Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 514
Alerts This Week
Warning Icon 1 514

Stay Secure with the Latest Linux Advisories

Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 21 articles for you...
202

openSUSE Leap 15.4: Poppler Moderate CVE-2025-43718 Recursion Patch

An update that solves one vulnerability can now be installed.. # Security update for poppler Announcement ID: SUSE-SU-2025:3898-1 Release Date: 2025-10-31T14:55:55Z Rating: moderate References: * bsc#1250908 Cross-References: * CVE-2025-43718 CVSS scores: * CVE-2025-43718 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2025-43718 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H * CVE-2025-43718 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43718 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-3898=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * typelib-1_0-Poppler-0_18-22.01.0-150400.3.41.1 * libpoppler-glib8-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-22.01.0-150400.3.41.1 * libpoppler-glib8-22.01.0-150400.3.41.1 * poppler-tools-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-22.01.0-150400.3.41.1 * libpoppler-devel-22.01.0-150400.3.41.1 * poppler-qt5-debugsource-22.01.0-150400.3.41.1 * libpoppler-glib-devel-22.01.0-150400.3.41.1 * libpoppler117-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-3-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-devel-22.01.0-150400.3.41.1 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.41.1 *libpoppler-cpp0-22.01.0-150400.3.41.1 * libpoppler-qt6-3-22.01.0-150400.3.41.1 * poppler-tools-22.01.0-150400.3.41.1 * poppler-debugsource-22.01.0-150400.3.41.1 * poppler-qt6-debugsource-22.01.0-150400.3.41.1 * libpoppler-qt5-devel-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (x86_64) * libpoppler-glib8-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-22.01.0-150400.3.41.1 * libpoppler-glib8-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-debuginfo-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libpoppler-glib8-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-22.01.0-150400.3.41.1 * libpoppler-glib8-64bit-22.01.0-150400.3.41.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43718.html * https://bugzilla.suse.com/show_bug.cgi?id=1250908 . This update addresses a moderate severity issue in poppler related to uncontrolled recursion in PDF files processing.. poppler security update, openSUSE patch, PDF processing fix, SUSE vulnerability management. . LinuxSecurity.com Team

Calendar%202 Oct 31, 2025 OpenSUSE
100

openSUSE: Poppler Moderate Recursion Issue SUSE-2025:3898-1 CVE-2025-43718

* bsc#1250908 Cross-References: * CVE-2025-43718 . # Security update for poppler Announcement ID: SUSE-SU-2025:3898-1 Release Date: 2025-10-31T14:55:55Z Rating: moderate References: * bsc#1250908 Cross-References: * CVE-2025-43718 CVSS scores: * CVE-2025-43718 ( SUSE ): 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N * CVE-2025-43718 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H * CVE-2025-43718 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-43718 ( NVD ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files (bsc#1250908) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-3898=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * typelib-1_0-Poppler-0_18-22.01.0-150400.3.41.1 * libpoppler-glib8-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-22.01.0-150400.3.41.1 * libpoppler-glib8-22.01.0-150400.3.41.1 * poppler-tools-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-22.01.0-150400.3.41.1 * libpoppler-devel-22.01.0-150400.3.41.1 * poppler-qt5-debugsource-22.01.0-150400.3.41.1 * libpoppler-glib-devel-22.01.0-150400.3.41.1 * libpoppler117-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-3-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt6-devel-22.01.0-150400.3.41.1 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-22.01.0-150400.3.41.1 *libpoppler-qt6-3-22.01.0-150400.3.41.1 * poppler-tools-22.01.0-150400.3.41.1 * poppler-debugsource-22.01.0-150400.3.41.1 * poppler-qt6-debugsource-22.01.0-150400.3.41.1 * libpoppler-qt5-devel-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (x86_64) * libpoppler-glib8-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-22.01.0-150400.3.41.1 * libpoppler-glib8-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-32bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-32bit-22.01.0-150400.3.41.1 * libpoppler117-32bit-debuginfo-22.01.0-150400.3.41.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libpoppler-glib8-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-22.01.0-150400.3.41.1 * libpoppler-cpp0-64bit-debuginfo-22.01.0-150400.3.41.1 * libpoppler117-64bit-22.01.0-150400.3.41.1 * libpoppler-qt5-1-64bit-22.01.0-150400.3.41.1 * libpoppler-glib8-64bit-22.01.0-150400.3.41.1 ## References: * https://www.suse.com/security/cve/CVE-2025-43718.html * https://bugzilla.suse.com/show_bug.cgi?id=1250908 . A moderate security update for openSUSE addressing CVE-2025-43718 in poppler, preventing controlled recursions in PDF processing.. openSUSE Poppler Security Update, CVE-2025-43718 Patch, Linux Application Security. . LinuxSecurity.com Team

Calendar%202 Oct 31, 2025 SuSE
89

Fedora 42: Critical Fix for Uncontrolled Recursion in rust-protobuf-codegen

Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf-codegen Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf-codegen Summary : Code generator for rust-protobuf Description : Code generator for rust-protobuf. Includes a library to invoke programmatically (e. g. from `build.rs`) and `protoc-gen-rs` binary. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Sun Sep 21 2025 Fabio Valentini - 3.7.2-1 - Update to version 3.7.2; Fixes RHBZ#2080867 * Fri Jul 25 2025 Fedora Release Engineering - 2.28.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Critical update for Fedora 42's rust-protobuf-codegen addresses uncontrolled recursion issue and other enhancements.. rust-protobuf-codegen, Fedora 42, update notification, security advisory. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 15, 2025 Critical Fedora
89

Fedora 42: Severe Uncontrolled Recursion Flaw in rust-protobuf-parse

Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf-parse Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf-parse Summary : Parse .proto files Description : Parse `.proto` files. Files are parsed into a `protobuf::descriptor::FileDescriptorSet` object using either: * pure rust parser (no dependencies) * `protoc` binary (more reliable and compatible with Google's implementation). -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 3.7.2-1 - Initial import (#2397168) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su-c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Update for rust-protobuf-parse solves critical uncontrolled recursion risks enhancing system compatibility and stability.. rust-protobuf-parse update, Fedora 42 security, package management. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 15, 2025 Critical Fedora
89

Fedora 42: rust-protobuf-update Loop Prevention Solution 2025-3de09bf58a

Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf-support Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf-support Summary : Code supporting protobuf implementation Description : Code supporting protobuf implementation. None of code in this crate is public API. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 3.7.2-1 - Initial import (#2397167) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnfdocumentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Update for Fedora 42 addressing the Uncontrolled Recursion Vulnerability in protobuf support. Fix your installations soon.. rust-protobuf-support, Fedora 42, patch, security advisory. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Oct 15, 2025 Critical Fedora
89

Fedora 42: Crucial Resolution for Infinite Recursion in rust-prometheus

Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-prometheus Product : Fedora 42 Version : 0.14.0 Release : 1.fc42 URL : https://crates.io/crates/prometheus Summary : Instrumentation library for Rust applications Description : Prometheus instrumentation library for Rust applications. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 0.14.0-1 - Update to version 0.14.0; Fixes RHBZ#2279084 * Fri Jul 25 2025 Fedora Release Engineering - 0.13.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Fedora 42 updates rust-prometheus to fix a critical uncontrolled recursion issue, enhancing system security.. rust-prometheus update, Fedora security update, vuln management. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Oct 15, 2025 Important Fedora
89

Fedora 42: Updated Mirrorlist Server to Fix Uncontrolled Recursion Issue

Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : mirrorlist-server Product : Fedora 42 Version : 3.0.8 Release : 1.fc42 URL : https://github.com/adrianreber/mirrorlist-server Summary : Mirrorlist Server Description : The mirrorlist-server uses the data created by MirrorManager2 (https://github.com/fedora-infra/mirrormanager2) to answer client request for the "best" mirror. This implementation of the mirrorlist-server is written in Rust. The original version of the mirrorlist-server was part of the MirrorManager2 repository and it is implemented using Python. While moving from Python2 to Python3 one of the problems was that the data exchange format (Python Pickle) did not support running the MirrorManager2 backend with Python2 and the mirrorlist frontend with Python3. To have a Pickle independent data exchange format protobuf was introduced. The first try to use protobuf in the python mirrorlist implementation required a lot more memory than the Pickle based implementation (3.5GB instead of 1.1GB). That is one of the reasons a new mirrorlist-server implementation was needed. Another reason to rewrite the mirrorlist-server is its architecture. The Python based version requires the Apache HTTP server or something that can run the included wsgi. The wsgi talks over a socket to the actual mirrorlist-server. In Fedora's MirrorManager2 instance this runs in a container which runs behind HAProxy. This implementation in Rust directly uses a HTTP library to reduce the number of involvedcomponents. In addition to being simpler this implementation also requires less memory than the Python version. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 30 2025 Fabio Valentini - 3.0.8-1 - Update to version 3.0.8; Fixes RHBZ#2379121 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Update to mirrorlist-server 3.0.8 includes critical fixes for Uncontrolled Recursion. Enhance your Fedora security.. Fedora mirrorlist-server update, security advisory, uncontrolled recursion fix, Fedora 42, software upgrade. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Oct 15, 2025 Important Fedora
89

Fedora 42: python-jsonschema Critical Infinite Loop Patch 2025-1b67ab3f5f

Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1ac08db27d 2025-10-15 01:00:23.850307+00:00 -------------------------------------------------------------------------------- Name : rust-protobuf Product : Fedora 42 Version : 3.7.2 Release : 1.fc42 URL : https://crates.io/crates/protobuf Summary : Rust implementation of Google protocol buffers Description : Rust implementation of Google protocol buffers. -------------------------------------------------------------------------------- Update Information: Update mirrorlist-server to version 3.0.8. Update the maxminddb crate to version 0.26.0. Update the prometheus crate to version 0.14.0. Update the protobuf and protobuf-codegen crates to version 3.7.2. Initial packaging of the protobuf-parse and protobuf-support crates. This includes fixes for CVE-2025-53605 (Uncontrolled Recursion Vulnerability in the protobuf crate). -------------------------------------------------------------------------------- ChangeLog: * Sun Sep 21 2025 Fabio Valentini - 3.7.2-1 - Update to version 3.7.2; Fixes RHBZ#2080866 * Fri Jul 25 2025 Fedora Release Engineering - 2.28.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2376751 - CVE-2025-53605 mirrorlist-server: Protobuf: Uncontrolled Recursion Vulnerability [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2376751 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade--advisory FEDORA-2025-1ac08db27d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Fedora 42 rust-protobuf update addresses an important uncontrolled recursion threat with fixes and enhancements.. Fedora 42,Rust Protobuf,security advisory,uncontrolled recursion,update. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Oct 15, 2025 Important Fedora
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200