Bug 35147 - gegl new security issues CVE-2026-2049 and CVE-2026-2050
Summary: gegl new security issues CVE-2026-2049 and CVE-2026-2050
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2026-02-20 16:00 CET by Nicolas Salguero
Modified: 2026-02-23 17:46 CET (History)
3 users (show)

See Also:
Source RPM: gegl-0.4.42-1.mga9.src.rpm
CVE: CVE-2026-2049, CVE-2026-2050
Status comment:
herman.viaene: test_passed_mga9_64+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2026-02-20 16:00:31 CET 
Debian has issued an advisory on February 19:
https://lists.debian.org/debian-security-announce/2026/msg00051.html
Nicolas Salguero 2026-02-20 16:02:45 CET

Status comment: (none) => Patch available from upstream and Debian
Whiteboard: (none) => MGA9TOO
Flags: (none) => affects_mga9+
Source RPM: (none) => gegl-0.4.42-1.mga9.src.rpm, gegl-0.4.66-4.mga10.src.rpm
CVE: (none) => CVE-2026-2049, CVE-2026-2050

Comment 1 Nicolas Salguero 2026-02-20 16:07:20 CET 
For Cauldron, gegl-0.4.66-5.mga10 solves the issues.


Suggested advisory:
========================

The updated packages fix security vulnerabilities:

ZDI-CAN-28618: New Vulnerability Report at rgbe.c. (CVE-2026-2049)

ZDI-CAN-28266: New Vulnerability Report at rgbe.c. (CVE-2026-2050)

References:
https://lists.debian.org/debian-security-announce/2026/msg00051.html
========================

Updated packages in core/updates_testing:
========================
gegl-0.4.42-1.1.mga9
lib(64)gegl-devel-0.4.42-1.1.mga9
lib(64)gegl-gir0.4-0.4.42-1.1.mga9
lib(64)gegl-npd0.4_0-0.4.42-1.1.mga9
lib(64)gegl-sc0.4_0-0.4.42-1.1.mga9
lib(64)gegl0.4-plugins-0.4.42-1.1.mga9
lib(64)gegl0.4_0-0.4.42-1.1.mga9

from SRPM:
gegl-0.4.42-1.1.mga9.src.rpm

Flags: affects_mga9+ => (none)
Status: NEW => ASSIGNED
Source RPM: gegl-0.4.42-1.mga9.src.rpm, gegl-0.4.66-4.mga10.src.rpm => gegl-0.4.42-1.mga9.src.rpm
Version: Cauldron => 9
Status comment: Patch available from upstream and Debian => (none)
Whiteboard: MGA9TOO => (none)

Nicolas Salguero 2026-02-20 16:08:37 CET

Assignee: bugsquad => qa-bugs

Comment 2 Herman Viaene 2026-02-21 15:50:04 CET 
MGA9-64 server Plasma Wayland on Compaq H000SB
No installation issues.
$ gegl quicklinks.jpg -o testgegl.png
Generated file shows OK in gwenview. OK to go.

Flags: (none) => test_passed_mga9_64+
CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 3 Thomas Andrews 2026-02-21 20:16:21 CET 
Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

katnatek 2026-02-22 23:17:05 CET

Keywords: (none) => advisory

Comment 4 Mageia Robot 2026-02-23 17:46:02 CET 
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0047.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.