Lector de Feeds

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10

Updated bind packages fix security vulnerabilities: Incorrect acceptance of NSEC3 records. (CVE-2026-10723) Key Record using PRIVATEDNS algorithm may lead to unexpected exit. (CVE-2026-10822) Potential wildcard CNAME RPZ policy bypass. (CVE-2026-11331) Unnecessary validation of DNSSEC signed records. (CVE-2026-11605) Cache poisoning possible with label count discrepancy, RRSIG, and wildcards. (CVE-2026-11721) Record ordering based unexpected exit with CNAME or DNAME. (CVE-2026-12617) Unexpected exit in certain situations with NSEC and NSEC3 both present. (CVE-2026-13204) DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field. (CVE-2026-13321) References

• https://bugs.mageia.org/show_bug.cgi?id=36003
• https://www.openwall.com/lists/oss-security/2026/07/22/8
• https://kb.isc.org/docs/cve-2026-10723
• https://kb.isc.org/docs/cve-2026-10822
• https://kb.isc.org/docs/cve-2026-11331
• https://kb.isc.org/docs/cve-2026-11605
• https://kb.isc.org/docs/cve-2026-11622
• https://kb.isc.org/docs/cve-2026-11721
• https://kb.isc.org/docs/cve-2026-12617
• https://kb.isc.org/docs/cve-2026-13204
• https://kb.isc.org/docs/cve-2026-13321

SRPMS 10/core

• bind-9.20.26-1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-17544 , CVE-2026-9672 , CVE-2026-17543 , CVE-2026-7260
Updated php 8.5 packages fix some security vulnerabilities. For details see the references. References

• https://bugs.mageia.org/show_bug.cgi?id=36036
• https://www.php.net/ChangeLog-8.php#8.5.9
• https://www.cve.org/CVERecord?id=CVE-2026-17544
• https://www.cve.org/CVERecord?id=CVE-2026-9672
• https://www.cve.org/CVERecord?id=CVE-2026-17543
• https://www.cve.org/CVERecord?id=CVE-2026-7260

SRPMS 10/core

• php8.5-8.5.9-1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-17544 , CVE-2026-9672 , CVE-2026-17543 , CVE-2026-7260
The updated php 8.4 packages fix some security vulnerabilities. See the references for more information. References

• https://bugs.mageia.org/show_bug.cgi?id=36037
• https://www.php.net/ChangeLog-8.php#8.4.24
• https://www.cve.org/CVERecord?id=CVE-2026-17544
• https://www.cve.org/CVERecord?id=CVE-2026-9672
• https://www.cve.org/CVERecord?id=CVE-2026-17543
• https://www.cve.org/CVERecord?id=CVE-2026-7260

SRPMS 10/core

• php8.4-8.4.24-1.1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48977
Arbitrary memory write with crafted Ventana BIF file. (CVE-2026-48977) References

• https://bugs.mageia.org/show_bug.cgi?id=35719
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LT3YC2CS4XTDLRWSH72YZE3EJ6BQCTJ/
• https://www.cve.org/CVERecord?id=CVE-2026-48977

SRPMS 10/core

• openslide-4.0.0-1.1.mga10

Publication date: 10 Aug 2026
Type: bugfix
Affected Mageia releases : 10

This is rawtherapee version 5.13, the latest from upstream. It is a bugfix and features release. References

• https://bugs.mageia.org/show_bug.cgi?id=36025

SRPMS 10/core

• rawtherapee-5.13-1.mga10

Publication date: 10 Aug 2026
Type: bugfix
Affected Mageia releases : 10

Upstream ported RemoteBox to Gtk3 long ago, but we still let the package depend on Gtk2. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36022

SRPMS 10/core

• remotebox-3.7-1.1.mga10

Publication date: 10 Aug 2026
Type: bugfix
Affected Mageia releases : 9

mock chroots for mageia 10 still are using the cauldron configuration and don't produce rpm files for mageia 10. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35939

SRPMS 9/core

• mock-core-configs-39.1-2.4.mga9
• mock-mageia-configs-9-1.2.mga9

Publication date: 09 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-28849 , CVE-2025-62727 , CVE-2026-48710
The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. (CVE-2024-28849) Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse. (CVE-2025-62727) Security restriction bypass via malformed HTTP Host header. (CVE-2026-48710) References

• https://bugs.mageia.org/show_bug.cgi?id=35637
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWLLKAJQCNBN46LPLDAYBM2FU65WBX72/
• https://lists.debian.org/debian-security-announce/2026/msg00213.html
• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FET4KWO46IN64G35ZF7HGJJBIM4OF3YC/
• https://www.cve.org/CVERecord?id=CVE-2024-28849
• https://www.cve.org/CVERecord?id=CVE-2025-62727
• https://www.cve.org/CVERecord?id=CVE-2026-48710

SRPMS 10/core

• python-starlette-0.46.0-3.1.mga10

Publication date: 09 Aug 2026
Type: bugfix
Affected Mageia releases : 10

Fix command line launching for some of the common Wine tools. References

• https://bugs.mageia.org/show_bug.cgi?id=36024

SRPMS 10/core

• wine-11.0-2.1.mga10
• wine-wow64-11.0-1.1.mga10

Publication date: 09 Aug 2026
Type: bugfix
Affected Mageia releases : 10

unoconv can't perform file conversions. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36046
• https://ask.libreoffice.org/t/is-this-unoconv-issue-a-regression-in-libreoffice/131807/2

SRPMS 10/core

• unoconv-0.9.0-4.1.mga10

Publication date: 09 Aug 2026
Type: bugfix
Affected Mageia releases : 10

When xz was missing, urpmi and rpmdrake were unable to display information about packages, because they could read neither the description, nor the file list, nor the history. This update fixes the issue by making urpmi depend on xz. References

• https://bugs.mageia.org/show_bug.cgi?id=36062

SRPMS 10/core

• urpmi-8.136-2.1.mga10

Publication date: 07 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14899 , CVE-2026-15718 , CVE-2026-15719 , CVE-2026-16349 , CVE-2026-16350 , CVE-2026-16351 , CVE-2026-16352 , CVE-2026-16353 , CVE-2026-16354 , CVE-2026-16355 , CVE-2026-16356 , CVE-2026-16357 , CVE-2026-16358 , CVE-2026-16359 , CVE-2026-16360 , CVE-2026-16361 , CVE-2026-16362 , CVE-2026-16363 , CVE-2026-16368 , CVE-2026-16369 , CVE-2026-16371 , CVE-2026-16374 , CVE-2026-16375 , CVE-2026-16377 , CVE-2026-16379 , CVE-2026-16381 , CVE-2026-16383 , CVE-2026-16387 , CVE-2026-16390 , CVE-2026-16391 , CVE-2026-16396 , CVE-2026-16405 , CVE-2026-16412 , CVE-2026-12289 , CVE-2026-12290 , CVE-2026-12291 , CVE-2026-12292 , CVE-2026-12294 , CVE-2026-12295 , CVE-2026-12296 , CVE-2026-12297 , CVE-2026-12298 , CVE-2026-12299 , CVE-2026-12302 , CVE-2026-12304 , CVE-2026-12305 , CVE-2026-12306 , CVE-2026-12307 , CVE-2026-12308 , CVE-2026-12309 , CVE-2026-12310 , CVE-2026-12311 , CVE-2026-12312 , CVE-2026-12313 , CVE-2026-12314 , CVE-2026-12315 , CVE-2026-12324 , CVE-2026-12325 , CVE-2026-12327 , CVE-2026-12328 , CVE-2026-12329 , CVE-2026-12330 , CVE-2026-57962 , CVE-2026-57963
Updated thunderbird packages fix various security issues. See the links to get complete information of each issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35982
• https://bugs.mageia.org/show_bug.cgi?id=35863
• https://www.thunderbird.net/en-US/thunderbird/140.13.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird140.13
• https://www.thunderbird.net/en-US/thunderbird/140.12.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-61/
• https://www.thunderbird.net/en-US/thunderbird/140.12.1esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/
• https://www.cve.org/CVERecord?id=CVE-2026-14899
• https://www.cve.org/CVERecord?id=CVE-2026-15718
• https://www.cve.org/CVERecord?id=CVE-2026-15719
• https://www.cve.org/CVERecord?id=CVE-2026-16349
• https://www.cve.org/CVERecord?id=CVE-2026-16350
• https://www.cve.org/CVERecord?id=CVE-2026-16351
• https://www.cve.org/CVERecord?id=CVE-2026-16352
• https://www.cve.org/CVERecord?id=CVE-2026-16353
• https://www.cve.org/CVERecord?id=CVE-2026-16354
• https://www.cve.org/CVERecord?id=CVE-2026-16355
• https://www.cve.org/CVERecord?id=CVE-2026-16356
• https://www.cve.org/CVERecord?id=CVE-2026-16357
• https://www.cve.org/CVERecord?id=CVE-2026-16358
• https://www.cve.org/CVERecord?id=CVE-2026-16359
• https://www.cve.org/CVERecord?id=CVE-2026-16360
• https://www.cve.org/CVERecord?id=CVE-2026-16361
• https://www.cve.org/CVERecord?id=CVE-2026-16362
• https://www.cve.org/CVERecord?id=CVE-2026-16363
• https://www.cve.org/CVERecord?id=CVE-2026-16368
• https://www.cve.org/CVERecord?id=CVE-2026-16369
• https://www.cve.org/CVERecord?id=CVE-2026-16371
• https://www.cve.org/CVERecord?id=CVE-2026-16374
• https://www.cve.org/CVERecord?id=CVE-2026-16375
• https://www.cve.org/CVERecord?id=CVE-2026-16377
• https://www.cve.org/CVERecord?id=CVE-2026-16379
• https://www.cve.org/CVERecord?id=CVE-2026-16381
• https://www.cve.org/CVERecord?id=CVE-2026-16383
• https://www.cve.org/CVERecord?id=CVE-2026-16387
• https://www.cve.org/CVERecord?id=CVE-2026-16390
• https://www.cve.org/CVERecord?id=CVE-2026-16391
• https://www.cve.org/CVERecord?id=CVE-2026-16396
• https://www.cve.org/CVERecord?id=CVE-2026-16405
• https://www.cve.org/CVERecord?id=CVE-2026-16412
• https://www.cve.org/CVERecord?id=CVE-2026-12289
• https://www.cve.org/CVERecord?id=CVE-2026-12290
• https://www.cve.org/CVERecord?id=CVE-2026-12291
• https://www.cve.org/CVERecord?id=CVE-2026-12292
• https://www.cve.org/CVERecord?id=CVE-2026-12294
• https://www.cve.org/CVERecord?id=CVE-2026-12295
• https://www.cve.org/CVERecord?id=CVE-2026-12296
• https://www.cve.org/CVERecord?id=CVE-2026-12297
• https://www.cve.org/CVERecord?id=CVE-2026-12298
• https://www.cve.org/CVERecord?id=CVE-2026-12299
• https://www.cve.org/CVERecord?id=CVE-2026-12302
• https://www.cve.org/CVERecord?id=CVE-2026-12304
• https://www.cve.org/CVERecord?id=CVE-2026-12305
• https://www.cve.org/CVERecord?id=CVE-2026-12306
• https://www.cve.org/CVERecord?id=CVE-2026-12307
• https://www.cve.org/CVERecord?id=CVE-2026-12308
• https://www.cve.org/CVERecord?id=CVE-2026-12309
• https://www.cve.org/CVERecord?id=CVE-2026-12310
• https://www.cve.org/CVERecord?id=CVE-2026-12311
• https://www.cve.org/CVERecord?id=CVE-2026-12312
• https://www.cve.org/CVERecord?id=CVE-2026-12313
• https://www.cve.org/CVERecord?id=CVE-2026-12314
• https://www.cve.org/CVERecord?id=CVE-2026-12315
• https://www.cve.org/CVERecord?id=CVE-2026-12324
• https://www.cve.org/CVERecord?id=CVE-2026-12325
• https://www.cve.org/CVERecord?id=CVE-2026-12327
• https://www.cve.org/CVERecord?id=CVE-2026-12328
• https://www.cve.org/CVERecord?id=CVE-2026-12329
• https://www.cve.org/CVERecord?id=CVE-2026-12330
• https://www.cve.org/CVERecord?id=CVE-2026-57962
• https://www.cve.org/CVERecord?id=CVE-2026-57963

SRPMS 10/core

• thunderbird-140.13.0-1.mga10
• thunderbird-l10n-140.13.0-1.mga10

9/core

• thunderbird-140.13.0-1.mga9
• thunderbird-l10n-140.13.0-1.mga9

Publication date: 07 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-15718 , CVE-2026-15719 , CVE-2026-16349 , CVE-2026-16350 , CVE-2026-16351 , CVE-2026-16352 , CVE-2026-16353 , CVE-2026-16354 , CVE-2026-16355 , CVE-2026-16356 , CVE-2026-16357 , CVE-2026-16358 , CVE-2026-16359 , CVE-2026-16360 , CVE-2026-16361 , CVE-2026-16362 , CVE-2026-16363 , CVE-2026-16368 , CVE-2026-16369 , CVE-2026-16371 , CVE-2026-16374 , CVE-2026-16375 , CVE-2026-16377 , CVE-2026-16379 , CVE-2026-16381 , CVE-2026-16383 , CVE-2026-16387 , CVE-2026-16390 , CVE-2026-16391 , CVE-2026-16396 , CVE-2026-16405 , CVE-2026-16412
Updated rootcerts, nss & firefox packages fixes various vulnerabilities. Please see the links for detailed information of each one. References

• https://bugs.mageia.org/show_bug.cgi?id=35981
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_126.html
• https://www.firefox.com/en-US/firefox/140.13.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/
• https://www.cve.org/CVERecord?id=CVE-2026-15718
• https://www.cve.org/CVERecord?id=CVE-2026-15719
• https://www.cve.org/CVERecord?id=CVE-2026-16349
• https://www.cve.org/CVERecord?id=CVE-2026-16350
• https://www.cve.org/CVERecord?id=CVE-2026-16351
• https://www.cve.org/CVERecord?id=CVE-2026-16352
• https://www.cve.org/CVERecord?id=CVE-2026-16353
• https://www.cve.org/CVERecord?id=CVE-2026-16354
• https://www.cve.org/CVERecord?id=CVE-2026-16355
• https://www.cve.org/CVERecord?id=CVE-2026-16356
• https://www.cve.org/CVERecord?id=CVE-2026-16357
• https://www.cve.org/CVERecord?id=CVE-2026-16358
• https://www.cve.org/CVERecord?id=CVE-2026-16359
• https://www.cve.org/CVERecord?id=CVE-2026-16360
• https://www.cve.org/CVERecord?id=CVE-2026-16361
• https://www.cve.org/CVERecord?id=CVE-2026-16362
• https://www.cve.org/CVERecord?id=CVE-2026-16363
• https://www.cve.org/CVERecord?id=CVE-2026-16368
• https://www.cve.org/CVERecord?id=CVE-2026-16369
• https://www.cve.org/CVERecord?id=CVE-2026-16371
• https://www.cve.org/CVERecord?id=CVE-2026-16374
• https://www.cve.org/CVERecord?id=CVE-2026-16375
• https://www.cve.org/CVERecord?id=CVE-2026-16377
• https://www.cve.org/CVERecord?id=CVE-2026-16379
• https://www.cve.org/CVERecord?id=CVE-2026-16381
• https://www.cve.org/CVERecord?id=CVE-2026-16383
• https://www.cve.org/CVERecord?id=CVE-2026-16387
• https://www.cve.org/CVERecord?id=CVE-2026-16390
• https://www.cve.org/CVERecord?id=CVE-2026-16391
• https://www.cve.org/CVERecord?id=CVE-2026-16396
• https://www.cve.org/CVERecord?id=CVE-2026-16405
• https://www.cve.org/CVERecord?id=CVE-2026-16412

SRPMS 10/core

• rootcerts-20260714.00-1.mga10
• nss-3.126.0-1.mga10
• firefox-140.13.0-1.mga10
• firefox-l10n-140.13.0-1.mga10

9/core

• rootcerts-20260714.00-1.mga9
• nss-3.126.0-1.mga9
• firefox-140.13.0-1.mga9
• firefox-l10n-140.13.0-1.mga9

Publication date: 07 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-6873 , CVE-2026-7666 , CVE-2026-8404 , CVE-2026-35193 , CVE-2026-48587 , CVE-2026-48588 , CVE-2026-53877 , CVE-2026-53878
The updated package fixes security vulnerabilities: Signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie`. (CVE-2026-6873) Potential unencrypted email transmission via `STARTTLS` in the SMTP backend. (CVE-2026-7666) Potential exposure of private data via case-sensitive `Cache-Control` directives in `UpdateCacheMiddleware`. (CVE-2026-8404) Potential exposure of private data via missing `Vary: Authorization` in `UpdateCacheMiddleware`. (CVE-2026-35193) Potential exposure of private data via whitespace padding in `Vary` header. (CVE-2026-48587) Potential exposure of private data via cached `Set-Cookie` response. (CVE-2026-48588) Heap buffer over-read in `GDALRaster`. (CVE-2026-53877) Header injection possibility since `DomainNameValidator` accepted newlines in input. (CVE-2026-53878) References

• https://bugs.mageia.org/show_bug.cgi?id=35870
• https://www.openwall.com/lists/oss-security/2026/06/03/10
• https://www.openwall.com/lists/oss-security/2026/07/07/10
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases/
• https://www.cve.org/CVERecord?id=CVE-2026-6873
• https://www.cve.org/CVERecord?id=CVE-2026-7666
• https://www.cve.org/CVERecord?id=CVE-2026-8404
• https://www.cve.org/CVERecord?id=CVE-2026-35193
• https://www.cve.org/CVERecord?id=CVE-2026-48587
• https://www.cve.org/CVERecord?id=CVE-2026-48588
• https://www.cve.org/CVERecord?id=CVE-2026-53877
• https://www.cve.org/CVERecord?id=CVE-2026-53878

SRPMS 10/core

• python-django-5.2.16-1.mga10