Lector de Feeds

Publication date: 07 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-35545 Description SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke And some regressions from the last fix are fixed. References

• https://bugs.mageia.org/show_bug.cgi?id=35302
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.15
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35545

SRPMS 9/core

• roundcubemail-1.6.15-1.mga9

Publication date: 07 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-34352 Description In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions. (CVE-2026-34352) References

• https://bugs.mageia.org/show_bug.cgi?id=35311
• https://www.openwall.com/lists/oss-security/2026/03/26/7
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34352

SRPMS 9/core

• tigervnc-1.13.1-2.10.mga9

Publication date: 06 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-30922 Description pyasn1 Vulnerable to Denial of Service via Unbounded Recursion. (CVE-2026-30922) References

• https://bugs.mageia.org/show_bug.cgi?id=35253
• https://www.openwall.com/lists/oss-security/2026/03/20/4
• https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r
• https://ubuntu.com/security/notices/USN-8129-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30922

SRPMS 9/core

• python-pyasn1-0.4.8-6.2.mga9

Publication date: 06 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-22852 , CVE-2026-22854 , CVE-2026-22855 , CVE-2026-22856 , CVE-2026-22857 , CVE-2026-22859 , CVE-2026-23732 , CVE-2026-23883 , CVE-2026-23884 , CVE-2026-24491 , CVE-2026-26271 , CVE-2026-26955 , CVE-2026-26965 , CVE-2026-31806 , CVE-2026-31883 , CVE-2026-31885 Description FreeRDP has a heap-buffer-overflow in audin_process_formats. (CVE-2026-22852) FreeRDP has a heap-buffer-overflow in drive_process_irp_read. (CVE-2026-22854) FreeRDP has a heap-buffer-overflow in smartcard_unpack_set_attrib_call. (CVE-2026-22855) FreeRDP has a heap-use-after-free in create_irp_thread. (CVE-2026-22856) FreeRDP has a heap-use-after-free in irp_thread_func. (CVE-2026-22857) FreeRDP has a heap-buffer-overflow in urb_select_configuration. (CVE-2026-22859) FreeRDP has heap-buffer-overflow in Glyph_Alloc. (CVE-2026-23732) Heap-use-after-free in update_pointer_new. (CVE-2026-23883) Heap-use-after-free in gdi_set_bounds. (CVE-2026-23884) FreeRDP has a heap-use-after-free in video_timer. (CVE-2026-24491) Buffer Overread in FreeRDP Icon Processing. (CVE-2026-26271) FreeRDP has Out-of-bounds Write. (CVE-2026-26955, CVE-2026-26965) FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions. (CVE-2026-31806) FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write. (CVE-2026-31883) FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks. (CVE-2026-31885) References

• https://bugs.mageia.org/show_bug.cgi?id=35141
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/F2VLQU7USVAQ733RYB7II6KGZB3FG2KW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HAYMD62GFPCFHGN6JPLMCVJHP3SKINMW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3QGQZQS6664TXPPYGBP7673W2JAXG4K/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/34ABPSLQFVRGFKDSR5ZEDKG5UH6KIBCA/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22852
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22854
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22855
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22856
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22857
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22859
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23732
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23883
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23884
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24491
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26271
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26955
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26965
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31806
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31883
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31885

SRPMS 9/core

• freerdp-2.11.7-1.3.mga9

Publication date: 06 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-4897 Description Denial of service via unbounded input processing through standard input. (CVE-2026-4897) References

• https://bugs.mageia.org/show_bug.cgi?id=35303
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOQZ5PSNKYLZPW6FHB2MTGHOYDTRJHLV/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4897

SRPMS 9/core

• polkit-122-2.1.mga9

Publication date: 06 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-34743 Description Buffer overflow in lzma_index_append(). (CVE-2026-34743) References

• https://bugs.mageia.org/show_bug.cgi?id=35307
• https://www.openwall.com/lists/oss-security/2026/03/31/13
• https://tukaani.org/xz/index-append-overflow.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34743

SRPMS 9/core

• xz-5.4.3-1.2.mga9

Publication date: 06 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-34982 , CVE-2026-35177 Description Vim modeline bypass via various options affects Vim < 9.2.0276. (CVE-2026-34982) Path traversal issue with zip.vim in Vim < v9.2.0280. (CVE-2026-35177) References

• https://bugs.mageia.org/show_bug.cgi?id=35308
• https://www.openwall.com/lists/oss-security/2026/03/31/14
• https://www.openwall.com/lists/oss-security/2026/04/01/1
• https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9
• https://www.openwall.com/lists/oss-security/2026/04/01/4
• https://github.com/vim/vim/security/advisories/GHSA-jc86-w7vm-8p24
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34982
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35177

SRPMS 9/core

• vim-9.2.280-1.mga9

Publication date: 06 Apr 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-33230 Description nltk Vulnerable to Cross-site Scripting. (CVE-2026-33230) References

• https://bugs.mageia.org/show_bug.cgi?id=35314
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/Z36Q44HZY76RE7YZX5B55777UQB6MPEI/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33230

SRPMS 9/core

• python-nltk-3.9.4-1.mga9