[CLSA-2026:1792798327] Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

Type:

security

Severity:

Critical

Release date:

2026-10-23 23:32:18 UTC

Description:

   * SECURITY UPDATE: integer overflow when compiling crafted regexps
     - debian/patches/CVE-2026-110264.patch: reject overflowed range-repeat
       and null-check IDs in huge regexps
     - CVE-2026-110264
   * SECURITY UPDATE: integer overflow when compiling crafted regexps
     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: avoid overflow in
       the quantifier expansion size check and reject a compiled program too
       big for its offset type
     - CVE-2026-93577
     - CVE-2026-97229
   * Fix build-time test failures:
     - debian/patches/fix-timezone-tests-and-update-expired-certs.patch:
       replace the expired test certificates and follow the installed
       tzdata in the Asia/Singapore checks
     - debian/patches/fix-eaddrinuse-race-in-port0-tests.patch: avoid
       EADDRINUSE races in tests that listen on a random port
     - debian/tests/excludes: skip the DTrace probe tests and two
       permission tests, which fail when the test suite runs as root

CVEs fixed:

Updated packages:

libruby2.5_2.5.5-3+deb10u6+tuxcare.els1_amd64.deb
sha:ba1bcb6132218600a09c1911b8f09b862db41522
ruby2.5_2.5.5-3+deb10u6+tuxcare.els1_amd64.deb
sha:b3139ff01e8d78edd0ee43d2e9b24704ca0e8028
ruby2.5-dev_2.5.5-3+deb10u6+tuxcare.els1_amd64.deb
sha:088f8aacd467d31f0ac22110700325ec058d991c
ruby2.5-doc_2.5.5-3+deb10u6+tuxcare.els1_all.deb
sha:e9d9ce5240099c4dc3cfc64d4de79618d5c260ff
libruby2.5_2.5.5-3+deb10u6+tuxcare.els1_arm64.deb
sha:a1865bc5e2ded7057bc399622385c9d45ed8354c
ruby2.5_2.5.5-3+deb10u6+tuxcare.els1_arm64.deb
sha:4c3ad41402c8e57209dc5ccfcb5fcbd68b7a9021
ruby2.5-dev_2.5.5-3+deb10u6+tuxcare.els1_arm64.deb
sha:318cb64d17379ee1a6c9193167cba868f3e68077

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.