Stay Secure with the Latest Linux Advisories

security advisoryfedoracritical

Fedora 43 CEF Warning Concerning Serious Integer Overflow Vulnerabilities

Bump to cef-145.0.28+g51162e8 + chromium 145.0.7632.159 (rhbz#2437035) CVE-2026-3536: Integer overflow in ANGLE CVE-2026-3537: Object lifecycle issue in PowerVR CVE-2026-3538: Integer overflow in Skia CVE-2026-3539: Object lifecycle issue in DevTools. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-b5f8adc627 2026-03-08 01:26:02.293241+00:00 -------------------------------------------------------------------------------- Name : cef Product : Fedora 43 Version : 145.0.28^chromium145.0.7632.159 Release : 1.fc43 URL : https://bitbucket.org/chromiumembedded/cef Summary : Chromium Embedded Framework Description : CEF is an embeddable build of Chromium, powered by WebKit (Blink). -------------------------------------------------------------------------------- Update Information: Bump to cef-145.0.28+g51162e8 + chromium 145.0.7632.159 (rhbz#2437035) CVE-2026-3536: Integer overflow in ANGLE CVE-2026-3537: Object lifecycle issue in PowerVR CVE-2026-3538: Integer overflow in Skia CVE-2026-3539: Object lifecycle issue in DevTools CVE-2026-3540: Inappropriate implementation in WebAudio CVE-2026-3541: Inappropriate implementation in CSS CVE-2026-3542: Inappropriate implementation in WebAssembly CVE-2026-3543: Inappropriate implementation in V8 CVE-2026-3544: Heap buffer overflow in WebCodecs CVE-2026-3545: Insufficient data validation in Navigation CVE-2026-3061: Out of bounds read in Media CVE-2026-3062: Out of bounds read and write in Tint CVE-2026-3063: Inappropriate implementation in DevTools CVE-2026-2648: Heap buffer overflow in PDFium CVE-2026-2649: Integer overflow in V8 CVE-2026-2650: Heap buffer overflow in Media -------------------------------------------------------------------------------- ChangeLog: * Sat Mar 7 2026 Hoshino Lina - 145.0.28^chromium145.0.7632.159-1 - Bump to cef-145.0.28+g51162e8 (rhbz#2437035) * Sat Mar 7 2026 Than Ngo -145.0.25^chromium145.0.7632.159-1 - Update to 145.0.7632.159 - * CVE-2026-3536: Integer overflow in ANGLE - * CVE-2026-3537: Object lifecycle issue in PowerVR - * CVE-2026-3538: Integer overflow in Skia - * CVE-2026-3539: Object lifecycle issue in DevTools - * CVE-2026-3540: Inappropriate implementation in WebAudio - * CVE-2026-3541: Inappropriate implementation in CSS - * CVE-2026-3542: Inappropriate implementation in WebAssembly - * CVE-2026-3543: Inappropriate implementation in V8 - * CVE-2026-3544: Heap buffer overflow in WebCodecs - * CVE-2026-3545: Insufficient data validation in Navigation * Sat Mar 7 2026 Than Ngo - 145.0.25^chromium145.0.7632.116-1 - Update to 145.0.7632.116 - * CVE-2026-3061: Out of bounds read in Media - * CVE-2026-3062: Out of bounds read and write in Tint - * CVE-2026-3063: Inappropriate implementation in DevTools * Sat Mar 7 2026 Than Ngo - 145.0.25^chromium145.0.7632.109-1 - Update to 145.0.7632.109 - * CVE-2026-2648: Heap buffer overflow in PDFium - * CVE-2026-2649: Integer overflow in V8 - * CVE-2026-2650: Heap buffer overflow in Media * Sat Mar 7 2026 Hoshino Lina - 145.0.25^chromium145.0.7632.75-5 - Use C++20 for libcef target -------------------------------------------------------------------------------- References: [ 1 ] Bug #2437035 - cef-145.0.28 is available https://bugzilla.redhat.com/show_bug.cgi?id=2437035 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b5f8adc627' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new . Stay informed about critical updates for Fedora 43 CEF to address integer overflow and lifecycle issues affecting security.. Fedora 43 Critical Update Integer Overflow CEF. . Severity: Critical. LinuxSecurity.com Team

Mar 08, 2026 •Critical Fedora