For Cauldron, perl-XML-Parser-2.470.0-5.mga10 fixes the issues.


Suggested advisory:
========================

The updated package fixes security vulnerabilities:

XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. (CVE-2006-10002)

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. (CVE-2006-10003)

References:
https://www.openwall.com/lists/oss-security/2026/03/19/1
https://www.openwall.com/lists/oss-security/2026/03/19/2
========================

Updated package in core/updates_testing:
========================
perl-XML-Parser-2.460.0-6.1.mga9

from SRPM:
perl-XML-Parser-2.460.0-6.1.mga9.src.rpm

Whiteboard: MGA9TOO => (none)
Status: NEW => ASSIGNED
Version: Cauldron => 9
Status comment: Patches available from upstream => (none)
Assignee: bugsquad => qa-bugs
Source RPM: perl-XML-Parser-2.470.0-4.mga10.src.rpm, perl-XML-Parser-2.460.0-6.mga9.src.rpm => perl-XML-Parser-2.460.0-6.mga9.src.rpm
Flags: affects_mga9+ => (none)

MGA9-64 server Plasma Wayland on Compaq H000SB
No installation issues.
No previous updates or wiki, so looked for packages depending on it, and picked gcstar.
Run it under trace, fool around in its dialogues and found in the trace:
newfstatat(AT_FDCWD, "/usr/lib64/perl5/vendor_perl/XML/Parser.pm", {st_mode=S_IFREG|0444, st_size=27721, ...}, 0) = 0
As gcstar seemed to work well, let this update go.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK
Flags: (none) => test_passed_mga9_64+

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

I was sure those CVEs were wrong and should have been "CVE-2026-..." but no, they're 20 year old bugs.

CC: (none) => dan

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0063.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED