Actualizaciones de Seguridad
MGAA-2026-0149 - Updated zrythm package fixes bug
Publication date: 07 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
The zrythm package has a build id that matches one in the carla package. This prevents both packages from being installed together and causes migrations from Mageia 9 to Mageia 10 to fail if both packages were installed before the migration. This update fixes the reported issue. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
The zrythm package has a build id that matches one in the carla package. This prevents both packages from being installed together and causes migrations from Mageia 9 to Mageia 10 to fail if both packages were installed before the migration. This update fixes the reported issue. References
SRPMS 10/core
- zrythm-1.0.0-3.1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0470 - Updated tesseract packages fix security vulnerabilities
Publication date: 07 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-73067 , CVE-2026-88047 , CVE-2026-88048 , CVE-2026-88049 , CVE-2026-88050 , CVE-2026-88051 , CVE-2026-88052 , CVE-2026-88053 , CVE-2026-88054 Description
This is a security update. It fixes nine vulnerabilities in tesseract, the OCR (text recognition) engine. All nine can be triggered only by feeding tesseract a maliciously crafted input file: either a specially crafted recognition/language data file (.traineddata) or a crafted word-list file. Depending on the specific flaw, this can cause a crash (denial of service) or memory corruption. CVE-2026-73067: out-of-bounds read when loading a crafted word-list file. CVE-2026-73066: out-of-bounds write when loading a crafted recognition model file. CVE-2026-88047: stack buffer overflow when loading a crafted language-normalisation file. CVE-2026-88048: out-of-bounds read/write from a crafted neural-network layer in a recognition model file. CVE-2026-88049: out-of-bounds write from a crafted neural-network layer in a recognition model file. CVE-2026-88050: out-of-bounds write from invalid character-encoding values in a crafted recognition model file. CVE-2026-88051: out-of-bounds write when loading a malformed internal data structure from a crafted recognition model file. CVE-2026-88052: out-of-bounds write when loading a crafted character-set file. CVE-2026-88053: out-of-bounds write when loading a crafted legacy recognition template file. CVE-2026-88054: crash (denial of service) when loading a crafted recognition model with an empty internal network. The tesseract package is updated to version 5.5.3, which on its own fixes CVE-2026-73067 and CVE-2026-73066. The remaining seven issues (CVE-2026-88047 to CVE-2026-88054) are not yet fixed in any upstream release, so nine patches taken from upstream's main development branch are also applied. Reported by Tristan Madani (CVE-2026-88047) and Zhixi "Jace" Sun (CVE-2026-88048 to CVE-2026-88054); see the individual advisories below for full credits, including CVE-2026-73067 and CVE-2026-73066. References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-73067 , CVE-2026-88047 , CVE-2026-88048 , CVE-2026-88049 , CVE-2026-88050 , CVE-2026-88051 , CVE-2026-88052 , CVE-2026-88053 , CVE-2026-88054 Description
This is a security update. It fixes nine vulnerabilities in tesseract, the OCR (text recognition) engine. All nine can be triggered only by feeding tesseract a maliciously crafted input file: either a specially crafted recognition/language data file (.traineddata) or a crafted word-list file. Depending on the specific flaw, this can cause a crash (denial of service) or memory corruption. CVE-2026-73067: out-of-bounds read when loading a crafted word-list file. CVE-2026-73066: out-of-bounds write when loading a crafted recognition model file. CVE-2026-88047: stack buffer overflow when loading a crafted language-normalisation file. CVE-2026-88048: out-of-bounds read/write from a crafted neural-network layer in a recognition model file. CVE-2026-88049: out-of-bounds write from a crafted neural-network layer in a recognition model file. CVE-2026-88050: out-of-bounds write from invalid character-encoding values in a crafted recognition model file. CVE-2026-88051: out-of-bounds write when loading a malformed internal data structure from a crafted recognition model file. CVE-2026-88052: out-of-bounds write when loading a crafted character-set file. CVE-2026-88053: out-of-bounds write when loading a crafted legacy recognition template file. CVE-2026-88054: crash (denial of service) when loading a crafted recognition model with an empty internal network. The tesseract package is updated to version 5.5.3, which on its own fixes CVE-2026-73067 and CVE-2026-73066. The remaining seven issues (CVE-2026-88047 to CVE-2026-88054) are not yet fixed in any upstream release, so nine patches taken from upstream's main development branch are also applied. Reported by Tristan Madani (CVE-2026-88047) and Zhixi "Jace" Sun (CVE-2026-88048 to CVE-2026-88054); see the individual advisories below for full credits, including CVE-2026-73067 and CVE-2026-73066. References
- https://bugs.mageia.org/show_bug.cgi?id=36427
- https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
- https://osv.dev/vulnerability/openSUSE-SU-2026:21957-1
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/25OCRCHOE46S5WTJZC25DVGO7KC2KVWO/
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h
- https://github.com/tesseract-ocr/tesseract/pull/4581
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8
- https://github.com/tesseract-ocr/tesseract/pull/4588
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-q44c-23p6-5mw6
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7v9h-3q3m-w68g
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-2hm8-q5c7-c373
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv
- https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-f6h7-cqr4-6fx4
- https://www.cve.org/CVERecord?id=CVE-2026-73067
- https://www.cve.org/CVERecord?id=CVE-2026-88047
- https://www.cve.org/CVERecord?id=CVE-2026-88048
- https://www.cve.org/CVERecord?id=CVE-2026-88049
- https://www.cve.org/CVERecord?id=CVE-2026-88050
- https://www.cve.org/CVERecord?id=CVE-2026-88051
- https://www.cve.org/CVERecord?id=CVE-2026-88052
- https://www.cve.org/CVERecord?id=CVE-2026-88053
- https://www.cve.org/CVERecord?id=CVE-2026-88054
- tesseract-5.5.3-1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0469 - Updated srt package fixes security vulnerabilities
Publication date: 06 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55868 , CVE-2026-55869 Description
Encryption State Machine Downgrade. (CVE-2026-55868) KMREQ/KMRSP Stack-Based Buffer Overflow. (CVE-2026-55869) References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55868 , CVE-2026-55869 Description
Encryption State Machine Downgrade. (CVE-2026-55868) KMREQ/KMRSP Stack-Based Buffer Overflow. (CVE-2026-55869) References
- https://bugs.mageia.org/show_bug.cgi?id=36158
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XN3R27AYMZKANUF4IXBPFLBC773HW7LM/
- https://lists.debian.org/debian-security-announce/2026/msg00361.html
- https://github.com/Haivision/srt/security/advisories/GHSA-4mc6-qmpp-g7gw
- https://github.com/Haivision/srt/security/advisories/GHSA-6xg9-784j-24rm
- https://www.cve.org/CVERecord?id=CVE-2026-55868
- https://www.cve.org/CVERecord?id=CVE-2026-55869
- srt-1.5.4-2.1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0468 - Updated tor package fixes security vulnerabilities
Publication date: 06 Oct 2026
Type: security
Affected Mageia releases : 10
Description
Avoid a set of possible memory corruption, double-free, and null pointer dereference bugs that could occur with some reverse DNS virtual address configurations. TROVE-2026-051. Avoid cacheing DNS PTR responses when DNS caching is disabled. Previous code to prevent this caching parsed the response addresses incorrectly, and defaulted to caching when the address could not be parsed. TROVE-2026-050 References
Type: security
Affected Mageia releases : 10
Description
Avoid a set of possible memory corruption, double-free, and null pointer dereference bugs that could occur with some reverse DNS virtual address configurations. TROVE-2026-051. Avoid cacheing DNS PTR responses when DNS caching is disabled. Previous code to prevent this caching parsed the response addresses incorrectly, and defaulted to caching when the address could not be parsed. TROVE-2026-050 References
- https://bugs.mageia.org/show_bug.cgi?id=36365
- https://www.openwall.com/lists/oss-security/2026/09/24/2
- https://lists.debian.org/debian-security-announce/2026/msg00445.html
- tor-0.4.9.13-1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0148 - Updated drakwizard package fixes bug
Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
/sbin/route is deprecated and drakwizard should use ip (from iproute2) instead. This will let us remove the dependency on the unmaintained Net::Route::Table module, which has not been updated upstream since 2009. This update fixes the reported issue. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
/sbin/route is deprecated and drakwizard should use ip (from iproute2) instead. This will let us remove the dependency on the unmaintained Net::Route::Table module, which has not been updated upstream since 2009. This update fixes the reported issue. References
SRPMS 10/core
- drakwizard-4.13-1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0147 - Updated task-cinnamon package fixes bugs
Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
xdg-desktop-portal-xapp package is missing in the requirements. lxdm should not be recommended as display manager for cinnamon. This update fixes the reported issues. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
xdg-desktop-portal-xapp package is missing in the requirements. lxdm should not be recommended as display manager for cinnamon. This update fixes the reported issues. References
SRPMS 10/core
- task-cinnamon-6.6-1.2.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0146 - Updated guayadeque package fixes bugs
Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
This last version 0.7.7 corrects some bugs and brings an offline help: - Fixed a long standing bug that causes the grids (like Media Library Songs Panel) to not update the screen on horizontal scroll. - Fixed a bug in the playlist vertical scrolling when the playing track is out of view. - The first track out of view in the bottom of the playlist wasn't scrolled to follow the player current track. - Playlist "Select" context-menu fixes - Fixed selections failing when a Directory panel filter was active. - Fixed saving and restoring the last directory path selected in Directory Panel. - Fixed the "enable volume" preference saving the wrong value. - Fixed build for gtk2 based distros. - Added missing Serbian (Latin) language to preferences. - Corrected several translations (Portuguese (Brasil), French, Italian, Catalan, Spanish, Greek, German...) References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
This last version 0.7.7 corrects some bugs and brings an offline help: - Fixed a long standing bug that causes the grids (like Media Library Songs Panel) to not update the screen on horizontal scroll. - Fixed a bug in the playlist vertical scrolling when the playing track is out of view. - The first track out of view in the bottom of the playlist wasn't scrolled to follow the player current track. - Playlist "Select" context-menu fixes - Fixed selections failing when a Directory panel filter was active. - Fixed saving and restoring the last directory path selected in Directory Panel. - Fixed the "enable volume" preference saving the wrong value. - Fixed build for gtk2 based distros. - Added missing Serbian (Latin) language to preferences. - Corrected several translations (Portuguese (Brasil), French, Italian, Catalan, Spanish, Greek, German...) References
SRPMS 10/core
- guayadeque-0.7.7-1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0145 - Updated php8.5 & php8.4 packages fix bugs
Publication date: 02 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
Bug fix releases for php 8.4 and php 8.5 References
Type: bugfix
Affected Mageia releases : 10
Description
Bug fix releases for php 8.4 and php 8.5 References
- https://bugs.mageia.org/show_bug.cgi?id=36368
- https://www.php.net/ChangeLog-8.php#8.4.26
- https://www.php.net/ChangeLog-8.php#8.5.11
- php8.5-8.5.11-1.mga10
- php8.4-8.4.26-1.1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0467 - Updated python-tornado packages fix security vulnerabilities
Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-49853 , CVE-2026-49854 , CVE-2026-49855 Description
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-49853 , CVE-2026-49854 , CVE-2026-49855 Description
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) References
- https://bugs.mageia.org/show_bug.cgi?id=35712
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GZ7Q55UOVFEKZDAHBHES3HJS2PZ4OQHV/
- https://www.cve.org/CVERecord?id=CVE-2026-49853
- https://www.cve.org/CVERecord?id=CVE-2026-49854
- https://www.cve.org/CVERecord?id=CVE-2026-49855
- python-tornado-6.5.10-1.1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0466 - Updated python-urwid & python-wcwidth packages fixes a security vulnerability
Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-9323 Description
Insecure PRNG and Information Exposure in urwid Web Display Backend References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-9323 Description
Insecure PRNG and Information Exposure in urwid Web Display Backend References
- https://bugs.mageia.org/show_bug.cgi?id=36159
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3XPYRLW6AB7WGF3ENBZSCZHGJCJFF7VI/
- https://github.com/urwid/urwid/security/advisories/GHSA-rjwp-g85x-gmjv
- https://ubuntu.com/security/notices/USN-8751-1
- https://www.cve.org/CVERecord?id=CVE-2026-9323
- python-urwid-4.1.3-1.mga10
- python-wcwidth-0.8.3-1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0465 - Updated wireshark package fixes security vulnerabilities
Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-15163 , CVE-2026-15164 , CVE-2026-15165 , CVE-2026-15166 , CVE-2026-15167 , CVE-2026-15168 , CVE-2026-15169 , CVE-2026-15170 , CVE-2026-15171 , CVE-2026-15172 , CVE-2026-15173 , CVE-2026-15174 Description
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark. (CVE-2026-15163) Heap-based Buffer Overflow in ciscodump. (CVE-2026-15164) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15165) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15166) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15167) Use of Uninitialized Variable in Wireshark. (CVE-2026-15168) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15169) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15170) NULL Pointer Dereference in Wireshark. (CVE-2026-15171) Unchecked Input for Loop Condition in Wireshark. (CVE-2026-15172) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15173) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15174) References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-15163 , CVE-2026-15164 , CVE-2026-15165 , CVE-2026-15166 , CVE-2026-15167 , CVE-2026-15168 , CVE-2026-15169 , CVE-2026-15170 , CVE-2026-15171 , CVE-2026-15172 , CVE-2026-15173 , CVE-2026-15174 Description
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark. (CVE-2026-15163) Heap-based Buffer Overflow in ciscodump. (CVE-2026-15164) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15165) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15166) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15167) Use of Uninitialized Variable in Wireshark. (CVE-2026-15168) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15169) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15170) NULL Pointer Dereference in Wireshark. (CVE-2026-15171) Unchecked Input for Loop Condition in Wireshark. (CVE-2026-15172) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15173) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15174) References
- https://bugs.mageia.org/show_bug.cgi?id=35985
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WDPYZRRCJU7AOWEFKBJ2IXADDJGWH4AH/
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OUNLKEGMF6HPV3WJRY6PZJF4BTUIQWBO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5DGIBJC6D6UABMCLLUPI5ZU2I3SEFUV/
- https://lists.debian.org/debian-security-announce/2026/msg00382.html
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UONW2KX7GYYS7MVUGXE7L23MZC42ZLHT/
- https://www.cve.org/CVERecord?id=CVE-2026-15163
- https://www.cve.org/CVERecord?id=CVE-2026-15164
- https://www.cve.org/CVERecord?id=CVE-2026-15165
- https://www.cve.org/CVERecord?id=CVE-2026-15166
- https://www.cve.org/CVERecord?id=CVE-2026-15167
- https://www.cve.org/CVERecord?id=CVE-2026-15168
- https://www.cve.org/CVERecord?id=CVE-2026-15169
- https://www.cve.org/CVERecord?id=CVE-2026-15170
- https://www.cve.org/CVERecord?id=CVE-2026-15171
- https://www.cve.org/CVERecord?id=CVE-2026-15172
- https://www.cve.org/CVERecord?id=CVE-2026-15173
- https://www.cve.org/CVERecord?id=CVE-2026-15174
- wireshark-4.6.8-1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0464 - Updated libgcrypt package fixes a security vulnerability
Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-2236 Description
Libgcrypt: vulnerable to marvin attack. (CVE-2024-2236) References
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-2236 Description
Libgcrypt: vulnerable to marvin attack. (CVE-2024-2236) References
- https://bugs.mageia.org/show_bug.cgi?id=36248
- https://ubuntu.com/security/notices/USN-8711-1
- https://bugzilla.redhat.com/show_bug.cgi?id=2268268
- https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html
- https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt
- https://people.redhat.com/~hkario/marvin/
- https://dev.gnupg.org/T7136
- https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17
- https://www.cve.org/CVERecord?id=CVE-2024-2236
- libgcrypt-1.11.3-1.1.mga10
Categorías: Actualizaciones de Seguridad
MGASA-2026-0463 - Updated python-pillow packages fix security vulnerabilities
Publication date: 01 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55380 , CVE-2026-54060 , CVE-2026-54059 , CVE-2026-55379 , CVE-2026-59205 , CVE-2026-59199 , CVE-2026-59197 , CVE-2026-59198 , CVE-2026-54058 , CVE-2026-59204 , CVE-2026-59203 Description
Prevent decompression bomb when parsing PDF WindowsViewer.get_command injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds (OOB) read Out-of-bounds (OOB) read when saving 1 mode TGA images Out-of-bounds (OOB) write from large RankFilter sizes Out-of-bounds (OOB) write from Image.paste() Out-of-bounds (OOB) write in ImageCmsTransform Prevent FontFile decompression bomb Prevent GD decompression bomb References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55380 , CVE-2026-54060 , CVE-2026-54059 , CVE-2026-55379 , CVE-2026-59205 , CVE-2026-59199 , CVE-2026-59197 , CVE-2026-59198 , CVE-2026-54058 , CVE-2026-59204 , CVE-2026-59203 Description
Prevent decompression bomb when parsing PDF WindowsViewer.get_command injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds (OOB) read Out-of-bounds (OOB) read when saving 1 mode TGA images Out-of-bounds (OOB) write from large RankFilter sizes Out-of-bounds (OOB) write from Image.paste() Out-of-bounds (OOB) write in ImageCmsTransform Prevent FontFile decompression bomb Prevent GD decompression bomb References
- https://bugs.mageia.org/show_bug.cgi?id=35909
- https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
- https://www.cve.org/CVERecord?id=CVE-2026-55380
- https://www.cve.org/CVERecord?id=CVE-2026-54060
- https://www.cve.org/CVERecord?id=CVE-2026-54059
- https://www.cve.org/CVERecord?id=CVE-2026-55379
- https://www.cve.org/CVERecord?id=CVE-2026-59205
- https://www.cve.org/CVERecord?id=CVE-2026-59199
- https://www.cve.org/CVERecord?id=CVE-2026-59197
- https://www.cve.org/CVERecord?id=CVE-2026-59198
- https://www.cve.org/CVERecord?id=CVE-2026-54058
- https://www.cve.org/CVERecord?id=CVE-2026-59204
- https://www.cve.org/CVERecord?id=CVE-2026-59203
- python-pillow-12.3.0-1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0144 - Updated glabels & glabels-qt packages fixes bug
Publication date: 01 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
glabels can't open previously-created glabels files. We have added a patch to fix the issue but the project is dead upstream and its developer is now focussing on glabels-qt. We are releasing glabels-qt as an alternative. Both versions fix the reported issue; it is your decision what tool to use. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
glabels can't open previously-created glabels files. We have added a patch to fix the issue but the project is dead upstream and its developer is now focussing on glabels-qt. We are releasing glabels-qt as an alternative. Both versions fix the reported issue; it is your decision what tool to use. References
SRPMS 10/core
- glabels-3.4.1-12.1.mga10
- glabels-qt-3.99-0.2.2026.08.27git554c9f0.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0143 - Updated borgbackup package fixes bug
Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Borgbackup uses the msgpack python module, and it includes a stopping check for exactly the version 1.2.1. It also recognises an option to disable this check. The updated package shunts this check, which seems overzealous. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
Borgbackup uses the msgpack python module, and it includes a stopping check for exactly the version 1.2.1. It also recognises an option to disable this check. The updated package shunts this check, which seems overzealous. References
SRPMS 10/core
- borgbackup-1.4.5-1.1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0142 - Updated engrampa package fixes opening zst files
Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Due to a missing requirement on zstd, engrampa can't open zst files. This update fixes the reported issue. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
Due to a missing requirement on zstd, engrampa can't open zst files. This update fixes the reported issue. References
SRPMS 10/core
- engrampa-1.28.5-1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0141 - Updated task-lxde package fixes bug
Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
LXDM is only installed by task-lxde. If you only install task-lxde-minimal, then you miss LXDM and you only have XDM which doesn't let you select your desktop environment. This update fixes the reported issue, moving the requirement on LXDM to the task-lxde-minimal package. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10
Description
LXDM is only installed by task-lxde. If you only install task-lxde-minimal, then you miss LXDM and you only have XDM which doesn't let you select your desktop environment. This update fixes the reported issue, moving the requirement on LXDM to the task-lxde-minimal package. References
SRPMS 10/core
- task-lxde-10-2.1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0140 - Updated whatsie package fixes bug
Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10
Description
Previously setting a dark theme is not respected after a system reboot. This update fixes the issue by updating whatsie to the 6.1.1 version. References
Type: bugfix
Affected Mageia releases : 10
Description
Previously setting a dark theme is not respected after a system reboot. This update fixes the issue by updating whatsie to the 6.1.1 version. References
- https://bugs.mageia.org/show_bug.cgi?id=35397
- https://github.com/keshavbhatt/whatsie/issues/299
- https://github.com/keshavbhatt/whatsie/releases/tag/v6.1.1
- https://github.com/keshavbhatt/whatsie/releases#release-v6.1.0
- https://github.com/keshavbhatt/whatsie/releases#release-v6.0.4
- https://github.com/keshavbhatt/whatsie/releases#release-v6.0.3
- https://github.com/keshavbhatt/whatsie/releases#release-v6.0.1
- https://github.com/keshavbhatt/whatsie/releases#release-v6.0.0
- whatsie-6.1.1-1.mga10
Categorías: Actualizaciones de Seguridad
MGAA-2026-0139 - New urpm-ng packages introduce urpm-ng
Publication date: 30 Sep 2026
Type: bugfix
Affected Mageia releases : 10 , 9
Description
urpm-ng is a reimplementation of the urpmi toolset, written in Python on top of libsolv. It installs, upgrades, removes and queries packages, and resolves dependencies automatically. This packages introduces urpm-ng in Mageia 9 and 10 to allow early testers do migrations from Mageia 9 to Mageia 10 with the package manager component without add external repositories. We do not recommend it yet for inexperienced users. References
SRPMS 10/core
Type: bugfix
Affected Mageia releases : 10 , 9
Description
urpm-ng is a reimplementation of the urpmi toolset, written in Python on top of libsolv. It installs, upgrades, removes and queries packages, and resolves dependencies automatically. This packages introduces urpm-ng in Mageia 9 and 10 to allow early testers do migrations from Mageia 9 to Mageia 10 with the package manager component without add external repositories. We do not recommend it yet for inexperienced users. References
SRPMS 10/core
- urpm-ng-0.9.14-1.mga10
- urpm-ng-0.9.14-1.mga9
Categorías: Actualizaciones de Seguridad
MGASA-2026-0462 - Updated fuse-overlayfs package fixes security vulnerabilities
Publication date: 29 Sep 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-52791 , CVE-2026-77478 Description
fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478) References
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-52791 , CVE-2026-77478 Description
fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478) References
- https://bugs.mageia.org/show_bug.cgi?id=36164
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OHDCW47LEOQXLVH2XJNC3A7VFVELJQ6U/
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YO4BSFYJPI6ZGUIXZ3AHYYYFEYEM4MFO/
- https://github.com/containers/fuse-overlayfs/releases/tag/v1.17
- https://github.com/containers/fuse-overlayfs/releases/tag/v1.18
- https://www.cve.org/CVERecord?id=CVE-2026-52791
- https://www.cve.org/CVERecord?id=CVE-2026-77478
- fuse-overlayfs-1.18-1.mga10
Categorías: Actualizaciones de Seguridad
