[CLSA-2026:1792795468] Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

Type:

security

Severity:

Critical

Release date:

2026-10-23 22:44:39 UTC

Description:

   * SECURITY UPDATE: out-of-bounds repeat stack access in huge regexps
     - debian/patches/CVE-2026-110264.patch: reject patterns whose range
       repeat or null check IDs overflow in regcomp.c, regerror.c.
     - CVE-2026-110264
   * SECURITY UPDATE: wrapped jump offsets in the regexp compiler
     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check the
       quantifier expansion size without int overflow and reject programs
       too big for their offset type in regcomp.c, regint.h, regerror.c.
     - CVE-2026-93577
     - CVE-2026-97229
   * Fix build-time test failures:
     - debian/patches/exclude-tests-failing-on-build-system.patch: skip the
       DTrace probe and permission tests, which fail when the test suite runs
       as root, the TLS tests whose test certificates expired and the
       Asia/Singapore tests that do not match the installed tzdata

CVEs fixed:

Updated packages:

libruby2.3_2.3.1-2~ubuntu16.04.16+tuxcare.els1_amd64.deb
sha:20f127e050f24b7326258524da4fbf32328a533d
ruby2.3_2.3.1-2~ubuntu16.04.16+tuxcare.els1_amd64.deb
sha:fca40a2a4d5256a8a6015f225965c1ba92a225b9
ruby2.3-dev_2.3.1-2~ubuntu16.04.16+tuxcare.els1_amd64.deb
sha:5877470a18e20ab48f7c64aef6b0e7594e379c9f
ruby2.3-doc_2.3.1-2~ubuntu16.04.16+tuxcare.els1_all.deb
sha:65e96c942c1a017d2eaf3f58422726e322669abf
ruby2.3-tcltk_2.3.1-2~ubuntu16.04.16+tuxcare.els1_amd64.deb
sha:b0caf1f589535836ee0780de39f5da102c025429

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.