing library
Description :
Python image processing library, fork of the Python Imaging Library (PIL)
This library provides extensive file format support, an efficient
internal representation, and powerful image processing capabilities.
There are four subpackages: tk (tk interface), qt (PIL image wrapper for Qt),
devel (development) and doc (documentation).
--------------------------------------------------------------------------------
Update Information:
Backport fixes for CVE-2026-59197 and CVE-2026-54058.
Fix CVE-2026-55380, CVE-2026-54060, CVE-2026-54059, CVE-2026-55379,
CVE-2026-55798
--------------------------------------------------------------------------------
ChangeLog:
* Sun Jul 19 2026 Sandro Mani [manisandro@gmail.com] - 11.3.0-10
- Backport fixes for CVE-2026-59197 and CVE-2026-54058
* Tue Jul 7 2026 Sandro Mani [manisandro@gmail.com] - 11.3.0-9
- Backport fixes for CVE-2026-55380, CVE-2026-54060, CVE-2026-54059,
CVE-2026-55379, CVE-2026-55798
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2497649 - CVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font file [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497649
[ 2 ] Bug #2497660 - CVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image file [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497660
[ 3 ] Bug #2497665 - CVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497665
[ 4 ] Bug #2497682 - CVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font data [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497682
[ 5 ] Bug #2497699 - CVE-2026-55798 python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497699
[ 6 ] Bug #2501494 - CVE-2026-59197 python-pillow: Pillow: Native heap out-of-bounds write [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2501494
[ 7 ] Bug #2501495 - CVE-2026-54058 python-pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2501495
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-fc2ded926e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: libseccomp-2.6.1-2.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-9afc6b6bb3
2026-07-21 01:13:08.976748+00:00
--------------------------------------------------------------------------------
Name : libseccomp
Product : Fedora 43
Version : 2.6.1
Release : 2.fc43
URL : https://github.com/seccomp/libseccomp
Summary : Enhanced seccomp library
Description :
The libseccomp library provides an easy to use interface to the Linux Kernel's
syscall filtering mechanism, seccomp. The libseccomp API allows an application
to specify which syscalls, and optionally which syscall arguments, the
application is allowed to execute, all of which are enforced by the Linux
Kernel.
--------------------------------------------------------------------------------
Update Information:
libseccomp 2.6.1
packaging changes
Enable Python bindings on Fedora 44+
upstream changes - July 1, 2026
Update the syscall table for Linux v7.1.0-rc4
Fix incorrect 64-bit comparison merge that can weaken libseccomp filters.
See GitHub Advisory GHSA-4q85-33p6-j5g6
Fix issue where oversized libseccomp filters can trigger a double free.
See GitHub Advisory GHSA-46fr-jh49-xvhx
Fix issue where oversized libseccomp filters can trigger a heap corruption.
See GitHub Advisory GHSA-2hqh-5c36-grrm
Fix struct aliasing undefined behavior in the internal libseccomp hash
algorithm
Fix issue where extraneous bytes were being copied to the destination
buffer in seccomp_export_bpf_mem()
Fix a bug where merged libseccomp filters failed to merge the notify_used
flag, leading to no listener file descriptor being generated
Update python shebang to point to python3
Add documentation for seccomp_transaction_start()
Since support for s390 has been removed from the upstream Linux kernel,
freeze libseccomp's s390 syscall table at Linux v6.18
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jul 18 2026 Michel Lind [salimma@fedoraproject.org] - 2.6.1-2
- Only enable Python subpackage on Fedora 44 and up
* Sat Jul 18 2026 Michel Lind [salimma@fedoraproject.org] - 2.6.1-1
- Update to version 2.6.1; Resolves: rhbz#2341880
- Build Python bindings; Resolves: rhbz#2437438
- Enable Packit
- Support disabling tests for iterating on spec changes
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 2.6.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 2.6.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2341880 - libseccomp-2.6.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2341880
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-9afc6b6bb3' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: openssh-10.0p1-11.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-169fd93089
2026-07-21 01:13:08.976736+00:00
--------------------------------------------------------------------------------
Name : openssh
Product : Fedora 43
Version : 10.0p1
Release : 11.fc43
URL : http://www.openssh.com/portable.html
Summary : An open source implementation of SSH protocol version 2
Description :
SSH (Secure SHell) is a program for logging into and executing
commands on a remote machine. SSH is intended to replace rlogin and
rsh, and to provide secure encrypted communications between two
untrusted hosts over an insecure network. X11 connections and
arbitrary TCP/IP ports can also be forwarded over the secure channel.
OpenSSH is OpenBSD's version of the last free version of SSH, bringing
it up to date in terms of security and features.
This package includes the core files necessary for both the OpenSSH
client and server. To make this package useful, you should also
install openssh-clients, openssh-server, or both.
--------------------------------------------------------------------------------
Update Information:
CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in
unintended parent directories when scp performs remote-to-remote copy via the
local host
CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jul 17 2026 Zoltan Fridrich [zfridric@redhat.com] - 10.0p1-11
- CVE-2026-59996: Fix remote glob result of ".." causing files to be placed
in unintended parent directories when scp performs remote-to-remote copy
via the local host
Resolves: rhbz#2498027
- CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
Resolves: rhbz#2497966
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2497966 - CVE-2026-60002 openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497966
[ 2 ] Bug #2498027 - CVE-2026-59996 openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498027
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-169fd93089' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: dnsx-1.3.0-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-1c78e384e3
2026-07-21 01:13:08.976738+00:00
--------------------------------------------------------------------------------
Name : dnsx
Product : Fedora 43
Version : 1.3.0
Release : 1.fc43
URL : https://github.com/projectdiscovery/dnsx
Summary : Dnsx is a fast and multi-purpose DNS toolkit
Description :
Dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries
of your choice with a list of user-supplied resolvers.
--------------------------------------------------------------------------------
Update Information:
Update to 1.3.0
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jul 17 2026 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.3.0-1
- Update to 1.3.0 - Closes rhbz#2420897
* Wed Jul 15 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.2.3-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Mon Feb 2 2026 Maxwell G [maxwell@gtmx.me] - 1.2.3-4
- Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.2.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.2.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Wed Dec 17 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.2.3-1
- Update to 1.2.3 - Closes rhbz#2420897
* Fri Oct 10 2025 Alejandro Sáez [asm@redhat.com] - 1.2.2-6
- rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2408156 - CVE-2025-58189 dnsx: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id$08156
[ 2 ] Bug #2409626 - CVE-2025-61723 dnsx: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id$09626
[ 3 ] Bug #2410577 - CVE-2025-58185 dnsx: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id$10577
[ 4 ] Bug #2411475 - CVE-2025-58188 dnsx: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id$11475
[ 5 ] Bug #2412680 - CVE-2025-58183 dnsx: Unbounded allocation when parsing GNU sparse map [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id$12680
[ 6 ] Bug #2442405 - CVE-2026-1229 dnsx: CIRCL ecc/p384: Incorrect cryptographic calculations via specific inputs [fedora-43]
https://bugzilla.redhat.com/show_bug.cgi?id$42405
[ 7 ] Bug #2456017 - CVE-2026-33817 dnsx: go.etcd.io/bbolt: Denial of Service via index out-of-range error [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$56017
[ 8 ] Bug #2458982 - CVE-2026-5160 dnsx: github.com/yuin/goldmark/renderer/html: Cross-site Scripting due to improper URL validation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$58982
[ 9 ] Bug #2494342 - CVE-2026-27145 dnsx: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$94342
[ 10 ] Bug #2495280 - CVE-2026-25681 dnsx: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$95280
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-1c78e384e3' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 43 Update: freerdp-3.30.0-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-fa672d26a8
2026-07-21 01:13:08.976727+00:00
--------------------------------------------------------------------------------
Name : freerdp
Product : Fedora 43
Version : 3.30.0
Release : 1.fc43
URL : http://www.freerdp.com/
Summary : Free implementation of the Remote Desktop Protocol (RDP)
Description :
The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP
project.
xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows
machines, xrdp and VirtualBox.
--------------------------------------------------------------------------------
Update Information:
Update to 3.30.0
Update to 3.29.0
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 16 2026 Ondrej Holy [oholy@redhat.com] - 2:3.30.0-1
- Update to 3.30.0
Resolves: rhbz#2501274
* Wed Jul 15 2026 Fedora Release Engineering [releng@fedoraproject.org] - 2:3.29.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Wed Jul 15 2026 Ondrej Holy [oholy@redhat.com] - 2:3.29.0-1
- Update to 3.29.0
Resolves: rhbz#2499994
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2499994 - freerdp-3.29.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2499994
[ 2 ] Bug #2501274 - freerdp-3.30.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2501274
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-fa672d26a8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: libtiff-4.7.2-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-feac063d56
2026-07-21 01:13:08.976725+00:00
--------------------------------------------------------------------------------
Name : libtiff
Product : Fedora 43
Version : 4.7.2
Release : 1.fc43
URL : http://www.simplesystems.org/libtiff/
Summary : Library of functions for manipulating TIFF format image files
Description :
The libtiff package contains a library of functions for manipulating
TIFF (Tagged Image File Format) image format files. TIFF is a widely
used file format for bitmapped images. TIFF files usually end in the
.tif extension and they are often quite large.
The libtiff package should be installed if you need to manipulate TIFF
format image files.
--------------------------------------------------------------------------------
Update Information:
updated to 4.7.2, fixes security issues
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 13 2026 Michal Hlavinka [mhlavink@redhat.com] - 4.7.2-1
- updated to 4.7.2 (#2496751)
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 4.7.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2450771 - CVE-2026-4775 libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2450771
[ 2 ] Bug #2494140 - CVE-2026-12912 libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2494140
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-feac063d56' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: mingw-python-pip-26.1.2-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-71562f8836
2026-07-21 01:13:08.976682+00:00
--------------------------------------------------------------------------------
Name : mingw-python-pip
Product : Fedora 43
Version : 26.1.2
Release : 1.fc43
URL : https://pypi.python.org/pypi/pip
Summary : MinGW Windows Python pip library
Description :
MinGW Windows Python pip library.
--------------------------------------------------------------------------------
Update Information:
Update to pip-26.1.2.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jul 4 2026 Sandro Mani [manisandro@gmail.com] - 26.1.2-1
- Update to 26.1.2
* Fri May 22 2026 Sandro Mani [manisandro@gmail.com] - 26.1.1-1
- Update to 26.1.1
* Sun Mar 1 2026 Sandro Mani [manisandro@gmail.com] - 26.0.1-1
- Update to 26.0.1
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 25.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Wed Dec 3 2025 Sandro Mani [manisandro@gmail.com] - 25.3-1
- Update to 25.3
* Sat Aug 30 2025 Sandro Mani [manisandro@gmail.com] - 25.2-1
- Update to 25.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2494474 - CVE-2026-8643 mingw-python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2494474
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-71562f8836' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: mingw-python-idna-3.18-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-9dbf4d0ca8
2026-07-21 01:13:08.976679+00:00
--------------------------------------------------------------------------------
Name : mingw-python-idna
Product : Fedora 43
Version : 3.18
Release : 1.fc43
URL : https://github.com/kjd/idna
Summary : MinGW Windows Python idna
Description :
MinGW Windows Python idna.
--------------------------------------------------------------------------------
Update Information:
Update to 3.18.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jun 15 2026 Sandro Mani [manisandro@gmail.com] - 3.18-1
- Update to 3.18
* Fri May 15 2026 Sandro Mani [manisandro@gmail.com] - 3.15-1
- Update to 3.15
* Sun Apr 26 2026 Sandro Mani [manisandro@gmail.com] - 3.13-1
- Update to 3.13
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 3.11-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Sun Oct 19 2025 Sandro Mani [manisandro@gmail.com] - 3.11-1
- Update to 3.11
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2498561 - CVE-2026-45409 mingw-python-idna: idna: Denial of Service via specially crafted long inputs [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498561
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-9dbf4d0ca8' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 43 Update: c-ares-1.34.8-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-d70d93fcd7
2026-07-21 01:13:08.976658+00:00
--------------------------------------------------------------------------------
Name : c-ares
Product : Fedora 43
Version : 1.34.8
Release : 1.fc43
URL : http://c-ares.org/
Summary : A library that performs asynchronous DNS operations
Description :
c-ares is a C library that performs DNS requests and name resolves
asynchronously. c-ares is a fork of the library named 'ares', written
by Greg Hudson at MIT.
--------------------------------------------------------------------------------
Update Information:
1.34.7 accidentally broke the API compatibility, this is fixed in 1.34.8.
update to 1.34.7
fixes CVE-2026-33630 (GHSA-6wfj-rwm7-3542) and GHSA-pjmc-gx33-gc76 and GHSA-
jv8r-gqr9-68wj
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jul 8 2026 Tom Callaway [spot@fedoraproject.org] - 1.34.8-1
- update to 1.34.8
* Mon Jul 6 2026 Tom Callaway [spot@fedoraproject.org] - 1.34.7-1
- update to 1.34.7
- fixes CVE-2026-33630 (GHSA-6wfj-rwm7-3542) and GHSA-pjmc-gx33-gc76 and GHSA-jv8r-gqr9-68wj
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.34.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.34.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Wed Dec 17 2025 Tom Callaway [spot@fedoraproject.org] - 1.34.6-1
- update to 1.34.6
- fixes CVE-2025-62408 (among other fixes)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2420051 - c-ares-1.34.7 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2420051
[ 2 ] Bug #2497696 - CVE-2026-33630 c-ares: c-ares: Use-after-free / double-free in query-completion handling [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2497696
[ 3 ] Bug #2497764 - c-ares-1.34.8 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2497764
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-d70d93fcd7' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: dnsx-1.3.0-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-902340971e
2026-07-21 00:56:03.169770+00:00
--------------------------------------------------------------------------------
Name : dnsx
Product : Fedora 44
Version : 1.3.0
Release : 1.fc44
URL : https://github.com/projectdiscovery/dnsx
Summary : Dnsx is a fast and multi-purpose DNS toolkit
Description :
Dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries
of your choice with a list of user-supplied resolvers.
--------------------------------------------------------------------------------
Update Information:
Update to 1.3.0
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jul 17 2026 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.3.0-1
- Update to 1.3.0 - Closes rhbz#2420897
* Wed Jul 15 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.2.3-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Mon Feb 2 2026 Maxwell G [maxwell@gtmx.me] - 1.2.3-4
- Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.2.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Fri Jan 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.2.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Wed Dec 17 2025 Mikel Olasagasti Uranga [mikel@olasagasti.info] - 1.2.3-1
- Update to 1.2.3 - Closes rhbz#2420897
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2433990 - dnsx: FTBFS in Fedora rawhide/f44
https://bugzilla.redhat.com/show_bug.cgi?id=2433990
[ 2 ] Bug #2456017 - CVE-2026-33817 dnsx: go.etcd.io/bbolt: Denial of Service via index out-of-range error [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2456017
[ 3 ] Bug #2458982 - CVE-2026-5160 dnsx: github.com/yuin/goldmark/renderer/html: Cross-site Scripting due to improper URL validation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2458982
[ 4 ] Bug #2494342 - CVE-2026-27145 dnsx: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2494342
[ 5 ] Bug #2495280 - CVE-2026-25681 dnsx: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2495280
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-902340971e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: libreswan-5.3.2-2.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-538c26f96a
2026-07-21 00:56:03.169768+00:00
--------------------------------------------------------------------------------
Name : libreswan
Product : Fedora 44
Version : 5.3.2
Release : 2.fc44
URL : https://libreswan.org/
Summary : Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
Description :
Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is
the Internet Protocol Security and uses strong cryptography to provide
both authentication and encryption services. These services allow you
to build secure tunnels through untrusted networks. Everything passing
through the untrusted net is encrypted by the ipsec gateway machine and
decrypted by the gateway at the other end of the tunnel. The resulting
tunnel is a virtual private network or VPN.
This package contains the daemons and userland tools for setting up
Libreswan.
Libreswan also supports IKEv2 (RFC7296) and Secure Labeling
Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
--------------------------------------------------------------------------------
Update Information:
Update to 5.3.2 for CVE-2026-14957 (with newsources)
--------------------------------------------------------------------------------
ChangeLog:
* Fri Jul 17 2026 Paul Wouters [paul.wouters@aiven.io] - 5.3.2-2
- Update to 5.3.2 for CVE-2026-14957 (with newsources)
* Fri Jul 17 2026 Paul Wouters [paul.wouters@aiven.io] - 5.3.2-1
- Update to 5.3.2 for CVE-2026-14957
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 5.3.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Wed Jun 24 2026 Paul Wouters [paul.wouters@aiven.io] - 5.3.1-1
- Update to libreswan-5.3.1
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-538c26f96a' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: freerdp-3.30.0-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-d31eea6f5e
2026-07-21 00:56:03.169766+00:00
--------------------------------------------------------------------------------
Name : freerdp
Product : Fedora 44
Version : 3.30.0
Release : 1.fc44
URL : http://www.freerdp.com/
Summary : Free implementation of the Remote Desktop Protocol (RDP)
Description :
The xfreerdp & wlfreerdp Remote Desktop Protocol (RDP) clients from the FreeRDP
project.
xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows
machines, xrdp and VirtualBox.
--------------------------------------------------------------------------------
Update Information:
Update to 3.30.0
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 16 2026 Ondrej Holy [oholy@redhat.com] - 2:3.30.0-1
- Update to 3.30.0
Resolves: rhbz#2501274
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2501274 - freerdp-3.30.0 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2501274
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-d31eea6f5e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: wget1-1.25.0-4.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-1b91a2f126
2026-07-21 00:56:03.169759+00:00
--------------------------------------------------------------------------------
Name : wget1
Product : Fedora 44
Version : 1.25.0
Release : 4.fc44
URL : http://www.gnu.org/software/wget/
Summary : A utility for retrieving files using the HTTP or FTP protocols
Description :
GNU Wget is a file retrieval utility which can use either the HTTP or
FTP protocols. Wget features include the ability to work in the
background while you are logged out, recursive retrieval of
directories, file name wildcard matching, remote file timestamp
storage and comparison, use of Rest with FTP servers and Range with
HTTP servers to retrieve files over slow or unstable connections,
support for Proxy servers, and configurability.
--------------------------------------------------------------------------------
Update Information:
Fix for CVE-2026-15146, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 16 2026 Michal Ruprich [mruprich@redhat.com] - 1.25.0-4
- Fix for CVE-2026-15146, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472
* Sat Jan 17 2026 Fedora Release Engineering [releng@fedoraproject.org] - 1.25.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2499188 - CVE-2026-15146 wget1: Wget: Server-Side Request Forgery via FTP PASV response IP address validation bypass [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499188
[ 2 ] Bug #2499583 - CVE-2026-58471 wget1: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499583
[ 3 ] Bug #2499957 - CVE-2026-58470 wget1: GNU Wget: Integer overflow in Content-Range header parsing causes download desynchronization [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499957
[ 4 ] Bug #2499971 - CVE-2026-58472 wget1: GNU Wget: Arbitrary code execution or denial of service via crafted HTML attribute [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499971
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-1b91a2f126' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: wireshark-4.6.7-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-bc152c9ff6
2026-07-21 00:56:03.169754+00:00
--------------------------------------------------------------------------------
Name : wireshark
Product : Fedora 44
Version : 4.6.7
Release : 1.fc44
URL : http://www.wireshark.org/
Summary : Network traffic analyzer
Description :
Wireshark allows you to examine protocol data stored in files or as it is
captured from wired or wireless (WiFi or Bluetooth) networks, USB devices,
and many other sources. It supports dozens of protocol capture file formats
and understands more than a thousand protocols.
It has many powerful features including a rich display filter language
and the ability to reassemble multiple protocol packets in order to, for
example, view a complete TCP stream, save the contents of a file which was
transferred over HTTP or CIFS, or play back an RTP audio stream.
--------------------------------------------------------------------------------
Update Information:
Latest wireshark version includes fixes for the following CVEs:
CVE-2026-15163
CVE-2026-15164
CVE-2026-15165
CVE-2026-15166
CVE-2026-15167
CVE-2026-15168
CVE-2026-15169
CVE-2026-15170
CVE-2026-15171
CVE-2026-15172
CVE-2026-15173
CVE-2026-15174
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 14 2026 Michal Ruprich [mruprich@redhat.com] - 1:4.6.7-1
- New version 4.6.7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2498379 - wireshark-4.6.7 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2498379
[ 2 ] Bug #2498388 - CVE-2026-15166 wireshark: Wireshark: Denial of Service via IEEE 802.11 protocol dissector crash [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498388
[ 3 ] Bug #2498389 - CVE-2026-15170 wireshark: Wireshark: Denial of service via Z39.50 protocol dissector crash [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498389
[ 4 ] Bug #2498393 - CVE-2026-15172 wireshark: Wireshark: Denial of service via FMP/NOTIFY protocol dissector crash [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498393
[ 5 ] Bug #2498399 - CVE-2026-15168 wireshark: Wireshark: Information disclosure in BLF file parser [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498399
[ 6 ] Bug #2498400 - CVE-2026-15164 wireshark: Wireshark: Denial of Service vulnerability in ciscodump [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498400
[ 7 ] Bug #2498401 - CVE-2026-15169 wireshark: Wireshark: Denial of Service via UMTS FP protocol dissector crash [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498401
[ 8 ] Bug #2498402 - CVE-2026-15165 wireshark: Wireshark: Denial of Service via TLS ECH decryptor crash [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498402
[ 9 ] Bug #2498403 - CVE-2026-15171 wireshark: Wireshark: Denial of service via SSH protocol dissector crash [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498403
[ 10 ] Bug #2498406 - CVE-2026-15173 wireshark: Wireshark: Denial of Service via pcapng file parser crash [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498406
[ 11 ] Bug #2498409 - CVE-2026-15163 wireshark: Wireshark: Denial of Service via multiple protocol dissector infinite loops [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498409
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-bc152c9ff6' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: gpsd-3.27.5-5.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-36e3aa0593
2026-07-21 00:56:03.169751+00:00
--------------------------------------------------------------------------------
Name : gpsd
Product : Fedora 44
Version : 3.27.5
Release : 5.fc44
URL : https://gpsd.gitlab.io/gpsd/index.html
Summary : Service daemon for mediating access to a GPS
Description :
gpsd is a service daemon that mediates access to a GPS sensor
connected to the host computer by serial or USB interface, making its
data on the location/course/velocity of the sensor available to be
queried on TCP port 2947 of the host computer. With gpsd, multiple
GPS client applications (such as navigational and war-driving software)
can share access to a GPS without contention or loss of data. Also,
gpsd responds to queries with a format that is substantially easier to
parse than NMEA 0183.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2026-58459
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jul 13 2026 Miroslav Lichvar [mlichvar@redhat.com] - 1:3.27.5-5
- fix command injection in gpsprof (CVE-2026-58459)
* Wed Jun 3 2026 Python Maint - 1:3.27.5-4
- Rebuilt for Python 3.15
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2498940 - CVE-2026-58459 gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498940
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-36e3aa0593' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: mingw-python-pip-26.1.2-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-6edc44733c
2026-07-21 00:56:03.169716+00:00
--------------------------------------------------------------------------------
Name : mingw-python-pip
Product : Fedora 44
Version : 26.1.2
Release : 1.fc44
URL : https://pypi.python.org/pypi/pip
Summary : MinGW Windows Python pip library
Description :
MinGW Windows Python pip library.
--------------------------------------------------------------------------------
Update Information:
Update to pip-26.1.2.
--------------------------------------------------------------------------------
ChangeLog:
* Sat Jul 4 2026 Sandro Mani [manisandro@gmail.com] - 26.1.2-1
- Update to 26.1.2
* Fri May 22 2026 Sandro Mani [manisandro@gmail.com] - 26.1.1-1
- Update to 26.1.1
* Sun Mar 1 2026 Sandro Mani [manisandro@gmail.com] - 26.0.1-1
- Update to 26.0.1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2494474 - CVE-2026-8643 mingw-python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2494474
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-6edc44733c' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: mingw-python-idna-3.18-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-db2b7b6415
2026-07-21 00:56:03.169714+00:00
--------------------------------------------------------------------------------
Name : mingw-python-idna
Product : Fedora 44
Version : 3.18
Release : 1.fc44
URL : https://github.com/kjd/idna
Summary : MinGW Windows Python idna
Description :
MinGW Windows Python idna.
--------------------------------------------------------------------------------
Update Information:
Update to 3.18.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Jun 15 2026 Sandro Mani [manisandro@gmail.com] - 3.18-1
- Update to 3.18
* Fri May 15 2026 Sandro Mani [manisandro@gmail.com] - 3.15-1
- Update to 3.15
* Sun Apr 26 2026 Sandro Mani [manisandro@gmail.com] - 3.13-1
- Update to 3.13
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2498561 - CVE-2026-45409 mingw-python-idna: idna: Denial of Service via specially crafted long inputs [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2498561
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-db2b7b6415' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
