This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues:
Changes in apache-commons-lang3:
Update to 3.20.0
* New features:
+ Add SystemProperties.getPath(String, Supplier<Path>)
+ Add JavaVersion.JAVA_25
+ Add JavaVersion.JAVA_26
+ Add SystemUtils.IS_JAVA_25
+ Add SystemUtils.IS_JAVA_26
+ Add MutablePair.ofNonNull(Map.Entry)
+ Add TimedSemaphore.builder(), Builder, and deprecate
constructors
+ LANG-1504: Adding labels and history to split StopWatch
* Fixed Bugs:
+ Optimize ObjectToStringComparator.compare() method
+ [javadoc] Improve StringUtils Javadoc
+ Fix internal inverted logic in private isEnum() method and
correct its usage in getFirstEnum()
+ Use accessors in ToStringStyle so subclasses can effectively
override them
+ 'LocaleUtils.toLocale(String)' for a 2 letter country code
now returns a value instead of throwing an
'IllegalArgumentException'
+ Fix typo in StringUtils.trunctate() IllegalArgumentException
message and test assertion messages
+ Fix test fixture in
ReflectionDiffBuilderTest.testTransientFieldDifference()
+ LANG-1789: NullPointerException when generating
NoSuchMethodException in MethodUtils
+ LANG-1786: Map deprecated TimeZone short IDs and avoid JRE
WARNINGs to the console
+ LANG-1792: TypeUtils.toString() skips angle brackets for Class
type
+ Mention JDK 25 LTS as a tested version in the release notes
* Changes:
+ Bump org.apache.commons:commons-parent from 88 to 92
- Update to 3.19.0
* New features:
+ Add ArrayUtils.SOFT_MAX_ARRAY_LENGTH
+ Add SystemUtils.IS_OS_NETWARE
+ Add MethodUtils.getAccessibleMethod(Class, Method)
+ Add documentation to site for CVE-2025-48924
ClassUtils.getClass(...) can throw a StackOverflowError on
very long inputs
+ Add StringUtils.indexOfAny(CharSequence, int, char...)
+ Add ConcurrentException.ConcurrentException(String)
+ Add DateUtils.toLocalDateTime(Date[, TimeZone])
+ Add DateUtils.toOffsetDateTime(Date[, TimeZone])
+ Add DateUtils.toZonedDateTime(Date[, TimeZone])
+ Add ByteConsumer
+ Add ByteSupplier
+ Add FailableByteConsumer
+ Add FailableByteSupplier
+ LANG-1784: Add Functions methods for null-safe mapping and
chaining
+ LANG-1784: Add Failable methods for null-safe mapping and
chaining
+ Add DoubleRange.fit(double)
+ Add IntegerRange.fit(int)
+ Add LongRange.fit(long)
+ Add DurationUtils.get(String, TemporalUnit, long)
+ Add DurationUtils.getMillis(String, long)
+ Add DurationUtils.getSeconds(String, long)
+ Add SystemProperties.getBoolean(Class, String, boolean)
+ Add SystemProperties.getInt(Class, String, int)
+ Add SystemProperties.getLong(Class, String, long)
* Fixed Bugs:
+ LANG-1778: MethodUtils.getMatchingMethod() doesn't respect the
hierarchy of methods
+ MethodUtils.getMethodObject(Class<?>, String, Class<?>...) now
returns null instead of throwing a NullPointerException, as it
does for other exception types
+ Reduce spurious failures in ArrayUtilsTest methods that test
ArrayUtils.shuffle() methods
+ MethodUtils cannot find or invoke a public method on a public
class implemented in its package-private superclass
+ AtomicSafeInitializer.get() can spin internally if the
FailableSupplier given to AbstractConcurrentInitializer
.AbstractBuilder.setInitializer(FailableSupplier) throws a
RuntimeException
+ LANG-1783: WordUtils.containsAllWords?() may throw
PatternSyntaxException
+ LANG-1782: MethodUtils cannot find or invoke vararg methods
without providing vararg types or values
+ MethodUtils cannot find or invoke vararg methods of interface
types
+ MethodUtils cannot find or invoke vararg methods when widening
primitive types following the JLS 5.1.2. Widening Primitive
Conversion
+ LANG-1597: Invocation fails because matching varargs method
found but then discarded
+ Don't check accessibility twice in MemberUtils
.setAccessibleWorkaround(T)
+ LANG-1774: Improve handling of ClassUtils
.getShortCanonicalName() for invalid input
+ LANG-1720: Improve Javadocs for Conversion
+ Fix CalendarUtils.toLocalDate() Javadoc return type
description
+ Fix the method name in Javadoc examples for CharUtils.isHex()
+ Deprecate NumberUtils.compare(byte, byte) in favor of
Byte.compare(byte, byte)
+ Deprecate NumberUtils.compare(int, int) in favor of
Integer.compare(int, int)
+ Deprecate NumberUtils.compare(long, long) in favor of
Long.compare(long, long)
+ Deprecate NumberUtils.compare(short, short) in favor of
Short.compare(short, short)
+ Deprecate obsolete sys
A security update for openjpeg2 addresses CVE-2025-54874, a vulnerability involving a missing error check that can lead to the use of an uninitialized pointer and cause an out-of-bounds heap memory write. This issue affects openjpeg2 as packaged in Red Hat Enterprise Linux 10 and related distributions. The vulnerability has been rated as high severity by the vendor. A patch is available and should be applied to affected systems to mitigate the risk.
A security update for python-Pillow addresses three vulnerabilities: an integer overflow in font processing causing denial of service, a heap buffer overflow when processing nested list coordinates, and an infinite loop with resource exhaustion triggered by specially crafted PDFs. These issues can lead to denial of service conditions. The vulnerabilities are identified as CVE-2026-42308, CVE-2026-42309, and CVE-2026-42310. No specific affected versions or patch details are provided in the input data.
This security update for Apptainer addresses multiple vulnerabilities, including CVE-2024-45310 and several CVE-2026 series issues. The update includes fixes for at least 13 CVEs and updates dependencies such as golang.org/x/crypto and golang.org/x/net to newer versions. The update also integrates vulnchecker optionally into the build process and synchronizes with the Factory version to ensure comprehensive vulnerability mitigation.
Multiple security vulnerabilities were found and fixed in the Vim text editor, including command injection flaws in the NetBeans interface, netrw plugin, and tar decompression, as well as a heap buffer overflow in spell file processing. These vulnerabilities could allow arbitrary file reads, writes, or code execution. The issues are resolved by updating Vim to version 9.2.0530.
Multiple vulnerabilities in localsearch related to parsing MP3 files and ID3 tags could lead to denial of service or information disclosure. These include heap buffer overflows and issues triggered by malformed or crafted MP3 files. The vulnerabilities have been fixed in a security update by the SUSE Product Security Team.
Multiple security vulnerabilities affecting the CUPS printing system have been addressed in updates culminating in version 2.4.19. These vulnerabilities include authorization bypass, path traversal, heap overflow, potential remote code execution, information disclosure, and denial of service issues. The update fixes several bugs and security flaws that could impact print job handling and system stability.
This security update for docker-stable addresses two vulnerabilities in the BuildKit component. The first (CVE-2026-33747) involves malicious frontends crafting API messages that cause files to be written outside the BuildKit state directory. The second (CVE-2026-33748) concerns insufficient validation of Git URL fragment subdirectory components, potentially allowing access to files outside the checked-out Git repository. Both issues have been fixed in this update.
A security update for bubblewrap addresses CVE-2026-41163, which involves improper process attachment via ptrace. This vulnerability can allow arbitrary privileged operations and local root escalation. The issue is fixed in the update provided by the SUSE Product Security Team. No specific affected versions are stated. The severity is assessed as high due to the potential for privilege escalation.
A security update for perl-HTTP-Tiny addresses a vulnerability identified as CVE-2026-7010, which involves invalid characters in HTTP headers and potential header smuggling. The update fixes these issues in version 0.093 and later. The vulnerability could allow manipulation of HTTP headers, but no active exploits are reported. The update also includes other improvements and fixes unrelated to the security issue.
This update for nginx fixes the following issues
- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled
(bsc#1260415).
- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).
- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives
are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module
(bsc#1265231).
- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`
(bsc#1265232).
- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and
`ngx_http_uwsgi_module` modules (bsc#1265233).
This update for MozillaFirefox fixes the following issues
- Update to Firefox Extended Support Release 140.11.0 ESR MFSA 2026-48 (bsc#1265212).
MFSA 2026-48:
- CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component.
- CVE-2026-8391: Other issue in the JavaScript Engine component.
- CVE-2026-8401: Sandbox escape in the Profile Backup component.
- CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component.
- CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component.
- CVE-2026-8949: Integer overflow in the Widget: Win32 component.
- CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component.
- CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access APIs component.
- CVE-2026-8954: Incorrect boundary conditions, integer overflow in the Audio/Video component.
- CVE-2026-8955: Privilege escalation in the DOM: Workers component.
- CVE-2026-8956: Integer overflow in the Networking: JAR component.
- CVE-2026-8957: Privilege escalation in the Enterprise Policies component.
- CVE-2026-8958: Information disclosure, sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
- CVE-2026-8961: Spoofing issue in the Form Autofill component.
- CVE-2026-8962: Mitigation bypass in the DOM: Security component.
- CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component.
- CVE-2026-8970: Privilege escalation in the Security component.
- CVE-2026-8974: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151.
- CVE-2026-8975: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151.
This security update for libsndfile addresses three vulnerabilities: a buffer overflow in the ircam_read_header function when processing malformed IRCAM audio files (CVE-2025-52194), a memory leak in the mpeg_l3_encoder_init() function (CVE-2025-56226), and an integer overflow in IMA-ADPCM processing (CVE-2026-37555). These issues could lead to potential memory corruption or resource exhaustion. The update fixes these issues to improve the security and stability of libsndfile.
This security update provides a functional equivalent of RHSA-2026:20129.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:20129.
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 140.10.0 ESR.
- MFSA 2026-32 (bsc#1262230):
* CVE-2026-6746: Use-after-free in the DOM: Core & HTML component
* CVE-2026-6747: Use-after-free in the WebRTC component
* CVE-2026-6748: Uninitialized memory in the Audio/Video: Web Codecs component
* CVE-2026-6749: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component
* CVE-2026-6750: Privilege escalation in the Graphics: WebRender component
* CVE-2026-6751: Uninitialized memory in the Audio/Video: Web Codecs component
* CVE-2026-6752: Incorrect boundary conditions in the WebRTC component
* CVE-2026-6753: Incorrect boundary conditions in the WebRTC component
* CVE-2026-6754: Use-after-free in the JavaScript Engine component
* CVE-2026-6757: Invalid pointer in the JavaScript: WebAssembly component
* CVE-2026-6759: Use-after-free in the Widget: Cocoa component
* CVE-2026-6761: Privilege escalation in the Networking component
* CVE-2026-6762: Spoofing issue in the DOM: Core & HTML component
* CVE-2026-6763: Mitigation bypass in the File Handling component
* CVE-2026-6764: Incorrect boundary conditions in the DOM: Device Interfaces component
* CVE-2026-6765: Information disclosure in the Form Autofill component
* CVE-2026-6766: Incorrect boundary conditions in the Libraries component in NSS
* CVE-2026-6767: Other issue in the Libraries component in NSS
* CVE-2026-6769: Privilege escalation in the Debugger component
* CVE-2026-6770: Other issue in the Storage: IndexedDB component
* CVE-2026-6771: Mitigation bypass in the DOM: Security component
* CVE-2026-6772: Incorrect boundary conditions in the Libraries component in NSS
* CVE-2026-6776: Incorrect boundary conditions in the WebRTC: Networking component
* CVE-2026-6785: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox
150 and Thunderbird 150
* CVE-2026-6786: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird
150
A vulnerability in the leancrypto library prior to version 1.7.1 involves an unsafe cast from size_t to uint8_t in the lc_x509_extract_name_segment() function. This issue has been addressed in version 1.7.1 with a security update that also includes multiple non-security fixes and improvements. The leancrypto library provides cryptographic algorithms focused on post-quantum cryptography resistance.
This security update for mozjs115 addresses three vulnerabilities: a NULL pointer dereference when processing empty external parameter entities, a denial of service caused by an infinite loop in DTD content parsing, and a NULL pointer dereference in 'setContext' after an out-of-memory condition. These issues could lead to application crashes or denial of service conditions. The update fixes these issues to improve stability and security.
This security update for git-bug addresses two vulnerabilities: CVE-2026-1229, involving an incorrect calculation in the secp384r1 CombinedMult function in the CIRCL library, and CVE-2026-41506, which causes HTTP authentication credentials to leak when following redirects during smart-HTTP clone and fetch operations. The update includes upgrading dependencies to fixed versions to resolve these issues.
This security update for perl-YAML-Syck addresses multiple bugs and vulnerabilities, including a critical heap buffer overflow (CVE-2026-4177) in the YAML emitter. The update fixes memory leaks, parsing errors, and crashes on Windows, improving stability and security. The fixes are included in versions 1.37 and later, with the critical heap buffer overflow resolved in version 1.37. No specific affected versions were explicitly stated in the input data.