Mageia alert MGASA-2026-0191 (libxmp)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2026-0191: Updated libxmp packages fix security vulnerabilities
Date:
             
 
Wed, 10 Jun 2026 07:07:53 +0200
Message-ID:
             
 
<20260610050753.1DEA2A0E2E@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2026-0191 - Updated libxmp packages fix security vulnerabilities

Publication date: 10 Jun 2026
URL: https://advisories.mageia.org/MGASA-2026-0191.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-45676,
     CVE-2023-45677,
     CVE-2023-45679,
     CVE-2023-45680,
     CVE-2023-45681,
     CVE-2023-45682,
     CVE-2025-47256

Description:
CVE-2023-45679: Attempt to free an uninitialized memory pointer in
vorbis_deinit()
CVE-2023-45680: Null pointer dereference in vorbis_deinit()
CVE-2023-45681: Out of bounds heap buffer write
CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()
CVE-2023-45677: Heap buffer out of bounds write in start_decoder()
CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()
CVE-2025-47256 stack-based buffer overflow in depack_pha in
loaders/prowizard/pha.c via a malformed Pha format tracker module in a
.mod file.

References:
- https://bugs.mageia.org/show_bug.cgi?id=33915
-
https://lists.fedoraproject.org/archives/list/package-ann...
-
https://lists.fedoraproject.org/archives/list/package-ann...
- https://www.cve.org/CVERecord?id=CVE-2023-45676
- https://www.cve.org/CVERecord?id=CVE-2023-45677
- https://www.cve.org/CVERecord?id=CVE-2023-45679
- https://www.cve.org/CVERecord?id=CVE-2023-45680
- https://www.cve.org/CVERecord?id=CVE-2023-45681
- https://www.cve.org/CVERecord?id=CVE-2023-45682
- https://www.cve.org/CVERecord?id=CVE-2025-47256

SRPMS:
- 9/core/libxmp-4.5.0-2.1.mga9