Release date:
2026-09-18 09:20:53 UTC
Description:
* SECURITY UPDATE: quadratic parse time in the tarfile module when a
streaming archive declares an offset past the end of the stream
- debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in
_Stream.seek() as soon as read() returns no data, in Lib/tarfile.py,
so a crafted mode="r|" archive can no longer keep the parser reading
an exhausted stream.
- CVE-2026-11972
Updated packages:
-
idle-python2.7_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_all.deb
sha:a4bc8243b2e3f0d0194e70a0f03373336730dd87
-
libpython2.7_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_amd64.deb
sha:9267a57bbfc3a33008a0ffe0aeaafe886f386e06
-
libpython2.7-dev_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_amd64.deb
sha:1072162873ed89276f085ec3c6142dc505e2711d
-
libpython2.7-minimal_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_amd64.deb
sha:3739d57037b84155bf87032d5c29aff6c6a8d8c2
-
libpython2.7-stdlib_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_amd64.deb
sha:1cbf7c934d1cdacf6b6f1df34375d09c44d0fea2
-
libpython2.7-testsuite_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_all.deb
sha:6f660f60eac0854250e1d5f81310f4bf2d80a1e6
-
python2.7_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_amd64.deb
sha:9dc4ada897be30afe8fc181e1d463d4529aa6da4
-
python2.7-dev_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_amd64.deb
sha:6c8705dad39a4068f5e4dddda402ea2045656340
-
python2.7-doc_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_all.deb
sha:358503c8f56a69dfcca9ec681490bfe8a6bd4daf
-
python2.7-examples_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_all.deb
sha:544ce2e9c7d83a9b14fd8ac0c201438c1246457a
-
python2.7-minimal_2.7.12-1ubuntu0~16.04.18+tuxcare.els25_amd64.deb
sha:6b88cec7aee95169be94607e3866155e6cd16672
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
