Lector de Feeds

Publication date: 26 Mar 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-44431 , CVE-2023-51580 , CVE-2023-51589 , CVE-2023-51592 , CVE-2023-51594 , CVE-2023-51596 Description BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2023-44431) BlueZ Audio Profile AVRCP avrcp_parse_attribute_list Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51580) BlueZ Audio Profile AVRCP parse_media_element Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51589) BlueZ Audio Profile AVRCP parse_media_folder Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51592) BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. (CVE-2023-51594) BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. (CVE-2023-51596) References

• https://bugs.mageia.org/show_bug.cgi?id=34123
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KKJVC5RPR5AMR4ZTMHWP7TATS4SY47/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44431
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51580
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51589
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51592
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51594
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51596

SRPMS 9/core

• bluez-5.80-1.mga9

Publication date: 26 Mar 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-12361 Description FFmpeg NULL Pointer Dereference. (CVE-2024-12361) References

• https://bugs.mageia.org/show_bug.cgi?id=34130
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNUZFKKYTUNYVVV4IRSNIJAOCMVCKVS/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12361

SRPMS 9/core

• ffmpeg-5.1.6-1.5.mga9

9/tainted

• ffmpeg-5.1.6-1.5.mga9.tainted

Publication date: 24 Mar 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-24912 Description hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail. (CVE-2025-24912) References

• https://bugs.mageia.org/show_bug.cgi?id=34117
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24912

SRPMS 9/core

• hostapd-2.11-1.1.mga9
• wpa_supplicant-2.11-1.1.mga9

Publication date: 24 Mar 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-58088 , CVE-2025-21838 , CVE-2025-21844 , CVE-2025-21846 , CVE-2025-21847 , CVE-2025-21848 , CVE-2025-21853 , CVE-2025-21854 , CVE-2025-21855 , CVE-2025-21856 , CVE-2025-21857 , CVE-2025-21858 , CVE-2025-21859 , CVE-2025-21862 , CVE-2025-21863 , CVE-2025-21864 , CVE-2025-21865 , CVE-2025-21866 Description Vanilla upstream kernel version 6.6.83 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=34115
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58088
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21838
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21844
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21846
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21847
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21848
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21853
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21854
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21855
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21856
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21857
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21858
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21859
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21862
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21863
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21864
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21865
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21866

SRPMS 9/core

• kernel-linus-6.6.83-1.mga9

Publication date: 24 Mar 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-58088 , CVE-2025-21838 , CVE-2025-21844 , CVE-2025-21846 , CVE-2025-21847 , CVE-2025-21848 , CVE-2025-21853 , CVE-2025-21854 , CVE-2025-21855 , CVE-2025-21856 , CVE-2025-21857 , CVE-2025-21858 , CVE-2025-21859 , CVE-2025-21862 , CVE-2025-21863 , CVE-2025-21864 , CVE-2025-21865 , CVE-2025-21866 Description Upstream kernel version 6.6.83 fixes bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=34114
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-58088
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21838
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21844
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21846
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21847
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21848
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21853
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21854
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21855
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21856
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21857
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21858
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21859
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21862
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21863
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21864
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21865
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21866

SRPMS 9/core

• kernel-6.6.83-1.mga9
• kmod-virtualbox-7.0.24-68.mga9
• kmod-xtables-addons-3.24-74.mga9

Publication date: 22 Mar 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-55549 , CVE-2025-24855 Description xsltGetInheritedNsList in libxslt has a use-after-free issue related to exclusion of result prefixes (CVE-2024-55549). numbers.c in libxslt has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal (CVE-2025-24855). References

• https://bugs.mageia.org/show_bug.cgi?id=34113
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZKCQGOW24ZBKSYCIKDUG4KKITEGCJKY2/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55549
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24855

SRPMS 9/core

• libxslt-1.1.38-1.1.mga9

Publication date: 22 Mar 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-8176 Description Improper restriction of xml entity expansion depth in libexpat. (CVE-2024-8176) References

• https://bugs.mageia.org/show_bug.cgi?id=34111
• https://www.openwall.com/lists/oss-security/2025/03/14/5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8176

SRPMS 9/core

• expat-2.7.0-1.mga9