Mageia Security

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10

nut-scanner failed to start. This update fixes the issue and also updates the nut packages to the latest maintained release. References

• https://bugs.mageia.org/show_bug.cgi?id=35938

SRPMS 10/core

• nut-2.8.5-1.mga10

Publication date: 23 Jul 2026
Type: bugfix
Affected Mageia releases : 10

warpinator uses the grpcio module, but with a stamp of the used module version. The stamp was not in accordance with the version of the provided module in the distro, preventing launch. This update fixes that. References

• https://bugs.mageia.org/show_bug.cgi?id=35891

SRPMS 10/core

• warpinator-2.0.4-1.mga10

Publication date: 21 Jul 2026
Type: security
Affected Mageia releases : 10

The updated package fixes a security vulnerability: editor command injection vulnerability. References

• https://bugs.mageia.org/show_bug.cgi?id=35720
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEP2W3H6GWB2VQQATCPANKNKGGK2TGMP/
• https://github.com/jonas/tig/issues/1432

SRPMS 10/core

• tig-2.6.1-1.mga10

Publication date: 21 Jul 2026
Type: bugfix
Affected Mageia releases : 10

The updates packages fix issues in our signature background. The images have been reworked providing a better look. Building with mock is fixed allowing the produced mageia-theme and mageia-theme-extra packages to be installed together. Fix the plymouth theme which still was the Mageia 9 version after upgrades. Behind the scenes some processes are now done at build time, avoiding recurring issues with interlaced images. References

• https://bugs.mageia.org/show_bug.cgi?id=35843
• https://bugs.mageia.org/show_bug.cgi?id=32259

SRPMS 10/core

• mageia-theme-10.11-1.1.mga10
• grub2-2.12-15.1.mga10
• grub2-mageia-theme-dejavu-1.0-17.1.mga10

Publication date: 21 Jul 2026
Type: bugfix
Affected Mageia releases : 10

The last versions of serd, sord, sratom, suil and lilv couldn't be submitted because of Cauldron FREEZE. References

• https://bugs.mageia.org/show_bug.cgi?id=35826

SRPMS 10/core

• serd-0.32.8-1.mga10
• sord-0.16.22-1.mga10
• sratom-0.6.22-1.mga10
• lilv-0.26.4-1.mga10
• suil-0.10.26-3.mga10

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-56016
The updated package fixes a security vulnerability: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. (CVE-2026-56016) References

• https://bugs.mageia.org/show_bug.cgi?id=35800
• https://www.openwall.com/lists/oss-security/2026/07/01/6
• https://metacpan.org/release/MARKSTOS/CGI-Session-4.49/changes
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OXFQ3DBWPONO7MHLPUC3HP44MVOLIY4B/
• https://www.cve.org/CVERecord?id=CVE-2026-56016

SRPMS 10/core

• perl-CGI-Session-4.490.0-1.mga10

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-14355
The updated php8.4 and php8.5 packages fix several security issues, e.g. Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD. (CVE-2026-14355) References

• https://bugs.mageia.org/show_bug.cgi?id=35809
• https://www.php.net/ChangeLog-8.php#8.4.23
• https://www.php.net/ChangeLog-8.php#8.5.8
• https://www.cve.org/CVERecord?id=CVE-2026-14355

SRPMS 10/core

• php8.4-8.4.23-1.mga10
• php8.5-8.5.8-1.mga10

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2024-53901 , CVE-2026-13705 , CVE-2026-13708 , CVE-2026-14454
The updated package fixes security vulnerabilities: The Imager package before 1.025 for Perl has a heap-based buffer overflow leading to denial of service, or possibly unspecified other impact, when the trim() method is called on a crafted input image. (CVE-2024-53901) Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. (CVE-2026-13705) Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. (CVE-2026-13708) Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. (CVE-2026-14454) References

• https://bugs.mageia.org/show_bug.cgi?id=35848
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7QJU7MFFAP73YEH5YEG35EDMGSNOZ3O5/
• https://www.openwall.com/lists/oss-security/2026/07/08/6
• https://lists.security.metacpan.org/cve-announce/msg/41572386/
• https://lists.security.metacpan.org/cve-announce/msg/41637674/
• https://github.com/briandfoy/cpan-security-advisory/issues/167
• https://www.cve.org/CVERecord?id=CVE-2024-53901
• https://www.cve.org/CVERecord?id=CVE-2026-13705
• https://www.cve.org/CVERecord?id=CVE-2026-13708
• https://www.cve.org/CVERecord?id=CVE-2026-14454

SRPMS 10/core

• perl-Imager-1.33.0-1.mga10

9/core

• perl-Imager-1.19.0-2.2.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-56017 , CVE-2026-56018
The updated package fixes security vulnerabilities: JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. (CVE-2026-56017) JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. (CVE-2026-56018) References

• https://bugs.mageia.org/show_bug.cgi?id=35780
• https://www.openwall.com/lists/oss-security/2026/06/29/16
• https://www.openwall.com/lists/oss-security/2026/06/29/17
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/JRQ3MRFSD4VDM6LUSDFWM5CGXIVDZXIV/
• https://www.cve.org/CVERecord?id=CVE-2026-56017
• https://www.cve.org/CVERecord?id=CVE-2026-56018

SRPMS 10/core

• perl-JavaScript-Minifier-XS-0.160.0-1.mga10

9/core

• perl-JavaScript-Minifier-XS-0.160.0-1.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-46523
The updated packages fix a security vulnerability: Use-After-Free in MSL decoder. (CVE-2026-46523) References

• https://bugs.mageia.org/show_bug.cgi?id=35775
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/IDMJWDSIIAL5DRGYDMBZ2JUPEQH7QCMJ/
• https://www.cve.org/CVERecord?id=CVE-2026-46523

SRPMS 10/core

• graphicsmagick-1.3.46-5.1.mga10

10/tainted

• graphicsmagick-1.3.46-5.1.mga10.tainted

9/core

• graphicsmagick-1.3.40-1.7.mga9

9/tainted

• graphicsmagick-1.3.40-1.7.mga9.tainted

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-54293
URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read. (CVE-2026-54293) References

• https://bugs.mageia.org/show_bug.cgi?id=35762
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WMWF7SLMCGEL35KSK5ERA7U5CKTU5Z57/
• https://github.com/nltk/nltk/security/advisories/GHSA-p4gq-832x-fm9v
• https://www.cve.org/CVERecord?id=CVE-2026-54293

SRPMS 10/core

• python-nltk-3.9.4-1.1.mga10

9/core

• python-nltk-3.9.4-1.1.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-55392
Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size. (CVE-2026-55392) References

• https://bugs.mageia.org/show_bug.cgi?id=35759
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/547QU7QRINNSB7HMT4YKQIJSKLUMGGKV/
• https://github.com/nilfs-dev/nilfs-utils/issues/26
• https://www.cve.org/CVERecord?id=CVE-2026-55392

SRPMS 10/core

• nilfs-utils-2.2.11-3.1.mga10

9/core

• nilfs-utils-2.2.9-1.1.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-42055 , CVE-2026-48142
ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability. (CVE-2026-42055) ngx_http_charset_module vulnerability. (CVE-2026-48142) References

• https://bugs.mageia.org/show_bug.cgi?id=35750
• https://ubuntu.com/security/notices/USN-8458-1
• https://my.f5.com/manage/s/article/K000161584
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLAG3KT4JVKUFDRLDTUDAIB4KDUXBVGU/
• https://lists.debian.org/debian-security-announce/2026/msg00285.html
• https://www.cve.org/CVERecord?id=CVE-2026-42055
• https://www.cve.org/CVERecord?id=CVE-2026-48142

SRPMS 10/core

• nginx-1.30.3-1.mga10

9/core

• nginx-1.30.3-1.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-11822 , CVE-2026-11824
The updated packages fix security vulnerabilities: SQLite before 3.53.2 Memory Corruption in FTS5 Extension. (CVE-2026-11822) SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate. (CVE-2026-11824) References

• https://bugs.mageia.org/show_bug.cgi?id=35740
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WSARHTYMOLWR6EKE3FP43GM4U37WSA2O/
• https://ubuntu.com/security/notices/USN-8480-1
• https://www.cve.org/CVERecord?id=CVE-2026-11822
• https://www.cve.org/CVERecord?id=CVE-2026-11824

SRPMS 10/core

• sqlite3-3.51.3-1.1.mga10

9/core

• sqlite3-3.40.1-1.9.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9

The updated package fixes a security vulnerability: XML external entity vulnerability. References: https://lists.fedoraproject.org/archives/list/package-announce@lists.fed oraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/ References

• https://bugs.mageia.org/show_bug.cgi?id=35671
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/

SRPMS 10/core

• xmlstarlet-1.6.1-12.1.mga10

9/core

• xmlstarlet-1.6.1-9.1.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-42504 , CVE-2026-42507 , CVE-2026-27145 , CVE-2026-39822 , CVE-2026-42505
The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. (CVE-2026-42504) net/textproto: arbitrary input are included in errors without any escaping. (CVE-2026-42507) crypto/x509: split candidate hostname only once. (CVE-2026-27145) os: Root escape via symlink plus trailing slash. (CVE-2026-39822) crypto/tls: Encrypted Client Hello privacy leak. (CVE-2026-42505) References

• https://bugs.mageia.org/show_bug.cgi?id=35624
• https://www.openwall.com/lists/oss-security/2026/06/03/2
• https://www.openwall.com/lists/oss-security/2026/07/08/10
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PHOAHESABWDZPEWFOMKYQVZYR2MQH3RA/
• https://www.cve.org/CVERecord?id=CVE-2026-42504
• https://www.cve.org/CVERecord?id=CVE-2026-42507
• https://www.cve.org/CVERecord?id=CVE-2026-27145
• https://www.cve.org/CVERecord?id=CVE-2026-39822
• https://www.cve.org/CVERecord?id=CVE-2026-42505

SRPMS 10/core

• golang-1.25.12-1.mga10

9/core

• golang-1.25.12-1.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-41054
The updated package fixes a security vulnerability: Privilege escalation via command socket. (CVE-2026-41054) References

• https://bugs.mageia.org/show_bug.cgi?id=35550
• https://www.openwall.com/lists/oss-security/2026/05/19/3
• https://www.cve.org/CVERecord?id=CVE-2026-41054

SRPMS 10/core

• haveged-1.9.21-2.mga10

9/core

• haveged-1.9.21-2.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-14355
The updated php packages fix a security issue: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD. (CVE-2026-14355) References

• https://bugs.mageia.org/show_bug.cgi?id=35807
• https://www.php.net/ChangeLog-8.php#8.2.32
• https://www.cve.org/CVERecord?id=CVE-2026-14355

SRPMS 9/core

• php-8.2.32-1.mga9

Publication date: 20 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2025-15661 , CVE-2026-7598 , CVE-2026-55199 , CVE-2026-55200 , CVE-2026-58050 , CVE-2026-58051
The updated packages fix security vulnerabilities: Heap Buffer Over-read via sftp_symlink() in sftp.c. (CVE-2025-15661) libssh2 userauth.c userauth_password integer overflow. (CVE-2026-7598) Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler. (CVE-2026-55199) Out-of-Bounds Write via Unchecked packet_length in transport.c. (CVE-2026-55200) Integer Overflow in publickey Subsystem Attribute Allocation. (CVE-2026-58050) Free of Uninitialized Pointer in publickey List Cleanup. (CVE-2026-58051) References

• https://bugs.mageia.org/show_bug.cgi?id=35616
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NRU63FODXZBBO73NFWUI32A2A36ETDQZ/
• https://www.openwall.com/lists/oss-security/2026/06/23/10
• https://www.openwall.com/lists/oss-security/2026/06/23/11
• https://lists.debian.org/debian-security-announce/2026/msg00276.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZREI4LITT4U2ZXPEEVVNALFKPLXGLAFM/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SRBHQ76PA4ZHTWY5F4ESYPYF3G2NLGWI/
• https://ubuntu.com/security/notices/USN-8486-1
• https://ubuntu.com/security/notices/USN-8532-1
• https://www.cve.org/CVERecord?id=CVE-2025-15661
• https://www.cve.org/CVERecord?id=CVE-2026-7598
• https://www.cve.org/CVERecord?id=CVE-2026-55199
• https://www.cve.org/CVERecord?id=CVE-2026-55200
• https://www.cve.org/CVERecord?id=CVE-2026-58050
• https://www.cve.org/CVERecord?id=CVE-2026-58051

SRPMS 10/core

• libssh2-1.11.1-2.1.mga10

9/core

• libssh2-1.11.0-1.1.mga9

Publication date: 19 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-14895
The updated package fixes a security vulnerability: String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. (CVE-2026-14895) References

• https://bugs.mageia.org/show_bug.cgi?id=35858
• https://www.openwall.com/lists/oss-security/2026/07/07/18
• https://www.cve.org/CVERecord?id=CVE-2026-14895

SRPMS 10/core

• perl-String-Util-1.350.0-2.1.mga10

9/core

• perl-String-Util-1.340.0-1.1.mga9