Suggested advisory:
========================

The updated packages fix a security vulnerability:

Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory. (CVE-2025-0633)

References:
https://ubuntu.com/security/notices/USN-7286-1
========================

Updated packages in core/updates_testing:
========================
lib(64)iniparser0-4.1-4.1.mga9
lib(64)iniparser-devel-4.1-4.1.mga9

from SRPM:
iniparser-4.1-4.1.mga9.src.rpm

Whiteboard: MGA9TOO => (none)
Status: NEW => ASSIGNED
Version: Cauldron => 9
Source RPM: iniparser-4.2.4-1.mga10.src.rpm, iniparser-4.1-4.mga9.src.rpm => iniparser-4.1-4.mga9.src.rpm
Assignee: bugsquad => qa-bugs
Status comment: Patch available from Ubuntu => (none)

mga9, x86_64

Installed the core versions of these libraries and also isomaster which depends on them.  Put isomaster through its paces using Mageia-9-Live-Plasma-x86_64.iso.
A gui is presented with two windows, the top one showing the current directory and the lower one the files on the iso after clicking on the iso name above.

Any of the sections on the iso can be extracted and will land in the current directory if the named file does not exist.  That can be restored at will using the Add function.  The Remove function will extract the data and throw it away.

That all seemed to work fine before the update and similar operations worked after the update.  I did try extracting all the sections after the update and then putting them back together again and noted that the rebuilt file was slightly smaller than the original.  Tried to produce a bootable iso by running isodumper against the patched-together iso.  The process seemed to work but the BIOS did not recognise it as a bootable device although it did appear in the list of attached devices.  isodumper did complain about a missing GPG signature.

It is probably safe to say that the libraries are OK but I shall wait for comments and maybe the results of other testers.

CC: (none) => tarazed25

It would be worth looking at a CD-ROM iso.  I might have one somewhere.

RH x86_64

LC_ALL=C urpmi lib64iniparser0

installing lib64iniparser0-4.1-4.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: lib64iniparser0       ##################################################################################################

 LC_ALL=C urpmi lib64iniparser-devel


installing lib64iniparser-devel-4.1-4.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/1: lib64iniparser-devel  ##################################################################################################


Reference: bug#23561 comment#8
gcc iniexample.c -lm /usr/lib64/libiniparser.so.0 -o iniexamp

./iniexamp
[pizza]=UNDEF
[pizza:ham]=[yes]
[pizza:mushrooms]=[TRUE]
[pizza:capres]=[0]
[pizza:cheese]=[Non]
[wine]=UNDEF
[wine:grape]=[Cabernet Sauvignon]
[wine:year]=[1989]
[wine:country]=[Spain]
[wine:alcohol]=[12.5]
Pizza:
Ham:       [1]
Mushrooms: [1]
Capres:    [0]
Cheese:    [0]
Wine:
Grape:     [Cabernet Sauvignon]
Year:      [1989]
Country:   [Spain]
Alcohol:   [12.5]

Whiteboard: (none) => MGA9-64-OK

Created a 16-track ISO file from an audio CD-ROM and mounted it as a loop device to check that it behaved as it should then used isomaster to remove four tracks and saved the tracks to a new iso which contained 12 tracks.  Reloaded that to check that all was good. 

$ sudo mount -t iso9660 -o ro,loop shorter.iso /mnt/iso
$ ls /mnt/iso
BATCHELO.WAV  HARVESTO.WAV  PADSTOW.WAV   THEOLDMA.WAV
BLACKJAC.WAV  JACKHALL.WAV  THECRUEL.WAV  THEWIFEO.WAV
GAUDETE.WAV   LONGLANK.WAV  THEELFKN.WAV  THOMASTH.WAV

The mangling of the track titles is an unfortunate side-effect of the original ISO creation process.

$ vlc /mnt/iso
That works fine, with all twelve tracks listed, which validates isomaster and by association the two libraries under test I think.
Katnatek's test is more to the point though - worth keeping in mind for future testing before and after.

Thanks. Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0077.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED