[CLSA-2026:1784887022] Fix of 9 CVEs
Type:
security
Severity:
Critical
Release date:
2026-07-24 09:57:48 UTC
Description:
* SECURITY UPDATE: webbrowser argument injection via action-token substitution - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519) - CVE-2026-4786 * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path - CVE-2026-6100 * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy - CVE-2026-7210 * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds - CVE-2026-41080 * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error - CVE-2026-9669
CVEs fixed:
Updated packages:
  • alt-python310_3.10.20-4_amd64.deb
    sha:00c4950ac51b850dc17504f2cf81dc0b760d51d7
  • alt-python310-debug_3.10.20-4_amd64.deb
    sha:23e10b76d78da04235b853da764851172d9d385f
  • alt-python310-devel_3.10.20-4_amd64.deb
    sha:5f4348864f6f4c4c8eee08b952ea9b01514c887b
  • alt-python310-idle_3.10.20-4_amd64.deb
    sha:d02a9353ad9853d53aaf5568af4936360c484cd2
  • alt-python310-libs_3.10.20-4_amd64.deb
    sha:2939acf68102511388f45c91f84323410d29d2ae
  • alt-python310-test_3.10.20-4_amd64.deb
    sha:50e849956de44862ee0aa947bc428006bd0d8bd1
  • alt-python310-tkinter_3.10.20-4_amd64.deb
    sha:577569d430aab44dbf97a1f93e21a5ddd260afd6
  • alt-python310_3.10.20-4_arm64.deb
    sha:26654de00745b81d2e906cd887ca3f467b9150f5
  • alt-python310-debug_3.10.20-4_arm64.deb
    sha:552d7315bebdb6334491b06254c2e89285edbded
  • alt-python310-devel_3.10.20-4_arm64.deb
    sha:a83db552171f52480fd9a1025048c9d9b6b8e538
  • alt-python310-idle_3.10.20-4_arm64.deb
    sha:3305f7744efe3b3d281baca09e5991be05ca72a8
  • alt-python310-libs_3.10.20-4_arm64.deb
    sha:040e52707cbc3a469cf939f35404f075b8ddf3c2
  • alt-python310-test_3.10.20-4_arm64.deb
    sha:94ee36076e7bdfac18d17faa5320d726d0b04a7b
  • alt-python310-tkinter_3.10.20-4_arm64.deb
    sha:1f2c48124ce48adfef442bdeac2725eb0afcb34c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.