Back Linuxsecurity

Fedora 43 pie 1.4.5 Important Sudo Code Execution Threats

Linuxsecurity •LinuxSecurity Advisories • June 4, 2026

Version 1.4.5 This release contains vulnerability fixes for the following security advisories: GHSA-h842-vjwg-pxxx - Sudo-elevated arbitrary file deletion via extra.pie- installed-binary metadata in UninstallUsingUnlink GHSA-pm6p-666q-hvj5 - Sudo-elevated root code execution via TOCTOU between self- update verify and write GHSA-f67f-c344-cqqr - PIE self-update accepts any historically-attested pie.phar (rollback gap) GHSA-vcv4-gmjc-mxvq - php-ext.build-path traversal escapes PIE's vendor extract directory GHSA-8xmh-xrvp-hwrf - WindowsInstall::copyExtraFile lacks destination containment check (Windows-only path traversal) GHSA-p4j8-36rr-gjfq - Self-update attestation verification is scoped to --owner=php, not --repo=php/pie

* Tue May 26 2026 Remi Collet - 1.4.5-1 - update to 1.4.5

Fedora Update Notification FEDORA-2026-b2fe14ec86 2026-06-04 01:35:07.681084+00:00 Name : pie Product : Fedora 43 Version : 1.4.5 Release : 1.fc43 URL : Summary : PHP Installer for Extensions Description : PIE (PHP Installer for Extensions). PIE can install an extension to any installed PHP version. A list of extensions that support PIE can be found on Documentation: /usr/ /doc/pie/docs/usage.md

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-b2fe14ec86' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 44 and 43 Sudo Vulnerabilities Enable Code Execution Risks On June 4, 2026, Fedora released updates for versions 43 and 44 of the PHP Installer for Extensions (PIE) to address multiple vulnerabilities in the Sudo command. These vulnerabilities include arbitrary file deletion and elevated root code execution due to time-of-check to time-of-use (TOCTOU) issues. The updates fix security advisories identified as GHSA-h842-vjwg-pxxx, GHSA-pm6p-666q-hvj5, and others. Affected systems include Fedora 43 and 44 installations using PIE version 1.4.5. Users are advised to apply the updates promptly to mitigate risks. The vulnerabilities were confirmed by Remi Collet, the maintainer who issued the updates. The updates can be installed using the 'dnf' package manager. No active exploitation has been reported at this time. 2 sources 58

Extracted Entities

Fedora 43 pie 1.4.5 Important Sudo Code Execution Threats

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (6)