Actualizaciones de Seguridad

Publication date: 25 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-23271 , CVE-2024-27808 , CVE-2024-27820 , CVE-2024-27833 , CVE-2024-40866 , CVE-2024-44187 , CVE-2024-44185 , CVE-2024-44244 , CVE-2024-44296 , CVE-2024-44308 , CVE-2024-54479 , CVE-2024-54502 , CVE-2024-54505 , CVE-2024-54534 , CVE-2024-27856 , CVE-2024-54543 , CVE-2025-24143 , CVE-2025-24150 , CVE-2025-24158 , CVE-2025-24162 , CVE-2024-44192 , CVE-2024-54467 , CVE-2025-24201 , CVE-2024-54551 , CVE-2025-24208 , CVE-2025-24209 , CVE-2025-24213 , CVE-2025-24216 , CVE-2025-24264 , CVE-2025-30427 , CVE-2025-24223 , CVE-2025-31204 , CVE-2025-31205 , CVE-2025-31206 , CVE-2025-31215 , CVE-2025-31257 , CVE-2025-24189 , CVE-2025-31273 , CVE-2025-31278 , CVE-2025-43211 , CVE-2025-43212 , CVE-2025-43216 , CVE-2025-43227 , CVE-2025-43228 , CVE-2025-43240 , CVE-2025-43265 , CVE-2025-6558 , CVE-2025-43272 , CVE-2025-43342 , CVE-2025-43356 , CVE-2025-43368 , CVE-2025-43343 Description We are updating webkit2 to version 2.50.1 that has many security fixes since our current version. Please see the links for additional information References

• https://bugs.mageia.org/show_bug.cgi?id=34747
• https://webkitgtk.org/2025/10/10/webkitgtk2.50.1-released.html
• https://webkitgtk.org/security/WSA-2025-0007.html
• https://webkitgtk.org/2025/09/17/webkitgtk2.50.0-released.html
• https://webkitgtk.org/security/WSA-2025-0006.html
• https://webkitgtk.org/2025/07/31/webkitgtk2.49.4-released.html
• https://webkitgtk.org/2025/09/03/webkitgtk2.48.6-released.html
• https://webkitgtk.org/2025/08/01/webkitgtk2.48.5-released.html
• https://webkitgtk.org/security/WSA-2025-0005.html
• https://webkitgtk.org/2025/05/28/webkitgtk2.48.3-released.html
• https://webkitgtk.org/2025/05/14/webkitgtk2.48.2-released.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23271
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27808
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27820
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27833
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40866
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44187
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44185
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44244
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44296
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44308
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54479
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54502
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54505
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54534
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27856
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54543
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24143
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24150
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24158
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24162
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44192
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54467
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24201
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54551
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24208
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24209
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24213
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24216
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24264
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30427
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24223
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31204
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31205
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31206
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31215
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31257
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24189
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31273
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31278
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43211
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43212
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43216
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43227
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43228
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43240
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43265
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6558
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43272
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43342
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43356
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43368
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-43343

SRPMS 9/core

• webkit2-2.50.1-1.2.mga9

Publication date: 24 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-64524 Description CUPS rastertopclx Filter Vulnerable to Heap Buffer Overflow Leading to Potential Arbitrary Code Execution. (CVE-2025-64524) References

• https://bugs.mageia.org/show_bug.cgi?id=34761
• https://www.openwall.com/lists/oss-security/2025/11/20/1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64524

SRPMS 9/core

• cups-filters-1.28.16-6.3.mga9

Publication date: 24 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-25184 , CVE-2025-27111 , CVE-2025-27610 Description Possible Log Injection in Rack::CommonLogger. (CVE-2025-25184) Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection. (CVE-2025-27111) Local File Inclusion in Rack::Static. (CVE-2025-27610) References

• https://bugs.mageia.org/show_bug.cgi?id=34135
• https://ubuntu.com/security/notices/USN-7366-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25184
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27111
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27610

SRPMS 9/core

• ruby-rack-2.2.13-1.mga9

Publication date: 22 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-39869 , CVE-2025-39870 , CVE-2025-39871 , CVE-2025-39873 , CVE-2025-39876 , CVE-2025-39877 , CVE-2025-39880 , CVE-2025-39881 , CVE-2025-39882 , CVE-2025-39883 , CVE-2025-39885 , CVE-2025-39886 , CVE-2025-39907 , CVE-2025-39909 , CVE-2025-39911 , CVE-2025-39913 , CVE-2025-39914 , CVE-2025-39916 , CVE-2025-39923 , CVE-2025-39929 , CVE-2025-39931 , CVE-2025-39934 , CVE-2025-39937 , CVE-2025-39938 , CVE-2025-39942 , CVE-2025-39943 , CVE-2025-39944 , CVE-2025-39945 , CVE-2025-39946 , CVE-2025-39947 , CVE-2025-39949 , CVE-2025-39951 , CVE-2025-39952 , CVE-2025-39953 , CVE-2025-39955 , CVE-2025-39957 , CVE-2025-39961 , CVE-2025-39964 , CVE-2025-39965 , CVE-2025-39967 , CVE-2025-39968 , CVE-2025-39969 , CVE-2025-39970 , CVE-2025-39971 , CVE-2025-39972 , CVE-2025-39973 , CVE-2025-39975 , CVE-2025-39977 , CVE-2025-39978 , CVE-2025-39980 , CVE-2025-39982 , CVE-2025-39985 , CVE-2025-39986 , CVE-2025-39987 , CVE-2025-39988 , CVE-2025-39993 , CVE-2025-39994 , CVE-2025-39995 , CVE-2025-39996 , CVE-2025-39998 , CVE-2025-40006 , CVE-2025-40008 , CVE-2025-40010 , CVE-2025-40011 , CVE-2025-40013 , CVE-2025-40016 , CVE-2025-40018 , CVE-2025-40019 , CVE-2025-40020 , CVE-2025-40021 , CVE-2025-40022 , CVE-2025-40024 , CVE-2025-40026 , CVE-2025-40027 , CVE-2025-40029 , CVE-2025-40030 , CVE-2025-40032 , CVE-2025-40033 , CVE-2025-40035 , CVE-2025-40036 , CVE-2025-40038 , CVE-2025-40040 , CVE-2025-40042 , CVE-2025-40043 , CVE-2025-40044 , CVE-2025-40048 , CVE-2025-40049 , CVE-2025-40051 , CVE-2025-40052 , CVE-2025-40053 , CVE-2025-40055 , CVE-2025-40056 , CVE-2025-40060 , CVE-2025-40061 , CVE-2025-40062 , CVE-2025-40067 , CVE-2025-40068 , CVE-2025-40070 , CVE-2025-40071 , CVE-2025-40078 , CVE-2025-40080 , CVE-2025-40081 , CVE-2025-40084 , CVE-2025-40085 , CVE-2025-40087 , CVE-2025-40088 , CVE-2025-40092 , CVE-2025-40093 , CVE-2025-40094 , CVE-2025-40095 , CVE-2025-40096 , CVE-2025-40099 , CVE-2025-40100 , CVE-2025-40103 , CVE-2025-40104 , CVE-2025-40105 , CVE-2025-40106 , CVE-2025-40107 , CVE-2025-40300 Description Vanilla upstream kernel version 6.6.116 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=34721
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.106
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.107
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.108
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.109
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.110
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.111
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.112
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.113
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.114
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.115
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.116
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39869
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39870
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39871
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39873
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39876
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39877
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39880
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39881
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39882
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39883
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39885
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39886
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39907
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39909
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39911
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39913
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39914
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39916
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39923
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39929
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39931
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39934
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39937
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39938
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39942
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39943
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39944
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39945
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39946
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39947
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39949
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39951
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39952
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39953
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39955
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39957
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39961
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39964
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39965
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39967
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39968
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39969
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39970
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39971
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39972
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39973
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39975
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39977
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39978
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39980
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39982
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39985
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39986
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39987
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39988
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39993
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39995
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39996
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39998
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40006
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40008
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40010
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40011
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40016
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40019
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40020
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40021
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40022
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40024
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40026
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40027
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40029
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40030
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40032
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40033
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40035
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40036
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40038
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40040
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40042
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40043
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40044
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40048
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40049
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40051
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40052
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40053
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40055
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40056
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40060
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40061
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40062
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40067
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40068
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40070
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40071
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40078
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40080
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40081
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40084
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40085
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40087
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40088
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40092
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40093
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40094
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40095
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40099
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40100
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40103
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40104
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40105
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40106
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40107
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40300

SRPMS 9/core

• kernel-linus-6.6.116-1.mga9

Publication date: 22 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-39869 , CVE-2025-39870 , CVE-2025-39871 , CVE-2025-39873 , CVE-2025-39876 , CVE-2025-39877 , CVE-2025-39880 , CVE-2025-39881 , CVE-2025-39882 , CVE-2025-39883 , CVE-2025-39885 , CVE-2025-39886 , CVE-2025-39907 , CVE-2025-39909 , CVE-2025-39911 , CVE-2025-39913 , CVE-2025-39914 , CVE-2025-39916 , CVE-2025-39923 , CVE-2025-39929 , CVE-2025-39931 , CVE-2025-39934 , CVE-2025-39937 , CVE-2025-39938 , CVE-2025-39942 , CVE-2025-39943 , CVE-2025-39944 , CVE-2025-39945 , CVE-2025-39946 , CVE-2025-39947 , CVE-2025-39949 , CVE-2025-39951 , CVE-2025-39952 , CVE-2025-39953 , CVE-2025-39955 , CVE-2025-39957 , CVE-2025-39961 , CVE-2025-39964 , CVE-2025-39965 , CVE-2025-39967 , CVE-2025-39968 , CVE-2025-39969 , CVE-2025-39970 , CVE-2025-39971 , CVE-2025-39972 , CVE-2025-39973 , CVE-2025-39975 , CVE-2025-39977 , CVE-2025-39978 , CVE-2025-39980 , CVE-2025-39982 , CVE-2025-39985 , CVE-2025-39986 , CVE-2025-39987 , CVE-2025-39988 , CVE-2025-39993 , CVE-2025-39994 , CVE-2025-39995 , CVE-2025-39996 , CVE-2025-39998 , CVE-2025-40006 , CVE-2025-40008 , CVE-2025-40010 , CVE-2025-40011 , CVE-2025-40013 , CVE-2025-40016 , CVE-2025-40018 , CVE-2025-40019 , CVE-2025-40020 , CVE-2025-40021 , CVE-2025-40022 , CVE-2025-40024 , CVE-2025-40026 , CVE-2025-40027 , CVE-2025-40029 , CVE-2025-40030 , CVE-2025-40032 , CVE-2025-40033 , CVE-2025-40035 , CVE-2025-40036 , CVE-2025-40038 , CVE-2025-40040 , CVE-2025-40042 , CVE-2025-40043 , CVE-2025-40044 , CVE-2025-40048 , CVE-2025-40049 , CVE-2025-40051 , CVE-2025-40052 , CVE-2025-40053 , CVE-2025-40055 , CVE-2025-40056 , CVE-2025-40060 , CVE-2025-40061 , CVE-2025-40062 , CVE-2025-40067 , CVE-2025-40068 , CVE-2025-40070 , CVE-2025-40071 , CVE-2025-40078 , CVE-2025-40080 , CVE-2025-40081 , CVE-2025-40084 , CVE-2025-40085 , CVE-2025-40087 , CVE-2025-40088 , CVE-2025-40092 , CVE-2025-40093 , CVE-2025-40094 , CVE-2025-40095 , CVE-2025-40096 , CVE-2025-40099 , CVE-2025-40100 , CVE-2025-40103 , CVE-2025-40104 , CVE-2025-40105 , CVE-2025-40106 , CVE-2025-40107 , CVE-2025-40300 Description Upstream kernel version 6.6.116 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel. References

• https://bugs.mageia.org/show_bug.cgi?id=34713
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.106
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.107
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.108
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.109
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.110
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.111
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.112
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.113
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.114
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.115
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.116
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39869
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39870
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39871
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39873
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39876
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39877
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39880
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39881
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39882
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39883
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39885
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39886
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39907
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39909
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39911
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39913
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39914
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39916
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39923
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39929
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39931
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39934
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39937
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39938
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39942
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39943
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39944
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39945
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39946
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39947
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39949
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39951
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39952
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39953
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39955
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39957
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39961
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39964
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39965
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39967
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39968
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39969
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39970
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39971
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39972
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39973
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39975
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39977
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39978
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39980
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39982
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39985
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39986
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39987
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39988
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39993
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39994
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39995
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39996
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39998
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40006
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40008
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40010
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40011
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40016
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40019
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40020
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40021
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40022
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40024
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40026
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40027
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40029
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40030
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40032
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40033
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40035
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40036
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40038
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40040
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40042
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40043
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40044
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40048
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40049
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40051
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40052
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40053
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40055
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40056
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40060
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40061
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40062
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40067
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40068
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40070
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40071
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40078
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40080
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40081
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40084
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40085
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40087
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40088
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40092
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40093
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40094
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40095
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40096
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40099
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40100
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40103
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40104
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40105
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40106
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40107
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40300

SRPMS 9/core

• kernel-6.6.116-1.mga9
• kmod-xtables-addons-3.24-87.mga9
• kmod-virtualbox-7.1.14-13.mga9

Publication date: 21 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-49091 Description KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code. (CVE-2025-49091) References

• https://bugs.mageia.org/show_bug.cgi?id=34364
• https://www.openwall.com/lists/oss-security/2025/06/10/5
• https://lists.debian.org/debian-security-announce/2025/msg00109.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49091

SRPMS 9/core

• konsole-23.04.3-1.2.mga9

Publication date: 21 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-49844 , CVE-2025-46817 , CVE-2025-46818 , CVE-2025-46819 Description A Lua script may lead to remote code execution. (CVE-2025-49844) A Lua script may lead to integer overflow and potential RCE. (CVE-2025-46817) A Lua script can be executed in the context of another user. (CVE-2025-46818) LUA out-of-bound read. (CVE-2025-46819) References

• https://bugs.mageia.org/show_bug.cgi?id=34650
• https://www.openwall.com/lists/oss-security/2025/10/07/2
• https://github.com/redis/redis/releases/tag/7.2.11
• https://github.com/redis/redis/releases/tag/7.2.12
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49844
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46817
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46818
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46819

SRPMS 9/core

• redis-7.2.12-1.mga9

Publication date: 21 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-50007 , CVE-2023-50008 , CVE-2023-6602 , CVE-2023-6604 , CVE-2023-6605 , CVE-2024-31582 , CVE-2024-35367 , CVE-2025-59728 , CVE-2025-59731 , CVE-2025-59732 , CVE-2025-59733 , CVE-2025-7700 Description FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component. (CVE-2023-50007) FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component. (CVE-2023-50008) Improper handling of input format in tty demuxer of ffmpeg. (CVE-2023-6602) Hls xbin demuxer dos amplification in ffmpeg. (CVE-2023-6604) Dash playlist ssrf vulnerability in ffmpeg. (CVE-2023-6605) FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input. (CVE-2024-31582) FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer. (CVE-2024-35367) Heap-buffer-overflow write in FFmpeg MDASH resolve_content_path. (CVE-2025-59728) Heap-buffer-overflow write in FFmpeg EXR dwa_uncompress. (CVE-2025-59731, CVE-2025-59732, CVE-2025-59733) Null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c). (CVE-2025-7700) References

• https://bugs.mageia.org/show_bug.cgi?id=34757
• https://ffmpeg.org/security.html
• https://lists.debian.org/debian-security-announce/2025/msg00149.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50007
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50008
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6602
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6604
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6605
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31582
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35367
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59728
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59731
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59732
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59733
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7700

SRPMS 9/core

• ffmpeg-5.1.7-1.mga9

9/tainted

• ffmpeg-5.1.7-1.mga9.tainted

Publication date: 19 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-13012 , CVE-2025-13013 , CVE-2025-13014 , CVE-2025-13015 , CVE-2025-13016 , CVE-2025-13017 , CVE-2025-13018 , CVE-2025-13019 , CVE-2025-13020 Description Race condition in the Graphics component. (CVE-2025-13012) Mitigation bypass in the DOM: Core & HTML component. (CVE-2025-13013) CVE-2025-13014: Use-after-free in the Audio/Video component. (CVE-2025-13014) Spoofing issue in Firefox. (CVE-2025-13015) Incorrect boundary conditions in the JavaScript: WebAssembly component. (CVE-2025-13016) Same-origin policy bypass in the DOM: Notifications component. (CVE-2025-13017) Mitigation bypass in the DOM: Security component. (CVE-2025-13018) Same-origin policy bypass in the DOM: Workers component. (CVE-2025-13019) Use-after-free in the WebRTC: Audio/Video component. (CVE-2025-13020) References

• https://bugs.mageia.org/show_bug.cgi?id=34743
• https://www.thunderbird.net/en-US/thunderbird/140.5.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-91/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020

SRPMS 9/core

• thunderbird-140.5.0-1.mga9
• thunderbird-l10n-140.5.0-1.mga9

Publication date: 19 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-57812 , CVE-2025-64503 Description CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`. (CVE-2025-57812) cups-filters 1.x: out of bounds write in pdftoraster. (CVE-2025-64503) References

• https://bugs.mageia.org/show_bug.cgi?id=34746
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57812
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64503

SRPMS 9/core

• cups-filters-1.28.16-6.2.mga9

Publication date: 19 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-42472 Description Flatpak may allow access to files outside sandbox for certain apps. (CVE-2024-42472). References

• https://bugs.mageia.org/show_bug.cgi?id=33510
• https://openwall.com/lists/oss-security/2024/08/14/6
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42472

SRPMS 9/core

• flatpak-1.14.10-1.mga9
• bubblewrap-0.7.0-1.1.mga9

Publication date: 18 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-12817 , CVE-2025-12818 Description PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege. (CVE-2025-12817) PostgreSQL libpq undersizes allocations, via integer wraparound. (CVE-2025-12818) References

• https://bugs.mageia.org/show_bug.cgi?id=34752
• https://www.postgresql.org/about/news/postgresql-181-177-1611-1515-1420-and-1323-released-3171/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12817
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12818

SRPMS 9/core

• postgresql15-15.15-1.mga9
• postgresql13-13.23-1.mga9

Publication date: 18 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-42516 , CVE-2024-43204 , CVE-2024-47252 , CVE-2025-49630 , CVE-2025-23048 , CVE-2025-49812 , CVE-2025-53020 , CVE-2025-54090 Description HTTP response splitting. (CVE-2024-42516) SSRF with mod_headers setting Content-Type header. (CVE-2024-43204) mod_ssl error log variable escaping. (CVE-2024-47252) mod_proxy_http2 denial of service. (CVE-2025-49630) mod_ssl access control bypass with session resumption. (CVE-2025-23048) mod_ssl TLS upgrade attack. (CVE-2025-49812) HTTP/2 DoS by Memory Increase. (CVE-2025-53020) 'RewriteCond expr' always evaluates to true in 2.4.64. (CVE-2025-54090) You will find the update delay sometimes causes a failure; just restart the service after the update. References

• https://bugs.mageia.org/show_bug.cgi?id=34464
• https://www.openwall.com/lists/oss-security/2025/07/10/2
• https://www.openwall.com/lists/oss-security/2025/07/10/3
• https://www.openwall.com/lists/oss-security/2025/07/10/4
• https://www.openwall.com/lists/oss-security/2025/07/10/6
• https://www.openwall.com/lists/oss-security/2025/07/10/7
• https://www.openwall.com/lists/oss-security/2025/07/10/8
• https://www.openwall.com/lists/oss-security/2025/07/10/9
• https://www.openwall.com/lists/oss-security/2025/07/10/10
• https://www.openwall.com/lists/oss-security/2025/07/24/2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42516
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43204
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47252
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49630
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23048
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49812
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53020
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54090

SRPMS 9/core

• apache-2.4.65-1.mga9

Publication date: 17 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-13012 , CVE-2025-13013 , CVE-2025-13014 , CVE-2025-13015 , CVE-2025-13016 , CVE-2025-13017 , CVE-2025-13018 , CVE-2025-13019 , CVE-2025-13020 Description Race condition in the Graphics component. (CVE-2025-13012) Mitigation bypass in the DOM: Core & HTML component. (CVE-2025-13013) CVE-2025-13014: Use-after-free in the Audio/Video component. (CVE-2025-13014) Spoofing issue in Firefox. (CVE-2025-13015) Incorrect boundary conditions in the JavaScript: WebAssembly component. (CVE-2025-13016) Same-origin policy bypass in the DOM: Notifications component. (CVE-2025-13017) Mitigation bypass in the DOM: Security component. (CVE-2025-13018) Same-origin policy bypass in the DOM: Workers component. (CVE-2025-13019) Use-after-free in the WebRTC: Audio/Video component. (CVE-2025-13020) References

• https://bugs.mageia.org/show_bug.cgi?id=34742
• https://www.firefox.com/en-US/firefox/140.5.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-88/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020

SRPMS 9/core

• firefox-140.5.0-1.mga9
• firefox-l10n-140.5.0-1.mga9

Publication date: 17 Nov 2025
Type: bugfix
Affected Mageia releases : 9
Description We are rebuilding packages requiring icu version 72 with icu version 73 to use an icu version with security fixes. These packages are the last set; after these updates there should not be packages that depend on icu version 72 in your system. If you find you can't run (change lib64 to lib in 32bit system): LC_ALL=C urpme lib64icu72 without uninstalling packages in your system, please report. References

• https://bugs.mageia.org/show_bug.cgi?id=34740

SRPMS 9/core

• gnome-builder-44.2-1.1.mga9
• gnucash-5.3-1.1.mga9
• kdeplasma-addons-5.27.10-1.1.mga9
• evolution-data-server-3.48.3-1.1.mga9
• kbibtex-0.10.0-3.1.mga9
• geary-43.0-3.1.mga9

Publication date: 17 Nov 2025
Type: bugfix
Affected Mageia releases : 9
Description We are rebuilding packages requiring icu version 72 with icu version 73 to use an icu version with security fixes. These packages are the third set. References

• https://bugs.mageia.org/show_bug.cgi?id=34730

SRPMS 9/core

• gspell-1.12.1-1.1.mga9
• libcdr-0.1.7-5.1.mga9
• 0ad-0.0.26-3.1.mga9
• c-icap-modules-classify-20180416-15.1.mga9
• enchant2-2.3.3-2.1.mga9
• gnustep-base-1.28.0-2.1.mga9
• gnustep-gui-0.28.0-10.1.mga9
• konsole-23.04.3-1.1.mga9
• qtwebengine5-5.15.10-8.1.mga9
• qtwebengine6-6.4.1-5.1.mga9
• performous-1.2.0-6.1.mga9
• plasma-workspace-5.27.10-1.3.mga9
• R-base-4.3.3-1.1.mga9
• scribus-1.5.8-11.1.mga9
• strawberry-1.0.17-1.1.mga9
• subtitlecomposer-0.7.1-3.1.mga9
• mpd-0.23.11-4.1.mga9

9/tainted

• mpd-0.23.11-4.1.mga9.tainted

Publication date: 17 Nov 2025
Type: bugfix
Affected Mageia releases : 9
Description It appears there has been a rollout for the WEB client where YouTube has removed the playback links for adaptiveFormats in the player response. This leaves only the SABR streaming URL for playback (which is what YouTube has been using for a while now) References

• https://bugs.mageia.org/show_bug.cgi?id=34750
• https://github.com/yt-dlp/yt-dlp/issues/12482

SRPMS 9/core

• python-packaging-24.2-1.mga9
• python-hatchling-1.27.0-1.mga9
• yt-dlp-2025.11.12-1.mga9

Publication date: 17 Nov 2025
Type: bugfix
Affected Mageia releases : 9
Description The kvm modules are now preloaded at boot, and thus it conflicts with vbox modules. This version has a fix that rmmod the kvm module before starting virtualbox VMs References

• https://bugs.mageia.org/show_bug.cgi?id=34408
• https://www.virtualbox.org/wiki/Changelog-7.1
• https://www.virtualbox.org/ticket/22248
• https://github.com/VirtualBox/virtualbox/issues/372

SRPMS 9/core

• virtualbox-7.1.14-2.mga9
• kmod-virtualbox-7.1.14-12.mga9

Publication date: 15 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-48734 Description Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default. (CVE-2025-48734) References

• https://bugs.mageia.org/show_bug.cgi?id=34330
• https://lists.opensuse.org/opensuse-updates/2019-09/msg00017.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48734

SRPMS 9/core

• apache-commons-beanutils-1.9.4-7.1.mga9

Publication date: 15 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-55014 Description The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via cleartext HTTP. (CVE-2025-55014) References

• https://bugs.mageia.org/show_bug.cgi?id=34533
• https://seclists.org/oss-sec/2025/q3/75
• https://seclists.org/oss-sec/2025/q3/81
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55014

SRPMS 9/core

• stardict-3.0.6.3-2.1.mga9