Bug 2539380
| Summary: | CVE-2026-79079 xiphos: Xiphos: Arbitrary code execution via URL handling and menu popup components [fedora-all] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Vladimir Vasilev <vvasilev> |
| Component: | xiphos | Assignee: | greg.hellings |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | rawhide | CC: | arraybolt3, greg.hellings |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["6a5d2503-cd03-44a1-ac0c-b04208759ccf"]} | ||
| Fixed In Version: | xiphos-4.3.2-6.fc44 xiphos-4.3.2-5.fc43 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-10-13 01:09:16 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2538056 | ||
|
Description
Vladimir Vasilev
2026-09-23 12:04:20 UTC
I'll look into fixing this issue this Saturday if no one beats me to it. I'm fairly sure this is already fixed in 4.4.0. Several such fixes for "bugs" were in that release, which I already packaged for Rawhide. So it should just be as simple as pulling that into the desired release branch. As I don't have a desktop Fedora install anymore I can't very well test those builds so I refrain from pulling new releases into existing Fedora versions. But a merge from rawhide with a build and Bodhi fix ought to accomplish what you need. I'm a little rusty on what Fedora's policies are around pulling new versions into existing releases (most of my work is in Debian/Ubuntu where the process is "backport the patch", but I know Fedora operates somewhat differently). That sounds like it will probably work though. Thanks for the tip! I embarrassingly forgot this over the weekend. I've gotten a packaging VM set up again, I'll try to remember to do this Monday morning. Looking at Fedora's packaging policies, I don't think I can do a full version backport. I have backported the fixing commit however (https://github.com/crosswire/xiphos/pull/1314/changes/68bbe3063b601537d1e505dd1a4560d51811a9e0), and have verified that it builds in mockbuild for both F44 and F43. I don't have time to finish testing today, but will get to it as soon as reasonably possible and hopefully publish updates not too long after. FEDORA-2026-3aeb1349ea (xiphos-4.3.2-6.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-3aeb1349ea FEDORA-2026-3c740789e0 (xiphos-4.3.2-5.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-3c740789e0 FEDORA-2026-3aeb1349ea has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3aeb1349ea` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3aeb1349ea See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-3c740789e0 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3c740789e0` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3c740789e0 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-3aeb1349ea (xiphos-4.3.2-6.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2026-3c740789e0 (xiphos-4.3.2-5.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report. |