Lector de Feeds

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-18321 Description
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec. (CVE-2026-18321) References

• https://bugs.mageia.org/show_bug.cgi?id=36168
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UTEH533TYAX7KYJMMA773F3LEQ3E2JX2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QJWRFBL7QOCH5ZDIFCWDUMRTVPZNV7UQ/
• https://www.cve.org/CVERecord?id=CVE-2026-18321

SRPMS 10/core

• ntpsec-1.2.4-3.2.mga10

9/core

• ntpsec-1.2.2-5.1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
Description
Updated packages fix security issues. Please see the references. References

• https://bugs.mageia.org/show_bug.cgi?id=36153
• https://www.openwall.com/lists/oss-security/2026/08/20/5
• https://www.postfix.org/announcements/postfix-3.11.6.html
• https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html
• https://www.openwall.com/lists/oss-security/2026/09/10/8
• https://www.postfix.org/announcements/postfix-3.11.7.html

SRPMS 10/core

• postfix-3.9.15-1.mga10

9/core

• postfix-3.8.21-1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10
Description
Updated packages fix security vulnerabilities, please se the reference. References

• https://bugs.mageia.org/show_bug.cgi?id=36131
• https://www.openwall.com/lists/oss-security/2026/08/03/2

SRPMS 10/core

• mpg123-1.33.7-1.mga10

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-40467 , CVE-2026-40468 , CVE-2026-40469 , CVE-2026-40553 Description
Use after free in gawk. (CVE-2026-40467) Heap buffer overflow in gawk. (CVE-2026-40468) Heap buffer overflow in gawk. (CVE-2026-40469) Stack-based buffer overflow in gawk. (CVE-2026-40553) References

• https://bugs.mageia.org/show_bug.cgi?id=35997
• https://ubuntu.com/security/notices/USN-8588-1
• https://www.cve.org/CVERecord?id=CVE-2026-40467
• https://www.cve.org/CVERecord?id=CVE-2026-40468
• https://www.cve.org/CVERecord?id=CVE-2026-40469
• https://www.cve.org/CVERecord?id=CVE-2026-40553

SRPMS 10/core

• gawk-5.3.2-2.1.mga10

9/core

• gawk-5.2.2-1.1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-63676 Description
Updated packages fixes CVE-2026-63676 References

• https://bugs.mageia.org/show_bug.cgi?id=35996
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/J2RXBIKA5WZB2UEHKQR7MEKDH6GABEFL/
• https://www.cve.org/CVERecord?id=CVE-2026-63676

SRPMS 10/core

• perl-YAML-1.310.0-2.1.mga10

9/core

• perl-YAML-1.300.0-3.1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-15370 , CVE-2026-59843 , CVE-2026-59844 , CVE-2026-59845 , CVE-2026-59846 , CVE-2026-59847 , CVE-2026-59848 , CVE-2026-59849 , CVE-2026-59850 Description
Stack buffer overflow in SFTP server longname construction. (CVE-2026-15370) Denial of service via zero advertised channel packet size. (CVE-2026-59843) Denial of service via oversized SFTP read length. (CVE-2026-59844) Denial of service via unchecked ProxyCommand fork() failure. (CVE-2026-59845) Information disclosure via ProxyCommand %r username expansion. (CVE-2026-59846) Integrity downgrade via OpenSSL AES-GCM tag verification. (CVE-2026-59847) Denial of service via SFTP responses with unknown request IDs. (CVE-2026-59848) Denial of service via automatic certificate authentication loop. (CVE-2026-59849) Use-after-free via data callbacks on closed channels. (CVE-2026-59850) References

• https://bugs.mageia.org/show_bug.cgi?id=35983
• https://www.openwall.com/lists/oss-security/2026/07/21/7
• https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIVTLBAG4MPX3WGPMVYDO2UPZB6G3ESR/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YZ324UUCGQ4JEC4ZOJMJODWYVPSFBWUU/
• https://lists.debian.org/debian-security-announce/2026/msg00321.html
• https://ubuntu.com/security/notices/USN-8699-1
• https://www.cve.org/CVERecord?id=CVE-2026-15370
• https://www.cve.org/CVERecord?id=CVE-2026-59843
• https://www.cve.org/CVERecord?id=CVE-2026-59844
• https://www.cve.org/CVERecord?id=CVE-2026-59845
• https://www.cve.org/CVERecord?id=CVE-2026-59846
• https://www.cve.org/CVERecord?id=CVE-2026-59847
• https://www.cve.org/CVERecord?id=CVE-2026-59848
• https://www.cve.org/CVERecord?id=CVE-2026-59849
• https://www.cve.org/CVERecord?id=CVE-2026-59850

SRPMS 10/core

• libssh-0.11.5-1.mga10

9/core

• libssh-0.10.6-1.3.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-42616 , CVE-2026-42617 , CVE-2026-42618 , CVE-2026-46569 , CVE-2026-46570 , CVE-2026-46571 , CVE-2026-46572 , CVE-2026-56135 , CVE-2026-56136 Description
Heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616) Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617) Single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618) Heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569) Heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570) Out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571) Heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572) Heap buffer overflow when building inherited ACL data. (CVE-2026-56135) Out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136) References

• https://bugs.mageia.org/show_bug.cgi?id=35940
• https://www.openwall.com/lists/oss-security/2026/07/15/6
• https://lists.debian.org/debian-security-announce/2026/msg00300.html
• https://ubuntu.com/security/notices/USN-8554-1
• https://www.cve.org/CVERecord?id=CVE-2026-42616
• https://www.cve.org/CVERecord?id=CVE-2026-42617
• https://www.cve.org/CVERecord?id=CVE-2026-42618
• https://www.cve.org/CVERecord?id=CVE-2026-46569
• https://www.cve.org/CVERecord?id=CVE-2026-46570
• https://www.cve.org/CVERecord?id=CVE-2026-46571
• https://www.cve.org/CVERecord?id=CVE-2026-46572
• https://www.cve.org/CVERecord?id=CVE-2026-56135
• https://www.cve.org/CVERecord?id=CVE-2026-56136

SRPMS 10/core

• ntfs-3g-2026.2.25-1.1.mga10

9/core

• ntfs-3g-2022.10.3-1.3.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-56288 , CVE-2026-56289 Description
NULL Pointer Dereference in GNU patch. (CVE-2026-56288) Loop with Unreachable Exit Condition in GNU patch. (CVE-2026-56289) References

• https://bugs.mageia.org/show_bug.cgi?id=35933
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5MJXY435MLDAL5GXH6V5OY6MEMOGFEH5/
• https://cert.pl/en/posts/2026/07/CVE-2026-56288/
• https://www.cve.org/CVERecord?id=CVE-2026-56288
• https://www.cve.org/CVERecord?id=CVE-2026-56289

SRPMS 10/core

• patch-2.8-1.1.mga10