Lector de Feeds

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-10723 , CVE-2026-10822 , CVE-2026-11331 , CVE-2026-11605 , CVE-2026-11721 , CVE-2026-12617 , CVE-2026-13204 , CVE-2026-13321 Description
Updated bind packages fix security vulnerabilities: Incorrect acceptance of NSEC3 records. (CVE-2026-10723) Key Record using PRIVATEDNS algorithm may lead to unexpected exit. (CVE-2026-10822) Potential wildcard CNAME RPZ policy bypass. (CVE-2026-11331) Unnecessary validation of DNSSEC signed records. (CVE-2026-11605) Cache poisoning possible with label count discrepancy, RRSIG, and wildcards. (CVE-2026-11721) Record ordering based unexpected exit with CNAME or DNAME. (CVE-2026-12617) Unexpected exit in certain situations with NSEC and NSEC3 both present. (CVE-2026-13204) DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field. (CVE-2026-13321) References

• https://bugs.mageia.org/show_bug.cgi?id=36003
• https://www.openwall.com/lists/oss-security/2026/07/22/8
• https://kb.isc.org/docs/cve-2026-10723
• https://kb.isc.org/docs/cve-2026-10822
• https://kb.isc.org/docs/cve-2026-11331
• https://kb.isc.org/docs/cve-2026-11605
• https://kb.isc.org/docs/cve-2026-11622
• https://kb.isc.org/docs/cve-2026-11721
• https://kb.isc.org/docs/cve-2026-12617
• https://kb.isc.org/docs/cve-2026-13204
• https://kb.isc.org/docs/cve-2026-13321
• https://www.cve.org/CVERecord?id=CVE-2026-10723
• https://www.cve.org/CVERecord?id=CVE-2026-10822
• https://www.cve.org/CVERecord?id=CVE-2026-11331
• https://www.cve.org/CVERecord?id=CVE-2026-11605
• https://www.cve.org/CVERecord?id=CVE-2026-11721
• https://www.cve.org/CVERecord?id=CVE-2026-12617
• https://www.cve.org/CVERecord?id=CVE-2026-13204
• https://www.cve.org/CVERecord?id=CVE-2026-13321

SRPMS 10/core

• bind-9.20.26-1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-17544 , CVE-2026-9672 , CVE-2026-17543 , CVE-2026-7260 Description
Updated php 8.5 packages fix some security vulnerabilities. For details see the references. References

• https://bugs.mageia.org/show_bug.cgi?id=36036
• https://www.php.net/ChangeLog-8.php#8.5.9
• https://www.cve.org/CVERecord?id=CVE-2026-17544
• https://www.cve.org/CVERecord?id=CVE-2026-9672
• https://www.cve.org/CVERecord?id=CVE-2026-17543
• https://www.cve.org/CVERecord?id=CVE-2026-7260

SRPMS 10/core

• php8.5-8.5.9-1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-17544 , CVE-2026-9672 , CVE-2026-17543 , CVE-2026-7260 Description
The updated php 8.4 packages fix some security vulnerabilities. See the references for more information. References

• https://bugs.mageia.org/show_bug.cgi?id=36037
• https://www.php.net/ChangeLog-8.php#8.4.24
• https://www.cve.org/CVERecord?id=CVE-2026-17544
• https://www.cve.org/CVERecord?id=CVE-2026-9672
• https://www.cve.org/CVERecord?id=CVE-2026-17543
• https://www.cve.org/CVERecord?id=CVE-2026-7260

SRPMS 10/core

• php8.4-8.4.24-1.1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48977 Description
Arbitrary memory write with crafted Ventana BIF file. (CVE-2026-48977) References

• https://bugs.mageia.org/show_bug.cgi?id=35719
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LT3YC2CS4XTDLRWSH72YZE3EJ6BQCTJ/
• https://www.cve.org/CVERecord?id=CVE-2026-48977

SRPMS 10/core

• openslide-4.0.0-1.1.mga10

Publication date: 10 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
This is rawtherapee version 5.13, the latest from upstream. It is a bugfix and features release. References

• https://bugs.mageia.org/show_bug.cgi?id=36025

SRPMS 10/core

• rawtherapee-5.13-1.mga10

Publication date: 10 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
Upstream ported RemoteBox to Gtk3 long ago, but we still let the package depend on Gtk2. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36022

SRPMS 10/core

• remotebox-3.7-1.1.mga10

Publication date: 10 Aug 2026
Type: bugfix
Affected Mageia releases : 9
Description
mock chroots for mageia 10 still are using the cauldron configuration and don't produce rpm files for mageia 10. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35939

SRPMS 9/core

• mock-core-configs-39.1-2.4.mga9
• mock-mageia-configs-9-1.2.mga9

Publication date: 09 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-28849 , CVE-2025-62727 , CVE-2026-48710 Description
The updated package fixes security vulnerabilities: Proxy-Authorization header kept across hosts. (CVE-2024-28849) Starlette vulnerable to O(n^2) DoS via Range header merging in starlette.responses.FileResponse. (CVE-2025-62727) Security restriction bypass via malformed HTTP Host header. (CVE-2026-48710) References

• https://bugs.mageia.org/show_bug.cgi?id=35637
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWLLKAJQCNBN46LPLDAYBM2FU65WBX72/
• https://lists.debian.org/debian-security-announce/2026/msg00213.html
• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FET4KWO46IN64G35ZF7HGJJBIM4OF3YC/
• https://www.cve.org/CVERecord?id=CVE-2024-28849
• https://www.cve.org/CVERecord?id=CVE-2025-62727
• https://www.cve.org/CVERecord?id=CVE-2026-48710

SRPMS 10/core

• python-starlette-0.46.0-3.1.mga10

Publication date: 09 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
Fix command line launching for some of the common Wine tools. References

• https://bugs.mageia.org/show_bug.cgi?id=36024

SRPMS 10/core

• wine-11.0-2.1.mga10
• wine-wow64-11.0-1.1.mga10

Publication date: 09 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
unoconv can't perform file conversions. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36046
• https://ask.libreoffice.org/t/is-this-unoconv-issue-a-regression-in-libreoffice/131807/2

SRPMS 10/core

• unoconv-0.9.0-4.1.mga10

Publication date: 09 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
When xz was missing, urpmi and rpmdrake were unable to display information about packages, because they could read neither the description, nor the file list, nor the history. This update fixes the issue by making urpmi depend on xz. References

• https://bugs.mageia.org/show_bug.cgi?id=36062

SRPMS 10/core

• urpmi-8.136-2.1.mga10

Publication date: 07 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14899 , CVE-2026-15718 , CVE-2026-15719 , CVE-2026-16349 , CVE-2026-16350 , CVE-2026-16351 , CVE-2026-16352 , CVE-2026-16353 , CVE-2026-16354 , CVE-2026-16355 , CVE-2026-16356 , CVE-2026-16357 , CVE-2026-16358 , CVE-2026-16359 , CVE-2026-16360 , CVE-2026-16361 , CVE-2026-16362 , CVE-2026-16363 , CVE-2026-16368 , CVE-2026-16369 , CVE-2026-16371 , CVE-2026-16374 , CVE-2026-16375 , CVE-2026-16377 , CVE-2026-16379 , CVE-2026-16381 , CVE-2026-16383 , CVE-2026-16387 , CVE-2026-16390 , CVE-2026-16391 , CVE-2026-16396 , CVE-2026-16405 , CVE-2026-16412 , CVE-2026-12289 , CVE-2026-12290 , CVE-2026-12291 , CVE-2026-12292 , CVE-2026-12294 , CVE-2026-12295 , CVE-2026-12296 , CVE-2026-12297 , CVE-2026-12298 , CVE-2026-12299 , CVE-2026-12302 , CVE-2026-12304 , CVE-2026-12305 , CVE-2026-12306 , CVE-2026-12307 , CVE-2026-12308 , CVE-2026-12309 , CVE-2026-12310 , CVE-2026-12311 , CVE-2026-12312 , CVE-2026-12313 , CVE-2026-12314 , CVE-2026-12315 , CVE-2026-12324 , CVE-2026-12325 , CVE-2026-12327 , CVE-2026-12328 , CVE-2026-12329 , CVE-2026-12330 , CVE-2026-57962 , CVE-2026-57963 Description
Updated thunderbird packages fix various security issues. See the links to get complete information of each issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35982
• https://bugs.mageia.org/show_bug.cgi?id=35863
• https://www.thunderbird.net/en-US/thunderbird/140.13.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird140.13
• https://www.thunderbird.net/en-US/thunderbird/140.12.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-61/
• https://www.thunderbird.net/en-US/thunderbird/140.12.1esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/
• https://www.cve.org/CVERecord?id=CVE-2026-14899
• https://www.cve.org/CVERecord?id=CVE-2026-15718
• https://www.cve.org/CVERecord?id=CVE-2026-15719
• https://www.cve.org/CVERecord?id=CVE-2026-16349
• https://www.cve.org/CVERecord?id=CVE-2026-16350
• https://www.cve.org/CVERecord?id=CVE-2026-16351
• https://www.cve.org/CVERecord?id=CVE-2026-16352
• https://www.cve.org/CVERecord?id=CVE-2026-16353
• https://www.cve.org/CVERecord?id=CVE-2026-16354
• https://www.cve.org/CVERecord?id=CVE-2026-16355
• https://www.cve.org/CVERecord?id=CVE-2026-16356
• https://www.cve.org/CVERecord?id=CVE-2026-16357
• https://www.cve.org/CVERecord?id=CVE-2026-16358
• https://www.cve.org/CVERecord?id=CVE-2026-16359
• https://www.cve.org/CVERecord?id=CVE-2026-16360
• https://www.cve.org/CVERecord?id=CVE-2026-16361
• https://www.cve.org/CVERecord?id=CVE-2026-16362
• https://www.cve.org/CVERecord?id=CVE-2026-16363
• https://www.cve.org/CVERecord?id=CVE-2026-16368
• https://www.cve.org/CVERecord?id=CVE-2026-16369
• https://www.cve.org/CVERecord?id=CVE-2026-16371
• https://www.cve.org/CVERecord?id=CVE-2026-16374
• https://www.cve.org/CVERecord?id=CVE-2026-16375
• https://www.cve.org/CVERecord?id=CVE-2026-16377
• https://www.cve.org/CVERecord?id=CVE-2026-16379
• https://www.cve.org/CVERecord?id=CVE-2026-16381
• https://www.cve.org/CVERecord?id=CVE-2026-16383
• https://www.cve.org/CVERecord?id=CVE-2026-16387
• https://www.cve.org/CVERecord?id=CVE-2026-16390
• https://www.cve.org/CVERecord?id=CVE-2026-16391
• https://www.cve.org/CVERecord?id=CVE-2026-16396
• https://www.cve.org/CVERecord?id=CVE-2026-16405
• https://www.cve.org/CVERecord?id=CVE-2026-16412
• https://www.cve.org/CVERecord?id=CVE-2026-12289
• https://www.cve.org/CVERecord?id=CVE-2026-12290
• https://www.cve.org/CVERecord?id=CVE-2026-12291
• https://www.cve.org/CVERecord?id=CVE-2026-12292
• https://www.cve.org/CVERecord?id=CVE-2026-12294
• https://www.cve.org/CVERecord?id=CVE-2026-12295
• https://www.cve.org/CVERecord?id=CVE-2026-12296
• https://www.cve.org/CVERecord?id=CVE-2026-12297
• https://www.cve.org/CVERecord?id=CVE-2026-12298
• https://www.cve.org/CVERecord?id=CVE-2026-12299
• https://www.cve.org/CVERecord?id=CVE-2026-12302
• https://www.cve.org/CVERecord?id=CVE-2026-12304
• https://www.cve.org/CVERecord?id=CVE-2026-12305
• https://www.cve.org/CVERecord?id=CVE-2026-12306
• https://www.cve.org/CVERecord?id=CVE-2026-12307
• https://www.cve.org/CVERecord?id=CVE-2026-12308
• https://www.cve.org/CVERecord?id=CVE-2026-12309
• https://www.cve.org/CVERecord?id=CVE-2026-12310
• https://www.cve.org/CVERecord?id=CVE-2026-12311
• https://www.cve.org/CVERecord?id=CVE-2026-12312
• https://www.cve.org/CVERecord?id=CVE-2026-12313
• https://www.cve.org/CVERecord?id=CVE-2026-12314
• https://www.cve.org/CVERecord?id=CVE-2026-12315
• https://www.cve.org/CVERecord?id=CVE-2026-12324
• https://www.cve.org/CVERecord?id=CVE-2026-12325
• https://www.cve.org/CVERecord?id=CVE-2026-12327
• https://www.cve.org/CVERecord?id=CVE-2026-12328
• https://www.cve.org/CVERecord?id=CVE-2026-12329
• https://www.cve.org/CVERecord?id=CVE-2026-12330
• https://www.cve.org/CVERecord?id=CVE-2026-57962
• https://www.cve.org/CVERecord?id=CVE-2026-57963

SRPMS 10/core

• thunderbird-140.13.0-1.mga10
• thunderbird-l10n-140.13.0-1.mga10

9/core

• thunderbird-140.13.0-1.mga9
• thunderbird-l10n-140.13.0-1.mga9

Publication date: 07 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-15718 , CVE-2026-15719 , CVE-2026-16349 , CVE-2026-16350 , CVE-2026-16351 , CVE-2026-16352 , CVE-2026-16353 , CVE-2026-16354 , CVE-2026-16355 , CVE-2026-16356 , CVE-2026-16357 , CVE-2026-16358 , CVE-2026-16359 , CVE-2026-16360 , CVE-2026-16361 , CVE-2026-16362 , CVE-2026-16363 , CVE-2026-16368 , CVE-2026-16369 , CVE-2026-16371 , CVE-2026-16374 , CVE-2026-16375 , CVE-2026-16377 , CVE-2026-16379 , CVE-2026-16381 , CVE-2026-16383 , CVE-2026-16387 , CVE-2026-16390 , CVE-2026-16391 , CVE-2026-16396 , CVE-2026-16405 , CVE-2026-16412 Description
Updated rootcerts, nss & firefox packages fixes various vulnerabilities. Please see the links for detailed information of each one. References

• https://bugs.mageia.org/show_bug.cgi?id=35981
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_126.html
• https://www.firefox.com/en-US/firefox/140.13.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/
• https://www.cve.org/CVERecord?id=CVE-2026-15718
• https://www.cve.org/CVERecord?id=CVE-2026-15719
• https://www.cve.org/CVERecord?id=CVE-2026-16349
• https://www.cve.org/CVERecord?id=CVE-2026-16350
• https://www.cve.org/CVERecord?id=CVE-2026-16351
• https://www.cve.org/CVERecord?id=CVE-2026-16352
• https://www.cve.org/CVERecord?id=CVE-2026-16353
• https://www.cve.org/CVERecord?id=CVE-2026-16354
• https://www.cve.org/CVERecord?id=CVE-2026-16355
• https://www.cve.org/CVERecord?id=CVE-2026-16356
• https://www.cve.org/CVERecord?id=CVE-2026-16357
• https://www.cve.org/CVERecord?id=CVE-2026-16358
• https://www.cve.org/CVERecord?id=CVE-2026-16359
• https://www.cve.org/CVERecord?id=CVE-2026-16360
• https://www.cve.org/CVERecord?id=CVE-2026-16361
• https://www.cve.org/CVERecord?id=CVE-2026-16362
• https://www.cve.org/CVERecord?id=CVE-2026-16363
• https://www.cve.org/CVERecord?id=CVE-2026-16368
• https://www.cve.org/CVERecord?id=CVE-2026-16369
• https://www.cve.org/CVERecord?id=CVE-2026-16371
• https://www.cve.org/CVERecord?id=CVE-2026-16374
• https://www.cve.org/CVERecord?id=CVE-2026-16375
• https://www.cve.org/CVERecord?id=CVE-2026-16377
• https://www.cve.org/CVERecord?id=CVE-2026-16379
• https://www.cve.org/CVERecord?id=CVE-2026-16381
• https://www.cve.org/CVERecord?id=CVE-2026-16383
• https://www.cve.org/CVERecord?id=CVE-2026-16387
• https://www.cve.org/CVERecord?id=CVE-2026-16390
• https://www.cve.org/CVERecord?id=CVE-2026-16391
• https://www.cve.org/CVERecord?id=CVE-2026-16396
• https://www.cve.org/CVERecord?id=CVE-2026-16405
• https://www.cve.org/CVERecord?id=CVE-2026-16412

SRPMS 10/core

• rootcerts-20260714.00-1.mga10
• nss-3.126.0-1.mga10
• firefox-140.13.0-1.mga10
• firefox-l10n-140.13.0-1.mga10

9/core

• rootcerts-20260714.00-1.mga9
• nss-3.126.0-1.mga9
• firefox-140.13.0-1.mga9
• firefox-l10n-140.13.0-1.mga9

Publication date: 07 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-6873 , CVE-2026-7666 , CVE-2026-8404 , CVE-2026-35193 , CVE-2026-48587 , CVE-2026-48588 , CVE-2026-53877 , CVE-2026-53878 Description
The updated package fixes security vulnerabilities: Signed cookie salt namespace collision in `django.http.HttpRequest.get_signed_cookie`. (CVE-2026-6873) Potential unencrypted email transmission via `STARTTLS` in the SMTP backend. (CVE-2026-7666) Potential exposure of private data via case-sensitive `Cache-Control` directives in `UpdateCacheMiddleware`. (CVE-2026-8404) Potential exposure of private data via missing `Vary: Authorization` in `UpdateCacheMiddleware`. (CVE-2026-35193) Potential exposure of private data via whitespace padding in `Vary` header. (CVE-2026-48587) Potential exposure of private data via cached `Set-Cookie` response. (CVE-2026-48588) Heap buffer over-read in `GDALRaster`. (CVE-2026-53877) Header injection possibility since `DomainNameValidator` accepted newlines in input. (CVE-2026-53878) References

• https://bugs.mageia.org/show_bug.cgi?id=35870
• https://www.openwall.com/lists/oss-security/2026/06/03/10
• https://www.openwall.com/lists/oss-security/2026/07/07/10
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases/
• https://www.cve.org/CVERecord?id=CVE-2026-6873
• https://www.cve.org/CVERecord?id=CVE-2026-7666
• https://www.cve.org/CVERecord?id=CVE-2026-8404
• https://www.cve.org/CVERecord?id=CVE-2026-35193
• https://www.cve.org/CVERecord?id=CVE-2026-48587
• https://www.cve.org/CVERecord?id=CVE-2026-48588
• https://www.cve.org/CVERecord?id=CVE-2026-53877
• https://www.cve.org/CVERecord?id=CVE-2026-53878

SRPMS 10/core

• python-django-5.2.16-1.mga10

Publication date: 06 Aug 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
In telegram groups with topics, the conversations from all the topics end in the Unique chat tab in pidgin and messages from pidgin end in the General topic, making it hard to follow the conversations. If the session for the plugin is closed from the phone client, in the next pidgin start you can't login. This update fixes the reported issues. Please note that the icon for the protocol has changed and is now listed as Unofficial Telegram. References

• https://bugs.mageia.org/show_bug.cgi?id=36048
• https://github.com/adrighem/tdlib-purple/issues/8
• https://github.com/adrighem/tdlib-purple/issues/19
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v2.0.2
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v2.0.1
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v2.0.0
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v1.2.2
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v1.2.1
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v1.2.0

SRPMS 10/core

• purple-telegram-tdlib-2.0.2-1.mga10

9/core

• purple-telegram-tdlib-2.0.2-1.mga9

Publication date: 06 Aug 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
pfm2afm crashed on 64-bit machines and did not accept absolute path names to files. Both these issues have been fixed. References

• https://bugs.mageia.org/show_bug.cgi?id=36017

SRPMS 10/core

• font-tools-0.1-34.mga10

9/core

• font-tools-0.1-34.mga9

Publication date: 06 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
Steam is updated to 1.0.0.87 and Requires: are added for libmesavulkan-drivers and libvulkan-loader1, needed for some games on Intel and AMD gpus. Note that steam-udevrules is required by steam and will be automatically pulled in by steam. However, it is available as a separate package so it can be used by folks with the libre steamcontroller without having to install all of steam to get it. References

• https://bugs.mageia.org/show_bug.cgi?id=36010

SRPMS 10/core

• steam-udevrules-1.0.0.87-1.mga10

10/nonfree

• steam-1.0.0.87-1.mga10.nonfree

Publication date: 05 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
woeusb-ng did not mark the 7zip package as a required dependency. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36029

SRPMS 10/core

• woeusb-ng-0.2.12-4.1.mga10