Lector de Feeds
MGASA-2025-0175 - Updated golang packages fix security vulnerabilities
Publication date: 02 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-22870 , CVE-2025-22871 Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied - CVE-2025-22870. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext - CVE-2025-22871. References
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-22870 , CVE-2025-22871 Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied - CVE-2025-22870. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext - CVE-2025-22871. References
- https://bugs.mageia.org/show_bug.cgi?id=34078
- https://www.openwall.com/lists/oss-security/2025/03/07/2
- https://www.openwall.com/lists/oss-security/2025/04/04/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFNTP3P4URUREHKSWZQWIJPIXGRCFHUI/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22870
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871
- golang-1.23.8-1.mga9
Categorías: Actualizaciones de Seguridad
MGAA-2025-0056 - Updated mesa packages fix bug
Publication date: 02 Jun 2025
Type: bugfix
Affected Mageia releases : 9
Description mesa-25.0.5-1 introduced a bug that makes Extreme Tuxracer crash on some hardware. This update fixes the reported issue. References SRPMS 9/core
Type: bugfix
Affected Mageia releases : 9
Description mesa-25.0.5-1 introduced a bug that makes Extreme Tuxracer crash on some hardware. This update fixes the reported issue. References SRPMS 9/core
- mesa-25.0.6-5.mga9
- rust-cbindgen-0.26.0-0.1.mga9
- mesa-25.0.6-5.mga9.tainted
Categorías: Actualizaciones de Seguridad
MGASA-2025-0174 - Updated deluge packages fix security vulnerabilities & bug
Publication date: 31 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-46561 , CVE-2025-46562 , CVE-2025-46563 , CVE-2025-46564 Description Limited unauthenticated file read in /flag. (CVE-2025-46561) New version check over unencrypted channel. (CVE-2025-46562) SSRF with information leak and limited unauthenticated file write. (CVE-2025-46563) Unauthenticated file read in /js may lead to RCE. (CVE-2025-46564) Mageia internal bug: deluge-daemon.service was not working; the update fixes this issue. References
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-46561 , CVE-2025-46562 , CVE-2025-46563 , CVE-2025-46564 Description Limited unauthenticated file read in /flag. (CVE-2025-46561) New version check over unencrypted channel. (CVE-2025-46562) SSRF with information leak and limited unauthenticated file write. (CVE-2025-46563) Unauthenticated file read in /js may lead to RCE. (CVE-2025-46564) Mageia internal bug: deluge-daemon.service was not working; the update fixes this issue. References
- https://bugs.mageia.org/show_bug.cgi?id=34274
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46561
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46562
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46563
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46564
- deluge-2.2.0-1.5.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2025-0173 - Updated glib2.0 packages fix security vulnerability
Publication date: 31 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-4373 Description Buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar. (CVE-2025-4373) References
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-4373 Description Buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar. (CVE-2025-4373) References
- https://bugs.mageia.org/show_bug.cgi?id=34310
- https://ubuntu.com/security/notices/USN-7532-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4373
- glib2.0-2.76.3-1.4.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2025-0172 - Updated coreutils packages fix security vulnerability
Publication date: 31 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-5278 Description Heap buffer under-read in gnu coreutils sort via key specification. (CVE-2025-5278) References
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-5278 Description Heap buffer under-read in gnu coreutils sort via key specification. (CVE-2025-5278) References
- https://bugs.mageia.org/show_bug.cgi?id=34313
- https://www.openwall.com/lists/oss-security/2025/05/27/2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5278
- coreutils-9.1-1.1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2025-0171 - Updated redis packages fix security vulnerabilitiy
Publication date: 31 May 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-21605 Description Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client. (CVE-2025-21605) References
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-21605 Description Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client. (CVE-2025-21605) References
- https://bugs.mageia.org/show_bug.cgi?id=34243
- https://lists.suse.com/pipermail/sle-updates/2025-April/039118.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21605
- redis-7.0.14-1.3.mga9
Categorías: Actualizaciones de Seguridad
