Actualizaciones de Seguridad

Publication date: 27 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-14957 Description
FIPS mode assertion failure via malicious CERT payload. (CVE-2026-14957) References

• https://bugs.mageia.org/show_bug.cgi?id=35984
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RHUMDPM6XZNYWMXOYIEUCSCNYXBDKSP2/
• https://bugzilla.redhat.com/show_bug.cgi?id=2501764
• https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt
• https://www.cve.org/CVERecord?id=CVE-2026-14957

SRPMS 10/core

• libreswan-5.3-1.1.mga10

Publication date: 26 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-11468 , CVE-2025-15366 , CVE-2025-15367 , CVE-2025-15282 , CVE-2026-0672 , CVE-2026-1299 , CVE-2026-0865 , CVE-2025-12781 , CVE-2026-2297 , CVE-2026-3644 , CVE-2026-4224 , CVE-2026-4519 , CVE-2026-1502 , CVE-2026-3446 , CVE-2026-6100 , CVE-2026-4786 , CVE-2026-5713 Description
Please see the references for additional information about vulnerabilities. References

• https://bugs.mageia.org/show_bug.cgi?id=35072
• https://www.cve.org/CVERecord?id=CVE-2025-11468
• https://www.cve.org/CVERecord?id=CVE-2025-15366
• https://www.cve.org/CVERecord?id=CVE-2025-15367
• https://www.cve.org/CVERecord?id=CVE-2025-15282
• https://www.cve.org/CVERecord?id=CVE-2026-0672
• https://www.cve.org/CVERecord?id=CVE-2026-1299
• https://www.cve.org/CVERecord?id=CVE-2026-0865
• https://www.cve.org/CVERecord?id=CVE-2025-12781
• https://www.cve.org/CVERecord?id=CVE-2026-2297
• https://www.cve.org/CVERecord?id=CVE-2026-3644
• https://www.cve.org/CVERecord?id=CVE-2026-4224
• https://www.cve.org/CVERecord?id=CVE-2026-4519
• https://www.cve.org/CVERecord?id=CVE-2026-1502
• https://www.cve.org/CVERecord?id=CVE-2026-3446
• https://www.cve.org/CVERecord?id=CVE-2026-6100
• https://www.cve.org/CVERecord?id=CVE-2026-4786
• https://www.cve.org/CVERecord?id=CVE-2026-5713

SRPMS 10/core

• python3-3.13.15-1.mga10
• python-pip-26.2.1-1.mga10

Publication date: 25 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-58459 Description
Command Injection via gnuplot plot title subtype field. (CVE-2026-58459) References

• https://bugs.mageia.org/show_bug.cgi?id=35953
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/AQ2ORFQ66FNIA3MWLLYYOG4BV4FARQUN/
• https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFEVG42PGVGT7U55DLZYEB2HKIVYGMPM/
• https://www.cve.org/CVERecord?id=CVE-2026-58459

SRPMS 10/core

• gpsd-3.27.5-1.1.mga10

9/core

• gpsd-3.25-1.2.mga9

Publication date: 25 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-7867 Description
Local privilege escalation via as-user option spoofing. (CVE-2026-7867) References

• https://bugs.mageia.org/show_bug.cgi?id=36173
• https://lists.debian.org/debian-security-announce/2026/msg00325.html
• https://ubuntu.com/security/notices/USN-8701-1
• https://www.cve.org/CVERecord?id=CVE-2026-7867

SRPMS 10/core

• udisks2-2.10.1-3.1.mga10

Publication date: 25 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Conflicting file between Mageia 9 and Mageia 10 versions of the package can block upgrades to Mageia 10. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36269

SRPMS 10/core

• libalkimia-8.2.1-1.1.mga10

Publication date: 25 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-44889 Description
Location header normalization during redirect leads to open redirect - again References

• https://bugs.mageia.org/show_bug.cgi?id=36323
• https://ubuntu.com/security/notices/USN-8759-1
• https://github.com/Pylons/webob/security/advisories/GHSA-fh3h-vg37-cc95
• https://www.cve.org/CVERecord?id=CVE-2026-44889

SRPMS 10/core

• python-webob-1.8.11-1.mga10

9/core

• python-webob-1.8.11-1.mga9

Publication date: 25 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14586 , CVE-2026-32665 , CVE-2026-40622 , CVE-2026-40691 , CVE-2026-41637 , CVE-2026-42955 , CVE-2026-44621 , CVE-2026-44687 , CVE-2026-44690 , CVE-2026-46582 , CVE-2026-50045 , CVE-2026-50046 , CVE-2026-50243 , CVE-2026-50248 , CVE-2026-50251 , CVE-2026-50252 , CVE-2026-52863 , CVE-2026-54478 , CVE-2026-55708 , CVE-2026-55717 , CVE-2026-55973 , CVE-2026-55990 , CVE-2026-55991 , CVE-2026-56416 , CVE-2026-56444 , CVE-2026-77860 , CVE-2026-77955 , CVE-2026-78227 , CVE-2026-80225 , CVE-2026-81634 , CVE-2026-81642 , CVE-2026-82717 , CVE-2026-82720 , CVE-2026-85501 Description
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY Possible heap buffer overflow during DNSSEC canonicalization CNAME synthesis could lead to heap corruption Possible ZONEMD verification bypass window Use-after-free in DoQ stream output buffer on reset re-transmission Possible degradation of service from continuous queries on the same TCP/DoT connection Use-after-free in DoH stream cleanup code path Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC 'serve-expired' can bypass Unbound 'wait-limit' Remote DNS-over-QUIC denial of service due to 'quic-size' budget bypass Packet of death for DNSCrypt over TCP Cross-zone wildcard cache poisoning via RRSIG.labels manipulation 'dns-error-reporting: yes' leads to stack buffer overflow Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments Libunbound applications configured with 'unwanted-reply-threshold' could eventually be abruptly terminated 'max-global-quota' reset by DNSSEC validation restarts Possible heap use-after-free in an error path when a DoT forwarded query is jostled out 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL BOGUS configured primary hostname accepted for XFR in auth/rpz zones Date: Attacker supplied '0.0.0.0'/'::' glue triggers defensive full-cache flush Possible cache poisoning attack by mapping source port population per thread Memory corruption could lead to crash and denial of service 'serve-expired-client-timeout' and 'response-ip' CNAME redirect could lead to a crash Packet of death for a DNSCrypt misconfigured Unbound Remote DNS-over-QUIC (DoQ) flow-control assertion failure in libngtcp2 Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name Degradation of resolution service when 'discard-timeout' and 'serve-expired-client-timeout' are combined in unusual configuration Degradation of resolution service from improperly accounted client-terminated DNS-over-QUIC queries Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records Off-by-one error in 'harden-below-nxdomain' logic can shadow a stub/forward zone by a legitimate parent's NXDOMAIN A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path DNS Cookie bypass when combined with proxy-protocol use Privacy/configuration issue when adding local data in views through 'unbound-control' Possible arbitrary code execution during DNSSEC validation Heap overflow with multiple NSID, COOKIE, PADDING EDNS options Crash during DNSSEC validation of malicious content Date: Packet of death with DNSCrypt Another "ghost domain names" attack variant Long list of incoming EDNS options degrades performance Jostle logic bypass degrades resolution performance Degradation of service with unbounded NSEC3 hash calculations Possible cache poisoning via promiscuous records for the authority section Unbounded name compression in certain cases causes degradation of service Use after free and crash under special conditions in RPZ code Possible domain hijacking via promiscuous records in the authority section Cache poisoning via the ECS-enabled Rebirthday Attack Unbounded name compression could lead to Denial of Service Unbound vulnerable to the "DNSBomb" pulsing DoS amplification attack Denial of service when trimming EDE text on positive replies DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers NSEC3 closest encloser proof can exhaust CPU Non-Responsive Delegation Attack Novel "ghost domain names" attack by updating almost expired delegation information Novel "ghost domain names" attack by introducing subdomain delegations Local symlink attack Vulnerability in Domain Parse NXNSAttack Vulnerability in IPSEC module Vulnerability in parsing NOTIFY queries Vulnerability in the processing of wildcard synthesized NSEC records No limit to delegation chaining Ghost domain names attack Incorrect proof processing for NSEC3-signed zone Processing of duplicate CNAME records in a signed zone Empty error packet handling assertion failure References

• https://bugs.mageia.org/show_bug.cgi?id=36346
• https://nlnetlabs.nl/projects/unbound/security-advisories/
• https://www.cve.org/CVERecord?id=CVE-2026-14586
• https://www.cve.org/CVERecord?id=CVE-2026-32665
• https://www.cve.org/CVERecord?id=CVE-2026-40622
• https://www.cve.org/CVERecord?id=CVE-2026-40691
• https://www.cve.org/CVERecord?id=CVE-2026-41637
• https://www.cve.org/CVERecord?id=CVE-2026-42955
• https://www.cve.org/CVERecord?id=CVE-2026-44621
• https://www.cve.org/CVERecord?id=CVE-2026-44687
• https://www.cve.org/CVERecord?id=CVE-2026-44690
• https://www.cve.org/CVERecord?id=CVE-2026-46582
• https://www.cve.org/CVERecord?id=CVE-2026-50045
• https://www.cve.org/CVERecord?id=CVE-2026-50046
• https://www.cve.org/CVERecord?id=CVE-2026-50243
• https://www.cve.org/CVERecord?id=CVE-2026-50248
• https://www.cve.org/CVERecord?id=CVE-2026-50251
• https://www.cve.org/CVERecord?id=CVE-2026-50252
• https://www.cve.org/CVERecord?id=CVE-2026-52863
• https://www.cve.org/CVERecord?id=CVE-2026-54478
• https://www.cve.org/CVERecord?id=CVE-2026-55708
• https://www.cve.org/CVERecord?id=CVE-2026-55717
• https://www.cve.org/CVERecord?id=CVE-2026-55973
• https://www.cve.org/CVERecord?id=CVE-2026-55990
• https://www.cve.org/CVERecord?id=CVE-2026-55991
• https://www.cve.org/CVERecord?id=CVE-2026-56416
• https://www.cve.org/CVERecord?id=CVE-2026-56444
• https://www.cve.org/CVERecord?id=CVE-2026-77860
• https://www.cve.org/CVERecord?id=CVE-2026-77955
• https://www.cve.org/CVERecord?id=CVE-2026-78227
• https://www.cve.org/CVERecord?id=CVE-2026-80225
• https://www.cve.org/CVERecord?id=CVE-2026-81634
• https://www.cve.org/CVERecord?id=CVE-2026-81642
• https://www.cve.org/CVERecord?id=CVE-2026-82717
• https://www.cve.org/CVERecord?id=CVE-2026-82720
• https://www.cve.org/CVERecord?id=CVE-2026-85501

SRPMS 10/core

• unbound-1.26.1-1.mga10

9/core

• unbound-1.26.1-1.mga9

Publication date: 25 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-87819 Description
Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the `.gitmodules` **name** but the sibling **path** field still reaches `os.makedirs()` unguarded, although GitPython already owns the containment guard References

• https://bugs.mageia.org/show_bug.cgi?id=36236
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BDOHJYCCKJJIA7ROKB3WUA4RCPF3K4XD/
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CXBNC2IT6FI6BVCJONOLKTNTJK7K4A5/
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w
• https://www.cve.org/CVERecord?id=CVE-2026-87819

SRPMS 10/core

• python-gitpython-3.1.62-1.mga10

9/core

• python-gitpython-3.1.62-1.mga9

Publication date: 25 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
In systems that don't have plasma as the desktop discover fails to start. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36259

SRPMS 10/core

• discover-6.5.5-4.1.mga10

Publication date: 24 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
This update fixes two issues causing zmsetup to fail due to mysql compatibility commands having been removed from mariadb. These commands are now replaced with the native mariadb equivalents. References

• https://bugs.mageia.org/show_bug.cgi?id=36287

SRPMS 10/tainted

• zoneminder-1.38.0-1.1.mga10.tainted

Publication date: 24 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-92238 , CVE-2026-92239 , CVE-2026-92240 , CVE-2026-92005 , CVE-2026-92006 , CVE-2026-92007 , CVE-2026-92008 , CVE-2026-92009 , CVE-2026-92010 , CVE-2026-92011 , CVE-2026-92012 , CVE-2026-92013 , CVE-2026-92014 , CVE-2026-92015 , CVE-2026-92016 , CVE-2026-92017 , CVE-2026-92018 , CVE-2026-92019 , CVE-2026-92020 , CVE-2026-92021 , CVE-2026-92022 , CVE-2026-92023 , CVE-2026-92024 , CVE-2026-92025 , CVE-2026-92026 , CVE-2026-92027 , CVE-2026-92028 , CVE-2026-92029 , CVE-2026-92030 , CVE-2026-92031 , CVE-2026-92032 , CVE-2026-92038 , CVE-2026-92039 , CVE-2026-92041 , CVE-2026-92042 , CVE-2026-92043 , CVE-2026-92044 , CVE-2026-92045 , CVE-2026-92046 , CVE-2026-92047 , CVE-2026-92052 , CVE-2026-92053 , CVE-2026-92054 , CVE-2026-92055 , CVE-2026-92056 , CVE-2026-92057 , CVE-2026-92058 , CVE-2026-92059 , CVE-2026-92060 , CVE-2026-92062 , CVE-2026-92064 , CVE-2026-92067 , CVE-2026-92068 , CVE-2026-92069 , CVE-2026-92070 , CVE-2026-92072 , CVE-2026-92073 , CVE-2026-92074 , CVE-2026-92075 , CVE-2026-92076 , CVE-2026-92077 , CVE-2026-92078 Description
Ambiguous parsing of mail headers. (CVE-2026-92238) Buffer overrun in IMAP. (CVE-2026-92239) Out-of-bounds read in IMAP response parser. (CVE-2026-92240) Use-after-free in the Audio/Video: Web Codecs component. (CVE-2026-92005) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92006) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92007) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92008) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92009) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92010) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92011) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92012) Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. (CVE-2026-92013) Privilege escalation due to incorrect boundary conditions in the Graphics component. (CVE-2026-92014) Privilege escalation in the WebExtensions component. (CVE-2026-92015) Use-after-free in the Disability Access APIs component. (CVE-2026-92016) Privilege escalation in the DOM: Service Workers component. (CVE-2026-92017) Sandbox escape in the DOM: Core & HTML component. (CVE-2026-92018) Mitigation bypass in the Remote Settings Client component. (CVE-2026-92019) Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. (CVE-2026-92020) Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-92021) Use-after-free in the DOM: HTML Parser component. (CVE-2026-92022) Use-after-free in the XML component. (CVE-2026-92023) Use-after-free in the SVG component. (CVE-2026-92024) Use-after-free in the DOM: Navigation component. (CVE-2026-92025) Use-after-free in the Networking component. (CVE-2026-92026) Use-after-free in the DOM: Streams component. (CVE-2026-92027) Use-after-free in the DOM: Core & HTML component. (CVE-2026-92028) Use-after-free in the SVG component. (CVE-2026-92029) Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. (CVE-2026-92030) Information disclosure in the Graphics: ImageLib component. (CVE-2026-92031) Sandbox escape due to invalid pointer in the Graphics component. (CVE-2026-92032) Mitigation bypass in the Remote Settings Client component. (CVE-2026-92038) Mitigation bypass in the DOM: Notifications component. (CVE-2026-92039) Mitigation bypass in the DOM: Networking component. (CVE-2026-92041) Race condition in the DOM: Content Processes component. (CVE-2026-92042) Privilege escalation due to incorrect boundary conditions in the Audio/Video component. (CVE-2026-92043) Information disclosure in the Networking: HTTP component. (CVE-2026-92044) Sandbox escape due to incorrect boundary conditions in the WebRTC component. (CVE-2026-92045) Use-after-free in the Graphics component. (CVE-2026-92046) Privilege escalation in the Crash Reporting component. (CVE-2026-92047) Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. (CVE-2026-92052) Privilege escalation in the Graphics: CanvasWebGL component. (CVE-2026-92053) Privilege escalation in the Memory component. (CVE-2026-92054) Privilege escalation in the DevTools component. (CVE-2026-92055) Use-after-free in the Graphics: Text component. (CVE-2026-92056) Mitigation bypass in the Enterprise Policies component. (CVE-2026-92057) Use-after-free in the Graphics component. (CVE-2026-92058) Incorrect boundary conditions in the DOM: Editor component. (CVE-2026-92059) Use-after-free in the Internationalization component. (CVE-2026-92060) Privilege escalation in the Session Restore component. (CVE-2026-92062) Use-after-free in the Widget: Gtk component. (CVE-2026-92067) Site isolation issue in the Reader Mode component. (CVE-2026-92068) Spoofing issue in the DOM: Navigation component. (CVE-2026-92069) Information disclosure in the Networking component. (CVE-2026-92070) Incorrect boundary conditions in the Safe Browsing component. (CVE-2026-92072) Privilege escalation in the Enterprise Policies component. (CVE-2026-92073) Mitigation bypass in the Popup Blocker component. (CVE-2026-92074) Mitigation bypass in the Networking component. (CVE-2026-92075) Incorrect boundary conditions in the Networking component. (CVE-2026-92076) Denial-of-service in the SVG component. (CVE-2026-92077) Denial-of-service in the Security component. (CVE-2026-92078) References

• https://bugs.mageia.org/show_bug.cgi?id=36318
• https://www.thunderbird.net/en-US/thunderbird/140.16.0esr/releasenotes/
• https://www.thunderbird.net/en-US/thunderbird/153.3.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-95/
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-96/
• https://www.cve.org/CVERecord?id=CVE-2026-92238
• https://www.cve.org/CVERecord?id=CVE-2026-92239
• https://www.cve.org/CVERecord?id=CVE-2026-92240
• https://www.cve.org/CVERecord?id=CVE-2026-92005
• https://www.cve.org/CVERecord?id=CVE-2026-92006
• https://www.cve.org/CVERecord?id=CVE-2026-92007
• https://www.cve.org/CVERecord?id=CVE-2026-92008
• https://www.cve.org/CVERecord?id=CVE-2026-92009
• https://www.cve.org/CVERecord?id=CVE-2026-92010
• https://www.cve.org/CVERecord?id=CVE-2026-92011
• https://www.cve.org/CVERecord?id=CVE-2026-92012
• https://www.cve.org/CVERecord?id=CVE-2026-92013
• https://www.cve.org/CVERecord?id=CVE-2026-92014
• https://www.cve.org/CVERecord?id=CVE-2026-92015
• https://www.cve.org/CVERecord?id=CVE-2026-92016
• https://www.cve.org/CVERecord?id=CVE-2026-92017
• https://www.cve.org/CVERecord?id=CVE-2026-92018
• https://www.cve.org/CVERecord?id=CVE-2026-92019
• https://www.cve.org/CVERecord?id=CVE-2026-92020
• https://www.cve.org/CVERecord?id=CVE-2026-92021
• https://www.cve.org/CVERecord?id=CVE-2026-92022
• https://www.cve.org/CVERecord?id=CVE-2026-92023
• https://www.cve.org/CVERecord?id=CVE-2026-92024
• https://www.cve.org/CVERecord?id=CVE-2026-92025
• https://www.cve.org/CVERecord?id=CVE-2026-92026
• https://www.cve.org/CVERecord?id=CVE-2026-92027
• https://www.cve.org/CVERecord?id=CVE-2026-92028
• https://www.cve.org/CVERecord?id=CVE-2026-92029
• https://www.cve.org/CVERecord?id=CVE-2026-92030
• https://www.cve.org/CVERecord?id=CVE-2026-92031
• https://www.cve.org/CVERecord?id=CVE-2026-92032
• https://www.cve.org/CVERecord?id=CVE-2026-92038
• https://www.cve.org/CVERecord?id=CVE-2026-92039
• https://www.cve.org/CVERecord?id=CVE-2026-92041
• https://www.cve.org/CVERecord?id=CVE-2026-92042
• https://www.cve.org/CVERecord?id=CVE-2026-92043
• https://www.cve.org/CVERecord?id=CVE-2026-92044
• https://www.cve.org/CVERecord?id=CVE-2026-92045
• https://www.cve.org/CVERecord?id=CVE-2026-92046
• https://www.cve.org/CVERecord?id=CVE-2026-92047
• https://www.cve.org/CVERecord?id=CVE-2026-92052
• https://www.cve.org/CVERecord?id=CVE-2026-92053
• https://www.cve.org/CVERecord?id=CVE-2026-92054
• https://www.cve.org/CVERecord?id=CVE-2026-92055
• https://www.cve.org/CVERecord?id=CVE-2026-92056
• https://www.cve.org/CVERecord?id=CVE-2026-92057
• https://www.cve.org/CVERecord?id=CVE-2026-92058
• https://www.cve.org/CVERecord?id=CVE-2026-92059
• https://www.cve.org/CVERecord?id=CVE-2026-92060
• https://www.cve.org/CVERecord?id=CVE-2026-92062
• https://www.cve.org/CVERecord?id=CVE-2026-92064
• https://www.cve.org/CVERecord?id=CVE-2026-92067
• https://www.cve.org/CVERecord?id=CVE-2026-92068
• https://www.cve.org/CVERecord?id=CVE-2026-92069
• https://www.cve.org/CVERecord?id=CVE-2026-92070
• https://www.cve.org/CVERecord?id=CVE-2026-92072
• https://www.cve.org/CVERecord?id=CVE-2026-92073
• https://www.cve.org/CVERecord?id=CVE-2026-92074
• https://www.cve.org/CVERecord?id=CVE-2026-92075
• https://www.cve.org/CVERecord?id=CVE-2026-92076
• https://www.cve.org/CVERecord?id=CVE-2026-92077
• https://www.cve.org/CVERecord?id=CVE-2026-92078

SRPMS 10/core

• thunderbird-153.3.0-1.mga10
• thunderbird-l10n-153.3.0-1.mga10

9/core

• thunderbird-140.16.0-1.mga9
• thunderbird-l10n-140.16.0-1.mga9

Publication date: 24 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-64193 , CVE-2026-64194 , CVE-2026-81928 Description
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. (CVE-2026-64193) Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. (CVE-2026-64194) Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. (CVE-2026-81928) References

• https://bugs.mageia.org/show_bug.cgi?id=35968
• https://www.openwall.com/lists/oss-security/2026/07/20/12
• https://www.openwall.com/lists/oss-security/2026/07/20/13
• https://www.net-dns.org/blog/#release-candidate-for-netdns-1.56
• https://rt.cpan.org/Ticket/Display.html?id=179945
• https://rt.cpan.org/Ticket/Display.html?id=179946
• https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/changes
• https://lists.debian.org/debian-security-announce/2026/msg00370.html
• https://www.openwall.com/lists/oss-security/2026/09/02/1
• https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L245-262
• https://metacpan.org/release/NLNETLABS/Net-DNS-1.56/source/lib/Net/DNS/RR/TSIG.pm#L62-73
• https://datatracker.ietf.org/doc/html/rfc8945#section-5.2
• https://rt.cpan.org/Ticket/Display.html?id=181125
• https://metacpan.org/release/NLNETLABS/Net-DNS-1.57/changes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5TS4YPB3LGX5Q5VWSYLSIQZWXJU4UMZN/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GGGP7EQRAUOGLVT6K5VJ7U3KCA7YMNZZ/
• https://www.cve.org/CVERecord?id=CVE-2026-64193
• https://www.cve.org/CVERecord?id=CVE-2026-64194
• https://www.cve.org/CVERecord?id=CVE-2026-81928

SRPMS 10/core

• perl-Net-DNS-1.570.0-1.mga10

9/core

• perl-Net-DNS-1.360.0-1.1.mga9

Publication date: 24 Sep 2026
Type: security
Affected Mageia releases : 10
Description
This update brings security fixes provided by upstream. References

• https://bugs.mageia.org/show_bug.cgi?id=36285
• https://www.openwall.com/lists/oss-security/2026/09/09/1

SRPMS 10/core

• fuse3-3.18.3-1.mga10

Publication date: 24 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
geogebra is updated to version 5.4.929.3 References

• https://bugs.mageia.org/show_bug.cgi?id=36300
• https://github.com/geogebra/geogebra/tree/20c53d18

SRPMS 10/nonfree

• geogebra-5.4.929.3-1.mga10.nonfree

Publication date: 24 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-93676 Description
filtering for broadcast messages bypassing path/interface/member checks References

• https://bugs.mageia.org/show_bug.cgi?id=36136
• https://www.openwall.com/lists/oss-security/2026/08/11/10
• https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c
• https://lists.debian.org/debian-security-announce/2026/msg00346.html
• https://www.cve.org/CVERecord?id=CVE-2026-93676

SRPMS 10/core

• xdg-dbus-proxy-0.1.8-1.mga10

9/core

• xdg-dbus-proxy-0.1.8-1.mga9

Publication date: 24 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-19953 Description
Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host encoding matches other clients instead of emitting a non-standard, non-round-tripping A-label (CVE-2026-19953) References

• https://bugs.mageia.org/show_bug.cgi?id=36193
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LMFMV7L7KSZWQ7ABCQNPAG65XHUR276O/
• https://www.cve.org/CVERecord?id=CVE-2026-19953

SRPMS 10/core

• perl-URI-5.360.0-1.mga10

9/core

• perl-URI-5.360.0-1.mga9

Publication date: 24 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-72693 Description
Local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login. (CVE-2026-72693) References

• https://bugs.mageia.org/show_bug.cgi?id=36239
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROE6W66CNK3GP7353HAME3NKIXGBUZ64/
• https://bugzilla.redhat.com/show_bug.cgi?id=2462115
• https://www.cve.org/CVERecord?id=CVE-2026-72693

SRPMS 10/core

• kbd-2.9.0-1.1.mga10

9/core

• kbd-2.5.1-1.1.mga9

Publication date: 23 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14324 , CVE-2026-14330 Description
RAOP module accepts unbounded Content-Length values and does not check the pw_array_add() return. (CVE-2026-14324) Multiple unbounded alloca() calls in the PulseAudio protocol server. (CVE-2026-14330) References

• https://bugs.mageia.org/show_bug.cgi?id=35929
• https://ubuntu.com/security/notices/USN-8535-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2495903
• https://gitlab.freedesktop.org/pipewire/pipewire/-/work_items/5352
• https://bugzilla.redhat.com/show_bug.cgi?id=2495907
• https://www.cve.org/CVERecord?id=CVE-2026-14324
• https://www.cve.org/CVERecord?id=CVE-2026-14330

SRPMS 10/core

• pipewire-1.6.5-1.1.mga10

9/core

• pipewire-0.3.85-6.1.mga9

Publication date: 23 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-10650 Description
warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption. (CVE-2026-10650) References

• https://bugs.mageia.org/show_bug.cgi?id=36157
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KMAEZLLRGAX46TX4KZNYWZXYVIWBF3RU/
• https://github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded-alloc
• https://github.com/advisories/GHSA-23jv-8gf4-7r88
• https://www.cve.org/CVERecord?id=CVE-2026-10650

SRPMS 10/core

• libwebsockets-4.5.2-1.1.mga10

9/core

• libwebsockets-4.3.2-1.1.mga9

Publication date: 23 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
amavisd service fails to start. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36315
• https://gitlab.com/amavis/amavis/-/work_items/128

SRPMS 10/core

• amavisd-new-2.15.0-1.mga10