Mageia Security

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-2236 Description
Libgcrypt: vulnerable to marvin attack. (CVE-2024-2236) References

• https://bugs.mageia.org/show_bug.cgi?id=36248
• https://ubuntu.com/security/notices/USN-8711-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2268268
• https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html
• https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt
• https://people.redhat.com/~hkario/marvin/
• https://dev.gnupg.org/T7136
• https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17
• https://www.cve.org/CVERecord?id=CVE-2024-2236

SRPMS 10/core

• libgcrypt-1.11.3-1.1.mga10

Publication date: 01 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55380 , CVE-2026-54060 , CVE-2026-54059 , CVE-2026-55379 , CVE-2026-59205 , CVE-2026-59199 , CVE-2026-59197 , CVE-2026-59198 , CVE-2026-54058 , CVE-2026-59204 , CVE-2026-59203 Description
Prevent decompression bomb when parsing PDF WindowsViewer.get_command injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds (OOB) read Out-of-bounds (OOB) read when saving 1 mode TGA images Out-of-bounds (OOB) write from large RankFilter sizes Out-of-bounds (OOB) write from Image.paste() Out-of-bounds (OOB) write in ImageCmsTransform Prevent FontFile decompression bomb Prevent GD decompression bomb References

• https://bugs.mageia.org/show_bug.cgi?id=35909
• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
• https://www.cve.org/CVERecord?id=CVE-2026-55380
• https://www.cve.org/CVERecord?id=CVE-2026-54060
• https://www.cve.org/CVERecord?id=CVE-2026-54059
• https://www.cve.org/CVERecord?id=CVE-2026-55379
• https://www.cve.org/CVERecord?id=CVE-2026-59205
• https://www.cve.org/CVERecord?id=CVE-2026-59199
• https://www.cve.org/CVERecord?id=CVE-2026-59197
• https://www.cve.org/CVERecord?id=CVE-2026-59198
• https://www.cve.org/CVERecord?id=CVE-2026-54058
• https://www.cve.org/CVERecord?id=CVE-2026-59204
• https://www.cve.org/CVERecord?id=CVE-2026-59203

SRPMS 10/core

• python-pillow-12.3.0-1.mga10

Publication date: 01 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
glabels can't open previously-created glabels files. We have added a patch to fix the issue but the project is dead upstream and its developer is now focussing on glabels-qt. We are releasing glabels-qt as an alternative. Both versions fix the reported issue; it is your decision what tool to use. References

• https://bugs.mageia.org/show_bug.cgi?id=36053
• https://github.com/j-evins/glabels-qt

SRPMS 10/core

• glabels-3.4.1-12.1.mga10
• glabels-qt-3.99-0.2.2026.08.27git554c9f0.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Borgbackup uses the msgpack python module, and it includes a stopping check for exactly the version 1.2.1. It also recognises an option to disable this check. The updated package shunts this check, which seems overzealous. References

• https://bugs.mageia.org/show_bug.cgi?id=36364

SRPMS 10/core

• borgbackup-1.4.5-1.1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Due to a missing requirement on zstd, engrampa can't open zst files. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36387

SRPMS 10/core

• engrampa-1.28.5-1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
LXDM is only installed by task-lxde. If you only install task-lxde-minimal, then you miss LXDM and you only have XDM which doesn't let you select your desktop environment. This update fixes the reported issue, moving the requirement on LXDM to the task-lxde-minimal package. References

• https://bugs.mageia.org/show_bug.cgi?id=36390

SRPMS 10/core

• task-lxde-10-2.1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Previously setting a dark theme is not respected after a system reboot. This update fixes the issue by updating whatsie to the 6.1.1 version. References

• https://bugs.mageia.org/show_bug.cgi?id=35397
• https://github.com/keshavbhatt/whatsie/issues/299
• https://github.com/keshavbhatt/whatsie/releases/tag/v6.1.1
• https://github.com/keshavbhatt/whatsie/releases#release-v6.1.0
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.4
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.3
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.1
• https://github.com/keshavbhatt/whatsie/releases#release-v6.0.0

SRPMS 10/core

• whatsie-6.1.1-1.mga10

Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
urpm-ng is a reimplementation of the urpmi toolset, written in Python on top of libsolv. It installs, upgrades, removes and queries packages, and resolves dependencies automatically. This packages introduces urpm-ng in Mageia 9 and 10 to allow early testers do migrations from Mageia 9 to Mageia 10 with the package manager component without add external repositories. We do not recommend it yet for inexperienced users. References

• https://bugs.mageia.org/show_bug.cgi?id=36393

SRPMS 10/core

• urpm-ng-0.9.14-1.mga10

9/core

• urpm-ng-0.9.14-1.mga9

Publication date: 29 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-52791 , CVE-2026-77478 Description
fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478) References

• https://bugs.mageia.org/show_bug.cgi?id=36164
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OHDCW47LEOQXLVH2XJNC3A7VFVELJQ6U/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YO4BSFYJPI6ZGUIXZ3AHYYYFEYEM4MFO/
• https://github.com/containers/fuse-overlayfs/releases/tag/v1.17
• https://github.com/containers/fuse-overlayfs/releases/tag/v1.18
• https://www.cve.org/CVERecord?id=CVE-2026-52791
• https://www.cve.org/CVERecord?id=CVE-2026-77478

SRPMS 10/core

• fuse-overlayfs-1.18-1.mga10

Publication date: 29 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
The tool has changed developers and has been migrated to Qt6. The update fixes bugs in our current release including but not limited to a bug where, in some conditions, the GUI does not start. References

• https://bugs.mageia.org/show_bug.cgi?id=31980
• https://github.com/Boomaga/boomaga/releases#release-v3.9.2
• https://github.com/Boomaga/boomaga/releases#release-v3.9.1
• https://github.com/Boomaga/boomaga/releases#release-v3.9.0
• https://github.com/Boomaga/boomaga/releases#release-v3.8.1
• https://github.com/Boomaga/boomaga/releases#release-v3.7.0
• https://github.com/Boomaga/boomaga/releases#release-v3.6.0
• https://github.com/Boomaga/boomaga/releases#release-v3.5.0
• https://github.com/Boomaga/boomaga/issues/143

SRPMS 10/core

• boomaga-3.9.2-1.mga10

9/core

• boomaga-3.9.2-1.mga9

Publication date: 28 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-54411 Description
The updated packages fix a security vulnerability: Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison. (CVE-2026-54411) References

• https://bugs.mageia.org/show_bug.cgi?id=35881
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5OKVWSDQUM4BD3D4IPRSS2LJPLO2SRH/
• https://ubuntu.com/security/notices/USN-8601-1
• https://www.cve.org/CVERecord?id=CVE-2026-54411

SRPMS 10/core

• pam-1.7.1-2.1.mga10

Publication date: 28 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-13757 , CVE-2026-18938 Description
The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. (CVE-2026-13757) Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. (CVE-2026-18938) References

• https://bugs.mageia.org/show_bug.cgi?id=35906
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q6TQ5QWOGE7ZBPZGVINQXHGKAYSV4IMF/
• https://bugzilla.redhat.com/show_bug.cgi?id=2494556
• https://github.com/p11-glue/p11-kit/issues/767
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD5OWYEURQQ756QI27UWHAMDLD5B6WGZ/
• https://www.cve.org/CVERecord?id=CVE-2026-13757
• https://www.cve.org/CVERecord?id=CVE-2026-18938

SRPMS 10/core

• p11-kit-0.25.10-1.1.mga10

Publication date: 28 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-11979 , CVE-2026-86137 , CVE-2026-86138 , CVE-2026-86139 , CVE-2026-86140 , CVE-2026-86141 , CVE-2026-86142 , CVE-2026-86143 , CVE-2026-86144 Description
The updated packages fix several security issues: Stack-Based Buffer Overflow in libxml2. (CVE-2026-11979) In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. (CVE-2026-86137) In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. (CVE-2026-86138) In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. (CVE-2026-86139) In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. (CVE-2026-86140) xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. (CVE-2026-86141) In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. (CVE-2026-86142) In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. (CVE-2026-86143) In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). (CVE-2026-86144) References

• https://bugs.mageia.org/show_bug.cgi?id=35932
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZWJ6JIPH33FSDSBTGTTXHQQKFJEXIKRU/
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
• https://www.openwall.com/lists/oss-security/2026/09/04/5
• https://www.openwall.com/lists/oss-security/2026/09/05/4
• https://www.cve.org/CVERecord?id=CVE-2026-11979
• https://www.cve.org/CVERecord?id=CVE-2026-86137
• https://www.cve.org/CVERecord?id=CVE-2026-86138
• https://www.cve.org/CVERecord?id=CVE-2026-86139
• https://www.cve.org/CVERecord?id=CVE-2026-86140
• https://www.cve.org/CVERecord?id=CVE-2026-86141
• https://www.cve.org/CVERecord?id=CVE-2026-86142
• https://www.cve.org/CVERecord?id=CVE-2026-86143
• https://www.cve.org/CVERecord?id=CVE-2026-86144

SRPMS 10/core

• libxml2-2.15.1-3.2.mga10

Publication date: 28 Sep 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-91768 , CVE-2025-1218 , CVE-2026-91769 , CVE-2026-91767 , CVE-2026-6103 , CVE-2026-91765 , CVE-2025-14181 , CVE-2026-92842 , CVE-2026-91766 , CVE-2026-93682 Description
FILTER_SANITIZE_ENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN Integer overflow in phar_tar_number() allowing TAR archive entry injection Unbounded recursion in server-side cleanup_xml_node() Integer overflow to buffer overflow in SOAP HTTP parsing) Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL ross-origin credential leak in HTTP stream wrapper redirects Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header References

• https://bugs.mageia.org/show_bug.cgi?id=36367
• https://www.php.net/ChangeLog-8.php#8.2.34
• https://www.cve.org/CVERecord?id=CVE-2026-91768
• https://www.cve.org/CVERecord?id=CVE-2025-1218
• https://www.cve.org/CVERecord?id=CVE-2026-91769
• https://www.cve.org/CVERecord?id=CVE-2026-91767
• https://www.cve.org/CVERecord?id=CVE-2026-6103
• https://www.cve.org/CVERecord?id=CVE-2026-91765
• https://www.cve.org/CVERecord?id=CVE-2025-14181
• https://www.cve.org/CVERecord?id=CVE-2026-92842
• https://www.cve.org/CVERecord?id=CVE-2026-91766
• https://www.cve.org/CVERecord?id=CVE-2026-93682

SRPMS 9/core

• php-8.2.34-1.mga9

Publication date: 27 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-54886 , CVE-2026-54891 , CVE-2026-54892 , CVE-2026-54893 , CVE-2026-55952 , CVE-2026-55953 Description
SSH SFTP server denial of service via extended channel data infinite loop. (CVE-2026-54886) Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl. (CVE-2026-54891) Plug: quadratic-time decoding of nested query/body parameters enables denial of service. (CVE-2026-54892) Email-derived URL path injection in the Swoosh Microsoft Graph adapter. (CVE-2026-54893) References

• https://bugs.mageia.org/show_bug.cgi?id=35971
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z643GQLCV3X4YNAD2P52IFBKQQU7E7A5/
• https://github.com/erlang/otp/security/advisories/GHSA-7wp4-pc27-2vj9
• https://cna.erlef.org/cves/CVE-2026-54886.html
• https://osv.dev/vulnerability/EEF-CVE-2026-54886
• https://github.com/erlang/otp/security/advisories/GHSA-gf6r-99xw-6qg6
• https://cna.erlef.org/cves/CVE-2026-54891.html
• https://osv.dev/vulnerability/EEF-CVE-2026-54891
• https://osv.dev/vulnerability/EEF-CVE-2026-55952
• https://cna.erlef.org/cves/CVE-2026-55952.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45JCTFOGPTE2S5BCCCJH6KKGFNKZIDVS/
• https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882
• https://cna.erlef.org/cves/CVE-2026-55953.html
• https://osv.dev/vulnerability/EEF-CVE-2026-55953
• https://github.com/erlang/otp/releases/tag/OTP-27.3.4.16
• https://github.com/erlang/otp/releases/tag/OTP-27.3.4.17
• https://www.cve.org/CVERecord?id=CVE-2026-54886
• https://www.cve.org/CVERecord?id=CVE-2026-54891
• https://www.cve.org/CVERecord?id=CVE-2026-54892
• https://www.cve.org/CVERecord?id=CVE-2026-54893
• https://www.cve.org/CVERecord?id=CVE-2026-55952
• https://www.cve.org/CVERecord?id=CVE-2026-55953

SRPMS 10/core

• erlang-27.3.4.17-1.mga10

Publication date: 27 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-14957 Description
FIPS mode assertion failure via malicious CERT payload. (CVE-2026-14957) References

• https://bugs.mageia.org/show_bug.cgi?id=35984
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RHUMDPM6XZNYWMXOYIEUCSCNYXBDKSP2/
• https://bugzilla.redhat.com/show_bug.cgi?id=2501764
• https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt
• https://www.cve.org/CVERecord?id=CVE-2026-14957

SRPMS 10/core

• libreswan-5.3-1.1.mga10

Publication date: 26 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-11468 , CVE-2025-15366 , CVE-2025-15367 , CVE-2025-15282 , CVE-2026-0672 , CVE-2026-1299 , CVE-2026-0865 , CVE-2025-12781 , CVE-2026-2297 , CVE-2026-3644 , CVE-2026-4224 , CVE-2026-4519 , CVE-2026-1502 , CVE-2026-3446 , CVE-2026-6100 , CVE-2026-4786 , CVE-2026-5713 Description
Please see the references for additional information about vulnerabilities. References

• https://bugs.mageia.org/show_bug.cgi?id=35072
• https://www.cve.org/CVERecord?id=CVE-2025-11468
• https://www.cve.org/CVERecord?id=CVE-2025-15366
• https://www.cve.org/CVERecord?id=CVE-2025-15367
• https://www.cve.org/CVERecord?id=CVE-2025-15282
• https://www.cve.org/CVERecord?id=CVE-2026-0672
• https://www.cve.org/CVERecord?id=CVE-2026-1299
• https://www.cve.org/CVERecord?id=CVE-2026-0865
• https://www.cve.org/CVERecord?id=CVE-2025-12781
• https://www.cve.org/CVERecord?id=CVE-2026-2297
• https://www.cve.org/CVERecord?id=CVE-2026-3644
• https://www.cve.org/CVERecord?id=CVE-2026-4224
• https://www.cve.org/CVERecord?id=CVE-2026-4519
• https://www.cve.org/CVERecord?id=CVE-2026-1502
• https://www.cve.org/CVERecord?id=CVE-2026-3446
• https://www.cve.org/CVERecord?id=CVE-2026-6100
• https://www.cve.org/CVERecord?id=CVE-2026-4786
• https://www.cve.org/CVERecord?id=CVE-2026-5713

SRPMS 10/core

• python3-3.13.15-1.mga10
• python-pip-26.2.1-1.mga10

Publication date: 25 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-58459 Description
Command Injection via gnuplot plot title subtype field. (CVE-2026-58459) References

• https://bugs.mageia.org/show_bug.cgi?id=35953
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/AQ2ORFQ66FNIA3MWLLYYOG4BV4FARQUN/
• https://gitlab.com/gpsd/gpsd/-/work_items/404#note_3534119267
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFEVG42PGVGT7U55DLZYEB2HKIVYGMPM/
• https://www.cve.org/CVERecord?id=CVE-2026-58459

SRPMS 10/core

• gpsd-3.27.5-1.1.mga10

9/core

• gpsd-3.25-1.2.mga9

Publication date: 25 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-7867 Description
Local privilege escalation via as-user option spoofing. (CVE-2026-7867) References

• https://bugs.mageia.org/show_bug.cgi?id=36173
• https://lists.debian.org/debian-security-announce/2026/msg00325.html
• https://ubuntu.com/security/notices/USN-8701-1
• https://www.cve.org/CVERecord?id=CVE-2026-7867

SRPMS 10/core

• udisks2-2.10.1-3.1.mga10

Publication date: 25 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Conflicting file between Mageia 9 and Mageia 10 versions of the package can block upgrades to Mageia 10. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36269

SRPMS 10/core

• libalkimia-8.2.1-1.1.mga10