Lector de Feeds

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10

After right clicking on a music file in Dolphin and selecting to open it with Amarok, Amarok failed to load the file. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36001

SRPMS 10/core

• amarok-3.3.3-1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10

If purpose wasn't installed, neochat would not start. This update adds the missing dependency on the purpose package. References

• https://bugs.mageia.org/show_bug.cgi?id=35978

SRPMS 10/core

• neochat-25.12.1-1.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10

The OCRFeeder package wouldn't start since python3.13. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35878

SRPMS 10/core

• ocrfeeder-0.8.5-4.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10

The byobu package failed to install its desktop menu entry. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35842
• https://svnweb.mageia.org/packages/cauldron/byobu/current/SPECS/byobu.spec?r1=2191646&r2=2344548

SRPMS 10/core

• byobu-6.13-1.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10

When doing a command line upgrade from Mageia 9 to Mageia 10, there were conflicts between phonon-vlc-i18n-0.12.0-2.mga10.noarch and phonon4qt5-vlc-0.11.3-2.mga9.x86_64. This Mageia 10 update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35950

SRPMS 10/core

• phonon-vlc-0.12.0-2.1.mga10

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-58469 , CVE-2026-58470 , CVE-2026-58471 , CVE-2026-58472 , CVE-2026-15146
Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget incorrectly handled Content-Range header values, leading to an integer overflow. A remote attacker could possibly use this issue to cause download desynchronization. -CVE-2026-58471 : Wget incorrectly handled character set conversion of server-supplied filenames. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. This issue affected Mageia9 and Mageia 10. -CVE-2026-58472: It was discovered that Wget incorrectly handled HTML attributes requiring entity encoding. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. -CVE-2026-15146: GNU Wget did not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, could exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port. This allowed an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources. References

• https://bugs.mageia.org/show_bug.cgi?id=35974
• https://ubuntu.com/security/notices/USN-8543-1
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MLFETWDGXIX52KIZRAM7CSI5NHATXLCF/
• https://www.cve.org/CVERecord?id=CVE-2026-58469
• https://www.cve.org/CVERecord?id=CVE-2026-58470
• https://www.cve.org/CVERecord?id=CVE-2026-58471
• https://www.cve.org/CVERecord?id=CVE-2026-58472
• https://www.cve.org/CVERecord?id=CVE-2026-15146

SRPMS 10/core

• wget-1.25.0-2.2.mga10

9/core

• wget-1.21.4-1.4.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-53689
The updated packages fix a security vulnerability: libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c. (CVE-2026-53689) References

• https://bugs.mageia.org/show_bug.cgi?id=35753
• https://ubuntu.com/security/notices/USN-8464-1
• https://www.cve.org/CVERecord?id=CVE-2026-53689

SRPMS 10/core

• libnfs-6.0.2-2.1.mga10

9/core

• libnfs-5.0.2-1.1.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-50593
The updated packages fix a security vulnerability: Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593) References

• https://bugs.mageia.org/show_bug.cgi?id=35684
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BJGN36JXOKYV45CXXVFRJEFEWLNO23ZD/
• https://ubuntu.com/security/notices/USN-8444-1
• https://www.cve.org/CVERecord?id=CVE-2026-50593

SRPMS 10/core

• graphite2-1.3.14-4.1.mga10

9/core

• graphite2-1.3.14-2.1.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-34253
The updated package fixes a security vulnerability: A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution. (CVE-2026-34253) References

• https://bugs.mageia.org/show_bug.cgi?id=35627
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QQDC2BQN5WTT7MV425PV3C4SL4HR3JD4/
• https://gitlab.xiph.org/xiph/vorbis-tools/-/work_items/2332
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FQREVQVTSI5B3ALQBRUPJMWUOU724VOS/
• https://www.cve.org/CVERecord?id=CVE-2026-34253

SRPMS 10/core

• vorbis-tools-1.4.3-2.1.mga10

9/core

• vorbis-tools-1.4.2-3.2.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-13601
The updated packages fix a security vulnerability: Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications. (CVE-2026-13601) References

• https://bugs.mageia.org/show_bug.cgi?id=35619
• https://lists.debian.org/debian-security-announce/2026/msg00230.html
• https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/
• https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
• https://www.cve.org/CVERecord?id=CVE-2026-13601

SRPMS 10/core

• yelp-49.0-2.1.mga10

9/core

• yelp-42.2-1.2.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-26740
The updated packages fix a security vulnerability: Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size. (CVE-2026-26740) References

• https://bugs.mageia.org/show_bug.cgi?id=35614
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AG6LRGR6CTYC6R6KKFK2YTY2NJNGE62F/
• https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.md
• https://sourceforge.net/p/giflib/bugs/199/
• https://www.cve.org/CVERecord?id=CVE-2026-26740

SRPMS 10/core

• giflib-5.2.2-4.1.mga10

9/core

• giflib-5.2.1-7.4.mga9

Publication date: 25 Jul 2026
Type: bugfix
Affected Mageia releases : 9

The previous update was released with the use of the shared library libzstd1, which is now at version 1.5.7 in Mageia 9. However, python-zstandard supported only version 1.5.5. This update patches python-zstandard to use libzstd version 1.5.7. References

• https://bugs.mageia.org/show_bug.cgi?id=35946

SRPMS 9/core

• python-zstandard-0.21.0-1.3.mga9

Publication date: 25 Jul 2026
Type: bugfix
Affected Mageia releases : 10 , 9

The suricata server did not start in Mageia 9 and Mageia 10. The updated suricata packages fix the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35737

SRPMS 10/core

• suricata-7.0.10-3.2.mga10

9/core

• suricata-7.0.10-1.2.mga9

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-63379 , CVE-2026-63381 , CVE-2026-63382 , CVE-2026-63382 , CVE-2026-63383 , CVE-2026-63384 , CVE-2026-63385 , CVE-2026-63387 , CVE-2026-63388
The updated packages fix some security vulnerabilities. References

• https://bugs.mageia.org/show_bug.cgi?id=35801
• https://www.openwall.com/lists/oss-security/2026/07/01/8
• https://www.cve.org/CVERecord?id=CVE-2026-63379
• https://www.cve.org/CVERecord?id=CVE-2026-63381
• https://www.cve.org/CVERecord?id=CVE-2026-63382
• https://www.cve.org/CVERecord?id=CVE-2026-63382
• https://www.cve.org/CVERecord?id=CVE-2026-63383
• https://www.cve.org/CVERecord?id=CVE-2026-63384
• https://www.cve.org/CVERecord?id=CVE-2026-63385
• https://www.cve.org/CVERecord?id=CVE-2026-63387
• https://www.cve.org/CVERecord?id=CVE-2026-63388

SRPMS 10/core

• libevent-2.1.13-1.mga10

9/core

• libevent-2.1.13-1.mga9

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-38978
The updated packages fix a security vulnerability: Transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. (CVE-2026-38978) References

• https://bugs.mageia.org/show_bug.cgi?id=35638
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSYWZMPQ6XPS66NXRF3SE4HICNOOEP64/
• https://github.com/transmission/transmission/issues/8726
• https://www.cve.org/CVERecord?id=CVE-2026-38978

SRPMS 10/core

• transmission-4.1.3-1.mga10

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-15570 , CVE-2025-9396
The updated package fixes security vulnerabilities: ckolivas lrzip stream.c lzma_decompress_buf use after free. (CVE-2025-15570) ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference. (CVE-2025-9396) References

• https://bugs.mageia.org/show_bug.cgi?id=35760
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/JSNIFYQRLND7PULS3ODEDTISSERCMKIQ/
• https://github.com/ckolivas/lrzip/issues/262
• https://github.com/ckolivas/lrzip/issues/264
• https://www.cve.org/CVERecord?id=CVE-2025-15570
• https://www.cve.org/CVERecord?id=CVE-2025-9396

SRPMS 10/core

• lrzip-0.660-1.mga10

Publication date: 24 Jul 2026
Type: bugfix
Affected Mageia releases : 10

Opening a spec file with emacs on mga10 did no longer provide syntax highlighting. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35713

SRPMS 10/core

• rpm-mageia-setup-2.84-1.mga10

Publication date: 24 Jul 2026
Type: bugfix
Affected Mageia releases : 10

Updated Xonotic packages to fix broken online statistics support. References

• https://bugs.mageia.org/show_bug.cgi?id=35803

SRPMS 10/core

• xonotic-0.8.6-2.1.mga10

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-12505
The updated packages fix a security vulnerability: Local privilege escalation via forged cifs.spnego key description in cifs.upcall. (CVE-2026-12505) References

• https://bugs.mageia.org/show_bug.cgi?id=35813
• https://ubuntu.com/security/notices/USN-8496-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2489805
• https://ubuntu.com/security/notices/USN-8496-2
• https://ubuntu.com/security/notices/USN-8496-3
• https://www.cve.org/CVERecord?id=CVE-2026-12505

SRPMS 10/core

• cifs-utils-7.5-1.1.mga10

9/core

• cifs-utils-7.0-1.2.mga9

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56123
The updated package fixes a security vulnerability: Heap Buffer Overflow via SOCKS5 Reply Parser. (CVE-2026-56123) References

• https://bugs.mageia.org/show_bug.cgi?id=35794
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/F6FLUO6FYZ6TSE43PLY7QJGUX4N2JXWW/
• https://ubuntu.com/security/notices/USN-8511-1
• https://www.cve.org/CVERecord?id=CVE-2026-56123

SRPMS 10/core

• socat-1.8.1.0-1.1.mga10

9/core

• socat-1.8.0.2-1.1.mga9