Mageia Security

Publication date: 08 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-59679 , CVE-2026-44950 Description
fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2. (CVE-2026-44950) fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2. (CVE-2026-59679) References

• https://bugs.mageia.org/show_bug.cgi?id=36174
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NP3ZEUVKBUAKXYPBOSJNJAGWTMNRTSSG/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/PTGMTNHE2PKU34GA4TVT54ZYUWSQDO6P/
• https://www.cve.org/CVERecord?id=CVE-2026-59679
• https://www.cve.org/CVERecord?id=CVE-2026-44950

SRPMS 10/core

• libxfont2-2.0.9-1.mga10

Publication date: 08 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
nfsdclnts requires python3-pyyaml to work. This update add the missing requirement to nfs-utils References

• https://bugs.mageia.org/show_bug.cgi?id=36335

SRPMS 10/core

• nfs-utils-2.8.3-2.1.mga10

Publication date: 08 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
marnav is updated to version 0.14.1. References

• https://bugs.mageia.org/show_bug.cgi?id=36399
• https://github.com/mariokonrad/marnav/releases/tag/v0.14.1

SRPMS 10/core

• marnav-0.14.1-1.mga10

Publication date: 08 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
This version 5.14.2 of OpenCPN is a maintenance release of the previous version 5.14.0 as usually such a maintenance release is provided some time after the main release has been published. It brings some corrections and improvements needed after user reports. References

• https://bugs.mageia.org/show_bug.cgi?id=36433
• https://opencpn.org/

SRPMS 10/core

• opencpn-5.14.2-1.mga10

Publication date: 08 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
This new version 1.2.35 now allows the use of jack with pipewire in addition to the use with pulseaudio (the previous version 1.2.34 allowed only the use of jack with pulseaudio). References

• https://bugs.mageia.org/show_bug.cgi?id=36434
• https://lsp-plug.in/

SRPMS 10/core

• lsp-plugins-1.2.35-1.mga10

Publication date: 07 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
vokoscreenNG requires the openh264 & gif gstreamer components. We now provide openh264 packages from the noopenh264 sources, packages generated from rust-gst-plugin-gif and update gstreamer1.0-plugins-bad to generate the missing components. Note: gstreamer1.0-openh264 should be installed by hand if you do not have tainted repositories enabled before the update. References

• https://bugs.mageia.org/show_bug.cgi?id=36097
• https://forums.mageia.org/en/viewtopic.php?t=15995

SRPMS 10/core

• rust-gst-plugin-gif-0.14.5-1.1.mga10
• vokoscreenNG-4.8.3-1.1.mga10
• gstreamer1.0-plugins-bad-1.26.11-3.1.mga10

10/tainted

• noopenh264-2.6.0-1.mga10.tainted
• gstreamer1.0-plugins-bad-1.26.11-3.1.mga10.tainted

Publication date: 07 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
The zrythm package has a build id that matches one in the carla package. This prevents both packages from being installed together and causes migrations from Mageia 9 to Mageia 10 to fail if both packages were installed before the migration. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36437

SRPMS 10/core

• zrythm-1.0.0-3.1.mga10

Publication date: 07 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-73067 , CVE-2026-88047 , CVE-2026-88048 , CVE-2026-88049 , CVE-2026-88050 , CVE-2026-88051 , CVE-2026-88052 , CVE-2026-88053 , CVE-2026-88054 Description
This is a security update. It fixes nine vulnerabilities in tesseract, the OCR (text recognition) engine. All nine can be triggered only by feeding tesseract a maliciously crafted input file: either a specially crafted recognition/language data file (.traineddata) or a crafted word-list file. Depending on the specific flaw, this can cause a crash (denial of service) or memory corruption. CVE-2026-73067: out-of-bounds read when loading a crafted word-list file. CVE-2026-73066: out-of-bounds write when loading a crafted recognition model file. CVE-2026-88047: stack buffer overflow when loading a crafted language-normalisation file. CVE-2026-88048: out-of-bounds read/write from a crafted neural-network layer in a recognition model file. CVE-2026-88049: out-of-bounds write from a crafted neural-network layer in a recognition model file. CVE-2026-88050: out-of-bounds write from invalid character-encoding values in a crafted recognition model file. CVE-2026-88051: out-of-bounds write when loading a malformed internal data structure from a crafted recognition model file. CVE-2026-88052: out-of-bounds write when loading a crafted character-set file. CVE-2026-88053: out-of-bounds write when loading a crafted legacy recognition template file. CVE-2026-88054: crash (denial of service) when loading a crafted recognition model with an empty internal network. The tesseract package is updated to version 5.5.3, which on its own fixes CVE-2026-73067 and CVE-2026-73066. The remaining seven issues (CVE-2026-88047 to CVE-2026-88054) are not yet fixed in any upstream release, so nine patches taken from upstream's main development branch are also applied. Reported by Tristan Madani (CVE-2026-88047) and Zhixi "Jace" Sun (CVE-2026-88048 to CVE-2026-88054); see the individual advisories below for full credits, including CVE-2026-73067 and CVE-2026-73066. References

• https://bugs.mageia.org/show_bug.cgi?id=36427
• https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3
• https://osv.dev/vulnerability/openSUSE-SU-2026:21957-1
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/25OCRCHOE46S5WTJZC25DVGO7KC2KVWO/
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-x3vq-7rr7-5x3h
• https://github.com/tesseract-ocr/tesseract/pull/4581
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8
• https://github.com/tesseract-ocr/tesseract/pull/4588
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-5j2p-r5vc-q7f3
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-q44c-23p6-5mw6
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-jgq8-pprg-vc68
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7v9h-3q3m-w68g
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-88qp-4g94-3rf3
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-2hm8-q5c7-c373
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-rphx-x795-5qjv
• https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-f6h7-cqr4-6fx4
• https://www.cve.org/CVERecord?id=CVE-2026-73067
• https://www.cve.org/CVERecord?id=CVE-2026-88047
• https://www.cve.org/CVERecord?id=CVE-2026-88048
• https://www.cve.org/CVERecord?id=CVE-2026-88049
• https://www.cve.org/CVERecord?id=CVE-2026-88050
• https://www.cve.org/CVERecord?id=CVE-2026-88051
• https://www.cve.org/CVERecord?id=CVE-2026-88052
• https://www.cve.org/CVERecord?id=CVE-2026-88053
• https://www.cve.org/CVERecord?id=CVE-2026-88054

SRPMS 10/core

• tesseract-5.5.3-1.mga10

Publication date: 06 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55868 , CVE-2026-55869 Description
Encryption State Machine Downgrade. (CVE-2026-55868) KMREQ/KMRSP Stack-Based Buffer Overflow. (CVE-2026-55869) References

• https://bugs.mageia.org/show_bug.cgi?id=36158
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XN3R27AYMZKANUF4IXBPFLBC773HW7LM/
• https://lists.debian.org/debian-security-announce/2026/msg00361.html
• https://github.com/Haivision/srt/security/advisories/GHSA-4mc6-qmpp-g7gw
• https://github.com/Haivision/srt/security/advisories/GHSA-6xg9-784j-24rm
• https://www.cve.org/CVERecord?id=CVE-2026-55868
• https://www.cve.org/CVERecord?id=CVE-2026-55869

SRPMS 10/core

• srt-1.5.4-2.1.mga10

Publication date: 06 Oct 2026
Type: security
Affected Mageia releases : 10
Description
Avoid a set of possible memory corruption, double-free, and null pointer dereference bugs that could occur with some reverse DNS virtual address configurations. TROVE-2026-051. Avoid cacheing DNS PTR responses when DNS caching is disabled. Previous code to prevent this caching parsed the response addresses incorrectly, and defaulted to caching when the address could not be parsed. TROVE-2026-050 References

• https://bugs.mageia.org/show_bug.cgi?id=36365
• https://www.openwall.com/lists/oss-security/2026/09/24/2
• https://lists.debian.org/debian-security-announce/2026/msg00445.html

SRPMS 10/core

• tor-0.4.9.13-1.mga10

Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
/sbin/route is deprecated and drakwizard should use ip (from iproute2) instead. This will let us remove the dependency on the unmaintained Net::Route::Table module, which has not been updated upstream since 2009. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36270

SRPMS 10/core

• drakwizard-4.13-1.mga10

Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
xdg-desktop-portal-xapp package is missing in the requirements. lxdm should not be recommended as display manager for cinnamon. This update fixes the reported issues. References

• https://bugs.mageia.org/show_bug.cgi?id=36354

SRPMS 10/core

• task-cinnamon-6.6-1.2.mga10

Publication date: 03 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
This last version 0.7.7 corrects some bugs and brings an offline help: - Fixed a long standing bug that causes the grids (like Media Library Songs Panel) to not update the screen on horizontal scroll. - Fixed a bug in the playlist vertical scrolling when the playing track is out of view. - The first track out of view in the bottom of the playlist wasn't scrolled to follow the player current track. - Playlist "Select" context-menu fixes - Fixed selections failing when a Directory panel filter was active. - Fixed saving and restoring the last directory path selected in Directory Panel. - Fixed the "enable volume" preference saving the wrong value. - Fixed build for gtk2 based distros. - Added missing Serbian (Latin) language to preferences. - Corrected several translations (Portuguese (Brasil), French, Italian, Catalan, Spanish, Greek, German...) References

• https://bugs.mageia.org/show_bug.cgi?id=36398
• https://codeberg.org/thothix/guayadeque

SRPMS 10/core

• guayadeque-0.7.7-1.mga10

Publication date: 02 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
Bug fix releases for php 8.4 and php 8.5 References

• https://bugs.mageia.org/show_bug.cgi?id=36368
• https://www.php.net/ChangeLog-8.php#8.4.26
• https://www.php.net/ChangeLog-8.php#8.5.11

SRPMS 10/core

• php8.5-8.5.11-1.mga10
• php8.4-8.4.26-1.1.mga10

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-49853 , CVE-2026-49854 , CVE-2026-49855 Description
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) References

• https://bugs.mageia.org/show_bug.cgi?id=35712
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/GZ7Q55UOVFEKZDAHBHES3HJS2PZ4OQHV/
• https://www.cve.org/CVERecord?id=CVE-2026-49853
• https://www.cve.org/CVERecord?id=CVE-2026-49854
• https://www.cve.org/CVERecord?id=CVE-2026-49855

SRPMS 10/core

• python-tornado-6.5.10-1.1.mga10

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-9323 Description
Insecure PRNG and Information Exposure in urwid Web Display Backend References

• https://bugs.mageia.org/show_bug.cgi?id=36159
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3XPYRLW6AB7WGF3ENBZSCZHGJCJFF7VI/
• https://github.com/urwid/urwid/security/advisories/GHSA-rjwp-g85x-gmjv
• https://ubuntu.com/security/notices/USN-8751-1
• https://www.cve.org/CVERecord?id=CVE-2026-9323

SRPMS 10/core

• python-urwid-4.1.3-1.mga10
• python-wcwidth-0.8.3-1.mga10

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-15163 , CVE-2026-15164 , CVE-2026-15165 , CVE-2026-15166 , CVE-2026-15167 , CVE-2026-15168 , CVE-2026-15169 , CVE-2026-15170 , CVE-2026-15171 , CVE-2026-15172 , CVE-2026-15173 , CVE-2026-15174 Description
Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark. (CVE-2026-15163) Heap-based Buffer Overflow in ciscodump. (CVE-2026-15164) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15165) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15166) Stack-based Buffer Overflow in Wireshark. (CVE-2026-15167) Use of Uninitialized Variable in Wireshark. (CVE-2026-15168) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15169) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15170) NULL Pointer Dereference in Wireshark. (CVE-2026-15171) Unchecked Input for Loop Condition in Wireshark. (CVE-2026-15172) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15173) Heap-based Buffer Overflow in Wireshark. (CVE-2026-15174) References

• https://bugs.mageia.org/show_bug.cgi?id=35985
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WDPYZRRCJU7AOWEFKBJ2IXADDJGWH4AH/
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/OUNLKEGMF6HPV3WJRY6PZJF4BTUIQWBO/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5DGIBJC6D6UABMCLLUPI5ZU2I3SEFUV/
• https://lists.debian.org/debian-security-announce/2026/msg00382.html
• https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UONW2KX7GYYS7MVUGXE7L23MZC42ZLHT/
• https://www.cve.org/CVERecord?id=CVE-2026-15163
• https://www.cve.org/CVERecord?id=CVE-2026-15164
• https://www.cve.org/CVERecord?id=CVE-2026-15165
• https://www.cve.org/CVERecord?id=CVE-2026-15166
• https://www.cve.org/CVERecord?id=CVE-2026-15167
• https://www.cve.org/CVERecord?id=CVE-2026-15168
• https://www.cve.org/CVERecord?id=CVE-2026-15169
• https://www.cve.org/CVERecord?id=CVE-2026-15170
• https://www.cve.org/CVERecord?id=CVE-2026-15171
• https://www.cve.org/CVERecord?id=CVE-2026-15172
• https://www.cve.org/CVERecord?id=CVE-2026-15173
• https://www.cve.org/CVERecord?id=CVE-2026-15174

SRPMS 10/core

• wireshark-4.6.8-1.mga10

Publication date: 02 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2024-2236 Description
Libgcrypt: vulnerable to marvin attack. (CVE-2024-2236) References

• https://bugs.mageia.org/show_bug.cgi?id=36248
• https://ubuntu.com/security/notices/USN-8711-1
• https://bugzilla.redhat.com/show_bug.cgi?id=2268268
• https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html
• https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt
• https://people.redhat.com/~hkario/marvin/
• https://dev.gnupg.org/T7136
• https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17
• https://www.cve.org/CVERecord?id=CVE-2024-2236

SRPMS 10/core

• libgcrypt-1.11.3-1.1.mga10

Publication date: 01 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-55380 , CVE-2026-54060 , CVE-2026-54059 , CVE-2026-55379 , CVE-2026-59205 , CVE-2026-59199 , CVE-2026-59197 , CVE-2026-59198 , CVE-2026-54058 , CVE-2026-59204 , CVE-2026-59203 Description
Prevent decompression bomb when parsing PDF WindowsViewer.get_command injection EPS image infinite loop JPEG2000 image memory usage McIdas out-of-bounds (OOB) read Out-of-bounds (OOB) read when saving 1 mode TGA images Out-of-bounds (OOB) write from large RankFilter sizes Out-of-bounds (OOB) write from Image.paste() Out-of-bounds (OOB) write in ImageCmsTransform Prevent FontFile decompression bomb Prevent GD decompression bomb References

• https://bugs.mageia.org/show_bug.cgi?id=35909
• https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst
• https://www.cve.org/CVERecord?id=CVE-2026-55380
• https://www.cve.org/CVERecord?id=CVE-2026-54060
• https://www.cve.org/CVERecord?id=CVE-2026-54059
• https://www.cve.org/CVERecord?id=CVE-2026-55379
• https://www.cve.org/CVERecord?id=CVE-2026-59205
• https://www.cve.org/CVERecord?id=CVE-2026-59199
• https://www.cve.org/CVERecord?id=CVE-2026-59197
• https://www.cve.org/CVERecord?id=CVE-2026-59198
• https://www.cve.org/CVERecord?id=CVE-2026-54058
• https://www.cve.org/CVERecord?id=CVE-2026-59204
• https://www.cve.org/CVERecord?id=CVE-2026-59203

SRPMS 10/core

• python-pillow-12.3.0-1.mga10

Publication date: 01 Oct 2026
Type: bugfix
Affected Mageia releases : 10
Description
glabels can't open previously-created glabels files. We have added a patch to fix the issue but the project is dead upstream and its developer is now focussing on glabels-qt. We are releasing glabels-qt as an alternative. Both versions fix the reported issue; it is your decision what tool to use. References

• https://bugs.mageia.org/show_bug.cgi?id=36053
• https://github.com/j-evins/glabels-qt

SRPMS 10/core

• glabels-3.4.1-12.1.mga10
• glabels-qt-3.99-0.2.2026.08.27git554c9f0.mga10