Mageia Security

Publication date: 17 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
Kazam crashed when importing imp. This update brings the latest commit after version 2.0.0, fixing the reported issue. It is reported that screenrecord in a Wayland session still doesn't work; try using obs-studio, spectacle (not sound), vokoscreenNG or simplescreenrecorder instead. References

• https://bugs.mageia.org/show_bug.cgi?id=35911
• https://github.com/henrywoo/kazam/blob/5646b3c7650b99959e65072cb43c1ac22f392901/NEWS

SRPMS 10/core

• kazam-2.0.0-1.20260728.2.mga10

Publication date: 17 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
This update fixes conflicting files to allow a smooth upgrade from mga9 to mga10! References

• https://bugs.mageia.org/show_bug.cgi?id=35851
• https://forums.mageia.org/en/viewtopic.php?p=92824#p92824

SRPMS 10/core

• mingw-gcc-15.2.1-1.1.mga10

Publication date: 15 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
sar2 not find the data in the path in which we locate it, causing the game to fail to start. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36090

SRPMS 10/core

• sar2-2.6.0-2.1.mga10

Publication date: 14 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
soundkonverter can't convert audio files. This update switches to another qt6 fork of soundkonverter to fix the reported issue. Please note that command line operations are still not working. References

• https://bugs.mageia.org/show_bug.cgi?id=36068

SRPMS 10/core

• soundkonverter-3.0.1.32-1.20260728.1.mga10

Publication date: 14 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
Due to an import error, the php[8.4,8.5]-imap package was compiled without SSL support. This update fixes this issue. Please be aware that this package was deprecated by php. Please use an alternative package instead; see the links. References

• https://bugs.mageia.org/show_bug.cgi?id=36045
• https://php.watch/versions/8.4/imap-unbundled

SRPMS 10/core

• php8.5-imap-1.0.3-1.1.mga10
• php8.4-imap-1.0.3-3.1.mga10

Publication date: 14 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
The current App::Asciio perl module in Mageia 10, version 1.51.3 (released in 2015), depends on Gtk2. This update brings a new version 1.9.02 (released in 2023) which upgraded its dependencies to Gtk3. References

• https://bugs.mageia.org/show_bug.cgi?id=36076

SRPMS 10/core

• perl-App-Asciio-1.9.2-1.3.mga10
• perl-IO-Prompter-0.5.4-1.mga10

Publication date: 13 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-56114 , CVE-2026-56116 Description
Attackers can send a crafted DHCPv6 ADVERTISE message containing an IA_PD IAPREFIX /0 with a valid OPTION_PD_EXCLUDE using an exclude prefix length of /121 through /128 to trigger the out-of-bounds write and potentially corrupt adjacent stack memory (CVE: CVE-2026-56114). Attackers can repeatedly send Router Advertisements containing Route Information options with a lifetime of zero, triggering unfreed allocations in routeinfo_findalloc() that cause linear memory exhaustion and eventual daemon crash (CVE: CVE-2026-56116). References

• https://bugs.mageia.org/show_bug.cgi?id=36063
• https://github.com/NetworkConfiguration/dhcpcd/pull/676
• https://www.cve.org/CVERecord?id=CVE-2026-56114
• https://www.cve.org/CVERecord?id=CVE-2026-56116

SRPMS 10/core

• dhcpcd-10.5.0-1.1.mga10

Publication date: 13 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-3886 , CVE-2026-3890 , CVE-2026-5744 , CVE-2026-5761 , CVE-2026-5763 , CVE-2026-6502 , CVE-2024-6519 , CVE-2026-8341 , CVE-2026-41435 , CVE-2026-41436 , CVE-2026-41437 , CVE-2026-41438 , CVE-2026-41439 , CVE-2026-41440 , CVE-2026-48004 , CVE-2026-48914 Description
This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4 References

• https://bugs.mageia.org/show_bug.cgi?id=35989
• https://lists.nongnu.org/archive/html/qemu-stable/2026-05/msg00654.html
• https://lists.nongnu.org/archive/html/qemu-stable/2026-06/msg00551.html
• https://www.cve.org/CVERecord?id=CVE-2026-3886
• https://www.cve.org/CVERecord?id=CVE-2026-3890
• https://www.cve.org/CVERecord?id=CVE-2026-5744
• https://www.cve.org/CVERecord?id=CVE-2026-5761
• https://www.cve.org/CVERecord?id=CVE-2026-5763
• https://www.cve.org/CVERecord?id=CVE-2026-6502
• https://www.cve.org/CVERecord?id=CVE-2024-6519
• https://www.cve.org/CVERecord?id=CVE-2026-8341
• https://www.cve.org/CVERecord?id=CVE-2026-41435
• https://www.cve.org/CVERecord?id=CVE-2026-41436
• https://www.cve.org/CVERecord?id=CVE-2026-41437
• https://www.cve.org/CVERecord?id=CVE-2026-41438
• https://www.cve.org/CVERecord?id=CVE-2026-41439
• https://www.cve.org/CVERecord?id=CVE-2026-41440
• https://www.cve.org/CVERecord?id=CVE-2026-48004
• https://www.cve.org/CVERecord?id=CVE-2026-48914

SRPMS 10/core

• qemu-10.2.4-2.mga10

Publication date: 13 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-54432 , CVE-2026-54433 , CVE-2026-62641 , CVE-2026-62642 , CVE-2026-62643 , CVE-2026-62644 Description
Add basic validation for content proxied by the css proxy Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions Fix RCE via cmd_learn driver of markasjunk plugin Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization Fix password's modoboa driver leak of an authentication token to a user-controlled host Fix stored XSS in "Add to address book" action Fix HTML/CSS sanitization bypass via SVG animate by attribute References

• https://bugs.mageia.org/show_bug.cgi?id=36080
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
• https://www.cve.org/CVERecord?id=CVE-2026-54432
• https://www.cve.org/CVERecord?id=CVE-2026-54433
• https://www.cve.org/CVERecord?id=CVE-2026-62641
• https://www.cve.org/CVERecord?id=CVE-2026-62642
• https://www.cve.org/CVERecord?id=CVE-2026-62643
• https://www.cve.org/CVERecord?id=CVE-2026-62644

SRPMS 10/core

• roundcubemail-1.7.3-2.mga10

Publication date: 13 Aug 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-54432 , CVE-2026-54433 , CVE-2026-62641 , CVE-2026-62642 , CVE-2026-62643 , CVE-2026-62644 Description
Updated roundcubemail to the 1.6.17 version to fix security vulnerabilities: Some XSS and DoS errors have been corrected. Various vulnerabilities in the password plugin have been fixed. An infinite loop has been fixed. References

• https://bugs.mageia.org/show_bug.cgi?id=35944
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TL4FNTXFDUDYFIB5CESGSLF7DCZCMJT6/
• https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54432
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54433
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62641
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62642
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62643
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62644
• https://www.cve.org/CVERecord?id=CVE-2026-54432
• https://www.cve.org/CVERecord?id=CVE-2026-54433
• https://www.cve.org/CVERecord?id=CVE-2026-62641
• https://www.cve.org/CVERecord?id=CVE-2026-62642
• https://www.cve.org/CVERecord?id=CVE-2026-62643
• https://www.cve.org/CVERecord?id=CVE-2026-62644

SRPMS 9/core

• roundcubemail-1.6.17-1.mga9

Publication date: 13 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
When upgrading from Mageia 9 to Mageia 10 in a graphical session controlled by gdm, gdm restarts in the middle of the distro upgrade process and causes an incomplete/broken upgrade. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=36078

SRPMS 10/core

• gdm-49.2-2.1.mga10

Publication date: 13 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
When upgrading from Mageia 9 to Mageia 10 in a graphical session controlled by lightdm, lightdm restarts in the middle of the distro upgrade process and causes an incomplete/broken upgrade. This update fixes the reported issue. References

• https://bugs.mageia.org/show_bug.cgi?id=35892

SRPMS 10/core

• lightdm-1.32.0-4.1.mga10

Publication date: 13 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
The updated packages fix an issue with sharing the clipboard and Plasma Wayland guests. References

• https://bugs.mageia.org/show_bug.cgi?id=35958

SRPMS 10/core

• virtualbox-7.2.14-1.mga10
• virtualbox-kvm-7.2.14-1.mga10
• kmod-virtualbox-7.2.14-29.mga10

Publication date: 13 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
This is the latest bugfix release for the new mesa 26.1.x branch, that further improves stability (fixing crashes and memleaks). References

• https://bugs.mageia.org/show_bug.cgi?id=36006
• https://docs.mesa3d.org/relnotes/26.1.5.html#changes
• https://docs.mesa3d.org/relnotes/26.1.4.html#changes
• https://docs.mesa3d.org/relnotes/26.1.3.html#changes
• https://docs.mesa3d.org/relnotes/26.1.2.html#changes
• https://docs.mesa3d.org/relnotes/26.1.1.html#changes
• https://docs.mesa3d.org/relnotes/26.1.0.html#changes
• https://docs.mesa3d.org/relnotes/26.1.5.html#bug-fixes
• https://docs.mesa3d.org/relnotes/26.1.4.html#bug-fixes
• https://docs.mesa3d.org/relnotes/26.1.3.html#bug-fixes
• https://docs.mesa3d.org/relnotes/26.1.2.html#bug-fixes
• https://docs.mesa3d.org/relnotes/26.1.1.html#bug-fixes
• https://docs.mesa3d.org/relnotes/26.1.0.html#bug-fixes

SRPMS 10/core

• libdrm-2.4.134-1.mga10
• libva-2.24.1-1.mga10
• libva-utils-2.24.0-1.mga10
• mesa-26.1.5-1.mga10

10/tainted

• mesa-26.1.5-1.mga10.tainted

Publication date: 13 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
This is a bug fix release for the new 580 series. See the upstream reference for details. References

• https://bugs.mageia.org/show_bug.cgi?id=36018
• https://www.nvidia.com/en-us/drivers/details/273160/

SRPMS 10/nonfree

• nvidia-current-580.173.02-1.mga10.nonfree
• nvidia-current-wopengpu-580.173.02-1.mga10.nonfree
• kmod-nvidia-current-wopengpu-580.173.02-38.mga10.nonfree

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-10723 , CVE-2026-10822 , CVE-2026-11331 , CVE-2026-11605 , CVE-2026-11721 , CVE-2026-12617 , CVE-2026-13204 , CVE-2026-13321 Description
Updated bind packages fix security vulnerabilities: Incorrect acceptance of NSEC3 records. (CVE-2026-10723) Key Record using PRIVATEDNS algorithm may lead to unexpected exit. (CVE-2026-10822) Potential wildcard CNAME RPZ policy bypass. (CVE-2026-11331) Unnecessary validation of DNSSEC signed records. (CVE-2026-11605) Cache poisoning possible with label count discrepancy, RRSIG, and wildcards. (CVE-2026-11721) Record ordering based unexpected exit with CNAME or DNAME. (CVE-2026-12617) Unexpected exit in certain situations with NSEC and NSEC3 both present. (CVE-2026-13204) DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field. (CVE-2026-13321) References

• https://bugs.mageia.org/show_bug.cgi?id=36003
• https://www.openwall.com/lists/oss-security/2026/07/22/8
• https://kb.isc.org/docs/cve-2026-10723
• https://kb.isc.org/docs/cve-2026-10822
• https://kb.isc.org/docs/cve-2026-11331
• https://kb.isc.org/docs/cve-2026-11605
• https://kb.isc.org/docs/cve-2026-11622
• https://kb.isc.org/docs/cve-2026-11721
• https://kb.isc.org/docs/cve-2026-12617
• https://kb.isc.org/docs/cve-2026-13204
• https://kb.isc.org/docs/cve-2026-13321
• https://www.cve.org/CVERecord?id=CVE-2026-10723
• https://www.cve.org/CVERecord?id=CVE-2026-10822
• https://www.cve.org/CVERecord?id=CVE-2026-11331
• https://www.cve.org/CVERecord?id=CVE-2026-11605
• https://www.cve.org/CVERecord?id=CVE-2026-11721
• https://www.cve.org/CVERecord?id=CVE-2026-12617
• https://www.cve.org/CVERecord?id=CVE-2026-13204
• https://www.cve.org/CVERecord?id=CVE-2026-13321

SRPMS 10/core

• bind-9.20.26-1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-17544 , CVE-2026-9672 , CVE-2026-17543 , CVE-2026-7260 Description
Updated php 8.5 packages fix some security vulnerabilities. For details see the references. References

• https://bugs.mageia.org/show_bug.cgi?id=36036
• https://www.php.net/ChangeLog-8.php#8.5.9
• https://www.cve.org/CVERecord?id=CVE-2026-17544
• https://www.cve.org/CVERecord?id=CVE-2026-9672
• https://www.cve.org/CVERecord?id=CVE-2026-17543
• https://www.cve.org/CVERecord?id=CVE-2026-7260

SRPMS 10/core

• php8.5-8.5.9-1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-17544 , CVE-2026-9672 , CVE-2026-17543 , CVE-2026-7260 Description
The updated php 8.4 packages fix some security vulnerabilities. See the references for more information. References

• https://bugs.mageia.org/show_bug.cgi?id=36037
• https://www.php.net/ChangeLog-8.php#8.4.24
• https://www.cve.org/CVERecord?id=CVE-2026-17544
• https://www.cve.org/CVERecord?id=CVE-2026-9672
• https://www.cve.org/CVERecord?id=CVE-2026-17543
• https://www.cve.org/CVERecord?id=CVE-2026-7260

SRPMS 10/core

• php8.4-8.4.24-1.1.mga10

Publication date: 10 Aug 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-48977 Description
Arbitrary memory write with crafted Ventana BIF file. (CVE-2026-48977) References

• https://bugs.mageia.org/show_bug.cgi?id=35719
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LT3YC2CS4XTDLRWSH72YZE3EJ6BQCTJ/
• https://www.cve.org/CVERecord?id=CVE-2026-48977

SRPMS 10/core

• openslide-4.0.0-1.1.mga10

Publication date: 10 Aug 2026
Type: bugfix
Affected Mageia releases : 10
Description
This is rawtherapee version 5.13, the latest from upstream. It is a bugfix and features release. References

• https://bugs.mageia.org/show_bug.cgi?id=36025

SRPMS 10/core

• rawtherapee-5.13-1.mga10