[CLSA-2026:1792797810] Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229
Type:
security
Severity:
Critical
Release date:
2026-10-23 23:23:41 UTC
Description:
* SECURITY UPDATE: regexp: out-of-bounds repeat stack access in Onigmo when the range-repeat or null-check ID overflows its internal type - debian/patches/CVE-2026-110264.patch: reject overflowed IDs - CVE-2026-110264 * SECURITY UPDATE: regexp: wrapped jump offsets in Onigmo from an integer overflow in the quantifier expansion size check and from compiled programs too big for their offset type - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the expansion size by division and cap the compiled program size - CVE-2026-93577 - CVE-2026-97229 * debian/rules: run test-all for test/ruby/test_regexp.rb only; the full suite aborts with a core dump after the last test on the build system
CVEs fixed:
Updated packages:
  • libruby2.7_2.7.4-1+deb11u6+tuxcare.els1_amd64.deb
    sha:125a84911ea5cffc584af76b9f22596d91dc93d6
  • ruby2.7_2.7.4-1+deb11u6+tuxcare.els1_amd64.deb
    sha:aad00b82ebf80d79c259174ad343403b6353aa99
  • ruby2.7-dev_2.7.4-1+deb11u6+tuxcare.els1_amd64.deb
    sha:d5be023a9b4b74a4cf5311d02d9938bf506a07e1
  • ruby2.7-doc_2.7.4-1+deb11u6+tuxcare.els1_all.deb
    sha:ccf3861627b6ab2bad5a4982187802518cdb547d
  • libruby2.7_2.7.4-1+deb11u6+tuxcare.els1_arm64.deb
    sha:0322a36b29986fe1ad351af0e2cc3b9f100c4848
  • ruby2.7_2.7.4-1+deb11u6+tuxcare.els1_arm64.deb
    sha:13c3669d3f51cefa1405abdd46fab8a69b8d3867
  • ruby2.7-dev_2.7.4-1+deb11u6+tuxcare.els1_arm64.deb
    sha:527b9de97733725b08780967b01103bdfe7034f2
  • libruby2.7_2.7.4-1+deb11u6+tuxcare.els1_armel.deb
    sha:8fc7cb48c3244a57345dc78a82f4c8f796b14d25
  • ruby2.7_2.7.4-1+deb11u6+tuxcare.els1_armel.deb
    sha:3071c73ab7b093088c187b85ca2516ab2ca05fa4
  • ruby2.7-dev_2.7.4-1+deb11u6+tuxcare.els1_armel.deb
    sha:2bdd586da7d2e39ef11ca71f57c12e083cde7983
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.