Fedora 44 Update: fuse-overlayfs-1.17-1.fc44
Fedora 44 Update: python3.12-3.12.13-6.fc44
Fedora 44 Update: php-8.5.9-1.fc44
Fedora 44 Update: nextcloud-34.0.2-1.fc44
Fedora 44 Update: exim-4.99.5-1.fc44
Fedora 44 Update: postgresql16-16.14-1.fc44
Fedora 44 Update: rabbitmq-server-4.2.9-2.fc44
[SECURITY] Fedora 44 Update: fuse-overlayfs-1.17-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-4e0490640f
2026-08-01 00:52:45.340703+00:00
--------------------------------------------------------------------------------
Name : fuse-overlayfs
Product : Fedora 44
Version : 1.17
Release : 1.fc44
URL : https://github.com/containers/fuse-overlayfs
Summary : FUSE overlay+shiftfs implementation for rootless containers
Description :
FUSE overlay+shiftfs implementation for rootless containers.
--------------------------------------------------------------------------------
Update Information:
Update to fuse-overlayfs 1.17 to fix CVE-2026-52791: privilege escalation via
SUID/SGID bit preservation on file truncation. When a file with SUID/SGID bits
is truncated, those privilege bits should be cleared but were not in versions
prior to 1.17, allowing potential privilege escalation in rootless containers.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 30 2026 Lokesh Mandvekar [lsm5@redhat.com] - 1.17-1
- Update to 1.17 - Fixes CVE-2026-52791 (BZ#2509242)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2509242 - CVE-2026-52791 fuse-overlayfs: fuse-overlayfs: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2509242
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-4e0490640f' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: python3.12-3.12.13-6.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-84e1cf3983
2026-08-01 00:52:45.340713+00:00
--------------------------------------------------------------------------------
Name : python3.12
Product : Fedora 44
Version : 3.12.13
Release : 6.fc44
URL : https://www.python.org/
Summary : Version 3.12 of the Python interpreter
Description :
Python 3.12 is an accessible, high-level, dynamically typed, interpreted
programming language, designed with an emphasis on code readability.
It includes an extensive standard library, and has a vast ecosystem of
third-party libraries.
The python3.12 package provides the "python3.12" executable: the reference
interpreter for the Python language, version 3.
The majority of its standard library is provided in the python3.12-libs package,
which should be installed automatically along with python3.12.
The remaining parts of the Python standard library are broken out into the
python3.12-tkinter and python3.12-test packages, which may need to be installed
separately.
Documentation for Python is provided in the python3.12-docs package.
Packages containing additional libraries for Python are generally named with
the "python3.12-" prefix.
--------------------------------------------------------------------------------
Update Information:
Security fix for CVE-2026-15308
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 28 2026 Lukáš Zachar [lzachar@redhat.com] - 3.12.13-6
- Security fix for CVE-2026-15308
Resolves: rhbz#2498688
* Tue Jul 28 2026 Miro Hrončok [mhroncok@redhat.com] - 3.12.13-5
- Skip UDP Lite tests if it's not supported
- Fixes FTBFS on Linux kernel 7.1 and newer
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 3.12.13-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2498688 - CVE-2026-15308 python3.12: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id$98688
[ 2 ] Bug #2504605 - python3.12: FTBFS in Fedora rawhide/f45
https://bugzilla.redhat.com/show_bug.cgi?id%04605
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-84e1cf3983' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 44 Update: php-8.5.9-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-6131a972fe
2026-08-01 00:52:45.340691+00:00
--------------------------------------------------------------------------------
Name : php
Product : Fedora 44
Version : 8.5.9
Release : 1.fc44
URL : http://www.php.net/
Summary : PHP scripting language for creating dynamic web sites
Description :
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated web pages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts.
--------------------------------------------------------------------------------
Update Information:
PHP version 8.5.9 (30 Jul 2026)
Core:
Fixed bug GH-22290 (AST pretty printing does not correctly handle strings
containing NUL). (iliaal)
Fixed bug GH-22206 (missing return in global register detection). (P3p111n0)
Lock unmodified readonly properties for modification after clone-with.
(NickSdot)
BCMath:
Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)
(Recep Asan)
Calendar:
Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
INT_MAX year). (arshidkv12)
Date:
Update timelib to 2022.17. (Derick)
Fixed bug GH-19803 (Parsing a string with a single white space does create an
error). (Derick)
Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
(LukasGelbmann)
Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date
classes). (Derick)
DBA:
Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)
DOM:
Fixed bug GH-22570 (Stack overflow when serializing a deeply nested
Dom\XMLDocument). (iliaal)
Fixed getElementsByClassName() item() returning the wrong element on random
access. (David Carlier)
Exif:
Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning
when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)
Hash:
Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).
(iliaal)
ODBC:
Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the
driver-reported display size). (iliaal)
Opcache:
Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through
the wrong run_time_cache slot on megamorphic calls). (ptondereau, iliaal)
Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an
undereferenced run_time_cache map_ptr offset). (iliaal)
Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache
preloaded trait). (iliaal)
OpenSSL:
Fixed timeout for supplemental read at end of a blocking stream in SSL stream
wrapper. (ilutov)
Intl:
Fixed Locale::lookup() and locale_lookup() to return NULL instead of the
fallback locale when a language tag cannot be canonicalized. (Weilin Du)
Fixed memory leaks when calling Collator::__construct() or
Spoofchecker::__construct() twice. (Weilin Du)
Fixed memory leak when calling IntlListFormatter::__construct() twice. (Weilin
Du)
Fixed IntlChar methods leaving stale global error state after successful calls.
(Xuyang Zhang)
PDO_ODBC:
Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no
credentials). (iliaal)
Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the
driver-reported display size). (iliaal)
Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is
longer than the declared maxlen). (iliaal)
Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a
diagnostic message length beyond the error buffer). (iliaal)
PGSQL:
Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout).
(CVE-2026-17543) (ilutov)
Phar:
Fixed inconsistent handling of the magic ".phar" directory. Paths such as
"/.phar" remain protected, while non-magic paths that merely start with ".phar"
are handled consistently across file and directory creation, copying,
ArrayAccess, stream lookup, directory iteration and extraction. (Weilin Du)
Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260) (Jakub
Zelenka)
PHPDBG:
Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal)
Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break. (jorgsowa)
Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always
fail during phpdbg's signal-safe interruption path. (jorgsowa)
Reflection:
Fixed bug GH-22324 (Ignore leading namespace separator in
ReflectionParameter::__construct()). (jorgsowa)
Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore
dynamic properties shadowing a private parent property). (iliaal)
Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with
null bytes truncates output). (DanielEScherzer)
Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on
NAN conversions). (Khaled Alam)
Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
(DanielEScherzer)
Session:
Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3
and PHP 8.5). (jorgsowa)
SPL:
Fix class_parents for classes with leading slash in non-autoload mode.
(jorgsowa)
Ignore leading back-slash in class_parents(), class_implements(), and
class_uses(). (jorgsowa)
Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object
segfaults). (iliaal)
Standard:
Fixed bug GH-22395 (base_convert() outputs at most 64 characters). (Weilin Du)
Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator
mutates the array being sorted). (azchin, iliaal)
URI:
Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque
hosts. (kocsismate)
Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not
performed). (kocsismate)
Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-
empty userinfo). (kocsismate)
--------------------------------------------------------------------------------
ChangeLog:
* Tue Jul 28 2026 Remi Collet [remi@remirepo.net] - 8.5.9-1
- Update to 8.5.9 - http://www.php.net/releases/8_5_9.php
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-6131a972fe' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 44 Update: nextcloud-34.0.2-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-df06189438
2026-08-01 00:52:45.340677+00:00
--------------------------------------------------------------------------------
Name : nextcloud
Product : Fedora 44
Version : 34.0.2
Release : 1.fc44
URL : http://nextcloud.com
Summary : Private file sync and share server
Description :
NextCloud gives you universal access to your files through a web interface or
WebDAV. It also provides a platform to easily view & sync your contacts,
calendars and bookmarks across all your devices and enables basic editing right
on the web. NextCloud is extendable via a simple but powerful API for
applications and plugins.
--------------------------------------------------------------------------------
Update Information:
34.0.2 Release
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 23 2026 Andrew Bauer [zonexpertconsulting@outlook.com] - 34.0.2-1
- 34.0.2 release RHBZ#2506423
* Thu Jul 16 2026 Fedora Release Engineering [releng@fedoraproject.org] - 33.0.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2499191 - CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499191
[ 2 ] Bug #2499193 - CVE-2026-59882 nextcloud: guzzlehttp/psr7: URI host validation flaw can lead to security bypass or misrouting [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499193
[ 3 ] Bug #2506423 - nextcloud-34.0.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2506423
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-df06189438' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: exim-4.99.5-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-94678c4b6e
2026-08-01 00:52:45.340647+00:00
--------------------------------------------------------------------------------
Name : exim
Product : Fedora 44
Version : 4.99.5
Release : 1.fc44
URL : https://www.exim.org/
Summary : The exim mail transfer agent
Description :
Exim is a message transfer agent (MTA) developed at the University of
Cambridge for use on Unix systems connected to the Internet. It is
freely available under the terms of the GNU General Public Licence. In
style it is similar to Smail 3, but its facilities are more
general. There is a great deal of flexibility in the way mail can be
routed, and there are extensive facilities for checking incoming
mail. Exim can be installed in place of sendmail, although the
configuration of exim is quite different to that of sendmail.
--------------------------------------------------------------------------------
Update Information:
This is new version fixing command execution with alternate privilege.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 23 2026 Jaroslav Škarvada [jskarvad@redhat.com] - 4.99.5-1
- New version
Resolves: rhbz#2506152
* Wed Jul 22 2026 Jitka Plesnikova [jplesnik@redhat.com] - 4.99.4-4
- Perl 5.44 rebuild
* Wed Jul 15 2026 Fedora Release Engineering [releng@fedoraproject.org] - 4.99.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
* Fri Jun 12 2026 Yaakov Selkowitz [yselkowi@redhat.com] - 4.99.4-2
- Rebuilt for openssl 4.0
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2506152 - exim-4.99.5 is available
https://bugzilla.redhat.com/show_bug.cgi?id%06152
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-94678c4b6e' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
[SECURITY] Fedora 44 Update: postgresql16-16.14-1.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-f8ee1fd482
2026-08-01 00:52:45.340615+00:00
--------------------------------------------------------------------------------
Name : postgresql16
Product : Fedora 44
Version : 16.14
Release : 1.fc44
URL : http://www.postgresql.org/
Summary : PostgreSQL client programs
Description :
PostgreSQL is an advanced Object-Relational database management system (DBMS).
The base postgresql package contains the client programs that you'll need to
access a PostgreSQL DBMS server, as well as HTML documentation for the whole
system. These client programs can be located on the same machine as the
PostgreSQL server, or on a remote machine that accesses a PostgreSQL server
over a network connection. The PostgreSQL server can be found in the
postgresql-server sub-package.
--------------------------------------------------------------------------------
Update Information:
Automatic update for postgresql16-16.14-1.fc44.
Changelog for postgresql16
* Thu May 14 2026 Packit [hello@packit.dev] - 16.14-1
- Update to version 16.14
- Resolves: rhbz#2477451
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 14 2026 Packit [hello@packit.dev] - 16.14-1
- Update to version 16.14
- Resolves: rhbz#2477451
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2477451 - postgresql16-16.14 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2477451
[ 2 ] Bug #2480430 - CVE-2026-6474 postgresql16: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2480430
[ 3 ] Bug #2482515 - CVE-2026-6478 postgresql16: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2482515
[ 4 ] Bug #2484431 - CVE-2026-6473 postgresql16: integer overflow can cause an undersized allocation and an out-of-bounds write [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2484431
[ 5 ] Bug #2484512 - CVE-2026-6475 postgresql16: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2484512
[ 6 ] Bug #2484513 - CVE-2026-6477 postgresql16: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2484513
[ 7 ] Bug #2487460 - CVE-2026-6575 postgresql16: PostgreSQL: Information disclosure via buffer over-read in pg_restore_attribute_stats() [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2487460
[ 8 ] Bug #2489304 - CVE-2026-6472 postgresql16: PostgreSQL: Arbitrary code execution via missing authorization in CREATE TYPE [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2489304
[ 9 ] Bug #2499705 - CVE-2026-6479 postgresql16: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499705
[ 10 ] Bug #2499726 - CVE-2026-6637 postgresql16: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499726
[ 11 ] Bug #2499964 - CVE-2026-6638 postgresql16: PostgreSQL: Arbitrary SQL execution via SQL injection in logical replication [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2499964
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-f8ee1fd482' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
[SECURITY] Fedora 44 Update: rabbitmq-server-4.2.9-2.fc44
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-6326bdeab0
2026-08-01 00:52:45.340613+00:00
--------------------------------------------------------------------------------
Name : rabbitmq-server
Product : Fedora 44
Version : 4.2.9
Release : 2.fc44
URL : https://www.rabbitmq.com/
Summary : The RabbitMQ server
Description :
RabbitMQ is an implementation of AMQP, the emerging standard for high
performance enterprise messaging. The RabbitMQ server is a robust and
scalable implementation of an AMQP broker.
--------------------------------------------------------------------------------
Update Information:
Fix users creation
RabbitMQ ver. 4.2.9
--------------------------------------------------------------------------------
ChangeLog:
* Thu Jul 23 2026 Tobias Urdin [tobias.urdin@binero.com] - 4.2.9-2
- Fix sysusers
* Wed Jul 22 2026 Peter Lemenkov [lemenkov@gmail.com] - 4.2.9-1
- Ver. 4.2.9
* Mon Jun 15 2026 Peter Lemenkov [lemenkov@gmail.com] - 4.2.8-1
- Ver. 4.2.8
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2489780 - CVE-2026-44839 rabbitmq-server: RabbitMQ: Unsanitized vhost names allow for XSS in management UI [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2489780
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-6326bdeab0' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
