Lector de Feeds

Publication date: 04 Dec 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2018-15853 , CVE-2018-15859 , CVE-2018-15861 , CVE-2018-15863 Description Endless recursion in xkbcomp/expr.c resulting in a crash. (CVE-2018-15853) NULL pointer dereference when parsing invalid atoms in ExprResolveLhs resulting in a crash. (CVE-2018-15859) NULL pointer dereference in ExprResolveLhs resulting in a crash. (CVE-2018-15861) NULL pointer dereference in ResolveStateAndPredicate resulting in a crash. (CVE-2018-15863) References

• https://bugs.mageia.org/show_bug.cgi?id=34796
• https://www.openwall.com/lists/oss-security/2025/12/03/1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15853
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15859
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15861
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15863

SRPMS 9/core

• xkbcomp-1.4.6-1.1.mga9

Publication date: 04 Dec 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-13372 , CVE-2025-64460 Description Potential SQL injection in FilteredRelation column aliases on PostgreSQL. (CVE-2025-13372) Potential denial-of-service vulnerability in XML serializer text extraction. (CVE-2025-64460) References

• https://bugs.mageia.org/show_bug.cgi?id=34795
• https://www.openwall.com/lists/oss-security/2025/12/02/3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13372
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64460

SRPMS 9/core

• python-django-4.1.13-1.9.mga9

Publication date: 04 Dec 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-43392 , CVE-2025-43419 , CVE-2025-43425 , CVE-2025-43427 , CVE-2025-43429 , CVE-2025-43430 , CVE-2025-43431 , CVE-2025-43432 , CVE-2025-43434 , CVE-2025-43440 , CVE-2025-43443 , CVE-2025-43421 Description The updated packages fix security vulnerabilities: CVE-2025-43392, CVE-2025-43419, CVE-2025-43425, CVE-2025-43427, CVE-2025-43429, CVE-2025-43430, CVE-2025-43431, CVE-2025-43432, CVE-2025-43434, CVE-2025-43440, CVE-2025-43443, CVE-2025-43421. References

• https://bugs.mageia.org/show_bug.cgi?id=34792
• https://webkitgtk.org/security/WSA-2025-0008.html
• https://webkitgtk.org/2025/11/19/webkitgtk2.50.2-released.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43392
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43419
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43425
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43427
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43429
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43430
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43431
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43432
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43434
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43440
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43443
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43421

SRPMS 9/core

• webkit2-2.50.2-1.mga9

Publication date: 04 Dec 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-11411 Description Possible domain hijacking via promiscuous records in the authority section. (CVE-2025-11411). Previous fixes for CVE-2025-11411 released with Unbound 1.24.1 were not complete. References

• https://bugs.mageia.org/show_bug.cgi?id=34785
• https://advisories.mageia.org/MGASA-2025-0273.html
• https://www.openwall.com/lists/oss-security/2025/11/26/4
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11411

SRPMS 9/core

• unbound-1.24.2-1.mga9

Publication date: 04 Dec 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-9820 Description Stack write buffer overflow. (CVE-2025-9820) References

• https://bugs.mageia.org/show_bug.cgi?id=34760
• https://www.openwall.com/lists/oss-security/2025/11/20/2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9820

SRPMS 9/core

• gnutls-3.8.4-1.3.mga9

Publication date: 04 Dec 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-43961 , CVE-2025-43962 , CVE-2025-43963 , CVE-2025-43964 Description In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. (CVE-2025-43961) In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing, related to large w0 or w1 values or the frac and mult calculations. (CVE-2025-43962) In LibRaw before 0.21.4, phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access because split_col and split_row values are not checked in 0x041f tag processing. (CVE-2025-43963) In LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. (CVE-2025-43964) References

• https://bugs.mageia.org/show_bug.cgi?id=34221
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDAIVZ4BSSDOYXE25CJ6Z7KXPOF4A6GL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMNI4GAUYVWHWJ2MPCIEMWUBTIM32E2H/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3I3BWKSTHKFJDS7ZRYZSMCPXZLSPJKIW/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43961
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43962
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43963
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43964

SRPMS 9/core

• libraw-0.20.2-5.1.mga9
• digikam-8.4.0-1.1.mga9
• darktable-4.6.1-1.2.mga9