Lector de Feeds

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-12505 Description
The updated packages fix a security vulnerability: Local privilege escalation via forged cifs.spnego key description in cifs.upcall. (CVE-2026-12505) References

• https://bugs.mageia.org/show_bug.cgi?id=35813
• https://ubuntu.com/security/notices/USN-8496-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2489805
• https://ubuntu.com/security/notices/USN-8496-2
• https://ubuntu.com/security/notices/USN-8496-3
• https://www.cve.org/CVERecord?id=CVE-2026-12505

SRPMS 10/core

• cifs-utils-7.5-1.1.mga10

9/core

• cifs-utils-7.0-1.2.mga9

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56123 Description
The updated package fixes a security vulnerability: Heap Buffer Overflow via SOCKS5 Reply Parser. (CVE-2026-56123) References

• https://bugs.mageia.org/show_bug.cgi?id=35794
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/F6FLUO6FYZ6TSE43PLY7QJGUX4N2JXWW/
• https://ubuntu.com/security/notices/USN-8511-1
• https://www.cve.org/CVERecord?id=CVE-2026-56123

SRPMS 10/core

• socat-1.8.1.0-1.1.mga10

9/core

• socat-1.8.0.2-1.1.mga9

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-29167 , CVE-2026-29170 , CVE-2026-34355 , CVE-2026-34356 , CVE-2026-42535 , CVE-2026-42536 , CVE-2026-43951 , CVE-2026-44119 , CVE-2026-44185 , CVE-2026-44186 , CVE-2026-44631 , CVE-2026-48913 , CVE-2026-49975 Description
The updated packages fix security vulnerabilities: Apache HTTP Server: mod_ldap per-dir use-after-free. (CVE-2026-29167) Apache HTTP Server: mod_proxy_ftp XSS. (CVE-2026-29170) Apache HTTP Server: mod_proxy_html buffer overflow. (CVE-2026-34355) Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow. (CVE-2026-34356) Apache HTTP Server: mod_dav_fs protected directory access. (CVE-2026-42535) Apache HTTP Server: mod_xml2enc heap overflow. (CVE-2026-42536) Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash. (CVE-2026-43951) Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules. (CVE-2026-44119) Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`. (CVE-2026-44185) Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp. (CVE-2026-44186) Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow. (CVE-2026-44631) Apache HTTP Server: mod_http2 memory corruption when file handles exhausted. (CVE-2026-48913) Apache HTTP Server: mod_http2 denial of service. (CVE-2026-49975) References

• https://bugs.mageia.org/show_bug.cgi?id=35625
• https://www.openwall.com/lists/oss-security/2026/06/03/3
• https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
• https://lists.debian.org/debian-security-announce/2026/msg00234.html
• https://www.openwall.com/lists/oss-security/2026/06/08/4
• https://www.openwall.com/lists/oss-security/2026/06/08/5
• https://www.openwall.com/lists/oss-security/2026/06/08/6
• https://www.openwall.com/lists/oss-security/2026/06/08/7
• https://www.openwall.com/lists/oss-security/2026/06/08/8
• https://www.openwall.com/lists/oss-security/2026/06/08/9
• https://www.openwall.com/lists/oss-security/2026/06/08/10
• https://www.openwall.com/lists/oss-security/2026/06/08/11
• https://www.openwall.com/lists/oss-security/2026/06/08/12
• https://www.openwall.com/lists/oss-security/2026/06/08/13
• https://www.openwall.com/lists/oss-security/2026/06/08/14
• https://www.openwall.com/lists/oss-security/2026/06/08/15
• https://www.openwall.com/lists/oss-security/2026/06/08/16
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R2KWQ6IEDZQHPWK66QN6DG4LW6X3OUM/
• https://www.cve.org/CVERecord?id=CVE-2026-29167
• https://www.cve.org/CVERecord?id=CVE-2026-29170
• https://www.cve.org/CVERecord?id=CVE-2026-34355
• https://www.cve.org/CVERecord?id=CVE-2026-34356
• https://www.cve.org/CVERecord?id=CVE-2026-42535
• https://www.cve.org/CVERecord?id=CVE-2026-42536
• https://www.cve.org/CVERecord?id=CVE-2026-43951
• https://www.cve.org/CVERecord?id=CVE-2026-44119
• https://www.cve.org/CVERecord?id=CVE-2026-44185
• https://www.cve.org/CVERecord?id=CVE-2026-44186
• https://www.cve.org/CVERecord?id=CVE-2026-44631
• https://www.cve.org/CVERecord?id=CVE-2026-48913
• https://www.cve.org/CVERecord?id=CVE-2026-49975

SRPMS 10/core

• apache-2.4.68-1.mga10

9/core

• apache-2.4.68-1.mga9

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-12725 , CVE-2026-12969 Description
The updated dnsmasq packages fix multiple security issues: A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725) An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions. (CVE-2026-12969) References

• https://bugs.mageia.org/show_bug.cgi?id=35935
• https://app.opencve.io/cve/CVE-2026-12725
• https://app.opencve.io/cve/CVE-2026-12969
• https://ubuntu.com/security/notices/USN-8542-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2490763
• https://bugzilla.redhat.com/show_bug.cgi?id=2491663
• https://thekelleys.org.uk/dnsmasq/CHANGELOG
• https://www.cve.org/CVERecord?id=CVE-2026-12725
• https://www.cve.org/CVERecord?id=CVE-2026-12969

SRPMS 10/core

• dnsmasq-2.93-1.mga10

9/core

• dnsmasq-2.93-1.mga9

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The plugin can't connect to the server to make AI calls. This update fixes the reported issue and updates the plugin to version 1.52.1. References

• https://bugs.mageia.org/show_bug.cgi?id=35955
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.52.1
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.52.0
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.51.1
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.51.0
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.50.0
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.49.1

SRPMS 10/core

• krita-ai-diffusion-1.52.1-1.mga10

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
nut-scanner failed to start. This update fixes the issue and also updates the nut packages to the latest maintained release. References

• https://bugs.mageia.org/show_bug.cgi?id=35938

SRPMS 10/core

• nut-2.8.5-1.mga10

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
warpinator uses the grpcio module, but with a stamp of the used module version. The stamp was not in accordance with the version of the provided module in the distro, preventing launch. This update fixes that. References

• https://bugs.mageia.org/show_bug.cgi?id=35891

SRPMS 10/core

• warpinator-2.0.4-1.mga10

Publication date: 21 Jul 2026
Type: security
Affected Mageia releases : 10
Description
The updated package fixes a security vulnerability: editor command injection vulnerability. References

• https://bugs.mageia.org/show_bug.cgi?id=35720
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEP2W3H6GWB2VQQATCPANKNKGGK2TGMP/
• https://github.com/jonas/tig/issues/1432

SRPMS 10/core

• tig-2.6.1-1.mga10

Publication date: 21 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The updates packages fix issues in our signature background. The images have been reworked providing a better look. Building with mock is fixed allowing the produced mageia-theme and mageia-theme-extra packages to be installed together. Fix the plymouth theme which still was the Mageia 9 version after upgrades. Behind the scenes some processes are now done at build time, avoiding recurring issues with interlaced images. References

• https://bugs.mageia.org/show_bug.cgi?id=35843
• https://bugs.mageia.org/show_bug.cgi?id=32259

SRPMS 10/core

• mageia-theme-10.11-1.1.mga10
• grub2-2.12-15.1.mga10
• grub2-mageia-theme-dejavu-1.0-17.1.mga10

Publication date: 21 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The last versions of serd, sord, sratom, suil and lilv couldn't be submitted because of Cauldron FREEZE. References

• https://bugs.mageia.org/show_bug.cgi?id=35826

SRPMS 10/core

• serd-0.32.8-1.mga10
• sord-0.16.22-1.mga10
• sratom-0.6.22-1.mga10
• lilv-0.26.4-1.mga10
• suil-0.10.26-3.mga10

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-56016 Description
The updated package fixes a security vulnerability: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. (CVE-2026-56016) References

• https://bugs.mageia.org/show_bug.cgi?id=35800
• https://www.openwall.com/lists/oss-security/2026/07/01/6
• https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OXFQ3DBWPONO7MHLPUC3HP44MVOLIY4B/
• https://www.cve.org/CVERecord?id=CVE-2026-56016

SRPMS 10/core

• perl-CGI-Session-4.490.0-1.mga10