[CLSA-2026:1784884507] Fix of 9 CVEs
Type:
security
Severity:
Critical
Release date:
2026-07-24 09:15:55 UTC
Description:
* SECURITY UPDATE: webbrowser argument injection via action-token substitution - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519) - CVE-2026-4786 * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path - CVE-2026-6100 * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy - CVE-2026-7210 * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds - CVE-2026-41080 * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error - CVE-2026-9669
CVEs fixed:
Updated packages:
  • alt-python310_3.10.20-4_amd64.deb
    sha:bab28aabd1f223ca5720a37e86c909e4f83f9a2c
  • alt-python310-debug_3.10.20-4_amd64.deb
    sha:6e55d4c37c140d97444af9cb1ad2c1b9d008cd97
  • alt-python310-devel_3.10.20-4_amd64.deb
    sha:837c9e01fa74ad2bfdda150729270b2e7880dd76
  • alt-python310-idle_3.10.20-4_amd64.deb
    sha:64ece3943ad25a5cf3e940d596bf4a9d51327557
  • alt-python310-libs_3.10.20-4_amd64.deb
    sha:85f8130b988ce7914c302162ca0e87e4a38a28bf
  • alt-python310-test_3.10.20-4_amd64.deb
    sha:7dabe472f69dc69825789a81ca00f940cb0e2b69
  • alt-python310-tkinter_3.10.20-4_amd64.deb
    sha:b5899365feafaf31746d701755657bc52da60667
  • alt-python310_3.10.20-4_arm64.deb
    sha:c8f375171aa531f5a908060f43b788eca9de2cc2
  • alt-python310-debug_3.10.20-4_arm64.deb
    sha:9ef7f3d03cf1bb508e02afb8355fb483072d8e67
  • alt-python310-devel_3.10.20-4_arm64.deb
    sha:130f879568f3cac8876ebccb67b46b82ae5ff74c
  • alt-python310-idle_3.10.20-4_arm64.deb
    sha:1a1511ecb3d93ee093cff34c9bff48fac9106a62
  • alt-python310-libs_3.10.20-4_arm64.deb
    sha:216d1362987d3633c998bb3f70ee86e5d98e708b
  • alt-python310-test_3.10.20-4_arm64.deb
    sha:3b231c99a1e2e77e2956f087da9f5333b79c23e0
  • alt-python310-tkinter_3.10.20-4_arm64.deb
    sha:ab831abfcc74821f27b8bb3c8242aa7c6d89a627
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.