Mageia Security

Publication date: 30 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-58055 Description
The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. (CVE-2026-58055) References

• https://bugs.mageia.org/show_bug.cgi?id=35814
• https://ubuntu.com/security/notices/USN-8495-1
• https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc
• https://www.cve.org/CVERecord?id=CVE-2026-58055

SRPMS 10/core

• nghttp2-1.68.1-2.1.mga10

9/core

• nghttp2-1.61.0-1.2.mga9

Publication date: 30 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-9698 , CVE-2026-10879 , CVE-2026-14380 , CVE-2026-14739 , CVE-2026-14740 , CVE-2026-15043 , CVE-2026-15392 , CVE-2026-60081 , CVE-2026-60082 Description
The updated packages fix several security issues. References

• https://bugs.mageia.org/show_bug.cgi?id=35643
• https://www.openwall.com/lists/oss-security/2026/06/06/4
• https://www.openwall.com/lists/oss-security/2026/06/09/9
• https://www.openwall.com/lists/oss-security/2026/07/07/16
• https://www.openwall.com/lists/oss-security/2026/07/07/17
• https://www.openwall.com/lists/oss-security/2026/07/14/9
• https://www.openwall.com/lists/oss-security/2026/07/14/13
• https://www.openwall.com/lists/oss-security/2026/07/14/14
• https://www.openwall.com/lists/oss-security/2026/07/14/15
• https://www.cve.org/CVERecord?id=CVE-2026-9698
• https://www.cve.org/CVERecord?id=CVE-2026-10879
• https://www.cve.org/CVERecord?id=CVE-2026-14380
• https://www.cve.org/CVERecord?id=CVE-2026-14739
• https://www.cve.org/CVERecord?id=CVE-2026-14740
• https://www.cve.org/CVERecord?id=CVE-2026-15043
• https://www.cve.org/CVERecord?id=CVE-2026-15392
• https://www.cve.org/CVERecord?id=CVE-2026-60081
• https://www.cve.org/CVERecord?id=CVE-2026-60082

SRPMS 10/core

• perl-DBI-1.651.0-1.mga10

9/core

• perl-DBI-1.651.0-1.mga9

Publication date: 28 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-52717 Description
Heap corruption in gst-libav AV protocol pipe. (CVE-2026-52717) References

• https://bugs.mageia.org/show_bug.cgi?id=35738
• https://lists.debian.org/debian-security-announce/2026/msg00264.html
• https://gstreamer.freedesktop.org/security/sa-2026-0037.html
• https://www.cve.org/CVERecord?id=CVE-2026-52717

SRPMS 10/core

• gstreamer1.0-libav-1.26.11-1.1.mga10

Publication date: 28 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-9539 Description
The updated packages fix a security vulnerability: TCP URG OOB Read Information Leak. (CVE-2026-9539) References

• https://bugs.mageia.org/show_bug.cgi?id=35786
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6UPWKZGJYGWQEVDO5XRTPSVFGDX2BIZC/
• https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93
• https://www.cve.org/CVERecord?id=CVE-2026-9539

SRPMS 10/core

• libslirp-4.8.0-2.1.mga10

9/core

• libslirp-4.6.1-1.1.mga9

Publication date: 28 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-50812 , CVE-2026-50813 Description
CVE-2026-50812: A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer. CVE-2026-50813: An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path. References

• https://bugs.mageia.org/show_bug.cgi?id=35988
• https://www.cve.org/CVERecord?id=CVE-2026-50812
• https://www.cve.org/CVERecord?id=CVE-2026-50813
• https://www.cve.org/CVERecord?id=CVE-2026-50812
• https://www.cve.org/CVERecord?id=CVE-2026-50813

SRPMS 10/core

• sqlite3-3.51.3-1.2.mga10

9/core

• sqlite3-3.40.1-1.10.mga9

Publication date: 28 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
Description
The updated packages fix bugs including security ones. References

• https://bugs.mageia.org/show_bug.cgi?id=35811
• https://github.com/memcached/memcached/wiki/ReleaseNotes1643
• https://github.com/memcached/memcached/wiki/ReleaseNotes1644
• https://github.com/memcached/memcached/wiki/ReleaseNotes1645

SRPMS 10/core

• memcached-1.6.45-1.mga10

9/core

• memcached-1.6.45-1.mga9

Publication date: 28 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
perl-Gtk2-Ex-PodViewer depends on perl-Gtk2-Ex-Simple-List, but upstream gscan2pdf now explicitly depends on Gtk3::SimpleList, so this dependency seems to be indeed obsolete. Yjis update removes the dependency on perl-Gtk2-Ex-PodViewer. References

• https://bugs.mageia.org/show_bug.cgi?id=36021

SRPMS 10/core

• gscan2pdf-2.13.5-2.1.mga10

Publication date: 27 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55999 , CVE-2026-56000 Description
The updated packages fix security vulnerabilities: glamor Font Atlas Heap Buffer Overflow. (CVE-2026-55999) GLX contextTags Use-After-Free in CommonMakeCurrent(). (CVE-2026-56000) References

• https://bugs.mageia.org/show_bug.cgi?id=35860
• https://www.openwall.com/lists/oss-security/2026/07/08/2
• https://www.cve.org/CVERecord?id=CVE-2026-55999
• https://www.cve.org/CVERecord?id=CVE-2026-56000

SRPMS 10/core

• x11-server-21.1.24-1.mga10
• x11-server-xwayland-24.1.13-1.mga10
• tigervnc-1.15.0-7.1.mga10

Publication date: 27 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-41401 Description
The updated packages fix a security vulnerability: Heap Use-After-Free Write in XML Metadata Parsing. (CVE-2026-41401) References

• https://bugs.mageia.org/show_bug.cgi?id=35795
• https://ubuntu.com/security/notices/USN-8485-1
• https://github.com/CESNET/libyang/security/advisories/GHSA-9f49-8x56-jmjc
• https://www.cve.org/CVERecord?id=CVE-2026-41401

SRPMS 10/core

• libyang-3.13.5-1.1.mga10

Publication date: 27 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-42533 , CVE-2026-56434 , CVE-2026-60005 Description
CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression. Thanks to Mufeed VH of Winfunc Research and Maxim Dounin. . CVE-2026-60005: Uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination. . CVE-2026-56434: Use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module. Thanks to P4P3R-HAK. References

• https://bugs.mageia.org/show_bug.cgi?id=35973
• https://my.f5.com/manage/s/article/K000162097
• https://my.f5.com/manage/s/article/K000162100
• https://my.f5.com/manage/s/article/K000162098
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LIWPH3EULRVLC6TMLBZYPJ5IKQGVF6C2/
• https://www.cve.org/CVERecord?id=CVE-2026-42533
• https://www.cve.org/CVERecord?id=CVE-2026-56434
• https://www.cve.org/CVERecord?id=CVE-2026-60005

SRPMS 10/core

• nginx-1.30.4-1.mga10

9/core

• nginx-1.30.4-1.mga9

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
purple-telegram-tdlib has been migrated to a new active fork and updated to version 1.1.1. purple-telegram-tdlib updated packages fix an issue where administrators of telegram's groups can't open a chat in the group tdlib has been updated to version 1.8.65, required to build the new version of purple-telegram-tdlib References

• https://bugs.mageia.org/show_bug.cgi?id=36011
• https://github.com/BenWiederhake/tdlib-purple/issues/15
• https://github.com/adrighem/tdlib-purple/releases/tag/tdlib-purple-v1.1.1

SRPMS 10/core

• tdlib-1.8.65-1.git20260613.mga10
• purple-telegram-tdlib-1.1.1-1.mga10

9/core

• tdlib-1.8.65-1.git20260613.mga9
• purple-telegram-tdlib-1.1.1-1.mga9

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
After right clicking on a music file in Dolphin and selecting to open it with Amarok, Amarok failed to load the file. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36001

SRPMS 10/core

• amarok-3.3.3-1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
If purpose wasn't installed, neochat would not start. This update adds the missing dependency on the purpose package. References

• https://bugs.mageia.org/show_bug.cgi?id=35978

SRPMS 10/core

• neochat-25.12.1-1.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The OCRFeeder package wouldn't start since python3.13. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35878

SRPMS 10/core

• ocrfeeder-0.8.5-4.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The byobu package failed to install its desktop menu entry. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35842
• https://svnweb.mageia.org/packages/cauldron/byobu/current/SPECS/byobu.spec?r1=2191646&r2=2344548

SRPMS 10/core

• byobu-6.13-1.1.mga10

Publication date: 27 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
When doing a command line upgrade from Mageia 9 to Mageia 10, there were conflicts between phonon-vlc-i18n-0.12.0-2.mga10.noarch and phonon4qt5-vlc-0.11.3-2.mga9.x86_64. This Mageia 10 update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35950

SRPMS 10/core

• phonon-vlc-0.12.0-2.1.mga10

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-58469 , CVE-2026-58470 , CVE-2026-58471 , CVE-2026-58472 , CVE-2026-15146 Description
Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget incorrectly handled Content-Range header values, leading to an integer overflow. A remote attacker could possibly use this issue to cause download desynchronization. -CVE-2026-58471 : Wget incorrectly handled character set conversion of server-supplied filenames. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. This issue affected Mageia9 and Mageia 10. -CVE-2026-58472: It was discovered that Wget incorrectly handled HTML attributes requiring entity encoding. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. -CVE-2026-15146: GNU Wget did not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, could exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port. This allowed an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources. References

• https://bugs.mageia.org/show_bug.cgi?id=35974
• https://ubuntu.com/security/notices/USN-8543-1
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MLFETWDGXIX52KIZRAM7CSI5NHATXLCF/
• https://www.cve.org/CVERecord?id=CVE-2026-58469
• https://www.cve.org/CVERecord?id=CVE-2026-58470
• https://www.cve.org/CVERecord?id=CVE-2026-58471
• https://www.cve.org/CVERecord?id=CVE-2026-58472
• https://www.cve.org/CVERecord?id=CVE-2026-15146

SRPMS 10/core

• wget-1.25.0-2.2.mga10

9/core

• wget-1.21.4-1.4.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-53689 Description
The updated packages fix a security vulnerability: libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c. (CVE-2026-53689) References

• https://bugs.mageia.org/show_bug.cgi?id=35753
• https://ubuntu.com/security/notices/USN-8464-1
• https://www.cve.org/CVERecord?id=CVE-2026-53689

SRPMS 10/core

• libnfs-6.0.2-2.1.mga10

9/core

• libnfs-5.0.2-1.1.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-50593 Description
The updated packages fix a security vulnerability: Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range. (CVE-2026-50593) References

• https://bugs.mageia.org/show_bug.cgi?id=35684
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/BJGN36JXOKYV45CXXVFRJEFEWLNO23ZD/
• https://ubuntu.com/security/notices/USN-8444-1
• https://www.cve.org/CVERecord?id=CVE-2026-50593

SRPMS 10/core

• graphite2-1.3.14-4.1.mga10

9/core

• graphite2-1.3.14-2.1.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-34253 Description
The updated package fixes a security vulnerability: A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution. (CVE-2026-34253) References

• https://bugs.mageia.org/show_bug.cgi?id=35627
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QQDC2BQN5WTT7MV425PV3C4SL4HR3JD4/
• https://gitlab.xiph.org/xiph/vorbis-tools/-/work_items/2332
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FQREVQVTSI5B3ALQBRUPJMWUOU724VOS/
• https://www.cve.org/CVERecord?id=CVE-2026-34253

SRPMS 10/core

• vorbis-tools-1.4.3-2.1.mga10

9/core

• vorbis-tools-1.4.2-3.2.mga9