Mageia is a Linux distribution maintained by a community project, presenting a modest but concentrated vulnerability footprint across its operating-system packages and underlying components. Vulnerabilities affecting the distribution skew toward moderate-to-serious severity outcomes and have a meaningful tendency toward both confirmed in-the-wild exploitation and public exploit availability, consistent with the visibility and utility of OS-level flaws for widespread infrastructure compromise. The exposure recurs through weakness classes characteristic of system software: information disclosure, OS command injection, memory buffer control issues, cryptographic initialization problems, and code-injection vulnerabilities that span kernel, utilities, and third-party software bundled in the distribution. Defenders running this distribution should monitor security advisories closely and prioritize patching for internet-reachable services; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Mageia over time
Signals from CVEs in this vendor scope (35 CVEs).
35 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-6271CRITICAL GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a cra | Sep 24, 2014 | 9.8 | 99 | YES | YES |
CVE-2014-7169CRITICAL GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to wri | Sep 25, 2014 | 9.8 | 98 | YES | YES |
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain clear | Oct 15, 2014 | 3.4 | 78 | NO | YES |
CVE-2014-9087HIGH Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) | Dec 1, 2014 | 7.5 | 26 | NO | NO |
CVE-2014-5461MEDIUM Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of | Sep 4, 2014 | 5.0 | 24 | NO | NO |
CVE-2014-9274HIGH UnRTF allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999". | Dec 9, 2014 | 7.5 | 21 | NO | NO |
CVE-2014-7204MEDIUM jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU and disk consumption) via a crafted JavaScript file. | Oct 7, 2014 | 5.0 | 21 | NO | NO |
CVE-2013-4159HIGH ctdb before 2.3 in OpenSUSE 12.3 and 13.1 does not create temporary files securely, which has unspecified impact related to "several temp file vulnerabilities" in (1) tcp/tcp_conne | Aug 6, 2014 | 7.5 | 20 | NO | NO |
CVE-2015-2296MEDIUM The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a red | Mar 18, 2015 | 6.8 | 19 | NO | NO |
CVE-2014-8104MEDIUM OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control chann | Dec 3, 2014 | 6.8 | 19 | NO | NO |
Signals from CVEs in this vendor scope (35 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Mageia.
Media articles that mention a CVE ID that affects a product developed by Mageia — matched by CVE ID, not by vendor name.