Lector de Feeds

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-19033 , CVE-2026-19662 , CVE-2026-19666 , CVE-2026-19667 , CVE-2026-19668 , CVE-2026-19941 , CVE-2026-75029 , CVE-2026-76163 , CVE-2026-77119 , CVE-2026-77692 , CVE-2026-78301 , CVE-2026-80274 , CVE-2026-81563 , CVE-2026-81736 Description
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (CVE-2026-19033). qpcache NOQNAME proof use-after-free crashes recursive resolver (CVE-2026-19662). Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (CVE-2026-19666). Remote assertion failure via 16-bit length truncation in dns_ncache_add() (CVE-2026-19667). Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (CVE-2026-19668). checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (CVE-2026-19941). Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (CVE-2026-75029). named aborts on a TKEY query when the user configuration has no global options statement (CVE-2026-76163). NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (CVE-2026-77119). Unauthenticated remote crash of named via a single DoH SIG(0) request (CVE-2026-77692). Out-of-zone database nodes can become authoritative zone cuts (CVE-2026-78301). Validating resolver can abort while caching a mismatched NOQNAME proof (CVE-2026-80274). SVCB AliasMode additional-data error leaks qpcache references (CVE-2026-81563). Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (CVE-2026-81736). References

• https://bugs.mageia.org/show_bug.cgi?id=36326
• https://kb.isc.org/docs/cve-2026-19033
• https://kb.isc.org/docs/cve-2026-19662
• https://kb.isc.org/docs/cve-2026-19666
• https://kb.isc.org/docs/cve-2026-19667
• https://kb.isc.org/docs/cve-2026-19668
• https://kb.isc.org/docs/cve-2026-19941
• https://kb.isc.org/docs/cve-2026-75029
• https://kb.isc.org/docs/cve-2026-76163
• https://kb.isc.org/docs/cve-2026-77119
• https://kb.isc.org/docs/cve-2026-77692
• https://kb.isc.org/docs/cve-2026-78301
• https://kb.isc.org/docs/cve-2026-80274
• https://kb.isc.org/docs/cve-2026-81563
• https://kb.isc.org/docs/cve-2026-81736
• https://www.cve.org/CVERecord?id=CVE-2026-19033
• https://www.cve.org/CVERecord?id=CVE-2026-19662
• https://www.cve.org/CVERecord?id=CVE-2026-19666
• https://www.cve.org/CVERecord?id=CVE-2026-19667
• https://www.cve.org/CVERecord?id=CVE-2026-19668
• https://www.cve.org/CVERecord?id=CVE-2026-19941
• https://www.cve.org/CVERecord?id=CVE-2026-75029
• https://www.cve.org/CVERecord?id=CVE-2026-76163
• https://www.cve.org/CVERecord?id=CVE-2026-77119
• https://www.cve.org/CVERecord?id=CVE-2026-77692
• https://www.cve.org/CVERecord?id=CVE-2026-78301
• https://www.cve.org/CVERecord?id=CVE-2026-80274
• https://www.cve.org/CVERecord?id=CVE-2026-81563
• https://www.cve.org/CVERecord?id=CVE-2026-81736

SRPMS 10/core

• bind-9.20.29-1.mga10

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
Description
Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values References

• https://bugs.mageia.org/show_bug.cgi?id=36321
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWACSE6EO43FMBJWXK22JG7C3LAOLJ3Z/
• https://github.com/bw2/ConfigArgParse/security/advisories/GHSA-6m27-337c-jcgf

SRPMS 10/core

• python-configargparse-1.7.7-1.mga10

9/core

• python-configargparse-1.7.7-1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-38949 , CVE-2024-38950 , CVE-2025-61147 , CVE-2026-33164 , CVE-2026-33165 , CVE-2026-45382 , CVE-2026-45383 , CVE-2026-49295 , CVE-2026-49337 , CVE-2026-49346 , CVE-2026-54240 , CVE-2026-54241 Description
Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 function at sdl.cc. (CVE-2024-38949) Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy function. (CVE-2024-38950) strukturag libde265 commit d9fea9d wa discovered to contain a segmentation fault via the component decoder_context::compute_framedrop_table(). (CVE-2025-61147) NULL Pointer Dereference in libde265. (CVE-2026-33164) Heap out-of-bounds write in libde265 1.0.16. (CVE-2026-33165) libde265 has a heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry. (CVE-2026-45382) libde265 has a heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access — libde265 <= v1.0.18. (CVE-2026-45383) libde265 has an out-of-bounds write in process_reference_picture_set via predicted short-term RPS. (CVE-2026-49295) libde265 has an unbounded memory leak via orphaned slice headers in `read_slice_NAL`. (CVE-2026-49337) libde265 has a heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow. (CVE-2026-49346) Pixel accessor signed integer overflow causes heap OOB read/write. (CVE-2026-54240) SAO sequential filter heap buffer overflow via signed integer overflow. (CVE-2026-54241) References

• https://bugs.mageia.org/show_bug.cgi?id=35987
• https://ubuntu.com/security/notices/USN-8573-1
• https://github.com/strukturag/libde265/issues/460
• https://github.com/strukturag/libde265/issues/484
• https://github.com/strukturag/libde265/security/advisories/GHSA-wqrf-6rf5-v78r
• https://github.com/strukturag/libde265/security/advisories/GHSA-653q-9f73-8hvg
• https://github.com/strukturag/libde265/security/advisories/GHSA-hwhx-x2mq-ccr9
• https://github.com/strukturag/libde265/security/advisories/GHSA-wg9q-ppqw-6q38
• https://github.com/strukturag/libde265/security/advisories/GHSA-g2rg-wj66-w594
• https://github.com/strukturag/libde265/security/advisories/GHSA-g5hj-rf9f-7vxm
• https://github.com/strukturag/libde265/security/advisories/GHSA-vv8h-932h-7r86
• https://github.com/strukturag/libde265/security/advisories/GHSA-ccfw-29x7-rrx3
• https://github.com/strukturag/libde265/security/advisories/GHSA-j2qq-x2xq-g9wr
• https://lists.debian.org/debian-security-announce/2026/msg00324.html
• https://lists.debian.org/debian-security-announce/2026/msg00397.html
• https://www.cve.org/CVERecord?id=CVE-2024-38949
• https://www.cve.org/CVERecord?id=CVE-2024-38950
• https://www.cve.org/CVERecord?id=CVE-2025-61147
• https://www.cve.org/CVERecord?id=CVE-2026-33164
• https://www.cve.org/CVERecord?id=CVE-2026-33165
• https://www.cve.org/CVERecord?id=CVE-2026-45382
• https://www.cve.org/CVERecord?id=CVE-2026-45383
• https://www.cve.org/CVERecord?id=CVE-2026-49295
• https://www.cve.org/CVERecord?id=CVE-2026-49337
• https://www.cve.org/CVERecord?id=CVE-2026-49346
• https://www.cve.org/CVERecord?id=CVE-2026-54240
• https://www.cve.org/CVERecord?id=CVE-2026-54241

SRPMS 10/core

• libde265-1.0.16-4.1.mga10

10/tainted

• libde265-1.0.16-4.1.mga10.tainted

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-59939 Description
Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling. (CVE-2026-59939) References

• https://bugs.mageia.org/show_bug.cgi?id=35936
• https://ubuntu.com/security/notices/USN-8537-1
• https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3
• https://lists.debian.org/debian-security-announce/2026/msg00352.html
• https://www.cve.org/CVERecord?id=CVE-2026-59939

SRPMS 10/core

• python-httplib2-0.22.0-3.1.mga10

9/core

• python-httplib2-0.20.4-1.1.mga9

Publication date: 20 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Current system-config-printer package does not show a logo in the about dialog box. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36325

SRPMS 10/core

• system-config-printer-1.5.18-6.2.mga10

Publication date: 20 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
perl-Chart is updated to version 2.403.9. perl-Graphics-Toolkit-Color is a new runtime requirement for perl-Chart. References

• https://bugs.mageia.org/show_bug.cgi?id=36292

SRPMS 10/core

• perl-Chart-2.403.9-1.mga10
• perl-Graphics-Toolkit-Color-2.220.0-1.mga10

Publication date: 20 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
GUI aplications packaged by mageia are not listed in gnome-software. This updates adds libdnf5-plugin-appstream as optional requirement to allow gnome-software see the GUI applications packaged by mageia and allow to user skip the additional package if they want. References

• https://bugs.mageia.org/show_bug.cgi?id=35733

SRPMS 10/core

• gnome-software-49.3-2.1.mga10

Publication date: 20 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
When formatting a partition which was already mounted, Isodumper failed. Now, it starts to unmount the partitions on the target device Devices list is also cleaned of optical devices. References

• https://bugs.mageia.org/show_bug.cgi?id=35652

SRPMS 10/core

• isodumper-1.93-1.mga10

Publication date: 19 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-18297 Description
GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2026-18297) References

• https://bugs.mageia.org/show_bug.cgi?id=36288
• https://lists.debian.org/debian-security-announce/2026/msg00400.html
• https://gstreamer.freedesktop.org/security/sa-2026-0053.html
• https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12044
• https://www.cve.org/CVERecord?id=CVE-2026-18297

SRPMS 10/core

• gstreamer1.0-plugins-base-1.26.11-1.1.mga10

9/core

• gstreamer1.0-plugins-base-1.22.11-1.4.mga9

Publication date: 19 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
audacity is updated to version 3.7.9 which has improvements and bugs fixed by the audacity team. References

• https://bugs.mageia.org/show_bug.cgi?id=36271
• https://github.com/audacity/audacity/releases#release-Audacity-3.7.9
• https://github.com/audacity/audacity/releases#release-Audacity-3.7.8

SRPMS 10/core

• audacity-3.7.9-1.mga10

Publication date: 18 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2025-7345 , CVE-2026-16768 , CVE-2026-81893 Description
Heap‑buffer‑overflow in gdk‑pixbuf. (CVE-2025-7345) Out-of-bounds read in ico parser. (CVE-2026-16768) Invalid write in jpeg icc profile parser on error recovery. (CVE-2026-81893) References

• https://bugs.mageia.org/show_bug.cgi?id=36238
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7DP4KY4CEXMYSH2LTCRQAN4JZKGOIKAV/
• https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MXN4IRXYCTUM4SHIHKYCZ4F65WY26VVT/
• https://lists.debian.org/debian-lts-announce/2025/10/msg00024.html
• https://www.cve.org/CVERecord?id=CVE-2025-7345
• https://www.cve.org/CVERecord?id=CVE-2026-16768
• https://www.cve.org/CVERecord?id=CVE-2026-81893

SRPMS 10/core

• gdk-pixbuf2.0-2.44.4-2.1.mga10

9/core

• gdk-pixbuf2.0-2.42.10-2.4.mga9

Publication date: 18 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-0799 , CVE-2026-31911 , CVE-2026-31912 , CVE-2026-6244 , CVE-2026-6554 , CVE-2026-18313 , CVE-2026-18238 Description
OOBR and OOBW in libpcap before 1.10.7. (CVE-2026-0799) abort() in libpcap before 1.10.7 on an invalid BPF opcode. (CVE-2026-31911) OOBR in libpcap before 1.10.7. (CVE-2026-31912) Division by zero in libpcap before 1.10.7. (CVE-2026-6244) Infinte loop in libpcap before 1.10.7. (CVE-2026-6554) rpcapd memory leak in libpcap before 1.10.7. (CVE-2026-18313) OOBR in rpcap client in libpcap before 1.10.7. (CVE-2026-18238) References

• https://bugs.mageia.org/show_bug.cgi?id=36286
• https://www.openwall.com/lists/oss-security/2026/09/09/2
• https://www.cve.org/CVERecord?id=CVE-2026-0799
• https://www.cve.org/CVERecord?id=CVE-2026-31911
• https://www.cve.org/CVERecord?id=CVE-2026-31912
• https://www.cve.org/CVERecord?id=CVE-2026-6244
• https://www.cve.org/CVERecord?id=CVE-2026-6554
• https://www.cve.org/CVERecord?id=CVE-2026-18313
• https://www.cve.org/CVERecord?id=CVE-2026-18238

SRPMS 10/core

• libpcap-1.10.7-1.mga10

9/core

• libpcap-1.10.7-1.mga9

Publication date: 18 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2025-55154 Description
Integer overflows in MNG magnification. (CVE-2025-55154) References

• https://bugs.mageia.org/show_bug.cgi?id=36290
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UOLRN3FZUDRWOSHYEWPEZNVV7735CFHF/
• https://www.cve.org/CVERecord?id=CVE-2025-55154

SRPMS 10/tainted

• graphicsmagick-1.3.46-5.2.mga10.tainted

9/tainted

• graphicsmagick-1.3.40-1.8.mga9.tainted

Publication date: 17 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-86420 , CVE-2026-86421 , CVE-2026-86423 , CVE-2026-86424 , CVE-2026-86425 Description
Heap-use-after-free in Layer method of PerlMagick could result in a crash Path Policy TOCTOU symlink race bypass in the video decoder Heap-use-after-free in the GetList method of PerlMagick could result in a crash Memory Leak in MSL decoder Denial of service when exhausting the process memory budget Policy Bypass in UHDR encoder Division by Zero in FLIF encoder Null Pointer Dereference in PNM coder when hitting a memory limit Policy Bypass in PCD, CUBE and HALD decoder when using a specific command line option. Use after free in ImagesToBlob method References

• https://bugs.mageia.org/show_bug.cgi?id=36167
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-chf5-8rv9-gjqr
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9x6f-98x9-rx6g
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5m9j-96ff-j6qc
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-92rw-c5mw-27v4
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67
• https://www.cve.org/CVERecord?id=CVE-2026-86420
• https://www.cve.org/CVERecord?id=CVE-2026-86421
• https://www.cve.org/CVERecord?id=CVE-2026-86423
• https://www.cve.org/CVERecord?id=CVE-2026-86424
• https://www.cve.org/CVERecord?id=CVE-2026-86425

SRPMS 10/core

• imagemagick-7.1.2.31-1.mga10

10/tainted

• imagemagick-7.1.2.31-1.mga10.tainted

Publication date: 17 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48817 , CVE-2026-54282 , CVE-2026-54283 Description
Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`. (CVE-2026-48817) Unvalidated request path concatenated into authority poisons request.url.hostname. (CVE-2026-54282) References

• https://bugs.mageia.org/show_bug.cgi?id=36224
• https://lists.debian.org/debian-security-announce/2026/msg00389.html
• https://www.cve.org/CVERecord?id=CVE-2026-48817
• https://www.cve.org/CVERecord?id=CVE-2026-54282
• https://www.cve.org/CVERecord?id=CVE-2026-54283

SRPMS 10/core

• python-starlette-0.46.0-3.2.mga10

Publication date: 16 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-9672 Description
A vulnerability was discovered in libgd2, a library for programmatic graphics creation and manipulation, which may result in denial of service or potentially the execution of arbitrary code if a malformed GIF file is processed. References

• https://bugs.mageia.org/show_bug.cgi?id=36162
• https://lists.debian.org/debian-security-announce/2026/msg00320.html?pow_referer=https%3A%2F%2Fbugs.mageia.org%2F
• https://www.cve.org/CVERecord?id=CVE-2026-9672

SRPMS 10/core

• libgd-2.3.3-11.1.mga10

9/core

• libgd-2.3.3-6.1.mga9

Publication date: 16 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-10294 Description
PackageKit API pk-transaction.c g_file_test improper authorization. (CVE-2026-10294) References

• https://bugs.mageia.org/show_bug.cgi?id=36166
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/M6KYMZZSTVVP7SBKMB54MNOK7HGHQQN4/
• https://github.com/PackageKit/PackageKit/issues/969
• https://www.cve.org/CVERecord?id=CVE-2026-10294

SRPMS 10/core

• packagekit-1.3.5-1.1.mga10

9/core

• packagekit-1.2.6-2.2.mga9

Publication date: 16 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56208 , CVE-2026-56209 , CVE-2026-56210 , CVE-2026-56211 Description
Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. (CVE-2026-56208) Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. (CVE-2026-56209) Heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id. (CVE-2026-56210) Remote code execution via svc layer context handling with attacker-controlled frames. (CVE-2026-56211) References

• https://bugs.mageia.org/show_bug.cgi?id=36170
• https://lists.debian.org/debian-security-announce/2026/msg00322.html
• https://www.cve.org/CVERecord?id=CVE-2026-56208
• https://www.cve.org/CVERecord?id=CVE-2026-56209
• https://www.cve.org/CVERecord?id=CVE-2026-56210
• https://www.cve.org/CVERecord?id=CVE-2026-56211

SRPMS 10/core

• aom-3.13.1-1.1.mga10

9/core

• aom-3.6.0-1.2.mga9

Publication date: 16 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-71554 Description
Duplicate Host header facilitate request smuggling. (CVE-2026-71554) References

• https://bugs.mageia.org/show_bug.cgi?id=36188
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/IDTJHCXCD2JELR2ZHWETBBYC3OYTW7QH/
• https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg
• https://www.cve.org/CVERecord?id=CVE-2026-71554

SRPMS 10/core

• python-h2-4.3.0-1.1.mga10

9/core

• python-h2-4.1.0-2.1.mga9

Publication date: 16 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-76235 Description
Cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html. (CVE-2026-76235) References

• https://bugs.mageia.org/show_bug.cgi?id=36207
• https://lists.debian.org/debian-security-announce/2026/msg00385.html
• https://bugzilla.redhat.com/show_bug.cgi?id=2519497
• https://github.com/cockpit-project/cockpit/pull/23633
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KV2ED2IAJAGOAIPNS3HQS7G4KHJANP3C/
• https://www.cve.org/CVERecord?id=CVE-2026-76235

SRPMS 10/core

• cockpit-356.2-1.1.mga10

9/core

• cockpit-356.2-1.1.mga9