<updates>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:17119</id>
    <title>Moderate: perl-JSON-XS security update</title>
    <issued date="2025-10-07 17:26:06" />
    <updated date="2025-10-21 08:10:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for perl-JSON-XS.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

* JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40928" id="CVE-2025-40928" type="cve" title="CVE-2025-40928" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393878" id="2393878" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:17119" id="RLSA-2025:17119" type="self" title="RLSA-2025:17119" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-ppc64le-crb-rpms">
        <name>rocky-linux-10-ppc64le-crb-rpms</name>
        <package name="perl-JSON-XS" arch="ppc64le" epoch="1" version="4.04" release="1.el10_0" src="perl-JSON-XS-4.04-1.el10_0.src.rpm">
          <filename>perl-JSON-XS-4.04-1.el10_0.ppc64le.rpm</filename>
          <sum type="sha256">0a2814b485c6af66dd0b3b0c2fe4b4757283d2e9547a822b5ebee4b6735fa713</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1902</id>
    <title>Important: python-wheel security update</title>
    <issued date="2026-02-06 09:09:00" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-wheel.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049" id="CVE-2026-24049" type="cve" title="CVE-2026-24049" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431959" id="2431959" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1902" id="RLSA-2026:1902" type="self" title="RLSA-2026:1902" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-ppc64le-crb-rpms">
        <name>rocky-linux-10-ppc64le-crb-rpms</name>
        <package name="python3-wheel-wheel" arch="noarch" epoch="1" version="0.41.2" release="5.el10_1.1" src="python-wheel-0.41.2-5.el10_1.1.src.rpm">
          <filename>python3-wheel-wheel-0.41.2-5.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">56189420f4b16cfd516fe737b84acae102ad65d1a0cde868d473cde2e9bb675b</sum>
        </package>
        <package name="python3-wheel" arch="noarch" epoch="1" version="0.41.2" release="5.el10_1.1" src="python-wheel-0.41.2-5.el10_1.1.src.rpm">
          <filename>python3-wheel-0.41.2-5.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">649f43f288ec51e52bac7dd5bf7edf309db95d6d11e18c4ea668a66103bc6467</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2230</id>
    <title>Important: fontforge security update</title>
    <issued date="2026-02-11 09:16:17" />
    <updated date="2026-02-24 18:58:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fontforge.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. 

Security Fix(es):

* fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279)

* fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269)

* fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15269" id="CVE-2025-15269" type="cve" title="CVE-2025-15269" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15275" id="CVE-2025-15275" type="cve" title="CVE-2025-15275" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15279" id="CVE-2025-15279" type="cve" title="CVE-2025-15279" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426423" id="2426423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426429" id="2426429" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426421" id="2426421" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2230" id="RLSA-2026:2230" type="self" title="RLSA-2026:2230" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-ppc64le-crb-rpms">
        <name>rocky-linux-10-ppc64le-crb-rpms</name>
        <package name="fontforge" arch="ppc64le" epoch="0" version="20230101" release="14.el10_1" src="fontforge-20230101-14.el10_1.src.rpm">
          <filename>fontforge-20230101-14.el10_1.ppc64le.rpm</filename>
          <sum type="sha256">259588fbdb9dcf97535090d1252114b784c699cc0629a04752eaedee0c66e04a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6631</id>
    <title>Important: fontforge security update</title>
    <issued date="2026-04-09 12:07:30" />
    <updated date="2026-04-23 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fontforge.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. 

Security Fix(es):

* fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15270" id="CVE-2025-15270" type="cve" title="CVE-2025-15270" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426434" id="2426434" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6631" id="RLSA-2026:6631" type="self" title="RLSA-2026:6631" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-ppc64le-crb-rpms">
        <name>rocky-linux-10-ppc64le-crb-rpms</name>
        <package name="fontforge" arch="ppc64le" epoch="0" version="20230101" release="15.el10_1" src="fontforge-20230101-15.el10_1.src.rpm">
          <filename>fontforge-20230101-15.el10_1.ppc64le.rpm</filename>
          <sum type="sha256">3f56458b442f913a86c843b737030e2c8ce59f7790ed76acb01e669fa175cf8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18344</id>
    <title>Moderate: mingw-glib2 security update</title>
    <issued date="2026-05-29 16:03:28" />
    <updated date="2026-06-12 12:06:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mingw-glib2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

* glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13601" id="CVE-2025-13601" type="cve" title="CVE-2025-13601" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2416741" id="2416741" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18344" id="RLSA-2026:18344" type="self" title="RLSA-2026:18344" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-ppc64le-crb-rpms">
        <name>rocky-linux-10-ppc64le-crb-rpms</name>
        <package name="mingw64-glib2-static" arch="noarch" epoch="0" version="2.87.0" release="1.el10" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw64-glib2-static-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">6f48e1a3d9019d704a56e0baefac75a631d24a2678a5983e66c17fbec284e6ba</sum>
        </package>
        <package name="mingw32-glib2" arch="noarch" epoch="0" version="2.87.0" release="1.el10" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw32-glib2-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">15209d7946db4525c622dce9475f0b4539adbdd8182e8dce7f9b5eebc4e281b5</sum>
        </package>
        <package name="mingw32-glib2-static" arch="noarch" epoch="0" version="2.87.0" release="1.el10" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw32-glib2-static-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">2bfd397165f14199d533701d89fa15e68e670134cba478ffbbcb1b11576e3a6d</sum>
        </package>
        <package name="mingw64-glib2" arch="noarch" epoch="0" version="2.87.0" release="1.el10" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw64-glib2-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">7bbe95bfd9bea82fc715ae74da83f62ff376aaaafd8b2111e8edb078ec36b594</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36189</id>
    <title>Important: perl-HTTP-Daemon security update</title>
    <issued date="2026-07-08 12:06:34" />
    <updated date="2026-07-12 06:06:45" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-HTTP-Daemon.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.

Security Fix(es):

* perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8450" id="CVE-2026-8450" type="cve" title="CVE-2026-8450" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481773" id="2481773" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36189" id="RLSA-2026:36189" type="self" title="RLSA-2026:36189" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-ppc64le-crb-rpms">
        <name>rocky-linux-10-ppc64le-crb-rpms</name>
        <package name="perl-HTTP-Daemon" arch="noarch" epoch="0" version="6.16" release="7.el10_2.1" src="perl-HTTP-Daemon-6.16-7.el10_2.1.src.rpm">
          <filename>perl-HTTP-Daemon-6.16-7.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">625e15bf04a8bd3a984207f1cd1f2d829e81876cbab8b1ccbf71d1a66d38059a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9166</id>
    <title>Important: apache-commons-beanutils security update</title>
    <issued date="2025-10-03 19:57:07" />
    <updated date="2025-10-17 08:18:15" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for apache-commons-beanutils.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans.

Security Fix(es):

* commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48734" id="CVE-2025-48734" type="cve" title="CVE-2025-48734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368956" id="2368956" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9166" id="RLSA-2025:9166" type="self" title="RLSA-2025:9166" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-ppc64le-crb-rpms">
        <name>rocky-linux-10-ppc64le-crb-rpms</name>
        <package name="apache-commons-beanutils" arch="noarch" epoch="0" version="1.9.4" release="21.el10_0" src="apache-commons-beanutils-1.9.4-21.el10_0.src.rpm">
          <filename>apache-commons-beanutils-1.9.4-21.el10_0.noarch.rpm</filename>
          <sum type="sha256">625c3a7da2e85cfef4eec62c51b8506a10786f52fb08897c60194aad9f34e9cc</sum>
        </package>
        <package name="apache-commons-beanutils-javadoc" arch="noarch" epoch="0" version="1.9.4" release="21.el10_0" src="apache-commons-beanutils-1.9.4-21.el10_0.src.rpm">
          <filename>apache-commons-beanutils-javadoc-1.9.4-21.el10_0.noarch.rpm</filename>
          <sum type="sha256">8864c5e894de6b487aa996b643096a2579c8da231666a58f8a7f00ec992fbd49</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>