Mageia Security

Publication date: 08 Jul 2025
Type: bugfix
Affected Mageia releases : 9
Description The update fixes an issue building firefox & thunderbird in the armv7hl architecture. References

• https://bugs.mageia.org/show_bug.cgi?id=34422

SRPMS 9/core

• llvm19-suite-19.1.0-4.mga9

Publication date: 05 Jul 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-1735 , CVE-2025-6491 , CVE-2025-1220 Description PGSQL: Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735) SOAP: Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491) Standard: Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220) References

• https://bugs.mageia.org/show_bug.cgi?id=34418
• https://www.php.net/ChangeLog-8.php#8.2.29
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1735
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6491
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1220

SRPMS 9/core

• php-8.2.29-1.mga9

Publication date: 05 Jul 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-48877 , CVE-2024-52035 , CVE-2024-54028 Description A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in the xls2csv utility version 0.95. (CVE-2024-48877) An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. (CVE-2024-52035) An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. (CVE-2024-54028) References

• https://bugs.mageia.org/show_bug.cgi?id=34411
• https://lists.debian.org/debian-security-announce/2025/msg00117.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-48877
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52035
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54028

SRPMS 9/core

• catdoc-0.95-5.1.mga9

Publication date: 02 Jul 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-6424 , CVE-2025-6425 , CVE-2025-6429 , CVE-2025-6430 Description CVE-2025-6424: A use-after-free in FontFaceSet resulted in a potentially exploitable crash. CVE-2025-6425: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. CVE-2025-6429: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. CVE-2025-6430: When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a website vulnerable to a cross-site scripting attack. We can't yet ship this update to the armv7hl architecture; we are investigating the issue and will try to update firefox for armv7hl as soon as possible. References

• https://bugs.mageia.org/show_bug.cgi?id=34393
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_113.html
• https://www.mozilla.org/en-US/firefox/128.12.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-53/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6424
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6425
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6429
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6430

SRPMS 9/core

• firefox-128.12.0-1.1.mga9
• firefox-l10n-128.12.0-1.1.mga9
• rootcerts-20250613.00-1.mga9
• nss-3.113.0-1.mga9

Publication date: 02 Jul 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-5914 , CVE-2025-5915 , CVE-2025-5916 , CVE-2025-5917 Description Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c. (CVE-2025-5914) Heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c. (CVE-2025-5915) Integer overflow while reading warc files at archive_read_support_format_warc.c. (CVE-2025-5916) Off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c. (CVE-2025-5917) References

• https://bugs.mageia.org/show_bug.cgi?id=34402
• https://ubuntu.com/security/notices/USN-7601-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5914
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5915
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5916
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5917

SRPMS 9/core

• libarchive-3.6.2-5.5.mga9

Publication date: 28 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-49175 , CVE-2025-49176 , CVE-2025-49177 , CVE-2025-49178 , CVE-2025-49179 , CVE-2025-49180 Description Out-of-bounds access in X Rendering extension (Animated cursors). (CVE-2025-49175) Integer overflow in Big Requests Extension. (CVE-2025-49176) Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode). (CVE-2025-49177) Unprocessed client request via bytes to ignore. (CVE-2025-49178) Integer overflow in X Record extension. (CVE-2025-49179) Integer overflow in RandR extension (RRChangeProviderProperty). (CVE-2025-49180) References

• https://bugs.mageia.org/show_bug.cgi?id=34381
• https://www.openwall.com/lists/oss-security/2025/06/17/3
• https://www.openwall.com/lists/oss-security/2025/06/18/2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49175
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49176
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49177
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49178
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49179
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49180

SRPMS 9/core

• x11-server-21.1.8-7.8.mga9
• x11-server-xwayland-22.1.9-1.8.mga9
• tigervnc-1.13.1-2.8.mga9

Publication date: 28 Jun 2025
Type: bugfix
Affected Mageia releases : 9
Description In some desktops, Muse freezes when you set a custom color for a track. We fixed the issue requiring the qt5ct package and forcing QT_QPA_PLATFORMTHEME=qt5ct muse4 in the desktop file. But, to not introduce unwanted side effects in systems with mixed desktops (Plasma KDE with others), we split the profile.d files of qt5ct in the package qt5ct-profile; the package is not fetched as part of the update and if you want to keep the effects of qt5ct at desktop start you should install qt5ct-profile after the update. References

• https://bugs.mageia.org/show_bug.cgi?id=34351

SRPMS 9/core

• muse-4.2.1-1.3.mga9
• qt5ct-1.7-1.1.mga9

Publication date: 27 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-6199 Description It was discovered that incorrect bounds validation in the GIF decoder of the GDK Pixbuf library may result in memory disclosure. References

• https://bugs.mageia.org/show_bug.cgi?id=34388
• https://lists.debian.org/debian-security-announce/2025/msg00110.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6199

SRPMS 9/core

• gdk-pixbuf2.0-2.42.10-2.2.mga9

Publication date: 27 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-5262 , CVE-2025-5263 , CVE-2025-5264 , CVE-2025-5266 , CVE-2025-5267 , CVE-2025-5268 , CVE-2025-5269 , CVE-2025-5986 Description CVE-2025-5262: A double-free could have occurred in vpx_codec_enc_init_multi after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. CVE-2025-5264: Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. CVE-2025-5266: Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. CVE-2025-5267: A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. CVE-2025-5268: Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. CVE-2025-5269: Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. CVE-2025-5986: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. We can't ship this update to armv7hl architecture, we are investigating the issue and will try to update thunderbird for armv7hl as soon as posible. References

• https://bugs.mageia.org/show_bug.cgi?id=34338
• https://www.thunderbird.net/en-US/thunderbird/128.11.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-46/
• https://www.thunderbird.net/en-US/thunderbird/128.11.1esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5262
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5986

SRPMS 9/core

• thunderbird-128.11.1-1.1.mga9
• thunderbird-l10n-128.11.1-1.mga9

Publication date: 25 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-6191 , CVE-2025-6192 Description Integer overflow in V8. (CVE-2025-6191) Use after free in Profiler. (CVE-2025-6192) References

• https://bugs.mageia.org/show_bug.cgi?id=34386
• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_17.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6191
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6192

SRPMS 9/tainted

• chromium-browser-stable-136.0.7103.113-3.mga9.tainted

Publication date: 25 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-5262 , CVE-2025-5263 , CVE-2025-5264 , CVE-2025-5266 , CVE-2025-5267 , CVE-2025-5268 , CVE-2025-5269 Description CVE-2025-5283: A double-free could have occurred in vpx_codec_enc_init_multi after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. CVE-2025-5264: Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. CVE-2025-5266: Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. CVE-2025-5267: A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. CVE-2025-5268: Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. CVE-2025-5269: Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. We can't ship this update to armv7hl architecture, we are investigating the issue and will try to update firefox for armv7hl as soon as posible. References

• https://bugs.mageia.org/show_bug.cgi?id=34337
• https://www.mozilla.org/en-US/firefox/128.11.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-44/
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_112.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5262
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269

SRPMS 9/core

• firefox-128.11.0-1.1.mga9
• firefox-l10n-128.11.0-1.mga9
• nss-3.112.0-1.mga9

Publication date: 25 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2020-7677 , CVE-2021-43138 , CVE-2022-3517 , CVE-2024-37890 , CVE-2024-48949 , CVE-2022-37599 , CVE-2023-26136 , CVE-2023-46234 , CVE-2024-12905 , CVE-2024-4067 , CVE-2025-48387 Description CVE-2024-37890 yarnpkg: denial of service when handling a request with many HTTP headers. CVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature Verification. CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file And other vulnerabilities in the yarn's bundled nodejs components are fixed too, see the references. References

• https://bugs.mageia.org/show_bug.cgi?id=33674
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UGLXZO6VIHGIITQTEUY5Q5YCAP2A4ZP/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VEDIJM7VQF4Q2L2KKQ6KJ2WZNR7AXYQD/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7677
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43138
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3517
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37890
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-48949
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37599
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26136
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46234
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12905
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4067
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48387

SRPMS 9/core

• yarnpkg-1.22.22-0.10.9.2.1.mga9

Publication date: 25 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-48432 Description Potential log injection via unescaped request path. (CVE-2025-48432) References

• https://bugs.mageia.org/show_bug.cgi?id=34348
• https://www.openwall.com/lists/oss-security/2025/06/04/5
• https://www.openwall.com/lists/oss-security/2025/06/10/2
• https://ubuntu.com/security/notices/USN-7555-1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LVFOPDCA45B4XTMYRHQUSJ7JCA56453W/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48432

SRPMS 9/core

• python-django-4.1.13-1.5.mga9

Publication date: 25 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-47947 , CVE-2025-48866 Description ModSecurity Has Possible DoS Vulnerability. (CVE-2025-47947) ModSecurity has possible DoS vulnerability in sanitiseArg action. (CVE-2025-48866) References

• https://bugs.mageia.org/show_bug.cgi?id=34362
• https://lists.debian.org/debian-security-announce/2025/msg00104.html
• https://ubuntu.com/security/notices/USN-7567-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47947
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48866

SRPMS 9/core

• apache-mod_security-2.9.7-1.1.mga9

Publication date: 25 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-48988 , CVE-2025-49125 Description FileUpload large number of parts with headers DoS. (CVE-2025-48988) Security constraint bypass for pre/post-resources. (CVE-2025-49125) References

• https://bugs.mageia.org/show_bug.cgi?id=34376
• https://www.openwall.com/lists/oss-security/2025/06/16/1
• https://www.openwall.com/lists/oss-security/2025/06/16/2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48988
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49125

SRPMS 9/core

• tomcat-9.0.106-1.mga9

Publication date: 25 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-20260 Description Fixed a possible buffer overflow write bug in the PDF file parser that could cause a denial-of-service (DoS) condition or enable remote code execution. (CVE-2025-20260) References

• https://bugs.mageia.org/show_bug.cgi?id=34387
• https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20260

SRPMS 9/core

• clamav-1.0.9-1.mga9

Publication date: 25 Jun 2025
Type: bugfix
Affected Mageia releases : 9
Description i586 packages that depend on nodejs to build have issues building: the build never ends or it fails at some point after lots of time. This update fixes the reported issue, but since this release, i586 will require CPUs with SSE2 support. References

• https://bugs.mageia.org/show_bug.cgi?id=34384

SRPMS 9/core

• nodejs-22.16.0-4.mga9

Publication date: 24 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-29018 Description External DNS requests from 'internal' networks could lead to data exfiltration - CVE-2024-29018 We can't determine if docker 24.0.5 is affected but as it is no longer supported we are releasing version 25.0.7, as it is supported and free of the CVE. References

• https://bugs.mageia.org/show_bug.cgi?id=33870
• https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx
• https://github.com/moby/moby/releases/tag/v25.0.7
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29018

SRPMS 9/core

• docker-25.0.7-1.mga9

Publication date: 24 Jun 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-6019 Description A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. References

• https://bugs.mageia.org/show_bug.cgi?id=34380
• https://www.openwall.com/lists/oss-security/2025/06/17/4
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6019

SRPMS 9/core

• udisks2-2.10.1-1.1.mga9
• libblockdev-3.3.1-1.mga9

Publication date: 24 Jun 2025
Type: bugfix
Affected Mageia releases : 9
Description Current release produces corrupted graphics for gtk4 apps in vulkan renderer, for some Intel hardware. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=34328
• https://gitlab.freedesktop.org/mesa/mesa/-/issues/13319

SRPMS 9/core

• mesa-25.0.7-4.mga9

9/tainted

• mesa-25.0.7-4.mga9.tainted