Lector de Feeds

Publication date: 17 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-93687 Description
It was discovered that braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards (CVE-2026-93687). References

• https://bugs.mageia.org/show_bug.cgi?id=36464
• https://github.com/micromatch/braces/issues/70
• https://www.cve.org/CVERecord?id=CVE-2026-93687
• https://www.cve.org/CVERecord?id=CVE-2026-93687

SRPMS 10/core

• nodejs-braces-3.0.3-1.mga10

Publication date: 17 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-107570 Description
When an email is processed as a template, an out-of-bounds write vulnerability in the convert_file_from_to () function can be triggered by a specially crafted Content-Type header (CVE-2026-107570). References

• https://bugs.mageia.org/show_bug.cgi?id=36502
• https://www.openwall.com/lists/oss-security/2026/10/09/21
• https://www.cve.org/CVERecord?id=CVE-2026-107570

SRPMS 10/core

• mutt-2.4.3-1.mga10

Publication date: 17 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-70103 Description
Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. (CVE-2025-70103) References

• https://bugs.mageia.org/show_bug.cgi?id=35656
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TDJLG2FVXLDZ2YCBFB5L3YEGWD2YVZ47/
• https://www.cve.org/CVERecord?id=CVE-2025-70103

SRPMS 10/core

• mozjs140-140.17.0-1.mga10

Publication date: 17 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-13608 , CVE-2026-18924 , CVE-2026-19931 , CVE-2026-80229 , CVE-2026-80230 , CVE-2026-80231 , CVE-2026-80255 , CVE-2026-80256 , CVE-2026-82208 , CVE-2026-82209 , CVE-2026-86409 , CVE-2026-86410 , CVE-2026-86411 , CVE-2026-86412 , CVE-2026-86413 , CVE-2026-86414 , CVE-2026-86415 , CVE-2026-87861 , CVE-2026-87862 , CVE-2026-87863 , CVE-2026-87864 , CVE-2026-92386 , CVE-2026-92387 , CVE-2026-92388 , CVE-2026-92389 , CVE-2026-92390 , CVE-2026-92391 , CVE-2026-92392 , CVE-2026-94265 , CVE-2026-94266 , CVE-2026-107929 Description
curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set cookie erases cookie jar CVE-2026-86413: Negotiate credentials sent to redirected origin CVE-2026-86414: leaking host credentials to HTTP proxy CVE-2026-86415: auto client cert connection reuse mixup CVE-2026-87861: cross-origin reuse of a Negotiate connection CVE-2026-87862: HSTS cache import drops longer-lived child CVE-2026-87863: HSTS response erases persisted entries CVE-2026-92386: server-set cookie aborts cookie jar load CVE-2026-92387: never-ending loop via server response omission CVE-2026-92388: FTP wildcard write callback mixup CVE-2026-92389: TFTP direction confusion CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints CVE-2026-92391: curl_mime_free stack overflow by recursion CVE-2026-92392: HTTP/2 upload Use-After-Free CVE-2026-94265: Authorization: Negotiate sent to foreign origin CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL CVE-2026-107929: local interface connection reuse mixup There were also some CVE IDs released at the same time that were fixed earlier, in 8.22.0, but just announced now: CVE-2026-86409: stale SigV4 headers sent unintended CVE-2026-86411: FTP connection reuse inherits client-certificate CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection Here are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so are only getting fixed now: CVE-2026-13608: OpenLDAP SASL authentication bypass CVE-2026-18924: HTTP/2 server push UAF CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-82209: domain-scoped PSL domain cookie References

• https://bugs.mageia.org/show_bug.cgi?id=36250
• https://curl.se/docs/security.html
• https://www.cve.org/CVERecord?id=CVE-2026-13608
• https://www.cve.org/CVERecord?id=CVE-2026-18924
• https://www.cve.org/CVERecord?id=CVE-2026-19931
• https://www.cve.org/CVERecord?id=CVE-2026-80229
• https://www.cve.org/CVERecord?id=CVE-2026-80230
• https://www.cve.org/CVERecord?id=CVE-2026-80231
• https://www.cve.org/CVERecord?id=CVE-2026-80255
• https://www.cve.org/CVERecord?id=CVE-2026-80256
• https://www.cve.org/CVERecord?id=CVE-2026-82208
• https://www.cve.org/CVERecord?id=CVE-2026-82209
• https://www.cve.org/CVERecord?id=CVE-2026-86409
• https://www.cve.org/CVERecord?id=CVE-2026-86410
• https://www.cve.org/CVERecord?id=CVE-2026-86411
• https://www.cve.org/CVERecord?id=CVE-2026-86412
• https://www.cve.org/CVERecord?id=CVE-2026-86413
• https://www.cve.org/CVERecord?id=CVE-2026-86414
• https://www.cve.org/CVERecord?id=CVE-2026-86415
• https://www.cve.org/CVERecord?id=CVE-2026-87861
• https://www.cve.org/CVERecord?id=CVE-2026-87862
• https://www.cve.org/CVERecord?id=CVE-2026-87863
• https://www.cve.org/CVERecord?id=CVE-2026-87864
• https://www.cve.org/CVERecord?id=CVE-2026-92386
• https://www.cve.org/CVERecord?id=CVE-2026-92387
• https://www.cve.org/CVERecord?id=CVE-2026-92388
• https://www.cve.org/CVERecord?id=CVE-2026-92389
• https://www.cve.org/CVERecord?id=CVE-2026-92390
• https://www.cve.org/CVERecord?id=CVE-2026-92391
• https://www.cve.org/CVERecord?id=CVE-2026-92392
• https://www.cve.org/CVERecord?id=CVE-2026-94265
• https://www.cve.org/CVERecord?id=CVE-2026-94266
• https://www.cve.org/CVERecord?id=CVE-2026-107929

SRPMS 10/core

• curl-8.23.0-1.mga10

Publication date: 17 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-63266 , CVE-2026-63267 , CVE-2026-63268 , CVE-2026-63269 , CVE-2026-63270 , CVE-2026-63272 , CVE-2026-63273 , CVE-2026-63274 , CVE-2026-63275 , CVE-2026-63276 , CVE-2026-63277 , CVE-2026-63278 , CVE-2026-63279 Description
Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality. (CVE-2026-63266) LFI and GET SSRF via calcext:data-mappings and csv provider. (CVE-2026-63267) LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href. (CVE-2026-63268) LFI and GET SSRF via GStreamer and HLS playlists. (CVE-2026-63269) Environment/ini-file leaks. (CVE-2026-63270) Heap buffer overflow in WMF text record import. (CVE-2026-63272) Heap buffer overflow in PDF import encryption handling. (CVE-2026-63273) Heap buffer overflow in PDF import stream handling. (CVE-2026-63274) Stack buffer overflow in CFF font hint handling. (CVE-2026-63275) Stack buffer overflow in CFF to Type 1 font conversion. (CVE-2026-63276) RCE via calcext:data-mappings, sql provider and jdbc connector. (CVE-2026-63277) Package URLs can be used to exfiltrate arbitrary INI file values and environment variables. (CVE-2026-63278) Out of bounds read in PICT image import. (CVE-2026-63279) References

• https://bugs.mageia.org/show_bug.cgi?id=36383
• https://lists.debian.org/debian-security-announce/2026/msg00424.html
• https://www.libreoffice.org/security/#cve-2026-63272
• https://www.libreoffice.org/security/#cve-2026-63273
• https://www.libreoffice.org/security/#cve-2026-63274
• https://www.libreoffice.org/security/#cve-2026-63275
• https://www.libreoffice.org/security/#cve-2026-63276
• https://www.libreoffice.org/security/#cve-2026-63277
• https://www.libreoffice.org/security/#cve-2026-63278
• https://www.libreoffice.org/security/#cve-2026-63279
• https://lists.debian.org/debian-security-announce/2026/msg00457.html
• https://www.libreoffice.org/security/#cve-2026-63266
• https://www.libreoffice.org/security/#cve-2026-63267
• https://www.libreoffice.org/security/#cve-2026-63268
• https://www.libreoffice.org/security/#cve-2026-63269
• https://www.libreoffice.org/security/#cve-2026-63270
• https://ubuntu.com/security/notices/USN-8868-1
• https://www.cve.org/CVERecord?id=CVE-2026-63266
• https://www.cve.org/CVERecord?id=CVE-2026-63267
• https://www.cve.org/CVERecord?id=CVE-2026-63268
• https://www.cve.org/CVERecord?id=CVE-2026-63269
• https://www.cve.org/CVERecord?id=CVE-2026-63270
• https://www.cve.org/CVERecord?id=CVE-2026-63272
• https://www.cve.org/CVERecord?id=CVE-2026-63273
• https://www.cve.org/CVERecord?id=CVE-2026-63274
• https://www.cve.org/CVERecord?id=CVE-2026-63275
• https://www.cve.org/CVERecord?id=CVE-2026-63276
• https://www.cve.org/CVERecord?id=CVE-2026-63277
• https://www.cve.org/CVERecord?id=CVE-2026-63278
• https://www.cve.org/CVERecord?id=CVE-2026-63279

SRPMS 10/core

• libreoffice-26.2.6.3-1.mga10

Publication date: 17 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-85644 Description
XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. (CVE-2026-85644) References

• https://bugs.mageia.org/show_bug.cgi?id=36402
• https://www.openwall.com/lists/oss-security/2026/09/28/14
• https://www.cve.org/CVERecord?id=CVE-2026-85644

SRPMS 10/core

• perl-XS-Parse-Keyword-0.510.0-1.mga10

Publication date: 17 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-89085 , CVE-2026-89088 Description
A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS). References

• https://bugs.mageia.org/show_bug.cgi?id=36423
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2K3TJ47ZMRSILG3IESTHGOOFEBBL5HS4/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6UHEOPPKU525Y6OAUPMV2W65RVVSAQ4V/
• https://www.cve.org/CVERecord?id=CVE-2026-89085
• https://www.cve.org/CVERecord?id=CVE-2026-89088

SRPMS 10/core

• parted-3.6-2.1.mga10