Important: go-rpm-macros security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2026:8840", "synopsis": "Important: go-rpm-macros security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for go-rpm-macros.\nThis update affects Rocky Linux 10.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages. It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.\n\nSecurity Fix(es):\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 10"], "fixes": [{"ticket": "2445356", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "description": ""}], "cves": [{"name": "CVE-2026-25679", "sourceBy": "MITRE", "sourceLink": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-1286"}], "references": [], "publishedAt": "2026-04-21T12:07:14.176910Z", "rpms": {"Rocky Linux 10": {"nvras": ["go-filesystem-0:3.6.0-8.el10_1.x86_64.rpm", "go-rpm-macros-debuginfo-0:3.6.0-8.el10_1.x86_64.rpm", "go-srpm-macros-0:3.6.0-8.el10_1.noarch.rpm", "go-rpm-templates-0:3.6.0-8.el10_1.s390x.rpm", "go-rpm-macros-0:3.6.0-8.el10_1.src.rpm", "go-rpm-macros-0:3.6.0-8.el10_1.ppc64le.rpm", "go-filesystem-0:3.6.0-8.el10_1.ppc64le.rpm", "go-rpm-macros-debugsource-0:3.6.0-8.el10_1.s390x.rpm", "go-rpm-macros-0:3.6.0-8.el10_1.x86_64.rpm", "go-rpm-macros-debugsource-0:3.6.0-8.el10_1.ppc64le.rpm","go-rpm-macros-0:3.6.0-8.el10_1.s390x.rpm", "go-rpm-macros-debugsource-0:3.6.0-8.el10_1.x86_64.rpm", "go-rpm-macros-0:3.6.0-8.el10_1.aarch64.rpm", "go-filesystem-0:3.6.0-8.el10_1.s390x.rpm", "go-rpm-templates-0:3.6.0-8.el10_1.aarch64.rpm", "go-filesystem-0:3.6.0-8.el10_1.aarch64.rpm", "go-rpm-templates-0:3.6.0-8.el10_1.ppc64le.rpm", "go-rpm-macros-debuginfo-0:3.6.0-8.el10_1.ppc64le.rpm", "go-rpm-templates-0:3.6.0-8.el10_1.x86_64.rpm", "go-rpm-macros-debuginfo-0:3.6.0-8.el10_1.s390x.rpm", "go-rpm-macros-debugsource-0:3.6.0-8.el10_1.aarch64.rpm", "go-rpm-macros-debuginfo-0:3.6.0-8.el10_1.aarch64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Explore the go-rpm-macros security update for Rocky Linux 10 addressing important network parsing issues and CVE-2026-25679.. Rocky Linux Go RPMS Important Security Update CVE-2026-25679. . Severity: Important. LinuxSecurity.com Team
* CVE-2016-2538: Integer overflow in usb module (bz #1305815) * CVE-2016-2841: ne2000: infinite loop (bz #1304047) * CVE-2016-2857: net: out of bounds read (bz #1309564) * CVE-2016-2392: usb: null pointer dereference (bz #1307115) * Fix external snapshot any more after active committing (bz #1300209). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-1b264ab4a4 2016-03-27 00:00:51.391668 -------------------------------------------------------------------------------- Name : qemu Product : Fedora 24 Version : 2.5.0 Release : 10.fc24 URL : https://www.qemu.org/ Summary : QEMU is a FAST! processor emulator Description : QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: * Full system emulation. In this mode, QEMU emulates a full system (for example a PC), including a processor and various peripherials. It can be used to launch different Operating Systems without rebooting the PC or to debug system code. * User mode emulation. In this mode, QEMU can launch Linux processes compiled for one CPU on another CPU. As QEMU requires no host kernel patches to run, it is safe and easy to use. -------------------------------------------------------------------------------- Update Information: * CVE-2016-2538: Integer overflow in usb module (bz #1305815) * CVE-2016-2841: ne2000: infinite loop (bz #1304047) * CVE-2016-2857: net: out of bounds read (bz #1309564) * CVE-2016-2392: usb: null pointer dereference (bz #1307115) * Fix external snapshot any more after active committing (bz #1300209) -------------------------------------------------------------------------------- References: [ 1 ] Bug #1303120 - CVE-2016-2538 Qemu: usb: integer overflow in remote NDIS control message handling https://bugzilla.redhat.com/show_bug.cgi?id=1303120 [ 2 ] Bug #1303106 - CVE-2016-2841 Qemu: net: ne2000: infiniteloop in ne2000_receive https://bugzilla.redhat.com/show_bug.cgi?id=1303106 [ 3 ] Bug #1296567 - CVE-2016-2857 Qemu: net: out of bounds read in net_checksum_calculate() https://bugzilla.redhat.com/show_bug.cgi?id=1296567 [ 4 ] Bug #1302299 - CVE-2016-2392 Qemu: usb: null pointer dereference in remote NDIS control message handling https://bugzilla.redhat.com/show_bug.cgi?id=1302299 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update qemu' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Get the latest Linux and open source security news straight to your inbox.