[CLSA-2026:1784821224] Fix of 9 CVEs
Type:
security
Severity:
Critical
Release date:
2026-07-23 15:41:12 UTC
Description:
* SECURITY UPDATE: webbrowser argument injection via action-token substitution - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519) - CVE-2026-4786 * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path - CVE-2026-6100 * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy - CVE-2026-7210 * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds - CVE-2026-41080 * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error - CVE-2026-9669
CVEs fixed:
Updated packages:
  • alt-python310_3.10.20-4_amd64.deb
    sha:a6427de616fdfdd54fa3f045440baa313ca26b80
  • alt-python310-debug_3.10.20-4_amd64.deb
    sha:4c3aaf0428044f67d05e7aa8b289b4df2cc2fbd8
  • alt-python310-devel_3.10.20-4_amd64.deb
    sha:66825b00ee75e1b2b32a078b84eac424a2960178
  • alt-python310-idle_3.10.20-4_amd64.deb
    sha:35d2cc751ee76831e66160222af1da973d1875b1
  • alt-python310-libs_3.10.20-4_amd64.deb
    sha:d9033372b4158265fd1f38001785086cdf6da785
  • alt-python310-test_3.10.20-4_amd64.deb
    sha:b8be805755c82f5b1ee18fa055f8f517fd005226
  • alt-python310-tkinter_3.10.20-4_amd64.deb
    sha:2bc66afa93585dde97a3332978412baf4b2bf3e7
  • alt-python310_3.10.20-4_arm64.deb
    sha:4154a19674b8add714e770f9d782e72aca3c7072
  • alt-python310-debug_3.10.20-4_arm64.deb
    sha:9c14d417f6969038df88d49676f274cd88d6929c
  • alt-python310-devel_3.10.20-4_arm64.deb
    sha:fbcebbc6617174b575b6311378b4a1562e0ffdfc
  • alt-python310-idle_3.10.20-4_arm64.deb
    sha:734467cd5e0b8d57fca4dcfd727e2699f26bf2a3
  • alt-python310-libs_3.10.20-4_arm64.deb
    sha:a4485b5c2c899bce0941ed8ff40a2abd31e69a42
  • alt-python310-test_3.10.20-4_arm64.deb
    sha:bb6a2afbd77a05925496bd28374a29f01c1b8692
  • alt-python310-tkinter_3.10.20-4_arm64.deb
    sha:3be30f2cf6813ae4fb64b421a135e7c4ebdc6066
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.