Lector de Feeds

Publication date: 31 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-6464 , CVE-2026-6469 , CVE-2026-6470 , CVE-2026-6471 , CVE-2026-14662 , CVE-2026-14663 , CVE-2026-14664 , CVE-2026-14666 , CVE-2026-14668 , CVE-2026-14669 , CVE-2026-14670 , CVE-2026-14671 , CVE-2026-14672 , CVE-2026-14673 , CVE-2026-14676 , CVE-2026-14677 , CVE-2026-14678 , CVE-2026-14679 , CVE-2026-14680 , CVE-2026-14681 , CVE-2026-15741 , CVE-2026-15742 , CVE-2026-16238 , CVE-2026-16239 , CVE-2026-16241 , CVE-2026-18024 , CVE-2026-18408 , CVE-2026-19385 Description
psql COPY FROM STDIN early failure processes data lines as psql commands. (CVE-2026-6464) ALTER TABLE ALTER TYPE resets extended statistics ownership. (CVE-2026-6469) Fails to check type USAGE privilege. (CVE-2026-6470) Logical decoding can dlopen arbitrary file. (CVE-2026-6471) tsvector and tsquery undersize allocations, via integer wraparound. (CVE-2026-14662) pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext. (CVE-2026-14663) Regexp heap buffer overflow executes arbitrary code. (CVE-2026-14664) Row security caching disregards role modifications. (CVE-2026-14666) ctid type confusion in selectivity estimator discloses derivative of arbitrary read. (CVE-2026-14668) to_char heap buffer overflow executes arbitrary code. (CVE-2026-14669) plperl tied object heap buffer overflow executes arbitrary code. (CVE-2026-14670) refint plan cache type confusion executes arbitrary code. (CVE-2026-14671) Observable response discrepancy with non-default scram_iterations provides user existence oracle. (CVE-2026-14672) amcheck does not clear untrusted search path. (CVE-2026-14673) pg_stat_statements heap buffer overflow executes arbitrary code. (CVE-2026-14676) 32-bit pltcl and plperl undersize allocations, via integer wraparound. (CVE-2026-14677) pg_trgm picksplit reads past end of buffer. (CVE-2026-14678) Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory. (CVE-2026-14679) Type confusion via "internal" arguments. (CVE-2026-14680) Improper enforcement of GSSAPI encryption when coupled with SSL. (CVE-2026-14681) Expression deparse allows SQL injection via EXTRACT argument. (CVE-2026-15741) fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound. (CVE-2026-15742) Type confusion in pg_restore_attribute_stats() executes arbitrary code. (CVE-2026-16238) Type confusion in cursor CLOSE + DECLARE executes arbitrary code. (CVE-2026-16239) ECPG integer underflow can crash the client. (CVE-2026-16241) ascii() function reads past end of buffer. (CVE-2026-18024) psql unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client. (CVE-2026-18408) pg_dump heap buffer overflow executes arbitrary code. (CVE-2026-19385) References

• https://bugs.mageia.org/show_bug.cgi?id=36165
• https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/
• https://www.cve.org/CVERecord?id=CVE-2026-6464
• https://www.cve.org/CVERecord?id=CVE-2026-6469
• https://www.cve.org/CVERecord?id=CVE-2026-6470
• https://www.cve.org/CVERecord?id=CVE-2026-6471
• https://www.cve.org/CVERecord?id=CVE-2026-14662
• https://www.cve.org/CVERecord?id=CVE-2026-14663
• https://www.cve.org/CVERecord?id=CVE-2026-14664
• https://www.cve.org/CVERecord?id=CVE-2026-14666
• https://www.cve.org/CVERecord?id=CVE-2026-14668
• https://www.cve.org/CVERecord?id=CVE-2026-14669
• https://www.cve.org/CVERecord?id=CVE-2026-14670
• https://www.cve.org/CVERecord?id=CVE-2026-14671
• https://www.cve.org/CVERecord?id=CVE-2026-14672
• https://www.cve.org/CVERecord?id=CVE-2026-14673
• https://www.cve.org/CVERecord?id=CVE-2026-14676
• https://www.cve.org/CVERecord?id=CVE-2026-14677
• https://www.cve.org/CVERecord?id=CVE-2026-14678
• https://www.cve.org/CVERecord?id=CVE-2026-14679
• https://www.cve.org/CVERecord?id=CVE-2026-14680
• https://www.cve.org/CVERecord?id=CVE-2026-14681
• https://www.cve.org/CVERecord?id=CVE-2026-15741
• https://www.cve.org/CVERecord?id=CVE-2026-15742
• https://www.cve.org/CVERecord?id=CVE-2026-16238
• https://www.cve.org/CVERecord?id=CVE-2026-16239
• https://www.cve.org/CVERecord?id=CVE-2026-16241
• https://www.cve.org/CVERecord?id=CVE-2026-18024
• https://www.cve.org/CVERecord?id=CVE-2026-18408
• https://www.cve.org/CVERecord?id=CVE-2026-19385

SRPMS 10/core

• postgresql18-18.6-1.mga10
• postgresql15-15.19-1.mga10

9/core

• postgresql15-15.19-1.mga9

Publication date: 31 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-74934 , CVE-2026-74935 , CVE-2026-74936 , CVE-2026-74937 , CVE-2026-74938 , CVE-2026-74939 , CVE-2026-74940 , CVE-2026-74941 , CVE-2026-74942 , CVE-2026-74943 , CVE-2026-74944 , CVE-2026-74945 , CVE-2026-74946 , CVE-2026-74947 , CVE-2026-74948 , CVE-2026-74950 , CVE-2026-74953 , CVE-2026-74954 , CVE-2026-74955 , CVE-2026-74956 , CVE-2026-74957 , CVE-2026-74958 , CVE-2026-74959 , CVE-2026-74960 , CVE-2026-74961 , CVE-2026-74962 , CVE-2026-74963 , CVE-2026-74964 , CVE-2026-74965 , CVE-2026-74966 , CVE-2026-74967 , CVE-2026-74968 , CVE-2026-74969 , CVE-2026-74970 , CVE-2026-74971 , CVE-2026-74972 , CVE-2026-74949 , CVE-2026-74973 , CVE-2026-74974 , CVE-2026-74976 , CVE-2026-74977 , CVE-2026-74978 , CVE-2026-74979 , CVE-2026-74981 , CVE-2026-74982 , CVE-2026-74983 , CVE-2026-74984 , CVE-2026-74985 , CVE-2026-74986 , CVE-2026-74987 , CVE-2026-74988 , CVE-2026-74990 Description
Site isolation issue in the Graphics: CanvasWebGL component. (CVE-2026-74934) Privilege escalation in the DOM: Networking component. (CVE-2026-74935) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-74936) Use-after-free in the JavaScript: GC component. (CVE-2026-74937) Mitigation bypass in the JavaScript: GC component. (CVE-2026-74938) Privilege escalation in the DOM: Navigation component. (CVE-2026-74939) Use-after-free in the Graphics: Text component. (CVE-2026-74940) Privilege escalation in the Graphics: CanvasWebGL component. (CVE-2026-74941) Privilege escalation in the Remote Settings Client component. (CVE-2026-74942) Use-after-free in the Graphics: ImageLib component. (CVE-2026-74943) Use-after-free in the DOM: Core & HTML component. (CVE-2026-74944) Information disclosure in the Graphics: Text component. (CVE-2026-74945) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-74946) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-74947) Information disclosure in the Graphics component. (CVE-2026-74948) Privilege escalation in the Downloads API component. (CVE-2026-74950) Privilege escalation in the Networking: Cookies component. (CVE-2026-74953) Information disclosure due to side-channel in the Storage: Cache API component. (CVE-2026-74954) Privilege escalation in the Request Handling component. (CVE-2026-74955) Same-origin policy bypass in the DOM: Service Workers component. (CVE-2026-74956) Mitigation bypass in the Safe Browsing component. (CVE-2026-74957) Information disclosure in the WebRTC component. (CVE-2026-74958) Mitigation bypass in the Storage: Cache API component. (CVE-2026-74959) Site isolation issue in the WebExtensions component. (CVE-2026-74960) Side-channel in the Web Audio component. (CVE-2026-74961) Site isolation issue in the Networking: Cookies component. (CVE-2026-74962) Same-origin policy bypass in the Networking: Cookies component. (CVE-2026-74963) Integer overflow in the Graphics component. (CVE-2026-74964) Privilege escalation in the Shell Integration component. (CVE-2026-74965) Information disclosure in the Form Autofill component. (CVE-2026-74966) Same-origin policy bypass in the Audio/Video: Playback component. (CVE-2026-74967) Site isolation issue in the Graphics: WebRender component. (CVE-2026-74968) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-74969) Site isolation issue in the Graphics component. (CVE-2026-74970) Information disclosure in the DOM: UI Events & Focus Handling component. (CVE-2026-74971) Information disclosure in the DOM: Push Subscriptions component. (CVE-2026-74972) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-74949) Race condition, use-after-free in the Graphics component. (CVE-2026-74973) Same-origin policy bypass in the Graphics: ImageLib component. (CVE-2026-74974) JIT miscompilation in the JavaScript Engine: JIT component. (CVE-2026-74976) Integer overflow in the Graphics component. (CVE-2026-74977) Clickjacking issue in the Widget component. (CVE-2026-74978) Mitigation bypass in the Add-ons Manager component. (CVE-2026-74979) Site isolation issue in the Audio/Video: Web Codecs component. (CVE-2026-74981) Denial-of-service in the Widget component. (CVE-2026-74982) Mitigation bypass in the Data Loss Prevention component. (CVE-2026-74983) Race condition in the JavaScript Engine component. (CVE-2026-74984) Privilege escalation in the Enterprise Policies component. (CVE-2026-74985) Site isolation issue in the CSS Parsing and Computation component. (CVE-2026-74986) Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154. (CVE-2026-74987) Internally found bugs fixed in Thunderbird ESR 153.1 and Thunderbird 154 (CVE-2026-74988) Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154. (CVE-2026-74990) References

• https://bugs.mageia.org/show_bug.cgi?id=36124
• https://www.thunderbird.net/en-US/thunderbird/140.14.0esr/releasenotes/
• https://www.thunderbird.net/en-US/thunderbird/153.1.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-79/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-80/
• https://www.cve.org/CVERecord?id=CVE-2026-74934
• https://www.cve.org/CVERecord?id=CVE-2026-74935
• https://www.cve.org/CVERecord?id=CVE-2026-74936
• https://www.cve.org/CVERecord?id=CVE-2026-74937
• https://www.cve.org/CVERecord?id=CVE-2026-74938
• https://www.cve.org/CVERecord?id=CVE-2026-74939
• https://www.cve.org/CVERecord?id=CVE-2026-74940
• https://www.cve.org/CVERecord?id=CVE-2026-74941
• https://www.cve.org/CVERecord?id=CVE-2026-74942
• https://www.cve.org/CVERecord?id=CVE-2026-74943
• https://www.cve.org/CVERecord?id=CVE-2026-74944
• https://www.cve.org/CVERecord?id=CVE-2026-74945
• https://www.cve.org/CVERecord?id=CVE-2026-74946
• https://www.cve.org/CVERecord?id=CVE-2026-74947
• https://www.cve.org/CVERecord?id=CVE-2026-74948
• https://www.cve.org/CVERecord?id=CVE-2026-74950
• https://www.cve.org/CVERecord?id=CVE-2026-74953
• https://www.cve.org/CVERecord?id=CVE-2026-74954
• https://www.cve.org/CVERecord?id=CVE-2026-74955
• https://www.cve.org/CVERecord?id=CVE-2026-74956
• https://www.cve.org/CVERecord?id=CVE-2026-74957
• https://www.cve.org/CVERecord?id=CVE-2026-74958
• https://www.cve.org/CVERecord?id=CVE-2026-74959
• https://www.cve.org/CVERecord?id=CVE-2026-74960
• https://www.cve.org/CVERecord?id=CVE-2026-74961
• https://www.cve.org/CVERecord?id=CVE-2026-74962
• https://www.cve.org/CVERecord?id=CVE-2026-74963
• https://www.cve.org/CVERecord?id=CVE-2026-74964
• https://www.cve.org/CVERecord?id=CVE-2026-74965
• https://www.cve.org/CVERecord?id=CVE-2026-74966
• https://www.cve.org/CVERecord?id=CVE-2026-74967
• https://www.cve.org/CVERecord?id=CVE-2026-74968
• https://www.cve.org/CVERecord?id=CVE-2026-74969
• https://www.cve.org/CVERecord?id=CVE-2026-74970
• https://www.cve.org/CVERecord?id=CVE-2026-74971
• https://www.cve.org/CVERecord?id=CVE-2026-74972
• https://www.cve.org/CVERecord?id=CVE-2026-74949
• https://www.cve.org/CVERecord?id=CVE-2026-74973
• https://www.cve.org/CVERecord?id=CVE-2026-74974
• https://www.cve.org/CVERecord?id=CVE-2026-74976
• https://www.cve.org/CVERecord?id=CVE-2026-74977
• https://www.cve.org/CVERecord?id=CVE-2026-74978
• https://www.cve.org/CVERecord?id=CVE-2026-74979
• https://www.cve.org/CVERecord?id=CVE-2026-74981
• https://www.cve.org/CVERecord?id=CVE-2026-74982
• https://www.cve.org/CVERecord?id=CVE-2026-74983
• https://www.cve.org/CVERecord?id=CVE-2026-74984
• https://www.cve.org/CVERecord?id=CVE-2026-74985
• https://www.cve.org/CVERecord?id=CVE-2026-74986
• https://www.cve.org/CVERecord?id=CVE-2026-74987
• https://www.cve.org/CVERecord?id=CVE-2026-74988
• https://www.cve.org/CVERecord?id=CVE-2026-74990

SRPMS 10/core

• thunderbird-153.1.0-1.mga10
• thunderbird-l10n-153.1.0-1.mga10

9/core

• thunderbird-140.14.0-1.mga9
• thunderbird-l10n-140.14.0-1.mga9

Publication date: 31 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-74934 , CVE-2026-74935 , CVE-2026-74936 , CVE-2026-74937 , CVE-2026-74938 , CVE-2026-74939 , CVE-2026-74940 , CVE-2026-74941 , CVE-2026-74942 , CVE-2026-74943 , CVE-2026-74944 , CVE-2026-74945 , CVE-2026-74946 , CVE-2026-74947 , CVE-2026-74948 , CVE-2026-74950 , CVE-2026-74953 , CVE-2026-74954 , CVE-2026-74955 , CVE-2026-74956 , CVE-2026-74957 , CVE-2026-74958 , CVE-2026-74959 , CVE-2026-74960 , CVE-2026-74961 , CVE-2026-74962 , CVE-2026-74963 , CVE-2026-74964 , CVE-2026-74965 , CVE-2026-74966 , CVE-2026-74967 , CVE-2026-74968 , CVE-2026-74969 , CVE-2026-74970 , CVE-2026-74971 , CVE-2026-74972 , CVE-2026-74949 , CVE-2026-74973 , CVE-2026-74974 , CVE-2026-74976 , CVE-2026-74977 , CVE-2026-74978 , CVE-2026-74979 , CVE-2026-74981 , CVE-2026-74982 , CVE-2026-74983 , CVE-2026-74984 , CVE-2026-74985 , CVE-2026-74986 , CVE-2026-74987 , CVE-2026-74988 , CVE-2026-74990 Description
Site isolation issue in the Graphics: CanvasWebGL component. (CVE-2026-74934) Privilege escalation in the DOM: Networking component. (CVE-2026-74935) Use-after-free in the JavaScript: WebAssembly component. (CVE-2026-74936) Use-after-free in the JavaScript: GC component. (CVE-2026-74937) Mitigation bypass in the JavaScript: GC component. (CVE-2026-74938) Privilege escalation in the DOM: Navigation component. (CVE-2026-74939) Use-after-free in the Graphics: Text component. (CVE-2026-74940) Privilege escalation in the Graphics: CanvasWebGL component. (CVE-2026-74941) Privilege escalation in the Remote Settings Client component. (CVE-2026-74942) Use-after-free in the Graphics: ImageLib component. (CVE-2026-74943) Use-after-free in the DOM: Core & HTML component. (CVE-2026-74944) Information disclosure in the Graphics: Text component. (CVE-2026-74945) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-74946) Privilege escalation due to invalid pointer in the Graphics component. (CVE-2026-74947) Information disclosure in the Graphics component. (CVE-2026-74948) Privilege escalation in the Downloads API component. (CVE-2026-74950) Privilege escalation in the Networking: Cookies component. (CVE-2026-74953) Information disclosure due to side-channel in the Storage: Cache API component. (CVE-2026-74954) Privilege escalation in the Request Handling component. (CVE-2026-74955) Same-origin policy bypass in the DOM: Service Workers component. (CVE-2026-74956) Mitigation bypass in the Safe Browsing component. (CVE-2026-74957) Information disclosure in the WebRTC component. (CVE-2026-74958) Mitigation bypass in the Storage: Cache API component. (CVE-2026-74959) Site isolation issue in the WebExtensions component. (CVE-2026-74960) Side-channel in the Web Audio component. (CVE-2026-74961) Site isolation issue in the Networking: Cookies component. (CVE-2026-74962) Same-origin policy bypass in the Networking: Cookies component. (CVE-2026-74963) Integer overflow in the Graphics component. (CVE-2026-74964) Privilege escalation in the Shell Integration component. (CVE-2026-74965) Information disclosure in the Form Autofill component. (CVE-2026-74966) Same-origin policy bypass in the Audio/Video: Playback component. (CVE-2026-74967) Site isolation issue in the Graphics: WebRender component. (CVE-2026-74968) Use-after-free in the Layout: Text and Fonts component. (CVE-2026-74969) Site isolation issue in the Graphics component. (CVE-2026-74970) Information disclosure in the DOM: UI Events & Focus Handling component. (CVE-2026-74971) Information disclosure in the DOM: Push Subscriptions component. (CVE-2026-74972) Use-after-free in the Graphics: Canvas2D component. (CVE-2026-74949) Race condition, use-after-free in the Graphics component. (CVE-2026-74973) Same-origin policy bypass in the Graphics: ImageLib component. (CVE-2026-74974) JIT miscompilation in the JavaScript Engine: JIT component. (CVE-2026-74976) Integer overflow in the Graphics component. (CVE-2026-74977) Clickjacking issue in the Widget component. (CVE-2026-74978) Mitigation bypass in the Add-ons Manager component. (CVE-2026-74979) Site isolation issue in the Audio/Video: Web Codecs component. (CVE-2026-74981) Denial-of-service in the Widget component. (CVE-2026-74982) Mitigation bypass in the Data Loss Prevention component. (CVE-2026-74983) Race condition in the JavaScript Engine component. (CVE-2026-74984) Privilege escalation in the Enterprise Policies component. (CVE-2026-74985) Site isolation issue in the CSS Parsing and Computation component. (CVE-2026-74986) Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154. (CVE-2026-74987) Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154. (CVE-2026-74988) Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154. (CVE-2026-74990) References

• https://bugs.mageia.org/show_bug.cgi?id=36123
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_127.html
• https://github.com/mozilla/nspr/releases/tag/NSPR_4_40_RTM
• https://www.firefox.com/en-US/firefox/140.14.0/releasenotes/
• https://www.firefox.com/en-US/firefox/153.1.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-76/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-77/
• https://www.cve.org/CVERecord?id=CVE-2026-74934
• https://www.cve.org/CVERecord?id=CVE-2026-74935
• https://www.cve.org/CVERecord?id=CVE-2026-74936
• https://www.cve.org/CVERecord?id=CVE-2026-74937
• https://www.cve.org/CVERecord?id=CVE-2026-74938
• https://www.cve.org/CVERecord?id=CVE-2026-74939
• https://www.cve.org/CVERecord?id=CVE-2026-74940
• https://www.cve.org/CVERecord?id=CVE-2026-74941
• https://www.cve.org/CVERecord?id=CVE-2026-74942
• https://www.cve.org/CVERecord?id=CVE-2026-74943
• https://www.cve.org/CVERecord?id=CVE-2026-74944
• https://www.cve.org/CVERecord?id=CVE-2026-74945
• https://www.cve.org/CVERecord?id=CVE-2026-74946
• https://www.cve.org/CVERecord?id=CVE-2026-74947
• https://www.cve.org/CVERecord?id=CVE-2026-74948
• https://www.cve.org/CVERecord?id=CVE-2026-74950
• https://www.cve.org/CVERecord?id=CVE-2026-74953
• https://www.cve.org/CVERecord?id=CVE-2026-74954
• https://www.cve.org/CVERecord?id=CVE-2026-74955
• https://www.cve.org/CVERecord?id=CVE-2026-74956
• https://www.cve.org/CVERecord?id=CVE-2026-74957
• https://www.cve.org/CVERecord?id=CVE-2026-74958
• https://www.cve.org/CVERecord?id=CVE-2026-74959
• https://www.cve.org/CVERecord?id=CVE-2026-74960
• https://www.cve.org/CVERecord?id=CVE-2026-74961
• https://www.cve.org/CVERecord?id=CVE-2026-74962
• https://www.cve.org/CVERecord?id=CVE-2026-74963
• https://www.cve.org/CVERecord?id=CVE-2026-74964
• https://www.cve.org/CVERecord?id=CVE-2026-74965
• https://www.cve.org/CVERecord?id=CVE-2026-74966
• https://www.cve.org/CVERecord?id=CVE-2026-74967
• https://www.cve.org/CVERecord?id=CVE-2026-74968
• https://www.cve.org/CVERecord?id=CVE-2026-74969
• https://www.cve.org/CVERecord?id=CVE-2026-74970
• https://www.cve.org/CVERecord?id=CVE-2026-74971
• https://www.cve.org/CVERecord?id=CVE-2026-74972
• https://www.cve.org/CVERecord?id=CVE-2026-74949
• https://www.cve.org/CVERecord?id=CVE-2026-74973
• https://www.cve.org/CVERecord?id=CVE-2026-74974
• https://www.cve.org/CVERecord?id=CVE-2026-74976
• https://www.cve.org/CVERecord?id=CVE-2026-74977
• https://www.cve.org/CVERecord?id=CVE-2026-74978
• https://www.cve.org/CVERecord?id=CVE-2026-74979
• https://www.cve.org/CVERecord?id=CVE-2026-74981
• https://www.cve.org/CVERecord?id=CVE-2026-74982
• https://www.cve.org/CVERecord?id=CVE-2026-74983
• https://www.cve.org/CVERecord?id=CVE-2026-74984
• https://www.cve.org/CVERecord?id=CVE-2026-74985
• https://www.cve.org/CVERecord?id=CVE-2026-74986
• https://www.cve.org/CVERecord?id=CVE-2026-74987
• https://www.cve.org/CVERecord?id=CVE-2026-74988
• https://www.cve.org/CVERecord?id=CVE-2026-74990

SRPMS 10/core

• nspr-4.40.0-1.mga10
• nss-3.127.0-1.mga10
• firefox-153.1.0-1.mga10
• firefox-l10n-153.1.0-1.mga10

9/core

• nspr-4.40.0-1.mga9
• nss-3.127.0-1.mga9
• firefox-140.14.0-1.mga9
• firefox-l10n-140.14.0-1.mga9

Publication date: 31 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2023-46361 , CVE-2026-38076 Description
Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. (CVE-2023-46361) An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVE-2026-38076) References

• https://bugs.mageia.org/show_bug.cgi?id=35994
• https://ubuntu.com/security/notices/USN-8582-1
• https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/jbig2dec-SEGV/jbig2dec-SEGV.md
• https://bugs.ghostscript.com/show_bug.cgi?id=707308
• https://bugs.ghostscript.com/show_bug.cgi?id=705041
• https://www.cve.org/CVERecord?id=CVE-2023-46361
• https://www.cve.org/CVERecord?id=CVE-2026-38076

SRPMS 10/core

• jbig2dec-0.20-2.1.mga10

9/core

• jbig2dec-0.19-4.1.mga9

Publication date: 31 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-33630 , CVE-2026-69184 , CVE-2026-69186 Description
Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP. (CVE-2026-33630) CPU-exhaustion denial of service via unbounded DNS name compression pointer chains. (CVE-2026-69184) Memory-amplification denial of service via unvalidated DNS header record counts. (CVE-2026-69186) References

• https://bugs.mageia.org/show_bug.cgi?id=35847
• https://www.openwall.com/lists/oss-security/2026/07/06/8
• https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542
• https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76
• https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RP4OX63ZTYCCB4UK6HI4BFEPQEPSNLOJ/
• https://www.cve.org/CVERecord?id=CVE-2026-33630
• https://www.cve.org/CVERecord?id=CVE-2026-69184
• https://www.cve.org/CVERecord?id=CVE-2026-69186

SRPMS 10/core

• c-ares-1.34.8-1.mga10

Publication date: 31 Aug 2026
Type: security
Affected Mageia releases : 10
Description
Updated flatpak package fixes security vulnerabilities. Please see the links for additional information. References

• https://bugs.mageia.org/show_bug.cgi?id=36137
• https://www.openwall.com/lists/oss-security/2026/08/11/9
• https://lists.debian.org/debian-security-announce/2026/msg00343.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT77VPU5W2JAF2LEXVLX6Q33HJJAOLTH/
• https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj
• https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp
• https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
• https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm
• https://github.com/flatpak/flatpak/security/advisories/GHSA-9rww-v4mm-x4jg
• https://github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x
• https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
• https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x
• https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f
• https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5

SRPMS 10/core

• flatpak-1.16.6-1.1.mga10

Publication date: 30 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56865 , CVE-2026-56864 , CVE-2026-56859 , CVE-2026-56853 , CVE-2026-56860 , CVE-2026-46600 , CVE-2026-56862 , CVE-2026-56858 , CVE-2026-39821 , CVE-2026-33818 Description
CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56853 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. Previously, this was being done with no timeout applied. ReadHeaderTimeout is now applied for this. CVE-2026-56860 Previously, resolving relative paths containing parent directory (|..|) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. CVE-2026-4660 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. CVE-2026-56862 Previously, we always counted handshake messages, such as KeyUpdate, as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. CVE-2026-56858 Previously, pathological inputs could close an unescaped |/| early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returned the name "example.com" rather than an error. CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. References

• https://bugs.mageia.org/show_bug.cgi?id=36142
• https://www.openwall.com/lists/oss-security/2026/08/13/13
• https://www.cve.org/CVERecord?id=CVE-2026-56865
• https://www.cve.org/CVERecord?id=CVE-2026-56864
• https://www.cve.org/CVERecord?id=CVE-2026-56859
• https://www.cve.org/CVERecord?id=CVE-2026-56853
• https://www.cve.org/CVERecord?id=CVE-2026-56860
• https://www.cve.org/CVERecord?id=CVE-2026-46600
• https://www.cve.org/CVERecord?id=CVE-2026-56862
• https://www.cve.org/CVERecord?id=CVE-2026-56858
• https://www.cve.org/CVERecord?id=CVE-2026-39821
• https://www.cve.org/CVERecord?id=CVE-2026-33818

SRPMS 10/core

• golang-1.25.13-1.mga10

9/core

• golang-1.25.13-1.mga9

Publication date: 29 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-62383 , CVE-2026-62384 , CVE-2026-62385 , CVE-2026-62388 , CVE-2026-63311 , CVE-2026-63312 , CVE-2026-63315 , CVE-2026-71513 , CVE-2026-71514 , CVE-2026-71518 , CVE-2026-78680 , CVE-2026-78681 , CVE-2026-78682 , CVE-2026-78683 , CVE-2026-79657 , CVE-2026-79674 , CVE-2026-79675 , CVE-2026-79676 Description
Updated packages fix security vulnerabilities. Please see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=36186
• https://github.com/nltk/nltk/releases#release-v3.10.0
• https://github.com/nltk/nltk/releases#release-v3.10.2
• https://github.com/nltk/nltk/releases#release-v3.10.3
• https://www.cve.org/CVERecord?id=CVE-2026-62383
• https://www.cve.org/CVERecord?id=CVE-2026-62384
• https://www.cve.org/CVERecord?id=CVE-2026-62385
• https://www.cve.org/CVERecord?id=CVE-2026-62388
• https://www.cve.org/CVERecord?id=CVE-2026-63311
• https://www.cve.org/CVERecord?id=CVE-2026-63312
• https://www.cve.org/CVERecord?id=CVE-2026-63315
• https://www.cve.org/CVERecord?id=CVE-2026-71513
• https://www.cve.org/CVERecord?id=CVE-2026-71514
• https://www.cve.org/CVERecord?id=CVE-2026-71518
• https://www.cve.org/CVERecord?id=CVE-2026-78680
• https://www.cve.org/CVERecord?id=CVE-2026-78681
• https://www.cve.org/CVERecord?id=CVE-2026-78682
• https://www.cve.org/CVERecord?id=CVE-2026-78683
• https://www.cve.org/CVERecord?id=CVE-2026-79657
• https://www.cve.org/CVERecord?id=CVE-2026-79674
• https://www.cve.org/CVERecord?id=CVE-2026-79675
• https://www.cve.org/CVERecord?id=CVE-2026-79676

SRPMS 10/core

• python-nltk-3.10.3-1.mga10

9/core

• python-nltk-3.10.3-1.mga9