Lector de Feeds

Publication date: 10 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-45676 , CVE-2023-45677 , CVE-2023-45679 , CVE-2023-45680 , CVE-2023-45681 , CVE-2023-45682 , CVE-2025-47256 Description CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit() CVE-2023-45680: Null pointer dereference in vorbis_deinit() CVE-2023-45681: Out of bounds heap buffer write CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder() CVE-2023-45677: Heap buffer out of bounds write in start_decoder() CVE-2023-45682: Wild address read in vorbis_decode_packet_rest() CVE-2025-47256 stack-based buffer overflow in depack_pha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file. References

• https://bugs.mageia.org/show_bug.cgi?id=33915
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVZWMTH36ES7RCJEMRANBDTL76QBE75Z/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKMOFYKVMD2LPU7O33SEH2RGSY2ZE73K/
• https://www.cve.org/CVERecord?id=CVE-2023-45676
• https://www.cve.org/CVERecord?id=CVE-2023-45677
• https://www.cve.org/CVERecord?id=CVE-2023-45679
• https://www.cve.org/CVERecord?id=CVE-2023-45680
• https://www.cve.org/CVERecord?id=CVE-2023-45681
• https://www.cve.org/CVERecord?id=CVE-2023-45682
• https://www.cve.org/CVERecord?id=CVE-2025-47256

SRPMS 9/core

• libxmp-4.5.0-2.1.mga9