Lector de Feeds

‎With removal on upgrade: add bookworm

← Older revision Revision as of 19:16, 5 June 2026 Line 720: Line 720:  This category contains the following packages, alphabetically: This category contains the following packages, alphabetically:    −*+* bookworm        <!-- More? --> <!-- More? --> Katnatek

Publication date: 05 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-4802 , CVE-2026-4631 , CVE-2026-4800 Description CVE-2026-4631, Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability. CVE-2026-4800, lodash vulnerable to Code Injection via `_.template` imports key names CVE-2026-4802, A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise. References

• https://bugs.mageia.org/show_bug.cgi?id=35563
• https://www.openwall.com/lists/oss-security/2026/05/20/19
• https://github.com/cockpit-project/cockpit/releases/tag/339
• https://github.com/cockpit-project/cockpit/releases/tag/340
• https://github.com/cockpit-project/cockpit/releases/tag/341
• https://github.com/cockpit-project/cockpit/releases/tag/341.1
• https://github.com/cockpit-project/cockpit/releases/tag/342
• https://github.com/cockpit-project/cockpit/releases/tag/343
• https://github.com/cockpit-project/cockpit/releases/tag/344
• https://github.com/cockpit-project/cockpit/releases/tag/345
• https://github.com/cockpit-project/cockpit/releases/tag/346
• https://github.com/cockpit-project/cockpit/releases/tag/347
• https://github.com/cockpit-project/cockpit/releases/tag/348
• https://github.com/cockpit-project/cockpit/releases/tag/349
• https://github.com/cockpit-project/cockpit/releases/tag/350
• https://github.com/cockpit-project/cockpit/releases/tag/351
• https://github.com/cockpit-project/cockpit/releases/tag/352
• https://github.com/cockpit-project/cockpit/releases/tag/353
• https://github.com/cockpit-project/cockpit/releases/tag/353.1
• https://github.com/cockpit-project/cockpit/releases/tag/354
• https://github.com/cockpit-project/cockpit/releases/tag/355
• https://github.com/cockpit-project/cockpit/releases/tag/356
• https://github.com/cockpit-project/cockpit/releases/tag/356.1
• https://github.com/cockpit-project/cockpit/releases/tag/356.2
• https://github.com/advisories/GHSA-rq49-h582-83m7
• https://github.com/advisories/GHSA-r5fr-rjxr-66jc
• https://github.com/advisories/GHSA-3wjm-5g86-c6p3
• https://www.cve.org/CVERecord?id=CVE-2026-4802
• https://www.cve.org/CVERecord?id=CVE-2026-4631
• https://www.cve.org/CVERecord?id=CVE-2026-4800

SRPMS 9/core

• cockpit-356.2-1.mga9

Publication date: 05 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-43491 , CVE-2026-43492 , CVE-2026-43493 , CVE-2026-43495 , CVE-2026-43496 , CVE-2026-43497 , CVE-2026-43499 , CVE-2026-43501 , CVE-2026-43502 , CVE-2026-43503 , CVE-2026-46300 , CVE-2026-46333 Description Upstream kernel version 6.6.141 fixes vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel. References

• https://bugs.mageia.org/show_bug.cgi?id=35579
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.139
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.140
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.141
• https://www.cve.org/CVERecord?id=CVE-2026-43491
• https://www.cve.org/CVERecord?id=CVE-2026-43492
• https://www.cve.org/CVERecord?id=CVE-2026-43493
• https://www.cve.org/CVERecord?id=CVE-2026-43495
• https://www.cve.org/CVERecord?id=CVE-2026-43496
• https://www.cve.org/CVERecord?id=CVE-2026-43497
• https://www.cve.org/CVERecord?id=CVE-2026-43499
• https://www.cve.org/CVERecord?id=CVE-2026-43501
• https://www.cve.org/CVERecord?id=CVE-2026-43502
• https://www.cve.org/CVERecord?id=CVE-2026-43503
• https://www.cve.org/CVERecord?id=CVE-2026-46300
• https://www.cve.org/CVERecord?id=CVE-2026-46333

SRPMS 9/core

• kernel-6.6.141-1.mga9
• kmod-virtualbox-7.1.18-20.mga9
• kmod-xtables-addons-3.24-92.mga9

Publication date: 05 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2022-25236 , CVE-2022-25313 , CVE-2022-25314 , CVE-2022-25315 , CVE-2022-40674 , CVE-2022-43680 Description This update fixes the vulnerabilities by no longer building with the vulnerable bundled libexpat version. References

• https://bugs.mageia.org/show_bug.cgi?id=31123
• https://www.cve.org/CVERecord?id=CVE-2022-25236
• https://www.cve.org/CVERecord?id=CVE-2022-25313
• https://www.cve.org/CVERecord?id=CVE-2022-25314
• https://www.cve.org/CVERecord?id=CVE-2022-25315
• https://www.cve.org/CVERecord?id=CVE-2022-40674
• https://www.cve.org/CVERecord?id=CVE-2022-43680

SRPMS 9/core

• xmlrpc-c-1.51.08-1.1.mga9

Publication date: 05 Jun 2026
Type: bugfix
Affected Mageia releases : 9
Description Closing windows of applications launched from Mageia Control Center (aka MCC) should return to the main MCC window; currently that does not happen. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=20387

SRPMS 9/core

• drakxtools-18.66.1-1.mga9

Como muchos servicios en el mundo del software, nuestros servicios están sujetos a solicitudes automatizadas disruptivas que sobrecargan nuestros servidores. Es posible que hayas notado esto en forma de importantes retrasos en la carga o incluso que los servicios dejen de estar disponibles.

Por ello, hemos implementado un sistema de seguridad durante los últimos días que nos permite rechazar las solicitudes que consideramos inapropiadas. Este sistema requiere específicamente la ejecución de un programa JavaScript, lo que frustra una cantidad significativa de bots. Es posible que vea aparecer brevemente la siguiente pantalla.

La infraestructura que hemos implementado nos permite restaurar un nivel muy alto de disponibilidad del servicio. También nos permitirá realizar ajustes fácilmente.

Sin embargo, si nota que ciertas características se ven afectadas por estas medidas, háganoslo saber, ya que esto nos permitirá realizar ajustes más precisos.

← Older revision Revision as of 06:26, 5 June 2026 Line 366: Line 366:     === Internetanwendungen === === Internetanwendungen === −* Der Chromium-Browser wurde entfernt, wegen zu viel Arbeit zur Pflege <!--#33609--> Falls Sie diesen benötigen, installieren Sie diesen als [[Flatpak-de|Flatpak]]; install app/org.chromium.Chromium/x86_64/stable, oder Chrome Flatpak. Verwenden Sie alternativ die von Google bereitgestellte RPM von Chrome.+* Der Chromium-Browser wurde entfernt, wegen zu viel Arbeit zur Pflege <!--#33609--> Falls Sie diesen benötigen, installieren Sie diesen als [[Flatpak-de|Flatpak]]; install app/org.chromium.Chromium/x86_64/stable, oder Chrome Flatpak. Verwenden Sie alternativ die von [[Google_Chrome-de|Google bereitgestellte RPM von Chrome]].  * Firefox wurde auf 140 ESR aktualisiert** * Firefox wurde auf 140 ESR aktualisiert**  * Wir haben Browser für das Gemini Protokoll hinzugefügt: Lagrange (SDL), Kristall (Qt), Offpunk (CLI) * Wir haben Browser für das Gemini Protokoll hinzugefügt: Lagrange (SDL), Kristall (Qt), Offpunk (CLI) Psyca

← Older revision Revision as of 06:26, 5 June 2026 Line 71: Line 71:  '''Für Mageia 9'''<br> '''Für Mageia 9'''<br>    −Kernel 6.18.4 wird seit Januar 2026 in den core backport Repositorien (6.18.26 in den backport Repositorien seit Mai 2026) für die x86 Architektur, für Desktop und Server, sowie als gleiche Arten für i586 und desktop586, angeboten.<br>+Kernel 6.18 wird seit Januar 2026 in den core backport Repositorien (6.18.33 seit Juni 2026) für die x86 Architektur, für Desktop und Server, sowie als gleiche Arten für i586 und desktop586, angeboten.<br>  Für aarch64 und armv7hl bieten wir aktuell nur die Pakete für den Quellcode und die Dokumentation.<br> Für aarch64 und armv7hl bieten wir aktuell nur die Pakete für den Quellcode und die Dokumentation.<br>  Sie finden auch Kernel 6.12.60 für alle Architekturen für den Desktop im core backport Repository '' - Beachten Sie, dass dieser sicherheitstechnisch alt ist, aber Sie möchten diesen gegebenenfalls zum ''testen'' verwenden, falls 6.18 nicht mit Ihrem System kompatibel ist.''<br> Sie finden auch Kernel 6.12.60 für alle Architekturen für den Desktop im core backport Repository '' - Beachten Sie, dass dieser sicherheitstechnisch alt ist, aber Sie möchten diesen gegebenenfalls zum ''testen'' verwenden, falls 6.18 nicht mit Ihrem System kompatibel ist.''<br> Psyca

fix broken link

← Older revision Revision as of 06:22, 5 June 2026 Line 421: Line 421:     === Internet apps === === Internet apps === −* Chromium-browser have been dropped due to too much maintenance work. <!--#33609--> If you need it, install it as [[Flatpak]]; install app/org.chromium.Chromium/x86_64/stable, or Chrome Flatpak. Or [https://wiki.mageia.org/en/Installing_Google_Chrome_in_Mageia|use the Chrome RPM from Google].  +* Chromium-browser have been dropped due to too much maintenance work. <!--#33609--> If you need it, install it as [[Flatpak]]; install app/org.chromium.Chromium/x86_64/stable, or Chrome Flatpak. Or [[Installing_Google_Chrome_in_Mageia|use the Chrome RPM from Google]].    * Firefox has been updated to 140 ESR** * Firefox has been updated to 140 ESR**  * We added browsers for Gemini protocol: Lagrange (SDL), Kristall (Qt), Offpunk (CLI). * We added browsers for Gemini protocol: Lagrange (SDL), Kristall (Qt), Offpunk (CLI). Psyca

‎Backport kernels: 6.18.33 now.

← Older revision Revision as of 21:10, 4 June 2026 Line 79: Line 79:     '''In Mageia 9'''<br> '''In Mageia 9'''<br> −Kernel 6.18.4 is provided since January 2026 in the core backport repository (6.18.26 in backport_testing May 2026) for x86_64 in desktop and server flavour, and for i586 the same plus desktop586.<br>+Kernel 6.18 is provided since January 2026 in the core backport repository (at 6.18.33 in june) for x86_64 in desktop and server flavour, and for i586 the same plus desktop586.<br>  For aarch64 and armv7hl we currently only provide source and doc packages. <br> For aarch64 and armv7hl we currently only provide source and doc packages. <br>  You also find kernel 6.12.60 for all architectures in desktop flavour in core backort testing repository ''- note that it is old security wise now but you may like to test it if 6.18 is not compatible for your use.''<br> You also find kernel 6.12.60 for all architectures in desktop flavour in core backort testing repository ''- note that it is old security wise now but you may like to test it if 6.18 is not compatible for your use.''<br> Morgano

‎Internet apps

← Older revision Revision as of 14:01, 4 June 2026 Line 421: Line 421:     === Internet apps === === Internet apps === −* Chromium-browser have been dropped due to too much maintenance work. <!--#33609--> If you need it, install it as [[Flatpak]]; install app/org.chromium.Chromium/x86_64/stable, or Chrome Flatpak. Or use the Chrome RPM from Google.  +* Chromium-browser have been dropped due to too much maintenance work. <!--#33609--> If you need it, install it as [[Flatpak]]; install app/org.chromium.Chromium/x86_64/stable, or Chrome Flatpak. Or [https://wiki.mageia.org/en/Installing_Google_Chrome_in_Mageia|use the Chrome RPM from Google].    * Firefox has been updated to 140 ESR** * Firefox has been updated to 140 ESR**  * We added browsers for Gemini protocol: Lagrange (SDL), Kristall (Qt), Offpunk (CLI). * We added browsers for Gemini protocol: Lagrange (SDL), Kristall (Qt), Offpunk (CLI). Baud

Publication date: 04 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-39402 Description CVE-2026-39402, lxc lxc-user-nic insufficient ownership validation allows cross-tenant OVS port deletion References

• https://bugs.mageia.org/show_bug.cgi?id=35487
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LRWSIWUURCABTGG26SGDYX7OCPQ7FIS7/
• https://github.com/lxc/lxc/security/advisories/GHSA-3m9j-g9gc-vcvq
• https://www.cve.org/CVERecord?id=CVE-2026-39402

SRPMS 9/core

• lxc-5.0.3-1.1.mga9

Publication date: 04 Jun 2026
Type: bugfix
Affected Mageia releases : 9
Description Updated ceph packages matching upstream bug fix release for the "Relief" branch References

• https://bugs.mageia.org/show_bug.cgi?id=35570
• https://ceph.io/en/news/blog/2026/v18-2-8-reef-released/

SRPMS 9/core

• ceph-18.2.8-1.mga9

Like many services in the software world, our services are subject to disruptive automated requests that overload our servers. You may have noticed this in the form of significant loading delays or even services becoming unavailable.

We have therefore implemented a security system over the past few days that allows us to reject requests we deem inappropriate. This system specifically requires the execution of a JavaScript program, which thwarts a significant number of bots. You may see the following screen appear briefly.

The infrastructure we’ve put in place allows us to restore a very high level of service availability. It will also enable us to make adjustments easily.

However, if you notice that certain features are affected by these measures, please let us know, as this will allow us to make more precise adjustments.

Publication date: 02 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-42046 Description Heap OOB write in canvas import functions caused by int overflow. (CVE-2026-42046) References

• https://bugs.mageia.org/show_bug.cgi?id=35600
• https://ubuntu.com/security/notices/USN-8318-1
• https://github.com/cacalabs/libcaca/security/advisories/GHSA-4vvg-vrqv-m56w
• https://github.com/cacalabs/libcaca/issues/86
• https://www.cve.org/CVERecord?id=CVE-2026-42046

SRPMS 9/core

• libcaca-0.99-0.beta19.11.1.mga9

Publication date: 02 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-2750 , CVE-2025-2751 , CVE-2025-2757 , CVE-2025-3158 , CVE-2025-3548 , CVE-2025-11277 , CVE-2025-70067 Description CVE-2025-2750,- A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. CVE-2025-2757, A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. CVE-2025-2757, A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. CVE-2025-3158, A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. CVE-2025-3548, A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. CVE-2025-11277, A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipulation can lead to heap-based buffer overflow. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. CVE-2025-70067, Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation References

• https://bugs.mageia.org/show_bug.cgi?id=34439
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZYGDCFEL3GZ5PDUZFKEVVISQWAENNBTB/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2LQLM3OX7KPUJNJSKSVDROFQGZRJPVRF/
• https://www.cve.org/CVERecord?id=CVE-2025-2750
• https://www.cve.org/CVERecord?id=CVE-2025-2751
• https://www.cve.org/CVERecord?id=CVE-2025-2757
• https://www.cve.org/CVERecord?id=CVE-2025-3158
• https://www.cve.org/CVERecord?id=CVE-2025-3548
• https://www.cve.org/CVERecord?id=CVE-2025-11277
• https://www.cve.org/CVERecord?id=CVE-2025-70067

SRPMS 9/core

• assimp-5.2.5-1.mga9

Publication date: 02 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-14369 Description Updated packages fix CVE-2025-14369 in bundled dr_flac. References

• https://bugs.mageia.org/show_bug.cgi?id=35217
• https://www.cve.org/CVERecord?id=CVE-2025-14369

SRPMS 9/core

• sdl2_sound-1.0.4-0.hg653.7.mga9

Publication date: 02 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-5704 Description A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35350
• https://bugzilla.redhat.com/show_bug.cgi?id=2455360
• https://www.openwall.com/lists/oss-security/2026/04/11/10
• https://lists.gnu.org/archive/html/bug-tar/2026-03/msg00007.html
• https://www.cve.org/CVERecord?id=CVE-2026-5704

SRPMS 9/core

• tar-1.35-4.mga9

Publication date: 02 Jun 2026
Type: bugfix
Affected Mageia releases : 9
CVE: CVE-2026-22007 , CVE-2026-22008 , CVE-2026-22013 , CVE-2026-22016 , CVE-2026-22018 , CVE-2026-22021 , CVE-2026-23865 , CVE-2026-34268 , CVE-2026-34282 Description Enhance crypto algorithm support. (CVE-2026-22007) Improved Arena allocations. (CVE-2026-22008) Improve Kerberos credentialing. (CVE-2026-22013) Enhance Path Factories Redux. (CVE-2026-22016) Enhance Zip file reading. (CVE-2026-22018) Enhance certificate chain validation. (CVE-2026-22021) Updating FreeType 2.14.1 . (CVE-2026-23865) Enhance key generation. (CVE-2026-34268) Enhance TLS connection handling. (CVE-2026-34282) References

• https://bugs.mageia.org/show_bug.cgi?id=35402
• https://access.redhat.com/errata/RHSA-2026:9682
• https://access.redhat.com/errata/RHSA-2026:9254
• https://access.redhat.com/errata/RHSA-2026:9686
• https://access.redhat.com/errata/RHSA-2026:9690
• https://access.redhat.com/errata/RHSA-2026:9693
• https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixJAVA
• https://www.cve.org/CVERecord?id=CVE-2026-22007
• https://www.cve.org/CVERecord?id=CVE-2026-22008
• https://www.cve.org/CVERecord?id=CVE-2026-22013
• https://www.cve.org/CVERecord?id=CVE-2026-22016
• https://www.cve.org/CVERecord?id=CVE-2026-22018
• https://www.cve.org/CVERecord?id=CVE-2026-22021
• https://www.cve.org/CVERecord?id=CVE-2026-23865
• https://www.cve.org/CVERecord?id=CVE-2026-34268
• https://www.cve.org/CVERecord?id=CVE-2026-34282

SRPMS 9/core

• java-1.8.0-openjdk-1.8.0.492.b09-1.mga9
• java-11-openjdk-11.0.31.0.11-1.mga9
• java-17-openjdk-17.0.19.0.10-1.mga9
• java-latest-openjdk-25.0.3.0.9-1.rolling.1.mga9