Actualizaciones de Seguridad

Publication date: 27 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-5222 Description A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution. References

• https://bugs.mageia.org/show_bug.cgi?id=34442
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/KB5WTHV4QSRRUVG6KMSV4Z2FIQKSWR54/
• https://lists.debian.org/debian-security-announce/2025/msg00115.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5222

SRPMS 9/core

• icu-73.2-1.2.mga9

Publication date: 27 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-49133 Description It was discovered that libtpms had a potential out-of-bound access & abort due to HMAC signing issue (CVE-2025-49133). References

• https://bugs.mageia.org/show_bug.cgi?id=34396
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XITIPFJQFQIYBAV5Y3UA5AL6T5ATFDFX/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49133

SRPMS 9/core

• libtpms-0.9.6-1.1.mga9

Publication date: 24 Oct 2025
Type: bugfix
Affected Mageia releases : 9
Description Fixed multiple shader bugs that were causing graphical artifacts and vegetation to not be visible Fixed a bug where messages from ATC were appearing on the splash screen before the user had fully spawned Fixed a bug in the launcher where dropdown boxes on the Flight Planner page were empty Fixed a memory bug in YASim that resulted in a crash under certain conditions Fixed missing maps in the FG1000 Fixed regional textures for random buildings Fixed minimum dewpoint calculation in JSBSim Fixed SID/STAR selection and modification in the route manager References

• https://bugs.mageia.org/show_bug.cgi?id=34659
• https://www.flightgear.org/download/releases/2024-1-2/

SRPMS 9/core

• simgear-2024.1.2-1.mga9
• flightgear-2024.1.2-1.mga9
• flightgear-data-2024.1.2-1.mga9

Publication date: 23 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-10527 , CVE-2025-10528 , CVE-2025-10529 , CVE-2025-10532 , CVE-2025-10533 , CVE-2025-10536 , CVE-2025-10537 , CVE-2025-11708 , CVE-2025-11709 , CVE-2025-11710 , CVE-2025-11711 , CVE-2025-11712 , CVE-2025-11713 , CVE-2025-11714 , CVE-2025-11715 Description CVE-2025-11708: Use-after-free in MediaTrackGraphImpl::GetInstance() CVE-2025-11709: Out of bounds read/write in a privileged process triggered by WebGL textures CVE-2025-11710: Cross-process information leaked due to malicious IPC messages CVE-2025-11711: Some non-writable Object properties could be modified CVE-2025-11712: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type CVE-2025-11713: Potential user-assisted code execution in “Copy as cURL” command CVE-2025-11714: Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 CVE-2025-11715: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144, and other security fixes; please see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=34638
• https://www.thunderbird.net/en-US/thunderbird/140.4.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-85/
• https://www.thunderbird.net/en-US/thunderbird/140.4.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-85/
• https://www.thunderbird.net/en-US/thunderbird/140.3.1esr/releasenotes/
• https://www.thunderbird.net/en-US/thunderbird/140.3.0esr/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-78/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11713
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715

SRPMS 9/core

• thunderbird-140.4.0-1.2.mga9
• thunderbird-l10n-140.4.0-1.mga9

Publication date: 23 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-10527 , CVE-2025-10528 , CVE-2025-10529 , CVE-2025-10532 , CVE-2025-10533 , CVE-2025-10536 , CVE-2025-10537 , CVE-2025-11708 , CVE-2025-11709 , CVE-2025-11710 , CVE-2025-11711 , CVE-2025-11712 , CVE-2025-11713 , CVE-2025-11714 , CVE-2025-11715 Description CVE-2025-11708: Use-after-free in MediaTrackGraphImpl::GetInstance() CVE-2025-11709: Out of bounds read/write in a privileged process triggered by WebGL textures CVE-2025-11710: Cross-process information leaked due to malicious IPC messages CVE-2025-11711: Some non-writable Object properties could be modified CVE-2025-11712: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type CVE-2025-11713: Potential user-assisted code execution in “Copy as cURL” command CVE-2025-11714: Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 CVE-2025-11715: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144, and other security fixes; please see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=34637
• https://www.firefox.com/en-US/firefox/140.4.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-83/
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_117.html
• https://www.firefox.com/en-US/firefox/140.3.1/releasenotes/
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_116.html
• https://www.firefox.com/en-US/firefox/140.3.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-75/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11713
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715

SRPMS 9/core

• nss-3.117.0-1.mga9
• rootcerts-20251003.00-1.mga9
• firefox-140.4.0-1.2.mga9
• firefox-l10n-140.4.0-1.mga9

Publication date: 22 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-53859 Description It was discovered that nginx contains a security issue in the ngx_mail_smtp_module which might allow an attacker to cause buffer over-read potentially resulting in sensitive information leak in a HTTP request to the authentication server (CVE-2025-53859). References

• https://bugs.mageia.org/show_bug.cgi?id=34585
• https://www.openwall.com/lists/oss-security/2025/08/13/5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53859

SRPMS 9/core

• nginx-1.26.3-1.1.mga9

Publication date: 22 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-9230 Description Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) References

• https://bugs.mageia.org/show_bug.cgi?id=34643
• https://www.openwall.com/lists/oss-security/2025/09/30/5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9230

SRPMS 9/core

• openssl-3.0.18-1.mga9

Publication date: 22 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-59681 , CVE-2025-59682 Description An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB). (CVE-2025-59681) An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory. (CVE-2025-59682) References

• https://bugs.mageia.org/show_bug.cgi?id=34645
• https://www.openwall.com/lists/oss-security/2025/10/01/3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59681
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59682

SRPMS 9/core

• python-django-4.1.13-1.7.mga9

Publication date: 22 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-11230 Description Haproxy has a critical, a major, few medium and few minor bugs fixed in the last upstream version 2.8.16 of branch 2.8. Fixed critical bug list: - mjson: fix possible DoS when parsing numbers Fixed major bug list: - listeners: transfer connection accounting when switching listeners Fixed medium bugs list: - check: Requeue healthchecks on I/O events to handle check timeout - check: Set SOCKERR by default when a connection error is reported - checks: fix ALPN inheritance from server - dns: Reset reconnect tempo when connection is finally established - fd: Use the provided tgid in fd_insert() to get tgroup_info - h1: Allow reception if we have early data - h1/h2/h3: reject forbidden chars in the Host header field - h2/h3: reject some forbidden chars in :authority before reassembly - hlua: Add function to change the body length of an HTTP Message - hlua: Forbid any L6/L7 sample fetche functions from lua services - hlua: Report to SC when data were consumed on a lua socket - hlua: Report to SC when output data are blocked on a lua socket - http-client: Ask for more room when request data cannot be xferred - http-client: Don't wake http-client applet if nothing was xferred - http-client: Drain the request if an early response is received - http-client: Notify applet has more data to deliver until the EOM - http-client: Properly inc input data when HTX blocks are xferred - http-client: Test HTX_FL_EOM flag before commiting the HTX buffer - httpclient: Throw an error if an lua httpclient instance is reused - mux-h2: Properly handle connection error during preface sending - server: Duplicate healthcheck's alpn inherited from default server - ssl: ca-file directory mode must read every certificates of a file - ssl/clienthello: ECDSA with ssl-max-ver TLSv1.2 and no ECDSA ciphers - ssl: create the mux immediately on early data - ssl: Fix 0rtt to the server - ssl: fix build with AWS-LC - threads: Disable the workaround to load libgcc_s on macOS References

• https://bugs.mageia.org/show_bug.cgi?id=34673
• https://www.haproxy.org/download/2.8/src/CHANGELOG
• https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11230

SRPMS 9/core

• haproxy-2.8.16-1.mga9

Publication date: 20 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-9230 , CVE-2025-9232 Description Two security issues and miscellaneous minor bug fixes. Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232) References

• https://bugs.mageia.org/show_bug.cgi?id=34674
• https://openssl-library.org/news/vulnerabilities/#CVE-2025-9230
• https://openssl-library.org/news/vulnerabilities/#CVE-2025-9232
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9230
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9232

SRPMS 9/core

• quictls-3.0.18-1.mga9

Publication date: 20 Oct 2025
Type: bugfix
Affected Mageia releases : 9
Description The current version of rust in mga9 is not new enough to keep building Mozilla's applications. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=34500

SRPMS 9/core

• rust-1.82.0-1.mga9

Publication date: 20 Oct 2025
Type: bugfix
Affected Mageia releases : 9
Description Fixed "Delete" button not asking for confirmation when deleting a row. Fix error 500 when simulating a SET statement. Fixed PHP 8.4 deprecations in thecodingmachine/safe. References

• https://bugs.mageia.org/show_bug.cgi?id=34680
• https://www.phpmyadmin.net/news/2025/10/8/phpmyadmin-523-is-released/

SRPMS 9/core

• phpmyadmin-5.2.3-1.mga9

Publication date: 18 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-8176 , CVE-2025-59375 Description Improper restriction of xml entity expansion depth in libexpat. (CVE-2024-8176) This is an extension of the fix published in MGASA-2025-0109 that was determined by upstream to be incomplete. Libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. (CVE-2025-59375) References

• https://bugs.mageia.org/show_bug.cgi?id=34640
• https://bugs.mageia.org/show_bug.cgi?id=34111
• https://www.openwall.com/lists/oss-security/2025/09/24/11
• https://advisories.mageia.org/MGASA-2025-0109.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8176
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375

SRPMS 9/core

• expat-2.7.3-1.mga9

Publication date: 17 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-8671 Description It was discovered that a denial of service attack can be performed on cache servers that have the HTTP/2 protocol turned on. An attacker can create a large number of streams and immediately reset them without ever reaching the maximum number of concurrent streams allowed for the session, causing the server to consume unnecessary resources processing requests for which the response will not be delivered (CVE-2025-8671). References

• https://bugs.mageia.org/show_bug.cgi?id=34587
• https://www.openwall.com/lists/oss-security/2025/08/13/6
• https://www.openwall.com/lists/oss-security/2025/08/16/1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8671

SRPMS 9/core

• varnish-7.7.3-1.mga9
• lighttpd-1.4.80-1.3.mga9

Publication date: 14 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-61962 Description It was discovered that fetchmail's SMTP client, when configured to authenticate, is susceptible to a protocol violation where, when a trusted but malicious or malfunctioning SMTP server responds to an authentication request with a "334" code but without a following blank on the line, it will attempt to start reading from memory address 0x1 to parse the server's SASL challenge. This event will usually cause a crash of fetchmail (CVE-2025-61962). References

• https://bugs.mageia.org/show_bug.cgi?id=34644
• https://www.openwall.com/lists/oss-security/2025/10/03/2
• https://www.openwall.com/lists/oss-security/2025/10/04/3
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61962

SRPMS 9/core

• fetchmail-6.5.6-1.mga9

Publication date: 14 Oct 2025
Type: bugfix
Affected Mageia releases : 9
Description Viking no longer downloads Open Street Maps map tiles. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=34660
• https://github.com/viking-gps/viking/issues/339

SRPMS 9/core

• viking-1.10-2.1.mga9

Publication date: 11 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-41244 Description It was discovered that open-vm-tools contains a local privilege escalation vulnerability. A malicious actor with non-administrative privileges on a guest VM may exploit this vulnerability to escalate privileges to root on the same VM (CVE-2025-41244). References

• https://bugs.mageia.org/show_bug.cgi?id=34641
• https://www.openwall.com/lists/oss-security/2025/09/29/10
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-41244

SRPMS 9/core

• open-vm-tools-12.3.5-2.2.mga9

Publication date: 11 Oct 2025
Type: bugfix
Affected Mageia releases : 9
Description When Qarte is started, the Arte TV window is blank. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=34654
• https://bugs.launchpad.net/qarte/+bug/2121947

SRPMS 9/core

• qarte-5.13.0-1.mga9

Publication date: 10 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-20109 , CVE-2025-22840 , CVE-2025-22839 , CVE-2025-20053 , CVE-2025-24305 , CVE-2025-21090 , CVE-2025-26403 , CVE-2025-32086 Description The updated package updates AMD cpu microcode for processor family 19h, adds AMD cpu microcode for processor family 1ah and fixes security vulnerabilities for Intel processors: Improper Isolation or Compartmentalization in the stream cache mechanism for some Intel® Processors may allow an authenticated user to potentially enable escalation of privilege via local access. (CVE-2025-20109) Sequence of processor instructions leads to unexpected behavior for some Intel® Xeon® 6 Scalable processors may allow an authenticated user to potentially enable escalation of privilege via local access. (CVE-2025-22840) Insufficient granularity of access control in the OOB-MSM for some Intel® Xeon® 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access. (CVE-2025-22839) Improper handling of overlap between protected memory ranges for some Intel® Xeon® 6 processor with Intel® TDX may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2025-22889) Improper buffer restrictions for some Intel® Xeon® Processor firmware with SGX enabled may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2025-20053) Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel® Xeon® processors may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2025-24305) Missing reference to active allocated resource for some Intel® Xeon® processors may allow an authenticated user to potentially enable denial of service via local access. (CVE-2025-21090) Out-of-bounds write in the memory subsystem for some Intel® Xeon® 6 processors when using Intel® SGX or Intel® TDX may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2025-26403) Improperly implemented security check for standard in the DDRIO configuration for some Intel® Xeon® 6 Processors when using Intel® SGX or Intel® TDX may allow a privileged user to potentially enable escalation of privilege via local access. (CVE-2025-32086) References

• https://bugs.mageia.org/show_bug.cgi?id=34629
• https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250812
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20109
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22840
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22839
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20053
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24305
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21090
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26403
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32086

SRPMS 9/nonfree

• microcode-0.20250812-1.mga9.nonfree

Publication date: 10 Oct 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2025-38501 , CVE-2025-38553 , CVE-2025-38555 , CVE-2025-38560 , CVE-2025-38561 , CVE-2025-38562 , CVE-2025-38563 , CVE-2025-38565 , CVE-2025-38566 , CVE-2025-38568 , CVE-2025-38569 , CVE-2025-38571 , CVE-2025-38572 , CVE-2025-38574 , CVE-2025-38576 , CVE-2025-38577 , CVE-2025-38578 , CVE-2025-38579 , CVE-2025-38581 , CVE-2025-38583 , CVE-2025-38587 , CVE-2025-38588 , CVE-2025-38590 , CVE-2025-38601 , CVE-2025-38602 , CVE-2025-38604 , CVE-2025-38608 , CVE-2025-38609 , CVE-2025-38610 , CVE-2025-38611 , CVE-2025-38612 , CVE-2025-38615 , CVE-2025-38617 , CVE-2025-38618 , CVE-2025-38622 , CVE-2025-38623 , CVE-2025-38624 , CVE-2025-38625 , CVE-2025-38626 , CVE-2025-38630 , CVE-2025-38632 , CVE-2025-38634 , CVE-2025-38635 , CVE-2025-38639 , CVE-2025-38640 , CVE-2025-38644 , CVE-2025-38645 , CVE-2025-38646 , CVE-2025-38648 , CVE-2025-38650 , CVE-2025-38652 , CVE-2025-38653 , CVE-2025-38656 , CVE-2025-38659 , CVE-2025-38677 , CVE-2025-38679 , CVE-2025-38680 , CVE-2025-38681 , CVE-2025-38683 , CVE-2025-38684 , CVE-2025-38685 , CVE-2025-38687 , CVE-2025-38688 , CVE-2025-38691 , CVE-2025-38692 , CVE-2025-38693 , CVE-2025-38694 , CVE-2025-38695 , CVE-2025-38696 , CVE-2025-38697 , CVE-2025-38698 , CVE-2025-38699 , CVE-2025-38700 , CVE-2025-38701 , CVE-2025-38702 , CVE-2025-38706 , CVE-2025-38707 , CVE-2025-38708 , CVE-2025-38709 , CVE-2025-38711 , CVE-2025-38712 , CVE-2025-38713 , CVE-2025-38714 , CVE-2025-38715 , CVE-2025-38716 , CVE-2025-38718 , CVE-2025-38721 , CVE-2025-38723 , CVE-2025-38724 , CVE-2025-38725 , CVE-2025-38727 , CVE-2025-38728 , CVE-2025-38729 , CVE-2025-38730 , CVE-2025-38732 , CVE-2025-38734 , CVE-2025-38735 , CVE-2025-39673 , CVE-2025-39675 , CVE-2025-39676 , CVE-2025-39679 , CVE-2025-39681 , CVE-2025-39682 , CVE-2025-39683 , CVE-2025-39684 , CVE-2025-39685 , CVE-2025-39686 , CVE-2025-39687 , CVE-2025-39689 , CVE-2025-39691 , CVE-2025-39692 , CVE-2025-39693 , CVE-2025-39694 , CVE-2025-39701 , CVE-2025-39702 , CVE-2025-39703 , CVE-2025-39706 , CVE-2025-39709 , CVE-2025-39710 , CVE-2025-39711 , CVE-2025-39713 , CVE-2025-39714 , CVE-2025-39715 , CVE-2025-39716 , CVE-2025-39718 , CVE-2025-39719 , CVE-2025-39720 , CVE-2025-39721 , CVE-2025-39724 , CVE-2025-39730 , CVE-2025-39731 , CVE-2025-39734 Description Upstream kernel version 6.6.105 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel. The newer meta-task and mageia-repos packages are required to simplify the correct installation of the kernel-stable-userspace-headers (for backport kernel-stable) and back to kernel-userspace-headers (for 6.6 kernels) packages see https://bugs.mageia.org/show_bug.cgi?id=34545. For information about the vulnerabilities see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=34594
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.102
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.103
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.104
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.105
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38501
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38553
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38555
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38560
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38561
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38562
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38563
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38565
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38566
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38568
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38569
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38571
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38572
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38574
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38576
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38577
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38578
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38579
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38581
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38583
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38587
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38588
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38590
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38601
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38602
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38604
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38608
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38609
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38610
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38611
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38612
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38615
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38617
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38618
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38622
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38623
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38624
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38625
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38626
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38630
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38632
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38634
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38635
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38639
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38640
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38644
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38645
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38646
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38648
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38650
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38652
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38653
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38656
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38659
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38677
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38679
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38680
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38681
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38683
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38684
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38685
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38687
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38688
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38691
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38692
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38693
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38694
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38695
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38696
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38697
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38698
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38699
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38700
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38701
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38702
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38706
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38707
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38708
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38709
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38711
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38712
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38713
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38714
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38715
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38716
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38718
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38721
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38723
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38724
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38725
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38727
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38728
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38729
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38730
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38732
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38734
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38735
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39673
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39675
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39676
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39679
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39681
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39682
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39683
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39684
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39685
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39686
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39687
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39689
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39691
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39692
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39693
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39694
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39701
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39702
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39703
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39706
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39709
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39710
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39711
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39713
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39714
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39715
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39716
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39718
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39719
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39720
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39721
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39724
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39730
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39731
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39734

SRPMS 9/core

• kernel-6.6.105-1.mga9
• kmod-virtualbox-7.1.10-10.mga9
• kmod-xtables-addons-3.24-86.mga9
• mageia-repos-9-4.mga9
• meta-task-9-4.mga9