Explore top 10 tips to secure your open-source projects now. Read More
×Security update. Publication date: 18 Jul 2026 URL: https://advisories.mageia.org/MGAA-2026-0056.html Type: bugfix Affected Mageia releases: 10 Description: Some Xfce packages were not updated to the latest versions during the version freeze. They are available as updates now. References: - https://bugs.mageia.org/show_bug.cgi?id=35827 SRPMS: - 10/core/libxfce4ui-4.21.8-1.mga10 - 10/core/xfce4-panel-4.21.2-1.mga10 - 10/core/xfce4-settings-4.21.2-1.mga10 - 10/core/xfdesktop-4.21.0-1.mga10 . Mageia releases an update for Xfce packages addressing issues from the version freeze. Important fixes available now.. Mageia Update, Xfce Packages, Security Advisory, System Security. . Severity: Informational. LinuxSecurity.com Team
Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45, fixing CVE-2026-33056. Update rust-nix to 0.31.2. Update uv and python- uv-build to 0.10.2, rebuilding them with the latest rust-astral-tokio-tar and rust-tar. Update python-fastar to 0.9.0, rebuilding it with the lastest rust- tar. Rebuild maturin with the latest rust-tar.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-23bb71ea52 2026-03-29 01:07:01.422539+00:00 -------------------------------------------------------------------------------- Name : rust-nix Product : Fedora 42 Version : 0.31.2 Release : 1.fc42 URL : https://crates.io/crates/nix Summary : Rust friendly bindings to *nix APIs Description : Rust friendly bindings to *nix APIs. -------------------------------------------------------------------------------- Update Information: Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45, fixing CVE-2026-33056. Update rust-nix to 0.31.2. Update uv and python- uv-build to 0.10.2, rebuilding them with the latest rust-astral-tokio-tar and rust-tar. Update python-fastar to 0.9.0, rebuilding it with the lastest rust- tar. Rebuild maturin with the latest rust-tar. -------------------------------------------------------------------------------- ChangeLog: * Tue Mar 17 2026 Benjamin A. Beasley - 0.31.2-1 - Update to verison 0.31.2; Fixes RHBZ#2443509 * Thu Feb 12 2026 Fabio Valentini - 0.31.1-2 - Skip one additional test that fails on RHEL 9 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2448054 - rust-astral-tokio-tar-0.6.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2448054 [ 2 ] Bug #2449243 - uv-0.10.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449243 [ 3 ] Bug #2449274 - rust-tar-0.4.45 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449274 [ 4 ] Bug #2449338 - python-uv-build-0.10.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449338 [ 5 ] Bug #2449547 - CVE-2026-32766 python-uv-build: astral-tokio-tar: Potential archive misinterpretation via malformed PAX extensions [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2449547 [ 6 ] Bug #2449549 - CVE-2026-32766 uv: astral-tokio-tar: Potential archive misinterpretation via malformed PAX extensions [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2449549 [ 7 ] Bug #2449645 - python-fastar-0.9.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449645 [ 8 ] Bug #2449681 - CVE-2026-33056 maturin: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449681 [ 9 ] Bug #2449683 - CVE-2026-33056 python-fastar: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449683 [ 10 ] Bug #2449684 - CVE-2026-33056 python-uv-build: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449684 [ 11 ] Bug #2449694 - CVE-2026-33056 uv: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449694 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-23bb71ea52' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45, fixing CVE-2026-33056. Update rust-nix to 0.31.2. Update uv and python- uv-build to 0.10.2, rebuilding them with the latest rust-astral-tokio-tar and rust-tar. Update python-fastar to 0.9.0, rebuilding it with the lastest rust- tar. Rebuild maturin with the latest rust-tar.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-d18cf572b8 2026-03-28 00:45:01.877972+00:00 -------------------------------------------------------------------------------- Name : maturin Product : Fedora 43 Version : 1.9.6 Release : 5.fc43 URL : https://github.com/PyO3/maturin Summary : Build and publish Rust crates as Python packages Description : Build and publish crates with pyo3, rust-cpython and cffi bindings as well as rust binaries as python packages. -------------------------------------------------------------------------------- Update Information: Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45, fixing CVE-2026-33056. Update rust-nix to 0.31.2. Update uv and python- uv-build to 0.10.2, rebuilding them with the latest rust-astral-tokio-tar and rust-tar. Update python-fastar to 0.9.0, rebuilding it with the lastest rust- tar. Rebuild maturin with the latest rust-tar. Update to 0.9.0 -------------------------------------------------------------------------------- ChangeLog: * Sat Mar 21 2026 Benjamin A. Beasley - 1.9.6-5 - Rebuilt with rust-tar 0.4.45 for CVE-2026-33056 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2448054 - rust-astral-tokio-tar-0.6.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2448054 [ 2 ] Bug #2449243 - uv-0.10.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449243 [ 3 ] Bug #2449274 - rust-tar-0.4.45 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449274 [ 4 ] Bug #2449338 - python-uv-build-0.10.12 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449338 [ 5 ] Bug #2449551 - CVE-2026-32766 python-uv-build: astral-tokio-tar: Potential archive misinterpretation via malformed PAX extensions [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2449551 [ 6 ] Bug #2449553 - CVE-2026-32766 uv: astral-tokio-tar: Potential archive misinterpretation via malformed PAX extensions [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2449553 [ 7 ] Bug #2449645 - python-fastar-0.9.0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2449645 [ 8 ] Bug #2449681 - CVE-2026-33056 maturin: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449681 [ 9 ] Bug #2449683 - CVE-2026-33056 python-fastar: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449683 [ 10 ] Bug #2449684 - CVE-2026-33056 python-uv-build: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449684 [ 11 ] Bug #2449694 - CVE-2026-33056 uv: tar-rs: Arbitrary directory permission modification via crafted tar archive [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449694 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-d18cf572b8' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:. Oracle Linux Security Advisory ELSA-2026-3752 http://linux.oracle.com/errata/ELSA-2026-3752.html The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network: x86_64: osbuild-composer-149-5.0.1.el10_1.x86_64.rpm osbuild-composer-core-149-5.0.1.el10_1.x86_64.rpm osbuild-composer-worker-149-5.0.1.el10_1.x86_64.rpm aarch64: osbuild-composer-149-5.0.1.el10_1.aarch64.rpm osbuild-composer-core-149-5.0.1.el10_1.aarch64.rpm osbuild-composer-worker-149-5.0.1.el10_1.aarch64.rpm SRPMS: http://oss.oracle.com/ol10/SRPMS-updates/osbuild-composer-149-5.0.1.el10_1.src.rpm Related CVEs: CVE-2025-61726 CVE-2025-61728 CVE-2025-61729 CVE-2025-68121 Description of changes: [149-5.0.1] - Add missing dependency over dracut-config-rescue for image-installer [Orabug: 38587453] - Add OL10 support - Update repository URLs for baseos, appstream and UERK - Fix the label for UEKR repository - Simplify repository names [JIRA: OLDIS-35893] - Ensure build on latest golang: CVE-2024-34156 - Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643] - Support using OCI variables inside built images [JIRA: OLDIS-35302] - Support using repository definitons with OCI variables [JIRA: OLDIS-38657] - Update repositories to contain OCI variables - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123] - Increase default /boot size to 1GB [Orabug: 36827079] - Add support for OCI hybrid images [JIRA: OLDIS-33593] - enable aarch64 OCI image builds [JIRA: OLDIS-33593] - support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619] [149-5] - Rebuilt to fix: - CVE-2025-61726 - CVE-2025-61728 - CVE-2025-61729 - CVE-2025-68121 - RHEL-146726 - RHEL-146931 - RHEL-147353 - RHEL-149232 _______________________________________________ El-errata mailing list
. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4471-1
update to version 2.25.2. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-be2a1b5e6a 2025-12-02 01:17:50.891972+00:00 -------------------------------------------------------------------------------- Name : python-spotipy Product : Fedora 41 Version : 2.25.2 Release : 1.fc41 URL : https://github.com/spotipy-dev/spotipy Summary : A light weight Python library for the Spotify Web API Description : A light weight Python library for the Spotify Web API -------------------------------------------------------------------------------- Update Information: update to version 2.25.2 -------------------------------------------------------------------------------- ChangeLog: * Wed Nov 26 2025 Bill Pemberton - 2.25.2-1 - update to version 2.25.2 * Fri Sep 19 2025 Python Maint - 2.25.1-5 - Rebuilt for Python 3.14.0rc3 bytecode * Fri Aug 15 2025 Python Maint - 2.25.1-4 - Rebuilt for Python 3.14.0rc2 bytecode * Fri Jul 25 2025 Fedora Release Engineering - 2.25.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild * Tue Jun 3 2025 Python Maint - 2.25.1-2 - Rebuilt for Python 3.14 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-be2a1b5e6a' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Rebuild with tracing-subscriber v0.3.20 for CVE-2025-58160.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-7b8fe5b994 2025-09-12 19:20:52.461958+00:00 -------------------------------------------------------------------------------- Name : rust-monitord Product : Fedora 43 Version : 0.12.1 Release : 3.fc43 URL : https://crates.io/crates/monitord Summary : Know how happy your systemd is Description : monitord is a library and daemon to gather statistics about systemd. -------------------------------------------------------------------------------- Update Information: Rebuild with tracing-subscriber v0.3.20 for CVE-2025-58160. -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 2 2025 Fabio Valentini - 0.12.1-3 - Rebuild with tracing-subscriber v0.3.20 for CVE-2025-58160 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-7b8fe5b994' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Qt 6.9.1 bugfix release.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-c546fd3f09 2025-06-11 02:45:06.590648+00:00 -------------------------------------------------------------------------------- Name : qt6-qtsensors Product : Fedora 42 Version : 6.9.1 Release : 1.fc42 URL : http://www.qt.io/ Summary : Qt6 - Sensors component Description : The Qt Sensors API provides access to sensor hardware via QML and C++ interfaces. The Qt Sensors API also provides a motion gesture recognition API for devices. -------------------------------------------------------------------------------- Update Information: Qt 6.9.1 bugfix release. -------------------------------------------------------------------------------- ChangeLog: * Mon Jun 2 2025 Jan Grulich - 6.9.1-1 - 6.9.1 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2369872 - CVE-2025-5455 qt6: QtCore Assertion Failure Denial of Service [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2369872 [ 2 ] Bug #2371133 - CVE-2025-5683 qt5: Qt ICNS Image Crash Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2371133 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-c546fd3f09' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list
Get the latest Linux and open source security news straight to your inbox.