Fedora 45 : brasero / epiphany / gnote / gtksourceview5 / libgsf (2026-75ff55f383)

high Nessus Plugin ID 374607

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-75ff55f383 advisory.

Update to newer versions and rebuild against new libxml2

### libgsf 1.14.60

* Fix ABW for ole2. [#54]

### brasero 3.12.4

Bugs fixed and enhancements:

* Remove libegg multidrag treeview support for in-built 'GtkFileChooser' (sid)
* cdrkit: Add better error message for Unsupported sector size errors (sid)
* cdrdao: Add better error message for Unsupported track mode errors (sid)
* libbrasero-burn: Fix incorrect condition during error check (sid)
* Replace 'BaobabCellRendererProgress' with native 'GtkCellRendererProgress' (sid)
* Fix grammar in help (Anders Jonsson)
* Update confirmation dialog logic to properly trigger cancellation dialog (John Cardullo)
* burn-dialog: Use 'media-optical' for notifications (sid)
* Prefer 'application/vnd.efi.iso' MIME type (sid)
* src: Fix 'GtkSpinButton' filling vertical space (sid)
* libbrasero-burn: Fix incorrect plugin version comparison (sid)
* checksum: Default to SHA256 rather than MD5 (David King)

Translation updates:

* Abkhazian (Nart Tlisha)
* Basque (Asier Sarasua Garmendia)
* Catalan (Jordi Mas)
* Chinese (China) (luming zh)
* Danish (Alan Mortensen)
* French (Charles Monzat)
* Friulian (Fabio Tomat)
* Georgian (Zurab Kargareteli)
* German (Jrgen Benvenuti)
* Icelandic (Sveinn Felli)
* Indonesian (Andika Triwidada)
* Interlingue (Olga Smirnova)
* Karbi (Jor Teron)
* Kazakh (Baurzhan Muftakhidinov)
* Nepali (Pawan Chitrakar)
* Occitan (Quentin PAGS)
* Portuguese (Hugo Carvalho)
* Russian (Sergej A)
* Slovenian (Martin)
* Spanish (Daniel Mustieles)
* Thai (Aefgh Threenine)
* Turkish (Sabri nal)
* Ukrainian (Yuri Chornoivan)
* Uzbek (Latin) (Baxrom Raxmatov)

### epiphany 51.1

Bugs fixed:

* i#2883 Wrong position of the suggestion popover at the first time (John Cardullo)
* i#2905 Refilter, do not clear SearchEntry when using the Clear action in History dialog (Arak)
* i#2952 (CVE-2026-94291) Epiphany allows insecure iframe through view-source / ephy-reader scheme (Michael Catanzaro)
* i#2958 Bookmark search does not work when a tag is viewed (Arak)
* m!2215 Pantheon: Revive about menuitem for debugging information (Ryo Nakano)

Translation updates:

* German (Christian Kirbach)
* Norwegian Nynorsk (Roy-Magne Mo)
* Portuguese (Ctia Silva)

### gnote 51.0

Fixes:

* Highlight menu item will be highlighted using the same color

Translations:

* Brazilian Portuguese (pt_BR)
* Czech (cs)
* Norwegian Nynorsk (nn)
* Swedish (sv)

### gtksourceview5 5.22.0

Changes since 5.20.0, including the 5.21.x development series:

* Reject non-regular files before opening them in GtkSourceFileLoader
* Add a configurable GtkSourceFileLoader max-size limit, defaulting to 1 GiB, for file, stream, and decompressed input
* Report oversized loads with GTK_SOURCE_FILE_LOADER_ERROR_TOO_BIG
* Centralize checked arithmetic for input sizes and buffer growth
* Unwind buffer output streams when file loading fails
* Handle stream-based loads without a file location in profiler marks
* Expand file loader tests for size limits, compressed input, load failures, and arithmetic boundaries
* Fix gutter renderer list and gutter lines leaks
* Break a circular reference when line numbers are enabled
* Avoid temporary region and text mark allocations in search context intersection checks
* Avoid per-line timer allocations in the syntax highlighting engine
* Avoid rescanning UTF-8 text to determine line character counts
* Reduce scrolling overhead in GtkSourceMap
* Fix GtkSourceMap slider sizing and positioning when the map is taller than its contents
* Reduce allocations and per-line work when drawing source mark backgrounds
* Reduce array access overhead in gutter lines
* Fix vertical alignment when jumping to text positions
* Improve Vim emulation for command repetition, r, and cw/cW
* Add Vim support for +, X, gu, gU, g~, and visual-mode ~
* Add Vim Ctrl-A and Ctrl-X support for signed decimal numbers
* Add Vim :set aliases and :noh/:nohlsearch commands
* Expand Vim input tests for commands, motions, and repetition
* Use canonical property names and static strings for properties
* Add missing API version annotations and correct function attributes
* Translation updates, including new Lao and Uzbek (Latin) translations

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 374607

File Name: fedora_2026-75ff55f383.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Fedora Local Security Checks

Published: 10/31/2026

Updated: 10/31/2026

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.55

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-94291

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:45, p-cpe:/a:fedoraproject:fedora:brasero, p-cpe:/a:fedoraproject:fedora:epiphany, p-cpe:/a:fedoraproject:fedora:gnote, p-cpe:/a:fedoraproject:fedora:gtksourceview5, p-cpe:/a:fedoraproject:fedora:libgsf

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 10/5/2026

Reference Information

CVE: CVE-2026-94291

FEDORA: 2026-75ff55f383

Detections

Analytics