Packages changed: 389-ds (3.1.4+e2562f589 -> 3.2.2+4b41542b2) LibVNCServer busybox ddcutil (2.2.5 -> 2.2.7) ed (1.22.5 -> 1.22.6) gnome-characters libdvdread (7.0.1 -> 7.1.1) libebml (1.4.5 -> 1.4.7) libmatroska (1.7.1 -> 1.7.2) live555 (2026.06.01 -> 2026.08.14) m17n-db (1.8.10 -> 1.8.14) openexr (3.4.13 -> 3.4.14) qt6-base rsyslog yast2-ntp-client (5.0.1 -> 5.0.2) === Details === ==== 389-ds ==== Version update (3.1.4+e2562f589 -> 3.2.2+4b41542b2) Subpackages: lib389 libsvrcore0 - Due to an administration error some patches were missed in the previous update. - bsc#1268047 - CVE-2026-11791 - schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free - bsc#1268064 - CVE-2026-11786 - lack of length check can cause an out-of-bound read - bsc#1268065 - CVE-2026-11785 - type confusion in the SSO token handler can cause partial stack address information disclosure - bsc#1268298 - CVE-2026-11774 - integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow - Update to version 3.2.2+4b41542b2: * Issue 7705 - With memberOfEntryScope set, deferred memberOf skips MODIFY operations (#7706) * Issue 7698 - Fix silent entry loss in LMDB bulk import waiter handling (#7699) * Issue 7711 - Fix typo in accountpolicy --login-history-size help text (#7713) * Issue 6419 - Error: name 'cockpit_present' is not defined (#7719) * Issue 7666 - Replication performance degradation during total init on high-latency storage (#7667) * Issue 7645 - Add runtime LeakSanitizer leak check (#7646) * Issue 7709 - Add EPEL 10 target to Packit COPR builds * Issue 7714 - UI - sass import rules are deprecated * Issue 7658 - Heap Buffer Overflow in sasl_io_recv() via Padded SASL UNBIND * Issue 7710 - MemberOf deferred update - Use condvar instead of sleep loop * Issue 7637 - UI - Using Arrow Keys in New Object Wizard Resulted in DOM Reload * Issue 7578 - schema - attribute refcount is not maintained properly * Issue 7468 - RFE - HIBP password breach validation (#7492) * Issue 7605 - Harden CI test ports against ephemeral allocation (#7692) * Issue 7528 - Retry the CI image pull instead of failing the job (#7691) * Backport Issue 7519 — ignore obsolete entrydn when entryrdn is in use (#7657) * Issue 7466 - UI - Refactor all TextInput number types to NumberInput * Issue 7505 - RFE - CLI - add feature to determine which password policy applies to a user * Issue 7670 - BDB range searches intermittently fail with err=1 under write load (#7671) * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7662) * Issue 7284 - Automated test for creating local password policy with incorrect passwordInHistory value (#7608) * Issue 7200 - repl-agmt create doesn't set some parameters (#7663) * Issue 7573 - Post-import cache autotuning does not recompute entry cache size (#7574) * Issue 7611 - Preserve legacy PBKDF2 hash compatibility (#7649) * Issue 7547 - Heap buffer overflow in ldap_utf8prev() * Issue 7611 - PBKDF2 password verification should reject invalid iteration count (#7613) * Issue 7535 - Fix race in test_schema_update_policy_reject * Issue 7558 - Total init sends the suffix entry twice (#7640) * Issue 7635 - Integer Underflow in {SMD5} Password Comparison (#7636) - bsc#1269120 - [QE] Exception in dsctl - bsc#1267975 - CVE-2026-11611 - content synchronization persistent search plugin can allow unbounded memory growth - bsc#1268041 - CVE-2026-11793 - crafted nsDS5ReplicaCredentials can lead to a stack buffer overflow - bsc#1268046 - CVE-2026-11792 - password value shorter than 23 characters can cause a heap buffer overflow - bsc#1268047 - CVE-2026-11791 - schema reload triggered during concurrent LDAP query traffic can lead to a use-after-free - bsc#1268057 - CVE-2026-11788 - lack of allocation failure check can lead to null pointer dereference - bsc#1268058 - CVE-2026-11789 - crafted SMD5 hash can lead to an integer underflow - bsc#1268060 - CVE-2026-11790 - crafted password hash can cause excessive CPU consumption - bsc#1268062 - CVE-2026-11787 - lack of bounds check can lead to a heap buffer over-read - bsc#1268064 - CVE-2026-11786 - lack of length check can cause an out-of-bound read - bsc#1268065 - CVE-2026-11785 - type confusion in the SSO token handler can cause partial stack address information disclosure - bsc#1268115 - CVE-2026-11884 - Remote Code Execution and Denial of Service via heap buffer overflow - bsc#1268298 - CVE-2026-11774 - integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow - bsc#1268491 - CVE-2026-12528 - heap-buffer-overflows in __aclp__normalize_acltxt() - bsc#1270695 - CVE-2026-11610 - Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND - Update to version 3.2.2+e58d96e17: * Issue 7406 - Fix ldap-agent SNMP stats file loading (#7630) * Issue 7621 - Stack Buffer Overflow in Password checkPrefix * Issue 7623 - Heap Buffer Overflow in 389-ds-base Audit Log Password Masking * Issue 7602 - CI - lib389 user compare fails due to parentid mismatch (#7603) * Issue 3555 - UI - Fix audit issue with npm - ws, js-yaml, babel/core (#7599) * Issue 7263 - UI - Use cockpit.file API for temporary file writes (#7590) * Issue 7541 - Add invalid ACL text header regression test (#7591) * Issue 7554 - UI - Revise local password policy layout * Issue 7521 - UI - make changes for cockpit API updates * Issue 7541 - heap-buffer-overflows in __aclp__normalize_acltxt() (#7542) * Issue 7490 - Enable USDT probes by default in RPM (#7491) * Issue 7576 - Fix leak of temporary attribute syntax hash tables after schema reload * Issue 7549 - Substring index should validate minimum nsSubStrBegin/nsSubStrEnd values (#7550) * Issue 7539 - Server shutdown during online reindex may lead to data loss (#7540) * Issue 7558 - During online import, the IDL should be created with in-depth first approach (#7559) * Issue 7500 - Prevent unsigned integer underflow during stalled import * Issue 7562 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' (#7563) * Issue 7560 - lib389 - Add helper function for checking ASAN files * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7556) * Issue 7554 - deref plugin null pointer dereference if ber_init fails * Bump version to 3.2.2 * Issue 6753 - Port ticket 49658 test * Issue 6753 - Removing ticket48252_test and porting to DSLdapObject (#7520) * Issue 6753 - Port ticket 48354 test * Issue 6753 - Port ticket 48745 and 48746 tests (#7513) * Issue 7493 - RFE - Add ShadowAccount fixup task * Issue 7507 - UI - cleanup style and alignments * Issue 7514 - Crash when doing moddn on very large subtree * Issue 7516 - dblayer_bulk_nextdata should not return an error when maxrecords is hit * Issue 7475 - Fix CI test failures in test_fd_limits (#7488) * Issue 7496 - Fix latest GCC compiler warnings * Issue 7503 - CVE-2026-9064 - Add a limit to the number controls per operation * Issue 7468 - RFE - Add HIBP HTTP client (#7469) * Issue 7402 - remove debug print state * address Simon's comments * Minor fixes * fix CI tests * Add disk space checking functionality for offline server * Issue 7402 - CLI - allow healthcheck to work when server is stopped * Issue 6753 - Removing ticket49412_test and porting to DSLdapObject (#7428) * Issue 6753 - Removing ticket49303_test and porting to DSLdapObject (#7429) * Issue 7460 - MOD_REPLACE on groups/link attributes modifies overlap targets (#7461) * Issue 6753 - Removing ticket49287 test and porting to DSLdapObject (#7480) * Issue 7464 - CLI - allow dsidm to work with other user types * Issue 7435 - Add AGENTS.md to support AI coding assistants * Issue 6753 - Port ticket 48266 test * Bump fast-uri from 3.1.0 to 3.1.2 in /src/cockpit/389-console (#7487) * Issue 6753 - Port ticket 48383 test (#7486) ... changelog too long, skipping 242 lines ... * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285) ==== LibVNCServer ==== - added patches CVE-2026-50538: a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer [bsc#1276218] * LibVNCServer-CVE-2026-50538.patch ==== busybox ==== Subpackages: busybox-static - Fix stack exhaustion in the ash applet caused by unbounded shell function recursion (CVE-2026-38755, bsc#1271548) * ash-fix-evalfun.patch - Fix out-of-bounds read in ifsbreakup() (CVE-2026-38754, bsc#1271547) * 0001-ash-fix-out-of-bounds-read-in-ifsbreakup.patch - Fix use-after-free in the awk applet regexp processing code when text replacement operations are used (CVE-2026-38753, bsc#1271545) * awk-fix-use-after-free-sub.patch - Fix stack exhaustion in the awk applet caused by unbounded function call recursion (CVE-2026-38752, bsc#1271544) * awk-fix-recursion.patch - Fix heap buffer overflow in the awk applet when a regexp ends with a backslash (CVE-2023-42366, bsc#1217586) * 0001-awk.c-fix-CVE-2023-42366-bug-15874.patch ==== ddcutil ==== Version update (2.2.5 -> 2.2.7) Subpackages: ddcutil-i2c-udev-rules libddcutil5 - Update to 2.2.7: * New: - Extensive diagnostics are written to the system log if opening a /dev/i2c device fails with errno EACCES. - Implemented a basic segfault handler. - Option max-eacces-retry-ms. (See above.) * Changes: - Re-enable reporting of laptop display connection/disconnection. Do not check DDC operation for the laptop /dev/i2c bus or for any bus unresponsive on slave address x37. - When watching for display connection/disconnection using watch-mode UDEV: * watch for UDEV notifications for subsystem i2c-dev as well as drm. * write udev event detail to the system log - dw_hotplug_change_handler(): write additonal messages to the system log when a /dev/i2c device unexpectedly no longer exists - Option --skip-ddc-checks: valid only for command line ddcutil, not shared library libddcutil. If specified in config file ddcutilrc, it must now be in the [ddcutil] section, not the [global] section. - The installed udev rules file, 60-ddcutil-i2c.rules now sets group i2c and mode 0660 as well as using token uaccess to assign /dev/i2c permissions. Users encountering the transient EACCES errors may need to use the old group permissions method. * Fixes: - ddca_redetect_displays(): Recover from an unexpected system state that previously triggered assert() failures. (gh#rockowitz/ddcutil#595), (kde#517571) - dw_create_display_status_event(), test for event type DDCA_EVENT_DDC_DISABLED incorrectly used flag DDCA_DISPLAY_EVENT_DDC_WORKING. - man page ddcutil: Replace "getvcp supported" by "getvcp all". Group "supported" was replaced long ago by "all". (gh#rockowitz/ddcutil#579). - segfault in diagnose_open_failure_to_syslog(). (gh#rockowitz/ddcutil#596) - Error parsing option --maxtries. - run command line programs lsof, getfacl caused a segfault when those programs are not found on the user's system. (gh#rockowitz/ddcutil#590) - In syslog, reported thread id might be the process id. - Change the sample rules file 60-ddcutil-i2c.rules, to conform to /usr/lib/udev/rules.d/60-ddcutil-i2c.rules. Loosens the display adapter test (gh#rockowitz/ddcutil#597) - Fix ioctl call in hiddev_get_report(), for monitors using USB rather that I2C - reading the EDID bytewise use get_edid_bytes_directly_using_fileio(), only every other byte was saved. - Incorrect call to i2c-dev set address ioctl. - General source cleanup using Claude Code - Update Doxygen documentaion. - Consistenly make #include "config.h" the first include. - Consistenly set AM_CFLAGS = $(AM_CLAGS_STD) in the Makefile.am - Avoid a possible buffer overflow when printing an EDID field such as serial number that contains invalid ASCII characters - Write error message during getvcp --brief* to stderr, not stdout. (gh#rockowitz/ddcutil#598) - More consistent formatting of syslog output. - Use atomic variables to fix time of use to time of check (TOCTOU) race conditions identified by Claude Code. * Drop 0001-fix-freezes-on-laptops.patch ==== ed ==== Version update (1.22.5 -> 1.22.6) - GNU ed 1.22.6: * Add gcc's static analyzer issues * documentation updates ==== gnome-characters ==== Subpackages: gnome-characters-lang gnome-shell-search-provider-gnome-characters - Replace appstream-glib with AppStream BuildRequires: Align with what meson really checks for (appstreamcli). ==== libdvdread ==== Version update (7.0.1 -> 7.1.1) - update to 7.1.1: * reduce the number of symbols exported to avoid conflicts when linking * DVD-Audio support: * Allow CPRM and CSS decryption support to be available simultaneously * Add Audio Still Video Set (ASVS) IFO structures and readers * Add ASVS and SAMG support to public IFO open APIs * Expose ASVS IFO, backup and menu VOB files * Improve AOB/VOB stream type handling * Misc fixes on structures documentation * DVD-VR support: * Add DVD-VR IFO parsing (PGIT, PG_GI, PS_GI) * Add DVDOpenVideoRecording functions * Add ifoOpenVideoRecording support * Add CPRM decryption support * Add DVDProbeType auto-detection for DVD-Video, DVD-Audio and DVD-VR * Add support for user-defined cells and time maps * Harden parsing of missing or malformed DVD-VR metadata * Add DVDOpenFiles for caller-provided virtual filesystem implementations * Split the internal filesystem implementation into platform- specific helpers * Improve file and directory handling on Windows, macOS and iOS * Improve logger fallback behavior when no controlling terminal is available * Add audio and subpicture code extension enums * Fixes and hardening: * Hardened IFO parsing for oversized still video groups * Fix DVD-Audio ASVS/SAMG fallback handling * Fix DVD-VR cell entry point byte swapping * Fix DVDFileSeek validation for non-sector-aligned files * Fix partial-block size accounting * Fix resource leaks, null pointer checks and error paths ==== libebml ==== Version update (1.4.5 -> 1.4.7) - Update to version 1.4.7 * Fixed cmake rules for building with utf8cpp 4.x version 1.4.6: * Set EbmlHead as not allowed to be infinite (as per RFC 8794) * Fix leak on upper element found inside the last element * EbmlString::ReadFully: use automatic memory management/fewer allocations * EbmlUnicodeString: use std::string when reading instead of manual memory management * IOCallback: avoid reading more than 2^32 at once * Fix some includes that are not implicit in modern compilers * Download utfcpp automatically * Show a summary of build configuration when configuring CMake * Add a DEV_MODE CMake option to check more compiler errors (default off) ==== libmatroska ==== Version update (1.7.1 -> 1.7.2) - update to 1.7.2: * Do not allow infinite sizes on all Master elements except Segment+Cluster * Only allow `KaxSeekId` of 4 bytes length (as per RFC 9559). * KaxBlock: release read buffers on `EndOfStream` error. * Catch some allocation failures internally. * Deprecate `KaxTrackMinCache`/`KaxTrackMaxCache` elements (as per RFC 9559). * Deprecate `KaxTrackOverlay` element (as per RFC 9559). * Fix `MATROSKA_VIDEO_FIELDORDER_TOPFIELDSWAPPED`/ * `MATROSKA_VIDEO_FIELDORDER_BOTTOMFIELDSWAPPED` values. * Add missing `MatroskaChapProcessCodecID` enum. * [API break] remove `MatroskaChapterTranslateCodec`/`MatroskaT rackTranslateCodec`. * KaxSemantic: update enum comments to match RFC 9559. * Add `MATROSKA_CHAPTERSKIPTYPE_INTERMISSION` to `MatroskaChapterSkipType`. * Fix some includes that are not implicit in modern compilers. * Show a summary of build configuration when configuring CMake. * Add a DEV_MODE CMake option to check more compiler errors (default off). * Add a BUILD_EXAMPLES CMake option (default off). ==== live555 ==== Version update (2026.06.01 -> 2026.08.14) Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 - update to 2026.08.14: * Fixed a bug that could cause a problem with subclassed variants of H.264 or H.265 RTP sinks. * Fixed old code in "GroupsockHelper.cpp" that was using hardcoded numeric error numbers * Fixed a memory leak that could occur when parsing a SDP description that contains two or more * When adding protection against the use of 'stolen' RTSP session ids we forgot to do so for every "SETUP" command. This release fixes that. * Fixed a typo in "RTSPCommon.cpp": "smtpe" -> "smpte". * Updated the RTSP server implementation to return a "Unsupported Transport" error if a "SETUP" request does not include a "Transport:" header. * Added "-std=c++20" to the "CPLUSPLUS_FLAGS" line in each "config.*" file, so that "std::atomic_flag::test" will compile with compilers that support * Made the parsing of MP3 audio files more robust to protect against malformed MP3 data. * Minor change to "testProgs/testRTSPClient.cpp" to make compiling on Mac OS X happier. ==== m17n-db ==== Version update (1.8.10 -> 1.8.14) Subpackages: m17n-db-lang - update to 1.8.14: * am-sera.mim: Fix Ethiopic Swap between ፙ and ፘ, and Add ጟ * mr-krutidev.mim: Marathi input method for Remington (Godrej) typewriter layout. By Aniruddha Purushottamrao Mohod * bn-unijoy.mim: Update to modern Unijoy layout * bn-khipro.mim: Updates by the author: Nafee * bn-khipro.mim: from https://github.com/rank- coder/khipro-m17n/blob/main/bn-khipro.mim by Nafee Bishan * ta-tamil99.mim: Various fixes by thesupertechie * kn-kgp.mim: Update by the original author Sridhar M A ==== openexr ==== Version update (3.4.13 -> 3.4.14) Subpackages: libIex-3_4-33 libIex-3_4-33-x86-64-v3 libIlmThread-3_4-33 libIlmThread-3_4-33-x86-64-v3 libOpenEXR-3_4-33 libOpenEXR-3_4-33-x86-64-v3 libOpenEXRCore-3_4-33 libOpenEXRCore-3_4-33-x86-64-v3 - version update to 3.4.14 * [CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514) PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow * [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513) PyOpenEXR prefixed literal RGB key collision heap buffer overflow * [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986) PyOpenEXR deep prefixed RGB stale lane disclosure * [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703) PyOpenEXR deep mixed RGB heap buffer overflow * [CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555) empty multiView viewFromChannelName file crash * [CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985) ILP32 OpenEXRCore RLE decode heap OOB read DoS * [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984) ILP32 B44 InputFile decode scratch buffer overflow * [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983) ILP32 DeepTiledInputFile sample count table decode OOB read * [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982) ILP32 DWAA InputFile packed AC buffer overflow * [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981) OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read * [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189) OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read * [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187) OpenEXR exrmetrics deep pixelmode heap buffer overflow * [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186) OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write * [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184) OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write * [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183) Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding - for other changes see CHANGES.md - fixes CVE-2026-59183 [bsc#1276428] CVE-2026-65979 [bsc#1276843] CVE-2026-68513 [bsc#1276845] CVE-2026-68514 [bsc#1276846] CVE-2026-68515 [bsc#1276848] CVE-2026-59184 [bsc#1276849] CVE-2026-59186 [bsc#1276850] CVE-2026-59187 [bsc#1276851] CVE-2026-59982 [bsc#1276853] CVE-2026-59189 [bsc#1276855] CVE-2026-59983 [bsc#1276856] CVE-2026-59984 [bsc#1276857] CVE-2026-59985 [bsc#1276858] CVE-2026-61555 [bsc#1276859] CVE-2026-62986 [bsc#1276861] CVE-2026-59981 [bsc#1276862] ==== qt6-base ==== Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-platformtheme-gtk3 qt6-printsupport-cups qt6-sql-mysql qt6-sql-sqlite qt6-wayland - Add patch to fix a regression in icon loading (kde#=524657, QTBUG-149431): * 0001-QIconLoader-Don-t-consider-fallbackThemeName-in-them.patch ==== rsyslog ==== - fix RainerScript replace() heap buffer overflow (bsc#1275926) * add 0001-fix-RainerScript-replace-heap-buffer-overflow.patch ==== yast2-ntp-client ==== Version update (5.0.1 -> 5.0.2) - bsc#1274746 - fix loading 'server' entries when there is only one of them - fixed removing of ntp source - 5.0.2