Lector de Feeds

Publication date: 07 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
The zrythm package has a build id that matches one in the carla package. This prevents both packages from being installed together and causes migrations from Mageia 9 to Mageia 10 to fail if both packages were installed before the migration. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36437

SRPMS 10/core

• zrythm-1.0.0-3.1.mga10

Publication date: 07 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-73067 , CVE-2026-88047 , CVE-2026-88048 , CVE-2026-88049 , CVE-2026-88050 , CVE-2026-88051 , CVE-2026-88052 , CVE-2026-88053 , CVE-2026-88054 Description
This is a security update. It fixes nine vulnerabilities in tesseract, the OCR (text recognition) engine. All nine can be triggered only by feeding tesseract a maliciously crafted input file: either a specially crafted recognition/language data file (.traineddata) or a crafted word-list file. Depending on the specific flaw, this can cause a crash (denial of service) or memory corruption. CVE-2026-73067: out-of-bounds read when loading a crafted word-list file. CVE-2026-73066: out-of-bounds write when loading a crafted recognition model file. CVE-2026-88047: stack buffer overflow when loading a crafted language-normalisation file. CVE-2026-88048: out-of-bounds read/write from a crafted neural-network layer in a recognition model file. CVE-2026-88049: out-of-bounds write from a crafted neural-network layer in a recognition model file. CVE-2026-88050: out-of-bounds write from invalid character-encoding values in a crafted recognition model file. CVE-2026-88051: out-of-bounds write when loading a malformed internal data structure from a crafted recognition model file. CVE-2026-88052: out-of-bounds write when loading a crafted character-set file. CVE-2026-88053: out-of-bounds write when loading a crafted legacy recognition template file. CVE-2026-88054: crash (denial of service) when loading a crafted recognition model with an empty internal network. The tesseract package is updated to version 5.5.3, which on its own fixes CVE-2026-73067 and CVE-2026-73066. The remaining seven issues (CVE-2026-88047 to CVE-2026-88054) are not yet fixed in any upstream release, so nine patches taken from upstream's main development branch are also applied. Reported by Tristan Madani (CVE-2026-88047) and Zhixi "Jace" Sun (CVE-2026-88048 to CVE-2026-88054); see the individual advisories below for full credits, including CVE-2026-73067 and CVE-2026-73066. References

• https://bugs.mageia.org/show_bug.cgi?id=36427
• https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
• https://osv.dev/vulnerability/openSUSE-SU-2026:21957-1
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/25OCRCHOE46S5WTJZC25DVGO7KC2KVWO/
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h
• https://github.com/tesseract-ocr/tesseract/pull/4581
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8
• https://github.com/tesseract-ocr/tesseract/pull/4588
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-q44c-23p6-5mw6
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7v9h-3q3m-w68g
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-2hm8-q5c7-c373
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-f6h7-cqr4-6fx4
• https://www.cve.org/CVERecord?id=CVE-2026-73067
• https://www.cve.org/CVERecord?id=CVE-2026-88047
• https://www.cve.org/CVERecord?id=CVE-2026-88048
• https://www.cve.org/CVERecord?id=CVE-2026-88049
• https://www.cve.org/CVERecord?id=CVE-2026-88050
• https://www.cve.org/CVERecord?id=CVE-2026-88051
• https://www.cve.org/CVERecord?id=CVE-2026-88052
• https://www.cve.org/CVERecord?id=CVE-2026-88053
• https://www.cve.org/CVERecord?id=CVE-2026-88054

SRPMS 10/core

• tesseract-5.5.3-1.mga10

Publication date: 06 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55868 , CVE-2026-55869 Description
Encryption State Machine Downgrade. (CVE-2026-55868) KMREQ/KMRSP Stack-Based Buffer Overflow. (CVE-2026-55869) References

• https://bugs.mageia.org/show_bug.cgi?id=36158
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XN3R27AYMZKANUF4IXBPFLBC773HW7LM/
• https://lists.debian.org/debian-security-announce/2026/msg00361.html
• https://github.com/Haivision/srt/security/advisories/GHSA-4mc6-qmpp-g7gw
• https://github.com/Haivision/srt/security/advisories/GHSA-6xg9-784j-24rm
• https://www.cve.org/CVERecord?id=CVE-2026-55868
• https://www.cve.org/CVERecord?id=CVE-2026-55869

SRPMS 10/core

• srt-1.5.4-2.1.mga10

Publication date: 06 Oct 2026
Type: security
Affected Mageia releases : 10
Description
Avoid a set of possible memory corruption, double-free, and null pointer dereference bugs that could occur with some reverse DNS virtual address configurations. TROVE-2026-051. Avoid cacheing DNS PTR responses when DNS caching is disabled. Previous code to prevent this caching parsed the response addresses incorrectly, and defaulted to caching when the address could not be parsed. TROVE-2026-050 References

• https://bugs.mageia.org/show_bug.cgi?id=36365
• https://www.openwall.com/lists/oss-security/2026/09/24/2
• https://lists.debian.org/debian-security-announce/2026/msg00445.html

SRPMS 10/core

• tor-0.4.9.13-1.mga10

Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
/sbin/route is deprecated and drakwizard should use ip (from iproute2) instead. This will let us remove the dependency on the unmaintained Net::Route::Table module, which has not been updated upstream since 2009. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36270

SRPMS 10/core

• drakwizard-4.13-1.mga10

Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
xdg-desktop-portal-xapp package is missing in the requirements. lxdm should not be recommended as display manager for cinnamon. This update fixes the reported issues. References

• https://bugs.mageia.org/show_bug.cgi?id=36354

SRPMS 10/core

• task-cinnamon-6.6-1.2.mga10

Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
This last version 0.7.7 corrects some bugs and brings an offline help: - Fixed a long standing bug that causes the grids (like Media Library Songs Panel) to not update the screen on horizontal scroll. - Fixed a bug in the playlist vertical scrolling when the playing track is out of view. - The first track out of view in the bottom of the playlist wasn't scrolled to follow the player current track. - Playlist "Select" context-menu fixes - Fixed selections failing when a Directory panel filter was active. - Fixed saving and restoring the last directory path selected in Directory Panel. - Fixed the "enable volume" preference saving the wrong value. - Fixed build for gtk2 based distros. - Added missing Serbian (Latin) language to preferences. - Corrected several translations (Portuguese (Brasil), French, Italian, Catalan, Spanish, Greek, German...) References

• https://bugs.mageia.org/show_bug.cgi?id=36398
• https://codeberg.org/thothix/guayadeque

SRPMS 10/core

• guayadeque-0.7.7-1.mga10

Publication date: 02 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
Bug fix releases for php 8.4 and php 8.5 References

• https://bugs.mageia.org/show_bug.cgi?id=36368
• https://www.php.net/ChangeLog-8.php#8.4.26
• https://www.php.net/ChangeLog-8.php#8.5.11

SRPMS 10/core

• php8.5-8.5.11-1.mga10
• php8.4-8.4.26-1.1.mga10