Mageia Security

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-13601 Description
The updated packages fix a security vulnerability: Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications. (CVE-2026-13601) References

• https://bugs.mageia.org/show_bug.cgi?id=35619
• https://lists.debian.org/debian-security-announce/2026/msg00230.html
• https://blogs.gnome.org/mcatanzaro/2026/05/11/flatpak-sandbox-escape-via-yelp/
• https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
• https://www.cve.org/CVERecord?id=CVE-2026-13601

SRPMS 10/core

• yelp-49.0-2.1.mga10

9/core

• yelp-42.2-1.2.mga9

Publication date: 25 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-26740 Description
The updated packages fix a security vulnerability: Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size. (CVE-2026-26740) References

• https://bugs.mageia.org/show_bug.cgi?id=35614
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AG6LRGR6CTYC6R6KKFK2YTY2NJNGE62F/
• https://github.com/zakkanijia/POC/blob/main/giflib/giftool/giflib_giftool_gce_len_heap_oobwrite_disclosure.md
• https://sourceforge.net/p/giflib/bugs/199/
• https://www.cve.org/CVERecord?id=CVE-2026-26740

SRPMS 10/core

• giflib-5.2.2-4.1.mga10

9/core

• giflib-5.2.1-7.4.mga9

Publication date: 25 Jul 2026
Type: bugfix
Affected Mageia releases : 9
Description
The previous update was released with the use of the shared library libzstd1, which is now at version 1.5.7 in Mageia 9. However, python-zstandard supported only version 1.5.5. This update patches python-zstandard to use libzstd version 1.5.7. References

• https://bugs.mageia.org/show_bug.cgi?id=35946

SRPMS 9/core

• python-zstandard-0.21.0-1.3.mga9

Publication date: 25 Jul 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
The suricata server did not start in Mageia 9 and Mageia 10. The updated suricata packages fix the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35737

SRPMS 10/core

• suricata-7.0.10-3.2.mga10

9/core

• suricata-7.0.10-1.2.mga9

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-63379 , CVE-2026-63381 , CVE-2026-63382 , CVE-2026-63382 , CVE-2026-63383 , CVE-2026-63384 , CVE-2026-63385 , CVE-2026-63387 , CVE-2026-63388 Description
The updated packages fix some security vulnerabilities. References

• https://bugs.mageia.org/show_bug.cgi?id=35801
• https://www.openwall.com/lists/oss-security/2026/07/01/8
• https://www.cve.org/CVERecord?id=CVE-2026-63379
• https://www.cve.org/CVERecord?id=CVE-2026-63381
• https://www.cve.org/CVERecord?id=CVE-2026-63382
• https://www.cve.org/CVERecord?id=CVE-2026-63382
• https://www.cve.org/CVERecord?id=CVE-2026-63383
• https://www.cve.org/CVERecord?id=CVE-2026-63384
• https://www.cve.org/CVERecord?id=CVE-2026-63385
• https://www.cve.org/CVERecord?id=CVE-2026-63387
• https://www.cve.org/CVERecord?id=CVE-2026-63388

SRPMS 10/core

• libevent-2.1.13-1.mga10

9/core

• libevent-2.1.13-1.mga9

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-38978 Description
The updated packages fix a security vulnerability: Transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths. (CVE-2026-38978) References

• https://bugs.mageia.org/show_bug.cgi?id=35638
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSYWZMPQ6XPS66NXRF3SE4HICNOOEP64/
• https://github.com/transmission/transmission/issues/8726
• https://www.cve.org/CVERecord?id=CVE-2026-38978

SRPMS 10/core

• transmission-4.1.3-1.mga10

Publication date: 24 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-15570 , CVE-2025-9396 Description
The updated package fixes security vulnerabilities: ckolivas lrzip stream.c lzma_decompress_buf use after free. (CVE-2025-15570) ckolivas lrzip strtol_l.c __GI_____strtol_l_internal null pointer dereference. (CVE-2025-9396) References

• https://bugs.mageia.org/show_bug.cgi?id=35760
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/JSNIFYQRLND7PULS3ODEDTISSERCMKIQ/
• https://github.com/ckolivas/lrzip/issues/262
• https://github.com/ckolivas/lrzip/issues/264
• https://www.cve.org/CVERecord?id=CVE-2025-15570
• https://www.cve.org/CVERecord?id=CVE-2025-9396

SRPMS 10/core

• lrzip-0.660-1.mga10

Publication date: 24 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
Opening a spec file with emacs on mga10 did no longer provide syntax highlighting. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35713

SRPMS 10/core

• rpm-mageia-setup-2.84-1.mga10

Publication date: 24 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
Updated Xonotic packages to fix broken online statistics support. References

• https://bugs.mageia.org/show_bug.cgi?id=35803

SRPMS 10/core

• xonotic-0.8.6-2.1.mga10

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-12505 Description
The updated packages fix a security vulnerability: Local privilege escalation via forged cifs.spnego key description in cifs.upcall. (CVE-2026-12505) References

• https://bugs.mageia.org/show_bug.cgi?id=35813
• https://ubuntu.com/security/notices/USN-8496-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2489805
• https://ubuntu.com/security/notices/USN-8496-2
• https://ubuntu.com/security/notices/USN-8496-3
• https://www.cve.org/CVERecord?id=CVE-2026-12505

SRPMS 10/core

• cifs-utils-7.5-1.1.mga10

9/core

• cifs-utils-7.0-1.2.mga9

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56123 Description
The updated package fixes a security vulnerability: Heap Buffer Overflow via SOCKS5 Reply Parser. (CVE-2026-56123) References

• https://bugs.mageia.org/show_bug.cgi?id=35794
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/F6FLUO6FYZ6TSE43PLY7QJGUX4N2JXWW/
• https://ubuntu.com/security/notices/USN-8511-1
• https://www.cve.org/CVERecord?id=CVE-2026-56123

SRPMS 10/core

• socat-1.8.1.0-1.1.mga10

9/core

• socat-1.8.0.2-1.1.mga9

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-29167 , CVE-2026-29170 , CVE-2026-34355 , CVE-2026-34356 , CVE-2026-42535 , CVE-2026-42536 , CVE-2026-43951 , CVE-2026-44119 , CVE-2026-44185 , CVE-2026-44186 , CVE-2026-44631 , CVE-2026-48913 , CVE-2026-49975 Description
The updated packages fix security vulnerabilities: Apache HTTP Server: mod_ldap per-dir use-after-free. (CVE-2026-29167) Apache HTTP Server: mod_proxy_ftp XSS. (CVE-2026-29170) Apache HTTP Server: mod_proxy_html buffer overflow. (CVE-2026-34355) Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow. (CVE-2026-34356) Apache HTTP Server: mod_dav_fs protected directory access. (CVE-2026-42535) Apache HTTP Server: mod_xml2enc heap overflow. (CVE-2026-42536) Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash. (CVE-2026-43951) Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules. (CVE-2026-44119) Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`. (CVE-2026-44185) Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp. (CVE-2026-44186) Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow. (CVE-2026-44631) Apache HTTP Server: mod_http2 memory corruption when file handles exhausted. (CVE-2026-48913) Apache HTTP Server: mod_http2 denial of service. (CVE-2026-49975) References

• https://bugs.mageia.org/show_bug.cgi?id=35625
• https://www.openwall.com/lists/oss-security/2026/06/03/3
• https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb
• https://lists.debian.org/debian-security-announce/2026/msg00234.html
• https://www.openwall.com/lists/oss-security/2026/06/08/4
• https://www.openwall.com/lists/oss-security/2026/06/08/5
• https://www.openwall.com/lists/oss-security/2026/06/08/6
• https://www.openwall.com/lists/oss-security/2026/06/08/7
• https://www.openwall.com/lists/oss-security/2026/06/08/8
• https://www.openwall.com/lists/oss-security/2026/06/08/9
• https://www.openwall.com/lists/oss-security/2026/06/08/10
• https://www.openwall.com/lists/oss-security/2026/06/08/11
• https://www.openwall.com/lists/oss-security/2026/06/08/12
• https://www.openwall.com/lists/oss-security/2026/06/08/13
• https://www.openwall.com/lists/oss-security/2026/06/08/14
• https://www.openwall.com/lists/oss-security/2026/06/08/15
• https://www.openwall.com/lists/oss-security/2026/06/08/16
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7R2KWQ6IEDZQHPWK66QN6DG4LW6X3OUM/
• https://www.cve.org/CVERecord?id=CVE-2026-29167
• https://www.cve.org/CVERecord?id=CVE-2026-29170
• https://www.cve.org/CVERecord?id=CVE-2026-34355
• https://www.cve.org/CVERecord?id=CVE-2026-34356
• https://www.cve.org/CVERecord?id=CVE-2026-42535
• https://www.cve.org/CVERecord?id=CVE-2026-42536
• https://www.cve.org/CVERecord?id=CVE-2026-43951
• https://www.cve.org/CVERecord?id=CVE-2026-44119
• https://www.cve.org/CVERecord?id=CVE-2026-44185
• https://www.cve.org/CVERecord?id=CVE-2026-44186
• https://www.cve.org/CVERecord?id=CVE-2026-44631
• https://www.cve.org/CVERecord?id=CVE-2026-48913
• https://www.cve.org/CVERecord?id=CVE-2026-49975

SRPMS 10/core

• apache-2.4.68-1.mga10

9/core

• apache-2.4.68-1.mga9

Publication date: 23 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-12725 , CVE-2026-12969 Description
The updated dnsmasq packages fix multiple security issues: A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service. (CVE-2026-12725) An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that 10 additional bytes exist for fixed-length DNS record fields. A remote attacker controlling a DNS zone can exploit this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-bounds read, potentially accessing stale data from prior transactions. (CVE-2026-12969) References

• https://bugs.mageia.org/show_bug.cgi?id=35935
• https://app.opencve.io/cve/CVE-2026-12725
• https://app.opencve.io/cve/CVE-2026-12969
• https://ubuntu.com/security/notices/USN-8542-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2490763
• https://bugzilla.redhat.com/show_bug.cgi?id=2491663
• https://thekelleys.org.uk/dnsmasq/CHANGELOG
• https://www.cve.org/CVERecord?id=CVE-2026-12725
• https://www.cve.org/CVERecord?id=CVE-2026-12969

SRPMS 10/core

• dnsmasq-2.93-1.mga10

9/core

• dnsmasq-2.93-1.mga9

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The plugin can't connect to the server to make AI calls. This update fixes the reported issue and updates the plugin to version 1.52.1. References

• https://bugs.mageia.org/show_bug.cgi?id=35955
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.52.1
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.52.0
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.51.1
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.51.0
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.50.0
• https://github.com/Acly/krita-ai-diffusion/releases/tag/v1.49.1

SRPMS 10/core

• krita-ai-diffusion-1.52.1-1.mga10

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
nut-scanner failed to start. This update fixes the issue and also updates the nut packages to the latest maintained release. References

• https://bugs.mageia.org/show_bug.cgi?id=35938

SRPMS 10/core

• nut-2.8.5-1.mga10

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
warpinator uses the grpcio module, but with a stamp of the used module version. The stamp was not in accordance with the version of the provided module in the distro, preventing launch. This update fixes that. References

• https://bugs.mageia.org/show_bug.cgi?id=35891

SRPMS 10/core

• warpinator-2.0.4-1.mga10

Publication date: 21 Jul 2026
Type: security
Affected Mageia releases : 10
Description
The updated package fixes a security vulnerability: editor command injection vulnerability. References

• https://bugs.mageia.org/show_bug.cgi?id=35720
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEP2W3H6GWB2VQQATCPANKNKGGK2TGMP/
• https://github.com/jonas/tig/issues/1432

SRPMS 10/core

• tig-2.6.1-1.mga10

Publication date: 21 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The updates packages fix issues in our signature background. The images have been reworked providing a better look. Building with mock is fixed allowing the produced mageia-theme and mageia-theme-extra packages to be installed together. Fix the plymouth theme which still was the Mageia 9 version after upgrades. Behind the scenes some processes are now done at build time, avoiding recurring issues with interlaced images. References

• https://bugs.mageia.org/show_bug.cgi?id=35843
• https://bugs.mageia.org/show_bug.cgi?id=32259

SRPMS 10/core

• mageia-theme-10.11-1.1.mga10
• grub2-2.12-15.1.mga10
• grub2-mageia-theme-dejavu-1.0-17.1.mga10

Publication date: 21 Jul 2026
Type: bugfix
Affected Mageia releases : 10
Description
The last versions of serd, sord, sratom, suil and lilv couldn't be submitted because of Cauldron FREEZE. References

• https://bugs.mageia.org/show_bug.cgi?id=35826

SRPMS 10/core

• serd-0.32.8-1.mga10
• sord-0.16.22-1.mga10
• sratom-0.6.22-1.mga10
• lilv-0.26.4-1.mga10
• suil-0.10.26-3.mga10

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-56016 Description
The updated package fixes a security vulnerability: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. (CVE-2026-56016) References

• https://bugs.mageia.org/show_bug.cgi?id=35800
• https://www.openwall.com/lists/oss-security/2026/07/01/6
• https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OXFQ3DBWPONO7MHLPUC3HP44MVOLIY4B/
• https://www.cve.org/CVERecord?id=CVE-2026-56016

SRPMS 10/core

• perl-CGI-Session-4.490.0-1.mga10