Lector de Feeds

Publication date: 27 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-42533 , CVE-2026-56434 , CVE-2026-60005 Description
CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression. Thanks to Mufeed VH of Winfunc Research and Maxim Dounin. . CVE-2026-60005: Uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination. . CVE-2026-56434: Use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module. Thanks to P4P3R-HAK. References

• https://bugs.mageia.org/show_bug.cgi?id=35973
• https://my.f5.com/manage/s/article/K000162097
• https://my.f5.com/manage/s/article/K000162100
• https://my.f5.com/manage/s/article/K000162098
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LIWPH3EULRVLC6TMLBZYPJ5IKQGVF6C2/
• https://www.cve.org/CVERecord?id=CVE-2026-42533
• https://www.cve.org/CVERecord?id=CVE-2026-56434
• https://www.cve.org/CVERecord?id=CVE-2026-60005

SRPMS 10/core

• nginx-1.30.4-1.mga10

9/core

• nginx-1.30.4-1.mga9

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
purple-telegram-tdlib has been migrated to a new active fork and updated to version 1.1.1. purple-telegram-tdlib updated packages fix an issue where administrators of telegram's groups can't open a chat in the group tdlib has been updated to version 1.8.65, required to build the new version of purple-telegram-tdlib References

• https://bugs.mageia.org/show_bug.cgi?id=36011
• https://github.com/BenWiederhake/tdlib-purple/issues/15
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v1.1.1

SRPMS 10/core

• tdlib-1.8.65-1.git20260613.mga10
• purple-telegram-tdlib-1.1.1-1.mga10

9/core

• tdlib-1.8.65-1.git20260613.mga9
• purple-telegram-tdlib-1.1.1-1.mga9

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
After right clicking on a music file in Dolphin and selecting to open it with Amarok, Amarok failed to load the file. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36001

SRPMS 10/core

• amarok-3.3.3-1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
If purpose wasn't installed, neochat would not start. This update adds the missing dependency on the purpose package. References

• https://bugs.mageia.org/show_bug.cgi?id=35978

SRPMS 10/core

• neochat-25.12.1-1.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The OCRFeeder package wouldn't start since python3.13. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35878

SRPMS 10/core

• ocrfeeder-0.8.5-4.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The byobu package failed to install its desktop menu entry. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35842
• https://svnweb.mageia.org/packages/cauldron/byobu/current/SPECS/byobu.spec?r1=2191646&r2=2344548

SRPMS 10/core

• byobu-6.13-1.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
When doing a command line upgrade from Mageia 9 to Mageia 10, there were conflicts between phonon-vlc-i18n-0.12.0-2.mga10.noarch and phonon4qt5-vlc-0.11.3-2.mga9.x86_64. This Mageia 10 update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35950

SRPMS 10/core

• phonon-vlc-0.12.0-2.1.mga10

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-58469 , CVE-2026-58470 , CVE-2026-58471 , CVE-2026-58472 , CVE-2026-15146 Description
Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget incorrectly handled Content-Range header values, leading to an integer overflow. A remote attacker could possibly use this issue to cause download desynchronization. -CVE-2026-58471 : Wget incorrectly handled character set conversion of server-supplied filenames. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. This issue affected Mageia9 and Mageia 10. -CVE-2026-58472: It was discovered that Wget incorrectly handled HTML attributes requiring entity encoding. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. -CVE-2026-15146: GNU Wget did not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, could exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port. This allowed an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources. References

• https://bugs.mageia.org/show_bug.cgi?id=35974
• https://ubuntu.com/security/notices/USN-8543-1
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MLFETWDGXIX52KIZRAM7CSI5NHATXLCF/
• https://www.cve.org/CVERecord?id=CVE-2026-58469
• https://www.cve.org/CVERecord?id=CVE-2026-58470
• https://www.cve.org/CVERecord?id=CVE-2026-58471
• https://www.cve.org/CVERecord?id=CVE-2026-58472
• https://www.cve.org/CVERecord?id=CVE-2026-15146

SRPMS 10/core

• wget-1.25.0-2.2.mga10

9/core

• wget-1.21.4-1.4.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-53689 Description
The updated packages fix a security vulnerability: libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c. (CVE-2026-53689) References

• https://bugs.mageia.org/show_bug.cgi?id=35753
• https://ubuntu.com/security/notices/USN-8464-1
• https://www.cve.org/CVERecord?id=CVE-2026-53689

SRPMS 10/core

• libnfs-6.0.2-2.1.mga10

9/core

• libnfs-5.0.2-1.1.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-50593 Description
The updated packages fix a security vulnerability: Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593) References

• https://bugs.mageia.org/show_bug.cgi?id=35684
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BJGN36JXOKYV45CXXVFRJEFEWLNO23ZD/
• https://ubuntu.com/security/notices/USN-8444-1
• https://www.cve.org/CVERecord?id=CVE-2026-50593

SRPMS 10/core

• graphite2-1.3.14-4.1.mga10

9/core

• graphite2-1.3.14-2.1.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-34253 Description
The updated package fixes a security vulnerability: A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution. (CVE-2026-34253) References

• https://bugs.mageia.org/show_bug.cgi?id=35627
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QQDC2BQN5WTT7MV425PV3C4SL4HR3JD4/
• https://gitlab.xiph.org/xiph/vorbis-tools/-/work_items/2332
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FQREVQVTSI5B3ALQBRUPJMWUOU724VOS/
• https://www.cve.org/CVERecord?id=CVE-2026-34253

SRPMS 10/core

• vorbis-tools-1.4.3-2.1.mga10

9/core

• vorbis-tools-1.4.2-3.2.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-13601 Description
The updated packages fix a security vulnerability: Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications. (CVE-2026-13601) References

• https://bugs.mageia.org/show_bug.cgi?id=35619
• https://lists.debian.org/debian-security-announce/2026/msg00230.html
• https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/
• https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
• https://www.cve.org/CVERecord?id=CVE-2026-13601

SRPMS 10/core

• yelp-49.0-2.1.mga10

9/core

• yelp-42.2-1.2.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-26740 Description
The updated packages fix a security vulnerability: Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size. (CVE-2026-26740) References

• https://bugs.mageia.org/show_bug.cgi?id=35614
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AG6LRGR6CTYC6R6KKFK2YTY2NJNGE62F/
• https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.md
• https://sourceforge.net/p/giflib/bugs/199/
• https://www.cve.org/CVERecord?id=CVE-2026-26740

SRPMS 10/core

• giflib-5.2.2-4.1.mga10

9/core

• giflib-5.2.1-7.4.mga9

Publication date: 25 Jul 2026
Type: bugfix
Affected Mageia releases : 9
Description
The previous update was released with the use of the shared library libzstd1, which is now at version 1.5.7 in Mageia 9. However, python-zstandard supported only version 1.5.5. This update patches python-zstandard to use libzstd version 1.5.7. References

• https://bugs.mageia.org/show_bug.cgi?id=35946

SRPMS 9/core

• python-zstandard-0.21.0-1.3.mga9

Publication date: 25 Jul 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
The suricata server did not start in Mageia 9 and Mageia 10. The updated suricata packages fix the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35737

SRPMS 10/core

• suricata-7.0.10-3.2.mga10

9/core

• suricata-7.0.10-1.2.mga9

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-63379 , CVE-2026-63381 , CVE-2026-63382 , CVE-2026-63382 , CVE-2026-63383 , CVE-2026-63384 , CVE-2026-63385 , CVE-2026-63387 , CVE-2026-63388 Description
The updated packages fix some security vulnerabilities. References

• https://bugs.mageia.org/show_bug.cgi?id=35801
• https://www.openwall.com/lists/oss-security/2026/07/01/8
• https://www.cve.org/CVERecord?id=CVE-2026-63379
• https://www.cve.org/CVERecord?id=CVE-2026-63381
• https://www.cve.org/CVERecord?id=CVE-2026-63382
• https://www.cve.org/CVERecord?id=CVE-2026-63382
• https://www.cve.org/CVERecord?id=CVE-2026-63383
• https://www.cve.org/CVERecord?id=CVE-2026-63384
• https://www.cve.org/CVERecord?id=CVE-2026-63385
• https://www.cve.org/CVERecord?id=CVE-2026-63387
• https://www.cve.org/CVERecord?id=CVE-2026-63388

SRPMS 10/core

• libevent-2.1.13-1.mga10

9/core

• libevent-2.1.13-1.mga9

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-38978 Description
The updated packages fix a security vulnerability: Transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. (CVE-2026-38978) References

• https://bugs.mageia.org/show_bug.cgi?id=35638
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSYWZMPQ6XPS66NXRF3SE4HICNOOEP64/
• https://github.com/transmission/transmission/issues/8726
• https://www.cve.org/CVERecord?id=CVE-2026-38978

SRPMS 10/core

• transmission-4.1.3-1.mga10

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-15570 , CVE-2025-9396 Description
The updated package fixes security vulnerabilities: ckolivas lrzip stream.c lzma_decompress_buf use after free. (CVE-2025-15570) ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference. (CVE-2025-9396) References

• https://bugs.mageia.org/show_bug.cgi?id=35760
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/JSNIFYQRLND7PULS3ODEDTISSERCMKIQ/
• https://github.com/ckolivas/lrzip/issues/262
• https://github.com/ckolivas/lrzip/issues/264
• https://www.cve.org/CVERecord?id=CVE-2025-15570
• https://www.cve.org/CVERecord?id=CVE-2025-9396

SRPMS 10/core

• lrzip-0.660-1.mga10

Publication date: 24 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
Opening a spec file with emacs on mga10 did no longer provide syntax highlighting. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35713

SRPMS 10/core

• rpm-mageia-setup-2.84-1.mga10

Publication date: 24 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
Updated Xonotic packages to fix broken online statistics support. References

• https://bugs.mageia.org/show_bug.cgi?id=35803

SRPMS 10/core

• xonotic-0.8.6-2.1.mga10