Sorry, cannot find the patch.
Assigning directly to you, David, as you look to be chief maintainer of radare2.

Assignee: bugsquad => geiger.david68210

Created attachment 14907 [details]
zlib-cve patch

CC: (none) => lovaren

Created attachment 14908 [details]
magic cve patch

Created attachment 14909 [details]
hfs-cve patch

Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Buffer overflow in the HFS parser from grub2. (CVE-2024-56737)

Out-of-bounds Write in radare2. (CVE-2025-1744)

Buffer Overflow and Potential Code Execution in Radare2. (CVE-2025-1864)

References:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JESFQCNT2ONAGTVQXEDREBQFC7NUDPEC/
========================

Updated packages in core/updates_testing:
========================
lib(64)radare2_5.8.8-5.8.8-1.6.mga9
lib(64)radare2-devel-5.8.8-1.6.mga9
radare2-5.8.8-1.6.mga9

from SRPM:
radare2-5.8.8-1.6.mga9.src.rpm

Version: Cauldron => 9
Source RPM: radare2-5.9.8-2.mga10.src.rpm, radare2-5.8.8-1.5.mga9.src.rpm => radare2-5.8.8-1.5.mga9.src.rpm
Status: NEW => ASSIGNED
Assignee: geiger.david68210 => qa-bugs
Status comment: Patch available from Fedora => (none)
Whiteboard: MGA9TOO => (none)

RH x86_64

installing radare2-5.8.8-1.6.mga9.x86_64.rpm lib64radare2_5.8.8-5.8.8-1.6.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: lib64radare2_5.8.8    ##################################################################################################
      2/2: radare2               ##################################################################################################
      1/2: removing radare2-5.8.8-1.5.mga9.x86_64
                                 ##################################################################################################
      2/2: removing lib64radare2_5.8.8-5.8.8-1.5.mga9.x86_64
                                 ##################################################################################################

rabin2 -I firefox.exe 
arch     x86
baddr    0x140000000
binsz    682560
bintype  pe
bits     64
canary   true
retguard false
class    PE32+
cmp.csum 0x000a77b9
compiled Mon Mar 17 13:21:16 2025
crypto   false
dbg_file firefox.pdb
endian   little
havecode true
hdr.csum 0x000a77b9
guid     76DB8B0DB20DA9994C4C44205044422E1
laddr    0x0
lang     msvc
linenum  false
lsyms    false
machine  AMD 64
nx       true
os       windows
overlay  true
cc       ms
pic      true
relocs   false
signed   true
sanitize false
static   false
stripped false
subsys   Windows GUI
va       true


radare2 firefox.exe 
[0x14001fce0]> aa
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze all functions arguments/locals (afva@@@F)
[0x14001fce0]> s/ fire
Searching 4 bytes in [0x1400ab600-0x1400ac000]
hits: 0
..etc...
Searching 4 bytes in [0x140054000-0x140062800]
[# ]0x14005715d hit0_0 .itigationPolicyfirefoxFirefoxNtOp.

V command is as described in bug#32521 comment#8

OK to me

MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 33853 for testing:
$ rabin2 -I  firefox.exe
arch     x86
baddr    0x400000
binsz    517072
bintype  pe
bits     32
canary   true
retguard false
class    PE32
cmp.csum 0x0008c46c
compiled Thu Jun 21 16:53:30 2018
crypto   false
dbg_file c:\builds\moz2_slave\m-esr52-w32-000000000000000000\build\src\obj-firefox\browser\app\firefox.pdb
endian   little
havecode true
hdr.csum 0x0008c46c
guid     CA62060F00F14226994F5C4935BE72192
laddr    0x0
lang     msvc
linenum  false
lsyms    false
machine  i386
nx       true
os       windows
overlay  true
cc       cdecl
pic      true
relocs   false
signed   true
sanitize false
static   false
stripped false
subsys   Windows GUI
va       true

$ rax2 0011000011111111d
12543

$ rasm2 ret
c3

$ radare2 firefox.exe
[0x00405eed]> aa
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze all functions arguments/locals (afva@@@F)
[0x00405eed]> s/ fire
Searching 4 bytes in [0x480e00-0x481000]
hits: 0
Searching 4 bytes in [0x47f000-0x480e00]
hits: 0
Searching 4 bytes in [0x47ea00-0x47f000]
hits: 0
Searching 4 bytes in [0x43d000-0x47ea00]
hits: 0
Searching 4 bytes in [0x43c200-0x43d000]
hits: 0
Searching 4 bytes in [0x43c000-0x43c200]
hits: 0
Searching 4 bytes in [0x43a200-0x43c000]
hits: 0
Searching 4 bytes in [0x43a000-0x43a200]
hits: 0
Searching 4 bytes in [0x439c00-0x43a000]
hits: 0
Searching 4 bytes in [0x422000-0x439c00]
[# ]0x00423028 hit0_0 .MozillaFirefoxfirefox52.9.02018.
[0x00423028]> quit
Together with katnatek's testing, this should be OK.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0116.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED