Back Linuxsecurity

Mageia perl-Config-IniFiles Important Command Injection Fix CVE-2026

Linuxsecurity •LinuxSecurity Advisories • July 18, 2026

Description: The updated package fixes a security vulnerability: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. (CVE-2026-11527)

- - - - - - -

- 10/core/perl-Config-IniFiles-3.0.3-3.1.mga10 - 9/core/perl-Config-IniFiles-3.0.3-2.1.mga9

- 10/core/perl-Config-IniFiles-3.0.3-3.1.mga10

- 9/core/perl-Config-IniFiles-3.0.3-2.1.mga9

Publication date: 18 Jul 2026 URL: https: //advisories.mageia.org/MGASA-2026-0263.html Type: security CVE: CVE-2026-11527

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Mageia Perl Packages Addressed Mageia has released updates for several Perl packages to address critical security vulnerabilities. Notable issues include CVE-2026-14803, which allows memory exhaustion in Mojo::JSON versions before 9.47, and CVE-2026-11625, affecting Bytes::Random::Secure versions through 0.29, which can expose internal state across forked processes. Additionally, CVE-2026-14895 highlights a regular expression denial of service in String::Util versions before 1.36. Lastly, CVE-2026-8829 addresses a heap corruption vulnerability in HTML::Entities versions before 3.84. These vulnerabilities could lead to significant service disruptions and potential exploitation if not patched. Users of Mageia 10 and earlier versions are advised to update their systems immediately to mitigate these risks. 6 sources 73

Extracted Entities

Mageia perl-Config-IniFiles Important Command Injection Fix CVE-2026

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)