Actualizaciones de Seguridad

Publication date: 23 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
bibletime is updated to version 3.2.0 References

• https://bugs.mageia.org/show_bug.cgi?id=36149
• https://github.com/bibletime/bibletime/releases

SRPMS 10/core

• bibletime-3.2.0-1.mga10
• clucene-2.3.3.4-16.1.mga10

Publication date: 23 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-13577 Description
Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. (CVE-2026-13577) References

• https://bugs.mageia.org/show_bug.cgi?id=35967
• https://www.openwall.com/lists/oss-security/2026/07/20/5
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXWK3ODXBSRKU5P4JUADGHFPAH5I42DO/
• https://www.cve.org/CVERecord?id=CVE-2026-13577

SRPMS 10/core

• perl-Dancer2-2.0.1-1.2.mga10

9/core

• perl-Dancer2-0.400.1-1.2.mga9

Publication date: 23 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-16615 Description
Weak random number generation in pkce implementation. (CVE-2026-16615) References

• https://bugs.mageia.org/show_bug.cgi?id=36176
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6Q63SLBWJIJZVOY6R6AXMKGOBBO26LVB/
• https://bugzilla.redhat.com/show_bug.cgi?id=2504432
• https://gitlab.gnome.org/GNOME/librest/-/issues/25
• https://www.cve.org/CVERecord?id=CVE-2026-16615

SRPMS 10/core

• rest-0.10.2-2.1.mga10

9/core

• rest-0.9.1-2.1.mga9

Publication date: 23 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-66484 , CVE-2026-66485 , CVE-2026-66486 Description
Path Traversal in GNU cpio. (CVE-2026-66484) Uncontrolled Memory Allocation in GNU cpio. (CVE-2026-66485) Improper Output Encoding in GNU cpio. (CVE-2026-66486) References

• https://bugs.mageia.org/show_bug.cgi?id=36242
• https://ubuntu.com/security/notices/USN-8704-1
• https://www.cve.org/CVERecord?id=CVE-2026-66484
• https://www.cve.org/CVERecord?id=CVE-2026-66485
• https://www.cve.org/CVERecord?id=CVE-2026-66486

SRPMS 10/core

• cpio-2.15-3.1.mga10

9/core

• cpio-2.14-1.1.mga9

Publication date: 23 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-53910 Description
Heap-based Buffer Overflow in GNU diffutils. (CVE-2026-53910) References

• https://bugs.mageia.org/show_bug.cgi?id=36243
• https://ubuntu.com/security/notices/USN-8692-1
• https://www.cve.org/CVERecord?id=CVE-2026-53910

SRPMS 10/core

• diffutils-3.12-1.1.mga10

9/core

• diffutils-3.10-1.1.mga9

Publication date: 23 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
twinkle is updated to version 1.11.0 to fix a crash in the application. References

• https://bugs.mageia.org/show_bug.cgi?id=36304

SRPMS 10/core

• twinkle-1.11.0-1.mga10

9/core

• twinkle-1.11.0-1.mga9

Publication date: 21 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-72712 Description
Denial of Service via Zero-Length TCP Option Packet. (CVE-2026-72712) References

• https://bugs.mageia.org/show_bug.cgi?id=36129
• https://www.openwall.com/lists/oss-security/2026/07/29/4
• https://github.com/nmap/nmap/issues/3368
• https://www.vulncheck.com/advisories/nmap-denial-of-service-via-zero-length-tcp-option-packet
• https://www.cve.org/CVERecord?id=CVE-2026-72712

SRPMS 10/core

• nmap-7.98-1.2.mga10

9/core

• nmap-7.95-1.2.mga9

Publication date: 21 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
Description
Out-of-bounds Access in libvterm Resize Handling in Vim < 9.2.1013 Integer Overflow in Undo File Entry Size Check in Vim < v9.2.1014 && Vim >= v8.1.0688 References

• https://bugs.mageia.org/show_bug.cgi?id=36204
• https://www.openwall.com/lists/oss-security/2026/08/26/17
• https://www.openwall.com/lists/oss-security/2026/08/26/18
• https://github.com/vim/vim/security/advisories/GHSA-vfc7-mhvm-gjp8
• https://github.com/vim/vim/security/advisories/GHSA-cvc5-p4x9-3f9f

SRPMS 10/core

• vim-9.2.1054-1.mga10

9/core

• vim-9.2.1054-1.mga9

Publication date: 21 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-86145 Description
Out-of-bounds write in pcre2_dfa_match() with recursive patterns under a low heap limit (CVE-2026-86145). References

• https://bugs.mageia.org/show_bug.cgi?id=36263
• https://www.openwall.com/lists/oss-security/2026/09/04/7
• https://www.openwall.com/lists/oss-security/2026/09/05/3
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf
• https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9
• https://www.cve.org/CVERecord?id=CVE-2026-86145

SRPMS 10/core

• pcre2-10.48-1.mga10

9/core

• pcre2-10.48-1.mga9

Publication date: 21 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
The conda version we had was not ready for Python 3.13. This update allows it to be compatible, with updates of msgpack and pluggy too. References

• https://bugs.mageia.org/show_bug.cgi?id=36305
• https://github.com/conda/conda/issues/14439

SRPMS 10/core

• conda-26.5.3-1.mga10
• python-msgpack-1.2.2-1.mga10
• python-pluggy-1.6.0-1.mga10

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-18321 Description
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec. (CVE-2026-18321) References

• https://bugs.mageia.org/show_bug.cgi?id=36168
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UTEH533TYAX7KYJMMA773F3LEQ3E2JX2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QJWRFBL7QOCH5ZDIFCWDUMRTVPZNV7UQ/
• https://www.cve.org/CVERecord?id=CVE-2026-18321

SRPMS 10/core

• ntpsec-1.2.4-3.2.mga10

9/core

• ntpsec-1.2.2-5.1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
Description
Updated packages fix security issues. Please see the references. References

• https://bugs.mageia.org/show_bug.cgi?id=36153
• https://www.openwall.com/lists/oss-security/2026/08/20/5
• https://www.postfix.org/announcements/postfix-3.11.6.html
• https://www.mail-archive.com/postfix-announce@postfix.org/msg00110.html
• https://www.openwall.com/lists/oss-security/2026/09/10/8
• https://www.postfix.org/announcements/postfix-3.11.7.html

SRPMS 10/core

• postfix-3.9.15-1.mga10

9/core

• postfix-3.8.21-1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10
Description
Updated packages fix security vulnerabilities, please se the reference. References

• https://bugs.mageia.org/show_bug.cgi?id=36131
• https://www.openwall.com/lists/oss-security/2026/08/03/2

SRPMS 10/core

• mpg123-1.33.7-1.mga10

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-40467 , CVE-2026-40468 , CVE-2026-40469 , CVE-2026-40553 Description
Use after free in gawk. (CVE-2026-40467) Heap buffer overflow in gawk. (CVE-2026-40468) Heap buffer overflow in gawk. (CVE-2026-40469) Stack-based buffer overflow in gawk. (CVE-2026-40553) References

• https://bugs.mageia.org/show_bug.cgi?id=35997
• https://ubuntu.com/security/notices/USN-8588-1
• https://www.cve.org/CVERecord?id=CVE-2026-40467
• https://www.cve.org/CVERecord?id=CVE-2026-40468
• https://www.cve.org/CVERecord?id=CVE-2026-40469
• https://www.cve.org/CVERecord?id=CVE-2026-40553

SRPMS 10/core

• gawk-5.3.2-2.1.mga10

9/core

• gawk-5.2.2-1.1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-63676 Description
Updated packages fixes CVE-2026-63676 References

• https://bugs.mageia.org/show_bug.cgi?id=35996
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/J2RXBIKA5WZB2UEHKQR7MEKDH6GABEFL/
• https://www.cve.org/CVERecord?id=CVE-2026-63676

SRPMS 10/core

• perl-YAML-1.310.0-2.1.mga10

9/core

• perl-YAML-1.300.0-3.1.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-15370 , CVE-2026-59843 , CVE-2026-59844 , CVE-2026-59845 , CVE-2026-59846 , CVE-2026-59847 , CVE-2026-59848 , CVE-2026-59849 , CVE-2026-59850 Description
Stack buffer overflow in SFTP server longname construction. (CVE-2026-15370) Denial of service via zero advertised channel packet size. (CVE-2026-59843) Denial of service via oversized SFTP read length. (CVE-2026-59844) Denial of service via unchecked ProxyCommand fork() failure. (CVE-2026-59845) Information disclosure via ProxyCommand %r username expansion. (CVE-2026-59846) Integrity downgrade via OpenSSL AES-GCM tag verification. (CVE-2026-59847) Denial of service via SFTP responses with unknown request IDs. (CVE-2026-59848) Denial of service via automatic certificate authentication loop. (CVE-2026-59849) Use-after-free via data callbacks on closed channels. (CVE-2026-59850) References

• https://bugs.mageia.org/show_bug.cgi?id=35983
• https://www.openwall.com/lists/oss-security/2026/07/21/7
• https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MIVTLBAG4MPX3WGPMVYDO2UPZB6G3ESR/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YZ324UUCGQ4JEC4ZOJMJODWYVPSFBWUU/
• https://lists.debian.org/debian-security-announce/2026/msg00321.html
• https://ubuntu.com/security/notices/USN-8699-1
• https://www.cve.org/CVERecord?id=CVE-2026-15370
• https://www.cve.org/CVERecord?id=CVE-2026-59843
• https://www.cve.org/CVERecord?id=CVE-2026-59844
• https://www.cve.org/CVERecord?id=CVE-2026-59845
• https://www.cve.org/CVERecord?id=CVE-2026-59846
• https://www.cve.org/CVERecord?id=CVE-2026-59847
• https://www.cve.org/CVERecord?id=CVE-2026-59848
• https://www.cve.org/CVERecord?id=CVE-2026-59849
• https://www.cve.org/CVERecord?id=CVE-2026-59850

SRPMS 10/core

• libssh-0.11.5-1.mga10

9/core

• libssh-0.10.6-1.3.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-42616 , CVE-2026-42617 , CVE-2026-42618 , CVE-2026-46569 , CVE-2026-46570 , CVE-2026-46571 , CVE-2026-46572 , CVE-2026-56135 , CVE-2026-56136 Description
Heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616) Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617) Single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618) Heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569) Heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570) Out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571) Heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572) Heap buffer overflow when building inherited ACL data. (CVE-2026-56135) Out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136) References

• https://bugs.mageia.org/show_bug.cgi?id=35940
• https://www.openwall.com/lists/oss-security/2026/07/15/6
• https://lists.debian.org/debian-security-announce/2026/msg00300.html
• https://ubuntu.com/security/notices/USN-8554-1
• https://www.cve.org/CVERecord?id=CVE-2026-42616
• https://www.cve.org/CVERecord?id=CVE-2026-42617
• https://www.cve.org/CVERecord?id=CVE-2026-42618
• https://www.cve.org/CVERecord?id=CVE-2026-46569
• https://www.cve.org/CVERecord?id=CVE-2026-46570
• https://www.cve.org/CVERecord?id=CVE-2026-46571
• https://www.cve.org/CVERecord?id=CVE-2026-46572
• https://www.cve.org/CVERecord?id=CVE-2026-56135
• https://www.cve.org/CVERecord?id=CVE-2026-56136

SRPMS 10/core

• ntfs-3g-2026.2.25-1.1.mga10

9/core

• ntfs-3g-2022.10.3-1.3.mga9

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-56288 , CVE-2026-56289 Description
NULL Pointer Dereference in GNU patch. (CVE-2026-56288) Loop with Unreachable Exit Condition in GNU patch. (CVE-2026-56289) References

• https://bugs.mageia.org/show_bug.cgi?id=35933
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5MJXY435MLDAL5GXH6V5OY6MEMOGFEH5/
• https://cert.pl/en/posts/2026/07/CVE-2026-56288/
• https://www.cve.org/CVERecord?id=CVE-2026-56288
• https://www.cve.org/CVERecord?id=CVE-2026-56289

SRPMS 10/core

• patch-2.8-1.1.mga10

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-19033 , CVE-2026-19662 , CVE-2026-19666 , CVE-2026-19667 , CVE-2026-19668 , CVE-2026-19941 , CVE-2026-75029 , CVE-2026-76163 , CVE-2026-77119 , CVE-2026-77692 , CVE-2026-78301 , CVE-2026-80274 , CVE-2026-81563 , CVE-2026-81736 Description
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification (CVE-2026-19033). qpcache NOQNAME proof use-after-free crashes recursive resolver (CVE-2026-19662). Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path (CVE-2026-19666). Remote assertion failure via 16-bit length truncation in dns_ncache_add() (CVE-2026-19667). Resource Exhaustion via Excessive DNSSEC Cryptographic Material Matching (CVE-2026-19668). checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof (CVE-2026-19941). Message parser retains every identical singleton RDATA, enabling wire-to-work amplification (CVE-2026-75029). named aborts on a TKEY query when the user configuration has no global options statement (CVE-2026-76163). NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets (CVE-2026-77119). Unauthenticated remote crash of named via a single DoH SIG(0) request (CVE-2026-77692). Out-of-zone database nodes can become authoritative zone cuts (CVE-2026-78301). Validating resolver can abort while caching a mismatched NOQNAME proof (CVE-2026-80274). SVCB AliasMode additional-data error leaks qpcache references (CVE-2026-81563). Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees (CVE-2026-81736). References

• https://bugs.mageia.org/show_bug.cgi?id=36326
• https://kb.isc.org/docs/cve-2026-19033
• https://kb.isc.org/docs/cve-2026-19662
• https://kb.isc.org/docs/cve-2026-19666
• https://kb.isc.org/docs/cve-2026-19667
• https://kb.isc.org/docs/cve-2026-19668
• https://kb.isc.org/docs/cve-2026-19941
• https://kb.isc.org/docs/cve-2026-75029
• https://kb.isc.org/docs/cve-2026-76163
• https://kb.isc.org/docs/cve-2026-77119
• https://kb.isc.org/docs/cve-2026-77692
• https://kb.isc.org/docs/cve-2026-78301
• https://kb.isc.org/docs/cve-2026-80274
• https://kb.isc.org/docs/cve-2026-81563
• https://kb.isc.org/docs/cve-2026-81736
• https://www.cve.org/CVERecord?id=CVE-2026-19033
• https://www.cve.org/CVERecord?id=CVE-2026-19662
• https://www.cve.org/CVERecord?id=CVE-2026-19666
• https://www.cve.org/CVERecord?id=CVE-2026-19667
• https://www.cve.org/CVERecord?id=CVE-2026-19668
• https://www.cve.org/CVERecord?id=CVE-2026-19941
• https://www.cve.org/CVERecord?id=CVE-2026-75029
• https://www.cve.org/CVERecord?id=CVE-2026-76163
• https://www.cve.org/CVERecord?id=CVE-2026-77119
• https://www.cve.org/CVERecord?id=CVE-2026-77692
• https://www.cve.org/CVERecord?id=CVE-2026-78301
• https://www.cve.org/CVERecord?id=CVE-2026-80274
• https://www.cve.org/CVERecord?id=CVE-2026-81563
• https://www.cve.org/CVERecord?id=CVE-2026-81736

SRPMS 10/core

• bind-9.20.29-1.mga10

Publication date: 20 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
Description
Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values References

• https://bugs.mageia.org/show_bug.cgi?id=36321
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWACSE6EO43FMBJWXK22JG7C3LAOLJ3Z/
• https://github.com/bw2/ConfigArgParse/security/advisories/GHSA-6m27-337c-jcgf

SRPMS 10/core

• python-configargparse-1.7.7-1.mga10

9/core

• python-configargparse-1.7.7-1.mga9