firefox security update

140.16.0-1.0.1 - Update to 140.16.0 ESR Orabug: 40189898CVE-2026-92005CVE-2026-92006 CVE-2026-92007CVE-2026-92008CVE-2026-92009CVE-2026-92010CVE-2026-92011 CVE-2026-92012CVE-2026-92013CVE-2026-92014CVE-2026-92015CVE-2026-92016 CVE-2026-92017CVE-2026-92018CVE-2026-92019CVE-2026-92020CVE-2026-92021...

glibc security update

2.34-284.0.1.4 - Forward-port Oralce patches for ol9-u8 Oracle history: October-13-2026 Jose E. Marchesi - 2.34-283.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Kris Van Hees August-03-2026 Cupertino Miranda - 2.34-275.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E...

gdb security update

8.2-20.1.0.1 - Import gdb-8.2-20.1.el810 and forward-port Oracle changes. Reviewed-by: Jose E. Marchesi Oracle history: Thu Dec 7 2023 Cupertino Miranda - 8.2-20.0.2 - OraBug 36055910 Support RDTSCP in RECORD/REPLAY in interpreter mode record full Reviewed-by: Jose E. Marchesi Wed Oct 4 2023...

firefox security update

140.15.0-1.0.1 - Update to 140.15.0 ESR Orabug: 40120040CVE-2026-16365CVE-2026-75874 CVE-2026-84119CVE-2026-84120CVE-2026-84121CVE-2026-84122CVE-2026-84124 CVE-2026-84131CVE-2026-84143CVE-2026-84145 140.14.0-1.0.1 - Update to 140.14.0 ESR Orabug: 40189882CVE-2026-74934CVE-2026-74935...

firefox security update

140.17.0-1.0.1 - Update to 140.17.0 ESR Orabug: 40229686CVE-2026-92035CVE-2026-96869 CVE-2026-100756CVE-2026-100757CVE-2026-100758CVE-2026-100759CVE-2026-100762 CVE-2026-100766CVE-2026-100767CVE-2026-100769CVE-2026-100770CVE-2026-100771...

delve security update

1.26.1-3.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.26.1-3 - Add GOMODCACHE in %check...

tesseract security update

4.1.1-7 - Rebuilt for mtime issue 4.1.1-6 - Fix incomplete CVE-2026-88051: reset 'sizeused' on validation failure in 'GenericVector::read'; check 'fontinfotable' and 'fontsettable' read return values in 'ReadIntTemplates'; fix callback leak on all early return paths in 'GenericVector::read'...

kernel security update

6.12.0-211.74.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

kernel security, bug fix, and enhancement update

4.18.0-553.184.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

gimp:2.8 security, bug fix, and enhancement update

gimp 2:2.8.22-26.10 - fix CVE-2026-112257 - modify fix for CVE-2026-4154 2:2.8.22-26.9 - fix CVE-2026-90947 - fix CVE-2026-90948 - fix CVE-2026-92248 - fix CVE-2026-97185 2:2.8.22-26.8 - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18303 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix...

firefox security update

140.14.0-1.0.1 - Update to 140.14.0 ESR Orabug: 40189882CVE-2026-74934CVE-2026-74935 CVE-2026-74936CVE-2026-74939CVE-2026-74940CVE-2026-74941CVE-2026-74942 CVE-2026-74943CVE-2026-74944CVE-2026-74945CVE-2026-74946CVE-2026-74948 CVE-2026-74949CVE-2026-74953CVE-2026-74957CVE-2026-74959CVE-2026-74960...

cockpit-files security update

36.1-1 - Fix CVE-2026-91202 - Don't de-reference a symlink when pasting RHEL-263140 - Fix CVE-2026-91205 - Don't de-reference a symlink when creating a directory RHEL-263132...

delve security update

1.26.1-2.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.26.1-2 - Add GOMODCACHE in check - Resolves: RHEL-289481...

kernel security update

5.14.0-687.66.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

osbuild-composer security update

175-1.0.2 - Rebuild to fix CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862...

ovirt-engine-wildfly security update

ovirt-engine-wildfly 24.0.1-4 - Update all bundled CXF release artifacts to 3.6.13 ovirt-engine-wildfly-overlay 24.0.1-4 - Require WildFly 24.0.1-4 with the CXF 3.6.13 update...

ovirt-engine-wildfly security update

ovirt-engine-wildfly 24.0.1-4 - Update all bundled CXF release artifacts to 3.6.13 ovirt-engine-wildfly-overlay 24.0.1-4 - Require WildFly 24.0.1-4 with the CXF 3.6.13 update...

xorg-x11-server-Xwayland security update

21.1.3-20.5 - Add missing antecedent for CVE-2026-93520 fix Resolves: https://redhat.atlassian.net/browse/RHEL-299853...

tesseract security update

4.1.1-11 - Fix incomplete CVE-2026-88051: reset 'sizeused' on validation failure in 'GenericVector::read'; check 'fontinfotable' and 'fontsettable' read return values in 'ReadIntTemplates' 4.1.1-10 - Replace ASSERTHOST around LSTM model Load with graceful error handling; fixes denial-of-service...

webkit2gtk3 security update

2.54.2-0.el98.2 - Update bundled Skia to aa789d9bd566...

tesseract security update

5.3.4-11 - Fix incomplete CVE-2026-88051: reset 'sizeused' on validation failure in 'GenericVector::read'; check 'fontinfotable' and 'fontsettable' read return values in 'ReadIntTemplates' 5.3.4-10 - Replace ASSERTHOST around LSTM model Load with graceful error handling; fixes denial-of-service...

perl-YAML:1.24 security update

perl-YAML 1.24-4 - CVE-2017-20285 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary destructor method execution via crafted YAML document destructor method execution via crafted YAML document - CVE-2019-25777 perl-YAML:1.24/perl-YAML: perl-yaml: Arbitrary code execution via unrestricted package...

gvfs security update

1.36.2-7.0.1 - Backport fix for CVE-2026-84268 Orabug: 40186814...

host-metering security update

Tue Oct 13 2026 Kaylin Devchand [email protected] - 1.2.0-4.0.5 - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-56860 Orabug: 40071668 1.2.0-4.0.3 - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-27145 Orabug: 39863765 1.2.0-4.0.1 - Rebuild with new...

glibc security update

2.34-283.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Kris Van Hees Oracle history: August-03-2026 Cupertino Miranda - 2.34-275.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi July-22-2026 Cupertino Miranda - 2.34-274.0.1 - Forward-port Oracle patches for...

dpdk security update

25.11-2 - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849 CVE-2026-86845 CVE-2026-86847 CVE-2026-86856 CVE-2026-86565 CVE-2026-93683 CVE-2026-100236...

firefox security update

153.6.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 153.6.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 153.6.0-1 - Update to 153.6.0 ESR...

fence-agents security update

4.16.0-21.7 - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272 Resolves: RHEL-281025, RHEL-281457, RHEL-286479, RHEL-278385, RHEL-281051...

qemu-kvm security, bug fix, and enhancement update

10.1.0-17.el98.9 - kvm-qcow2-Add-keepdatafile-command-line-option.patch RHEL-164549 - kvm-qcow2-Simplify-size-round-up-in-cocreateopts.patch RHEL-164549 - kvm-iotests-common.filter-Sort-keepdatafile.patch RHEL-164549 - kvm-iotests-244-Add-test-cases-for-keepdatafile.patch RHEL-164549 -...

cockpit security update

356.4-1.0.1 - Apply the patch for duplicate reference Orabug: 39250109 - Storage: Enable btrfs support Orabug: 37464632 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110 - Remove duplicate reference...

kernel security update

6.12.0-211.73.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

freerdp security update

2:2.11.7-15 - Backport several CVE fixes CVE-2026-109242, CVE-2026-110837, CVE-2026-111880 Resolves: RHEL-282289, RHEL-283715, RHEL-286595...

dpdk security update

25.11-2 - Backport fixes for CVE-2026-86846 CVE-2026-86848 CVE-2026-86561 CVE-2026-86562 CVE-2026-86563 CVE-2026-86567 CVE-2026-86566 CVE-2026-86849 CVE-2026-86845 CVE-2026-86847 CVE-2026-86856 CVE-2026-86565 CVE-2026-93683 CVE-2026-100236...

glibc security update

2.28-251.0.5.48 - Forward port of Oracle patches to 2.28-251.48 Reviewed-by: Kris Van Hees Oracle history: July-28-2026 Cupertino Miranda - 2.28-251.0.5.40 - Fixed orabug 39809344 - Default ldso uses str/mem functions which are not MTE compatible Reviewed-by: Jose E. Marchesi July-23-2026 Cuperti...

cockpit security, bug fix, and enhancement update

310.10-1.0.1 - Fixed cockpitwst selinux issue for tmpfs Orabug: 36013589 - Move update-motd out of cockpitwst context Orabug: 36013589 - Update documentation links Orabug: 34706402 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110 - Remove duplicate reference to server in...

freerdp security, bug fix, and enhancement update

2:3.32.2-1 - Update to 3.32.2 - Backport gateway freeze and busy-loop fixes, including partial-header handling - Reset completed RDG header state before control-packet dispatch - Keep WebSocket and chunked-transfer decoder state separate Resolves: RHEL-277442 Resolves: RHEL-282285, RHEL-283665,...

.NET 10.0 security, bug fix, and enhancement update

10.0.114-1.0.2 - Add support for Oracle Linux - build dotnet-host 10.0.114-1 - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291741 10.0.113-2 - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277805...

.NET 10.0 security, bug fix, and enhancement update

10.0.114-1.0.2 - Add support for Oracle Linux - build dotnet-host 10.0.114-1 - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291741 10.0.113-2 - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277805...

firefox security update

153.6.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 153.6.0-1 - Update to 153.6.0 ESR...

firefox security update

153.6.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 153.6.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 153.6.0-1 - Update to 153.6.0 ESR...

gimp security update

2:3.0.4-4.15 - fix CVE-2026-106062 - fix CVE-2026-112257 - fix CVE-2026-112258 - fix CVE-2026-112260 - fix CVE-2026-112261...

raptor2 security update

2.0.15-18 - CVE-2025-71436 raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling heap-based buffer overflow in language tag handling - Resolves: RHEL-287843...

glibc security, bug fix, and enhancement update

2.39-145.0.1 - Forward port Oracle chnages to 2.39-145. Oracle history: Sep-01-2026 Jose E. Marchesi - 2.39-128.0.1 - Forward port Oracle changes to 2.39-128. - Reviewed-by: Elena Zannoni Jul-15-2026 Cupertino Miranda - 2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E...

python-dns security update

1.15.0-13 - CVE-2026-114605 python-dns: dnspython: Denial of Service via excessive DNS compression pointer traversal Resolves: RHEL-290592...

fence-agents security update

4.10.0-110.8 - bundled PyJWT: upgrade to v2.15.1 to fix CVE-2026-102266, CVE-2026-102267, CVE-2026-102268, CVE-2026-102271, and CVE-2026-102272 Resolves: RHEL-281011, RHEL-281460, RHEL-286482, RHEL-278388, RHEL-281053...

glibc security update

2.28-251.0.5.48 - Forward port of Oracle patches to 2.28-251.48 Reviewed-by: Kris Van Hees Oracle history: July-28-2026 Cupertino Miranda - 2.28-251.0.5.40 - Fixed orabug 39809344 - Default ldso uses str/mem functions which are not MTE compatible Reviewed-by: Jose E. Marchesi July-23-2026 Cuperti...

kernel security update

5.14.0-687.65.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

python-pillow security update

5.1.1-36 - CVE-2026-112900 python-pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Resolves: RHEL-295960 5.1.1-35 - CVE-2026-112398 python-pillow: Pillow: Heap buffer overflow in FlashPix FPX JPEG decoding leads to code execution Resolves: RHEL-294549 5.1.1-34 ...

libXi security update

1.7.10-8.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293452 1.7.10-8.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293398...

libXi security update

1.8.1-7.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293447 1.8.1-7.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293391...