Actualizaciones de Seguridad
MGAA-2026-0119 - Updated drakx-net packages add nl80211 (iw) scan and WPA3 (SAE) support
Publication date: 03 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
Our drakx.net packages still depended on deprecated wext (iwlist), causing problems with finding and connecting to networks for several users. This update adds both nl80211 (iw) scan and WPA3 (SAE) support, thus fixing the issues. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10 , 9
Description
Our drakx.net packages still depended on deprecated wext (iwlist), causing problems with finding and connecting to networks for several users. This update adds both nl80211 (iw) scan and WPA3 (SAE) support, thus fixing the issues. References
SRPMS 10/core
- drakx-net-2.65-1.mga10
- drakx-net-2.65-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0371 - Updated bubblewrap package fixes security vulnerabilities
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-87766 Description
Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-87766 Description
Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup References
- https://bugs.mageia.org/show_bug.cgi?id=36206
- https://lists.debian.org/debian-security-announce/2026/msg00383.html
- https://github.com/containers/bubblewrap/security/advisories/GHSA-pxhw-h44j-8pfx
- https://www.openwall.com/lists/oss-security/2026/08/27/7
- https://www.cve.org/CVERecord?id=CVE-2026-87766
- bubblewrap-0.12.0-1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0370 - Updated perl-Text-CSV_XS packages fix a security vulnerability
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-7111 Description
Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption. References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-7111 Description
Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption. References
- https://bugs.mageia.org/show_bug.cgi?id=35547
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/QELUJSCSNBIE4N5UNKH4YGI5LFCHEY65/
- https://lists.security.metacpan.org/cve-announce/msg/39453344/
- https://github.com/cpan-authors/Text-CSV_XS/issues/65
- https://www.cve.org/CVERecord?id=CVE-2026-7111
- perl-Text-CSV_XS-1.640.0-1.mga10
- perl-Text-CSV_XS-1.640.0-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0369 - Updated libalsa2 packages fix security vulnerabilities
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-25068 , CVE-2026-56109 Description
alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow. (CVE-2026-25068) ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c. (CVE-2026-56109) References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-25068 , CVE-2026-56109 Description
alsa-lib 1.2.15.2 Topology Decoder Heap-based Buffer Overflow. (CVE-2026-25068) ALSA Library < 1.2.16.1 Double-Free via parse_def() in conf.c. (CVE-2026-56109) References
- https://bugs.mageia.org/show_bug.cgi?id=35934
- https://ubuntu.com/security/notices/USN-8044-1
- https://ubuntu.com/security/notices/USN-8538-1
- https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/
- https://www.cve.org/CVERecord?id=CVE-2026-25068
- https://www.cve.org/CVERecord?id=CVE-2026-56109
- libalsa2-1.2.15.2-1.1.mga10
- libalsa2-1.2.9-1.1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0368 - Updated perl-XML-Bare packages fix security vulnerabilities
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-57074 , CVE-2026-13401 Description
XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-57074 , CVE-2026-13401 Description
XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. References
- https://bugs.mageia.org/show_bug.cgi?id=35948
- https://www.openwall.com/lists/oss-security/2026/07/16/1
- https://www.openwall.com/lists/oss-security/2026/07/16/2
- https://www.cve.org/CVERecord?id=CVE-2026-57074
- https://www.cve.org/CVERecord?id=CVE-2026-13401
- perl-XML-Bare-0.530.0-26.mga10
- perl-XML-Bare-0.530.0-22.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0367 - Updated perl-YAML-Syck packages fix security vulnerabilities
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-13713 , CVE-2026-57075 , CVE-2026-57076 , CVE-2026-57077 Description
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-13713 , CVE-2026-57075 , CVE-2026-57076 , CVE-2026-57077 Description
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len References
- https://bugs.mageia.org/show_bug.cgi?id=35949
- https://www.openwall.com/lists/oss-security/2026/07/17/1
- https://www.openwall.com/lists/oss-security/2026/07/17/2
- https://www.openwall.com/lists/oss-security/2026/07/17/3
- https://www.openwall.com/lists/oss-security/2026/07/17/4
- https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes
- https://www.cve.org/CVERecord?id=CVE-2026-13713
- https://www.cve.org/CVERecord?id=CVE-2026-57075
- https://www.cve.org/CVERecord?id=CVE-2026-57076
- https://www.cve.org/CVERecord?id=CVE-2026-57077
- perl-YAML-Syck-1.470.0-1.mga10
- perl-YAML-Syck-1.470.0-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0366 - Updated libarchive packages fix security vulnerabilities
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14164 , CVE-2026-15028 , CVE-2026-5745 , CVE-2025-5918 , CVE-2025-60753 , CVE-2026-4111 , CVE-2026-4424 , CVE-2026-4426 , CVE-2026-5121 Description
Double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack(). (CVE-2026-14164) Heap overflow oob read while parsing a tar archive contains a pax extended header. (CVE-2026-15028) A null pointer dereference vulnerability exists in the acl parser of libarchive. (CVE-2026-5745) Reading past eof may be triggered for piped file streams. (CVE-2025-5918) An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). (CVE-2025-60753) Infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive. (CVE-2026-4111) Information disclosure via heap out-of-bounds read in rar archive processing. (CVE-2026-4424) Denial of service via malformed iso file processing. (CVE-2026-4426) Arbitrary code execution via integer overflow in iso9660 image processing. (CVE-2026-5121) References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14164 , CVE-2026-15028 , CVE-2026-5745 , CVE-2025-5918 , CVE-2025-60753 , CVE-2026-4111 , CVE-2026-4424 , CVE-2026-4426 , CVE-2026-5121 Description
Double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack(). (CVE-2026-14164) Heap overflow oob read while parsing a tar archive contains a pax extended header. (CVE-2026-15028) A null pointer dereference vulnerability exists in the acl parser of libarchive. (CVE-2026-5745) Reading past eof may be triggered for piped file streams. (CVE-2025-5918) An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). (CVE-2025-60753) Infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive. (CVE-2026-4111) Information disclosure via heap out-of-bounds read in rar archive processing. (CVE-2026-4424) Denial of service via malformed iso file processing. (CVE-2026-4426) Arbitrary code execution via integer overflow in iso9660 image processing. (CVE-2026-5121) References
- https://bugs.mageia.org/show_bug.cgi?id=35999
- https://ubuntu.com/security/notices/USN-8581-1
- https://www.cve.org/CVERecord?id=CVE-2026-14164
- https://www.cve.org/CVERecord?id=CVE-2026-15028
- https://www.cve.org/CVERecord?id=CVE-2026-5745
- https://www.cve.org/CVERecord?id=CVE-2025-5918
- https://www.cve.org/CVERecord?id=CVE-2025-60753
- https://www.cve.org/CVERecord?id=CVE-2026-4111
- https://www.cve.org/CVERecord?id=CVE-2026-4424
- https://www.cve.org/CVERecord?id=CVE-2026-4426
- https://www.cve.org/CVERecord?id=CVE-2026-5121
- libarchive-3.8.9-1.mga10
- libarchive-3.6.2-5.6.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0365 - Updated perl-Net-OAuth packages fix security vulnerabilities
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-72887 , CVE-2026-72888 , CVE-2026-72889 , CVE-2026-75589 Description
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-72887 , CVE-2026-72888 , CVE-2026-72889 , CVE-2026-75589 Description
Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify References
- https://bugs.mageia.org/show_bug.cgi?id=36145
- https://www.openwall.com/lists/oss-security/2026/08/16/3
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-jh72-4qq2-8j6g
- https://www.openwall.com/lists/oss-security/2026/08/16/4
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-m2cv-cq5x-47ph
- https://www.openwall.com/lists/oss-security/2026/08/19/2
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-c8rm-g5cm-4pf5
- https://www.openwall.com/lists/oss-security/2026/08/19/3
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-g8xr-69p3-gw56
- https://www.cve.org/CVERecord?id=CVE-2026-72887
- https://www.cve.org/CVERecord?id=CVE-2026-72888
- https://www.cve.org/CVERecord?id=CVE-2026-72889
- https://www.cve.org/CVERecord?id=CVE-2026-75589
- perl-Net-OAuth-0.330.0-1.mga10
- perl-Net-OAuth-0.330.0-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0364 - Updated apr-util packages fix security vulnerabilities
Publication date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2025-49506 , CVE-2026-32327 , CVE-2026-34191 , CVE-2026-34501 , CVE-2026-34502 Description
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack. (CVE-2025-49506) Apache Portable Runtime Utility: apr-util XML stack recursion crash. (CVE-2026-32327) Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle. (CVE-2026-34191) Apache Portable Runtime Utility: Heap buffer overflow in APR redis client. (CVE-2026-34501) Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client. (CVE-2026-34502) References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2025-49506 , CVE-2026-32327 , CVE-2026-34191 , CVE-2026-34501 , CVE-2026-34502 Description
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack. (CVE-2025-49506) Apache Portable Runtime Utility: apr-util XML stack recursion crash. (CVE-2026-32327) Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle. (CVE-2026-34191) Apache Portable Runtime Utility: Heap buffer overflow in APR redis client. (CVE-2026-34501) Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client. (CVE-2026-34502) References
- https://bugs.mageia.org/show_bug.cgi?id=36181
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKNIDBBNHOGIQ7XPC4JGLXADWZC3JEUN/
- https://lists.debian.org/debian-security-announce/2026/msg00348.html
- https://www.cve.org/CVERecord?id=CVE-2025-49506
- https://www.cve.org/CVERecord?id=CVE-2026-32327
- https://www.cve.org/CVERecord?id=CVE-2026-34191
- https://www.cve.org/CVERecord?id=CVE-2026-34501
- https://www.cve.org/CVERecord?id=CVE-2026-34502
- apr-util-1.6.3-3.1.mga10
- apr-util-1.6.3-1.1.mga9
Categorías: Actualizaciones de Seguridad
MGAA-2026-0118 - Updated opencpn-climatology-plugin package fixes bug
Publication date: 02 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Updated package provides more recent climatology data (data from 2026) than the previous version (data from 2019). References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
Updated package provides more recent climatology data (data from 2026) than the previous version (data from 2019). References
SRPMS 10/core
- opencpn-climatology-plugin-1.6.37.0-1.git20260510.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0363 - Updated hplip package fixes security vulnerabilities
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-8631 , CVE-2026-8632 Description
Potential Escalation of Privilege and Arbitrary Code Execution. (CVE-2026-8631, CVE-2026-8632) References
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-8631 , CVE-2026-8632 Description
Potential Escalation of Privilege and Arbitrary Code Execution. (CVE-2026-8631, CVE-2026-8632) References
- https://bugs.mageia.org/show_bug.cgi?id=35583
- https://www.openwall.com/lists/oss-security/2026/05/23/1
- https://support.hp.com/us-en/document/ish_14942099-14942126-16/hpsbpi04118
- https://ubuntu.com/security/notices/USN-8483-1
- https://lists.debian.org/debian-security-announce/2026/msg00313.html
- https://www.cve.org/CVERecord?id=CVE-2026-8631
- https://www.cve.org/CVERecord?id=CVE-2026-8632
- hplip-3.22.10-4.2.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0362 - Updated perl-HTTP-Date packages fix a security vulnerability
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14741 Description
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14741 Description
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date References
- https://bugs.mageia.org/show_bug.cgi?id=35952
- https://www.openwall.com/lists/oss-security/2026/07/17/10
- https://www.cve.org/CVERecord?id=CVE-2026-14741
- perl-HTTP-Date-6.80.0-1.mga10
- perl-HTTP-Date-6.80.0-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0361 - Updated perl-Date-Manip packages fix security vulnerabilities
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-60074 , CVE-2026-60075 Description
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-60074 , CVE-2026-60075 Description
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time References
- https://bugs.mageia.org/show_bug.cgi?id=36130
- https://www.openwall.com/lists/oss-security/2026/07/30/19
- https://www.openwall.com/lists/oss-security/2026/07/30/20
- https://www.cve.org/CVERecord?id=CVE-2026-60074
- https://www.cve.org/CVERecord?id=CVE-2026-60075
- perl-Date-Manip-6.990.0-1.mga10
- perl-Date-Manip-6.990.0-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0360 - Updated perl-HTML-FormHandler packages fix a security vulnerability
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2022-4993 Description
HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2022-4993 Description
HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template References
- https://bugs.mageia.org/show_bug.cgi?id=36141
- https://www.openwall.com/lists/oss-security/2026/08/13/9
- https://www.cve.org/CVERecord?id=CVE-2022-4993
- perl-HTML-FormHandler-0.400.680-8.mga10
- perl-HTML-FormHandler-0.400.680-6.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0359 - Updated nodejs packages fix security vulnerabilities
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56846 , CVE-2026-56848 , CVE-2026-58043 , CVE-2026-56850 , CVE-2026-58040 , CVE-2026-58042 , CVE-2026-58045 , CVE-2026-56847 , CVE-2026-58039 , CVE-2026-58044 Description
http2: retain header memory in session accounting. (CVE-2026-56846) http2: defer rst stream while in scope. (CVE-2026-56848) permission: avoid granting radix split nodes. (CVE-2026-58043) https: distinguish PFX object-array agent keys. (CVE-2026-56850) https: bind identity checks to session reuse. (CVE-2026-58040) dns: handle large resolveAny address replies. (CVE-2026-58042) zlib: throw on out-of-bounds write buffers. (CVE-2026-58045) permission: enforce fs write permission for trace events. (CVE-2026-56847) permission: check final report output path. (CVE-2026-58039) http: reject requests exceeding max header count. (CVE-2026-58044) References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56846 , CVE-2026-56848 , CVE-2026-58043 , CVE-2026-56850 , CVE-2026-58040 , CVE-2026-58042 , CVE-2026-58045 , CVE-2026-56847 , CVE-2026-58039 , CVE-2026-58044 Description
http2: retain header memory in session accounting. (CVE-2026-56846) http2: defer rst stream while in scope. (CVE-2026-56848) permission: avoid granting radix split nodes. (CVE-2026-58043) https: distinguish PFX object-array agent keys. (CVE-2026-56850) https: bind identity checks to session reuse. (CVE-2026-58040) dns: handle large resolveAny address replies. (CVE-2026-58042) zlib: throw on out-of-bounds write buffers. (CVE-2026-58045) permission: enforce fs write permission for trace events. (CVE-2026-56847) permission: check final report output path. (CVE-2026-58039) http: reject requests exceeding max header count. (CVE-2026-58044) References
- https://bugs.mageia.org/show_bug.cgi?id=36201
- https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
- https://nodejs.org/en/blog/release/v22.23.2
- https://www.cve.org/CVERecord?id=CVE-2026-56846
- https://www.cve.org/CVERecord?id=CVE-2026-56848
- https://www.cve.org/CVERecord?id=CVE-2026-58043
- https://www.cve.org/CVERecord?id=CVE-2026-56850
- https://www.cve.org/CVERecord?id=CVE-2026-58040
- https://www.cve.org/CVERecord?id=CVE-2026-58042
- https://www.cve.org/CVERecord?id=CVE-2026-58045
- https://www.cve.org/CVERecord?id=CVE-2026-56847
- https://www.cve.org/CVERecord?id=CVE-2026-58039
- https://www.cve.org/CVERecord?id=CVE-2026-58044
- nodejs-22.23.2-1.mga10
- nodejs-22.23.2-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0358 - Updated roundcubemail packages fix security vulnerabilities
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 9
Description
* Add basic validation for content proxied by the css proxy acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix arbitrary Sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337 acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix password’s modoboa driver leak of an authentication token to a user-controlled host, reported by [meifukun](https://github.com/meifukun) acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix stored XSS in “Add to address book” action, reported by Paulos Yibelo from pwn.ai acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix HTML/CSS sanitization bypass via SVG animate `by` attribute, reported by vectrain References
Type: security
Affected Mageia releases : 9
Description
* Add basic validation for content proxied by the css proxy acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix arbitrary Sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`, reported by Milan Hoppe acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337 acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix password’s modoboa driver leak of an authentication token to a user-controlled host, reported by [meifukun](https://github.com/meifukun) acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix stored XSS in “Add to address book” action, reported by Paulos Yibelo from pwn.ai acta2.jpg acta.jpg advisories avatar.jpg avatar.png bdk-key.bkup bdk-mga9.txt bdk-new.key bdkpackagers.key bdkpackagers.sec bdkpass bin blogdrake.net bookmarks.html BRF Descargas Desktop diagrana.pdf discover-missing Documentos Dragon Quest： Dai no Daibouken - Bravest Full OP Sub Español [2MZON1ev9DE].mkv ejemplo añadir_archivo1.spec ejemplo añadir_archivo2.spec google-chrome.spec html i18n.pdf Imágenes index.php kernel-backport kernel-cves.enc kernel-cves.txt lqshell-stylesheet.css mageia-advisories MANOLO MUÑOZ VS ALBERTO VAZQUEZ MANO A MANO 24 EXITAZOS RANCHEROS CON MARIACHI.opus MEGA megasync-10.tar.gz #*message*-20260914-112747# mgaadv-error.txt mgarepo mirrorbdk mock Música origen.rss out.pnm PDF Plantillas Precure News - Star Detective PreCure! OP (Movie Footage Edition) [2099120870992310272].mp4 Proyectos qatest qa-testing qphotorec.desktop qphotorec.log reinstall.sh repodkfix.sh repositorio rpm rss Sailor Moon Cosmos AMV - Makenai (Sailor Star Song).mp4 sshrc style.html Taylor Swift, les coulisses du succès [120464-000-A].mp4 test.jpg tmp update-bdkkey.sh urpm-ng-distupgrade-orphans vdhcoapp-2.0.19 Ventoy Backup Vídeos VirtualBox VMs xen test xen-mga#33082 YAML-LibYAML-Test-dir zekemx Fix HTML/CSS sanitization bypass via SVG animate `by` attribute, reported by vectrain References
- https://bugs.mageia.org/show_bug.cgi?id=36135
- https://www.openwall.com/lists/oss-security/2026/08/10/2
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
- roundcubemail-1.6.18-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0357 - Updated varnish packages fix security vulnerabilities
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-34475 , CVE-2026-50052 Description
The updated packages fix security vulnerabilities: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass. (CVE-2026-34475) In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default. (CVE-2026-50052) References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-34475 , CVE-2026-50052 Description
The updated packages fix security vulnerabilities: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass. (CVE-2026-34475) In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default. (CVE-2026-50052) References
- https://bugs.mageia.org/show_bug.cgi?id=35703
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTQ3IFV7A766BA4ZMWNVCZOAN3FGCW2J/
- https://vinyl-cache.org/security/VSV00018.html
- https://vinyl-cache.org/security/VSV00019.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W24WNWHXMWTWVX7NH65HHLBVOBMB3QGQ/
- https://www.cve.org/CVERecord?id=CVE-2026-34475
- https://www.cve.org/CVERecord?id=CVE-2026-50052
- varnish-8.0.2-2.mga10
- varnish-7.7.3-1.1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0356 - Updated perl-Mojolicious packages fix a security vulnerability
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-15747 Description
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-15747 Description
Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. References
- https://bugs.mageia.org/show_bug.cgi?id=35928
- https://www.openwall.com/lists/oss-security/2026/07/14/16
- https://metacpan.org/release/SRI/Mojolicious-9.48/changes
- https://www.cve.org/CVERecord?id=CVE-2026-15747
- perl-Mojolicious-9.480.0-1.1.mga10
- perl-Mojolicious-9.480.0-1.1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0355 - Updated vim packages fix security vulnerabilities
Publication date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-73077 , CVE-2026-73078 , CVE-2026-73074 , CVE-2026-73070 , CVE-2026-73075 , CVE-2026-73071 , CVE-2026-73073 , CVE-2026-73072 , CVE-2026-73076 Description
Arbitrary Code Execution via Shell Keyword Lookup in Vim < 9.2.0839. (CVE-2026-73077) Arbitrary Code Execution via Netrw Menu Construction in Vim < 9.2.0840. (CVE-2026-73078) Heap Buffer Overflow in Text Property Handling in Vim < 9.2.0841. (CVE-2026-73074) Stack Buffer Overflow in the Vim Socket Server in Vim < 9.2.0842. (CVE-2026-73070) Out-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim < 9.2.0843. (CVE-2026-73075) Use-after-free in JSON Decoding in Vim >= 9.2.0511 && Vim < 9.2.0844. (CVE-2026-73071) Arbitrary Ex Command Execution in C Omni-Completion in Vim < 9.2.0845. (CVE-2026-73073) Heap Buffer Overflow when Loading a Spell File in Vim < 9.2.0846. (CVE-2026-73072) Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`. (CVE-2026-73076) References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-73077 , CVE-2026-73078 , CVE-2026-73074 , CVE-2026-73070 , CVE-2026-73075 , CVE-2026-73071 , CVE-2026-73073 , CVE-2026-73072 , CVE-2026-73076 Description
Arbitrary Code Execution via Shell Keyword Lookup in Vim < 9.2.0839. (CVE-2026-73077) Arbitrary Code Execution via Netrw Menu Construction in Vim < 9.2.0840. (CVE-2026-73078) Heap Buffer Overflow in Text Property Handling in Vim < 9.2.0841. (CVE-2026-73074) Stack Buffer Overflow in the Vim Socket Server in Vim < 9.2.0842. (CVE-2026-73070) Out-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim < 9.2.0843. (CVE-2026-73075) Use-after-free in JSON Decoding in Vim >= 9.2.0511 && Vim < 9.2.0844. (CVE-2026-73071) Arbitrary Ex Command Execution in C Omni-Completion in Vim < 9.2.0845. (CVE-2026-73073) Heap Buffer Overflow when Loading a Spell File in Vim < 9.2.0846. (CVE-2026-73072) Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`. (CVE-2026-73076) References
- https://bugs.mageia.org/show_bug.cgi?id=36127
- https://www.openwall.com/lists/oss-security/2026/07/24/17
- https://www.openwall.com/lists/oss-security/2026/07/24/18
- https://www.openwall.com/lists/oss-security/2026/07/24/19
- https://www.openwall.com/lists/oss-security/2026/07/24/20
- https://www.openwall.com/lists/oss-security/2026/07/24/21
- https://www.openwall.com/lists/oss-security/2026/07/24/28
- https://www.openwall.com/lists/oss-security/2026/07/24/29
- https://www.openwall.com/lists/oss-security/2026/07/24/30
- https://www.openwall.com/lists/oss-security/2026/07/24/31
- https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2
- https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2
- https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j
- https://github.com/vim/vim/security/advisories/GHSA-49m8-wwxj-mr69
- https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4
- https://github.com/vim/vim/security/advisories/GHSA-69ch-22ch-r887
- https://github.com/vim/vim/security/advisories/GHSA-cx73-phcg-3j5g
- https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64
- https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2
- https://www.openwall.com/lists/oss-security/2026/08/25/8
- https://github.com/vim/vim/security/advisories/GHSA-r77m-8m55-rpr6
- https://www.cve.org/CVERecord?id=CVE-2026-73077
- https://www.cve.org/CVERecord?id=CVE-2026-73078
- https://www.cve.org/CVERecord?id=CVE-2026-73074
- https://www.cve.org/CVERecord?id=CVE-2026-73070
- https://www.cve.org/CVERecord?id=CVE-2026-73075
- https://www.cve.org/CVERecord?id=CVE-2026-73071
- https://www.cve.org/CVERecord?id=CVE-2026-73073
- https://www.cve.org/CVERecord?id=CVE-2026-73072
- https://www.cve.org/CVERecord?id=CVE-2026-73076
- vim-9.2.1011-2.mga10
- vim-9.2.1011-2.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0354 - Updated redis packages fix a security vulnerability
Publication date: 31 Aug 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-62356 Description
The updated package fixes security vulnerabilities, including: Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write. (CVE-2026-62356) References
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-62356 Description
The updated package fixes security vulnerabilities, including: Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write. (CVE-2026-62356) References
- https://bugs.mageia.org/show_bug.cgi?id=36195
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LJCOCIGFJRTGSL7B6LBQA4CBTCFCTL75/
- https://www.heise.de/en/news/Redis-Security-updates-against-code-injection-vulnerabilities-11417601.html
- https://github.com/redis/redis/releases/tag/8.6.6
- https://github.com/redis/redis/releases/tag/7.2.16
- https://www.cve.org/CVERecord?id=CVE-2026-62356
- redis-8.6.6-1.mga10
- redis-7.2.16-1.mga9
Categorías: Actualizaciones de Seguridad
