[CLSA-2026:1784836875] Fix of 9 CVEs
Type:
security
Severity:
Critical
Release date:
2026-07-23 20:02:03 UTC
Description:
* SECURITY UPDATE: webbrowser argument injection via action-token substitution - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519) - CVE-2026-4786 * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path - CVE-2026-6100 * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy - CVE-2026-7210 * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds - CVE-2026-41080 * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error - CVE-2026-9669
CVEs fixed:
Updated packages:
  • alt-python310_3.10.20-4_amd64.deb
    sha:ea56926ee1d9fa8c56e7fe28fffa6e91f50fb192
  • alt-python310-debug_3.10.20-4_amd64.deb
    sha:4c3aaf0428044f67d05e7aa8b289b4df2cc2fbd8
  • alt-python310-devel_3.10.20-4_amd64.deb
    sha:21d7496e336ef67dc162b5a3ca11451768008c16
  • alt-python310-idle_3.10.20-4_amd64.deb
    sha:c52d6676b7cfc2831a7a01c78472ce7cb147f942
  • alt-python310-libs_3.10.20-4_amd64.deb
    sha:ff2de7e9e26e0f440236abc594a46573fb0d2838
  • alt-python310-test_3.10.20-4_amd64.deb
    sha:420b2f7f494b904479c84fb21d7045a8eca74d3e
  • alt-python310-tkinter_3.10.20-4_amd64.deb
    sha:e4dba811fabadc8e982707b89992325087cb6589
  • alt-python310_3.10.20-4_arm64.deb
    sha:6bbfdd6017066c140fed477a3d8cb3fdb964f14b
  • alt-python310-debug_3.10.20-4_arm64.deb
    sha:9c14d417f6969038df88d49676f274cd88d6929c
  • alt-python310-devel_3.10.20-4_arm64.deb
    sha:ace448ea972b04d72467538dd20da49ac48b6593
  • alt-python310-idle_3.10.20-4_arm64.deb
    sha:2227f9b598b25935f51e5932cbe0127296c61557
  • alt-python310-libs_3.10.20-4_arm64.deb
    sha:91bea05c49e9e3328de7a812a960d330aae1e23f
  • alt-python310-test_3.10.20-4_arm64.deb
    sha:4f4a1fe2a72dfdc4284a29600cc03231c2c84e73
  • alt-python310-tkinter_3.10.20-4_arm64.deb
    sha:2f3c003f7691416a0c7de7d3611cff46ac9b2958
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.