Lector de Feeds

Publication date: 01 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55380 , CVE-2026-54060 , CVE-2026-54059 , CVE-2026-55379 , CVE-2026-59205 , CVE-2026-59199 , CVE-2026-59197 , CVE-2026-59198 , CVE-2026-54058 , CVE-2026-59204 , CVE-2026-59203 Description
Prevent decompression bomb when parsing PDF WindowsViewer.get_command injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds (OOB) read Out-of-bounds (OOB) read when saving 1 mode TGA images Out-of-bounds (OOB) write from large RankFilter sizes Out-of-bounds (OOB) write from Image.paste() Out-of-bounds (OOB) write in ImageCmsTransform Prevent FontFile decompression bomb Prevent GD decompression bomb References

• https://bugs.mageia.org/show_bug.cgi?id=35909
• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
• https://www.cve.org/CVERecord?id=CVE-2026-55380
• https://www.cve.org/CVERecord?id=CVE-2026-54060
• https://www.cve.org/CVERecord?id=CVE-2026-54059
• https://www.cve.org/CVERecord?id=CVE-2026-55379
• https://www.cve.org/CVERecord?id=CVE-2026-59205
• https://www.cve.org/CVERecord?id=CVE-2026-59199
• https://www.cve.org/CVERecord?id=CVE-2026-59197
• https://www.cve.org/CVERecord?id=CVE-2026-59198
• https://www.cve.org/CVERecord?id=CVE-2026-54058
• https://www.cve.org/CVERecord?id=CVE-2026-59204
• https://www.cve.org/CVERecord?id=CVE-2026-59203

SRPMS 10/core

• python-pillow-12.3.0-1.mga10

Publication date: 01 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
glabels can't open previously-created glabels files. We have added a patch to fix the issue but the project is dead upstream and its developer is now focussing on glabels-qt. We are releasing glabels-qt as an alternative. Both versions fix the reported issue; it is your decision what tool to use. References

• https://bugs.mageia.org/show_bug.cgi?id=36053
• https://github.com/j-evins/glabels-qt

SRPMS 10/core

• glabels-3.4.1-12.1.mga10
• glabels-qt-3.99-0.2.2026.08.27git554c9f0.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Borgbackup uses the msgpack python module, and it includes a stopping check for exactly the version 1.2.1. It also recognises an option to disable this check. The updated package shunts this check, which seems overzealous. References

• https://bugs.mageia.org/show_bug.cgi?id=36364

SRPMS 10/core

• borgbackup-1.4.5-1.1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Due to a missing requirement on zstd, engrampa can't open zst files. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36387

SRPMS 10/core

• engrampa-1.28.5-1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
LXDM is only installed by task-lxde. If you only install task-lxde-minimal, then you miss LXDM and you only have XDM which doesn't let you select your desktop environment. This update fixes the reported issue, moving the requirement on LXDM to the task-lxde-minimal package. References

• https://bugs.mageia.org/show_bug.cgi?id=36390

SRPMS 10/core

• task-lxde-10-2.1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Previously setting a dark theme is not respected after a system reboot. This update fixes the issue by updating whatsie to the 6.1.1 version. References

• https://bugs.mageia.org/show_bug.cgi?id=35397
• https://github.com/keshavbhatt/whatsie/issues/299
• https://github.com/keshavbhatt/whatsie/releases/tag/v6.1.1
• https://github.com/keshavbhatt/whatsie/releases#release-v6.1.0
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.4
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.3
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.1
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.0

SRPMS 10/core

• whatsie-6.1.1-1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
urpm-ng is a reimplementation of the urpmi toolset, written in Python on top of libsolv. It installs, upgrades, removes and queries packages, and resolves dependencies automatically. This packages introduces urpm-ng in Mageia 9 and 10 to allow early testers do migrations from Mageia 9 to Mageia 10 with the package manager component without add external repositories. We do not recommend it yet for inexperienced users. References

• https://bugs.mageia.org/show_bug.cgi?id=36393

SRPMS 10/core

• urpm-ng-0.9.14-1.mga10

9/core

• urpm-ng-0.9.14-1.mga9

Publication date: 29 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-52791 , CVE-2026-77478 Description
fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478) References

• https://bugs.mageia.org/show_bug.cgi?id=36164
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OHDCW47LEOQXLVH2XJNC3A7VFVELJQ6U/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YO4BSFYJPI6ZGUIXZ3AHYYYFEYEM4MFO/
• https://github.com/containers/fuse-overlayfs/releases/tag/v1.17
• https://github.com/containers/fuse-overlayfs/releases/tag/v1.18
• https://www.cve.org/CVERecord?id=CVE-2026-52791
• https://www.cve.org/CVERecord?id=CVE-2026-77478

SRPMS 10/core

• fuse-overlayfs-1.18-1.mga10

Publication date: 29 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
The tool has changed developers and has been migrated to Qt6. The update fixes bugs in our current release including but not limited to a bug where, in some conditions, the GUI does not start. References

• https://bugs.mageia.org/show_bug.cgi?id=31980
• https://github.com/Boomaga/boomaga/releases#release-v3.9.2
• https://github.com/Boomaga/boomaga/releases#release-v3.9.1
• https://github.com/Boomaga/boomaga/releases#release-v3.9.0
• https://github.com/Boomaga/boomaga/releases#release-v3.8.1
• https://github.com/Boomaga/boomaga/releases#release-v3.7.0
• https://github.com/Boomaga/boomaga/releases#release-v3.6.0
• https://github.com/Boomaga/boomaga/releases#release-v3.5.0
• https://github.com/Boomaga/boomaga/issues/143

SRPMS 10/core

• boomaga-3.9.2-1.mga10

9/core

• boomaga-3.9.2-1.mga9

Publication date: 28 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-54411 Description
The updated packages fix a security vulnerability: Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison. (CVE-2026-54411) References

• https://bugs.mageia.org/show_bug.cgi?id=35881
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5OKVWSDQUM4BD3D4IPRSS2LJPLO2SRH/
• https://ubuntu.com/security/notices/USN-8601-1
• https://www.cve.org/CVERecord?id=CVE-2026-54411

SRPMS 10/core

• pam-1.7.1-2.1.mga10

Publication date: 28 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-13757 , CVE-2026-18938 Description
The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. (CVE-2026-13757) Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. (CVE-2026-18938) References

• https://bugs.mageia.org/show_bug.cgi?id=35906
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q6TQ5QWOGE7ZBPZGVINQXHGKAYSV4IMF/
• https://bugzilla.redhat.com/show_bug.cgi?id=2494556
• https://github.com/p11-glue/p11-kit/issues/767
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD5OWYEURQQ756QI27UWHAMDLD5B6WGZ/
• https://www.cve.org/CVERecord?id=CVE-2026-13757
• https://www.cve.org/CVERecord?id=CVE-2026-18938

SRPMS 10/core

• p11-kit-0.25.10-1.1.mga10

Publication date: 28 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-11979 , CVE-2026-86137 , CVE-2026-86138 , CVE-2026-86139 , CVE-2026-86140 , CVE-2026-86141 , CVE-2026-86142 , CVE-2026-86143 , CVE-2026-86144 Description
The updated packages fix several security issues: Stack-Based Buffer Overflow in libxml2. (CVE-2026-11979) In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. (CVE-2026-86137) In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. (CVE-2026-86138) In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. (CVE-2026-86139) In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. (CVE-2026-86140) xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141) In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. (CVE-2026-86142) In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. (CVE-2026-86143) In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). (CVE-2026-86144) References

• https://bugs.mageia.org/show_bug.cgi?id=35932
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZWJ6JIPH33FSDSBTGTTXHQQKFJEXIKRU/
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
• https://www.openwall.com/lists/oss-security/2026/09/04/5
• https://www.openwall.com/lists/oss-security/2026/09/05/4
• https://www.cve.org/CVERecord?id=CVE-2026-11979
• https://www.cve.org/CVERecord?id=CVE-2026-86137
• https://www.cve.org/CVERecord?id=CVE-2026-86138
• https://www.cve.org/CVERecord?id=CVE-2026-86139
• https://www.cve.org/CVERecord?id=CVE-2026-86140
• https://www.cve.org/CVERecord?id=CVE-2026-86141
• https://www.cve.org/CVERecord?id=CVE-2026-86142
• https://www.cve.org/CVERecord?id=CVE-2026-86143
• https://www.cve.org/CVERecord?id=CVE-2026-86144

SRPMS 10/core

• libxml2-2.15.1-3.2.mga10