Lector de Feeds

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-49853 , CVE-2026-49854 , CVE-2026-49855 Description
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) References

• https://bugs.mageia.org/show_bug.cgi?id=35712
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GZ7Q55UOVFEKZDAHBHES3HJS2PZ4OQHV/
• https://www.cve.org/CVERecord?id=CVE-2026-49853
• https://www.cve.org/CVERecord?id=CVE-2026-49854
• https://www.cve.org/CVERecord?id=CVE-2026-49855

SRPMS 10/core

• python-tornado-6.5.10-1.1.mga10

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-9323 Description
Insecure PRNG and Information Exposure in urwid Web Display Backend References

• https://bugs.mageia.org/show_bug.cgi?id=36159
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3XPYRLW6AB7WGF3ENBZSCZHGJCJFF7VI/
• https://github.com/urwid/urwid/security/advisories/GHSA-rjwp-g85x-gmjv
• https://ubuntu.com/security/notices/USN-8751-1
• https://www.cve.org/CVERecord?id=CVE-2026-9323

SRPMS 10/core

• python-urwid-4.1.3-1.mga10
• python-wcwidth-0.8.3-1.mga10

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-15163 , CVE-2026-15164 , CVE-2026-15165 , CVE-2026-15166 , CVE-2026-15167 , CVE-2026-15168 , CVE-2026-15169 , CVE-2026-15170 , CVE-2026-15171 , CVE-2026-15172 , CVE-2026-15173 , CVE-2026-15174 Description
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark. (CVE-2026-15163) Heap-based Buffer Overflow in ciscodump. (CVE-2026-15164) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15165) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15166) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15167) Use of Uninitialized Variable in Wireshark. (CVE-2026-15168) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15169) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15170) NULL Pointer Dereference in Wireshark. (CVE-2026-15171) Unchecked Input for Loop Condition in Wireshark. (CVE-2026-15172) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15173) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15174) References

• https://bugs.mageia.org/show_bug.cgi?id=35985
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WDPYZRRCJU7AOWEFKBJ2IXADDJGWH4AH/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OUNLKEGMF6HPV3WJRY6PZJF4BTUIQWBO/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5DGIBJC6D6UABMCLLUPI5ZU2I3SEFUV/
• https://lists.debian.org/debian-security-announce/2026/msg00382.html
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UONW2KX7GYYS7MVUGXE7L23MZC42ZLHT/
• https://www.cve.org/CVERecord?id=CVE-2026-15163
• https://www.cve.org/CVERecord?id=CVE-2026-15164
• https://www.cve.org/CVERecord?id=CVE-2026-15165
• https://www.cve.org/CVERecord?id=CVE-2026-15166
• https://www.cve.org/CVERecord?id=CVE-2026-15167
• https://www.cve.org/CVERecord?id=CVE-2026-15168
• https://www.cve.org/CVERecord?id=CVE-2026-15169
• https://www.cve.org/CVERecord?id=CVE-2026-15170
• https://www.cve.org/CVERecord?id=CVE-2026-15171
• https://www.cve.org/CVERecord?id=CVE-2026-15172
• https://www.cve.org/CVERecord?id=CVE-2026-15173
• https://www.cve.org/CVERecord?id=CVE-2026-15174

SRPMS 10/core

• wireshark-4.6.8-1.mga10

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-2236 Description
Libgcrypt: vulnerable to marvin attack. (CVE-2024-2236) References

• https://bugs.mageia.org/show_bug.cgi?id=36248
• https://ubuntu.com/security/notices/USN-8711-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2268268
• https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html
• https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt
• https://people.redhat.com/~hkario/marvin/
• https://dev.gnupg.org/T7136
• https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17
• https://www.cve.org/CVERecord?id=CVE-2024-2236

SRPMS 10/core

• libgcrypt-1.11.3-1.1.mga10

Publication date: 01 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55380 , CVE-2026-54060 , CVE-2026-54059 , CVE-2026-55379 , CVE-2026-59205 , CVE-2026-59199 , CVE-2026-59197 , CVE-2026-59198 , CVE-2026-54058 , CVE-2026-59204 , CVE-2026-59203 Description
Prevent decompression bomb when parsing PDF WindowsViewer.get_command injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds (OOB) read Out-of-bounds (OOB) read when saving 1 mode TGA images Out-of-bounds (OOB) write from large RankFilter sizes Out-of-bounds (OOB) write from Image.paste() Out-of-bounds (OOB) write in ImageCmsTransform Prevent FontFile decompression bomb Prevent GD decompression bomb References

• https://bugs.mageia.org/show_bug.cgi?id=35909
• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
• https://www.cve.org/CVERecord?id=CVE-2026-55380
• https://www.cve.org/CVERecord?id=CVE-2026-54060
• https://www.cve.org/CVERecord?id=CVE-2026-54059
• https://www.cve.org/CVERecord?id=CVE-2026-55379
• https://www.cve.org/CVERecord?id=CVE-2026-59205
• https://www.cve.org/CVERecord?id=CVE-2026-59199
• https://www.cve.org/CVERecord?id=CVE-2026-59197
• https://www.cve.org/CVERecord?id=CVE-2026-59198
• https://www.cve.org/CVERecord?id=CVE-2026-54058
• https://www.cve.org/CVERecord?id=CVE-2026-59204
• https://www.cve.org/CVERecord?id=CVE-2026-59203

SRPMS 10/core

• python-pillow-12.3.0-1.mga10

Publication date: 01 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
glabels can't open previously-created glabels files. We have added a patch to fix the issue but the project is dead upstream and its developer is now focussing on glabels-qt. We are releasing glabels-qt as an alternative. Both versions fix the reported issue; it is your decision what tool to use. References

• https://bugs.mageia.org/show_bug.cgi?id=36053
• https://github.com/j-evins/glabels-qt

SRPMS 10/core

• glabels-3.4.1-12.1.mga10
• glabels-qt-3.99-0.2.2026.08.27git554c9f0.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Borgbackup uses the msgpack python module, and it includes a stopping check for exactly the version 1.2.1. It also recognises an option to disable this check. The updated package shunts this check, which seems overzealous. References

• https://bugs.mageia.org/show_bug.cgi?id=36364

SRPMS 10/core

• borgbackup-1.4.5-1.1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Due to a missing requirement on zstd, engrampa can't open zst files. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36387

SRPMS 10/core

• engrampa-1.28.5-1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
LXDM is only installed by task-lxde. If you only install task-lxde-minimal, then you miss LXDM and you only have XDM which doesn't let you select your desktop environment. This update fixes the reported issue, moving the requirement on LXDM to the task-lxde-minimal package. References

• https://bugs.mageia.org/show_bug.cgi?id=36390

SRPMS 10/core

• task-lxde-10-2.1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Previously setting a dark theme is not respected after a system reboot. This update fixes the issue by updating whatsie to the 6.1.1 version. References

• https://bugs.mageia.org/show_bug.cgi?id=35397
• https://github.com/keshavbhatt/whatsie/issues/299
• https://github.com/keshavbhatt/whatsie/releases/tag/v6.1.1
• https://github.com/keshavbhatt/whatsie/releases#release-v6.1.0
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.4
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.3
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.1
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.0

SRPMS 10/core

• whatsie-6.1.1-1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
urpm-ng is a reimplementation of the urpmi toolset, written in Python on top of libsolv. It installs, upgrades, removes and queries packages, and resolves dependencies automatically. This packages introduces urpm-ng in Mageia 9 and 10 to allow early testers do migrations from Mageia 9 to Mageia 10 with the package manager component without add external repositories. We do not recommend it yet for inexperienced users. References

• https://bugs.mageia.org/show_bug.cgi?id=36393

SRPMS 10/core

• urpm-ng-0.9.14-1.mga10

9/core

• urpm-ng-0.9.14-1.mga9

Publication date: 29 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-52791 , CVE-2026-77478 Description
fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478) References

• https://bugs.mageia.org/show_bug.cgi?id=36164
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OHDCW47LEOQXLVH2XJNC3A7VFVELJQ6U/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YO4BSFYJPI6ZGUIXZ3AHYYYFEYEM4MFO/
• https://github.com/containers/fuse-overlayfs/releases/tag/v1.17
• https://github.com/containers/fuse-overlayfs/releases/tag/v1.18
• https://www.cve.org/CVERecord?id=CVE-2026-52791
• https://www.cve.org/CVERecord?id=CVE-2026-77478

SRPMS 10/core

• fuse-overlayfs-1.18-1.mga10