[CLSA-2026:1792795609] Fix CVE(s): CVE-2026-110264, CVE-2026-93577, CVE-2026-97229

Type:

security

Severity:

Critical

Release date:

2026-10-23 22:47:00 UTC

Description:

   * SECURITY UPDATE: out-of-bounds repeat stack access in regexps
     - debian/patches/CVE-2026-110264.patch: reject patterns whose range-repeat
       or null-check count overflows the ID type in regcomp.c
     - CVE-2026-110264
   * SECURITY UPDATE: wrapped jump offsets in compiled regexps
     - debian/patches/CVE-2026-93577-CVE-2026-97229.patch: check quantifier
       expansion without int overflow and cap program size in regcomp.c
     - CVE-2026-93577
     - CVE-2026-97229
   * Fix build-time test failures:
     - debian/tests/excludes: skip the DTrace probe and two permission tests,
       which fail when the test suite runs as root, the TLS tests whose
       test certificates expired and the EADDRINUSE local bind tests

CVEs fixed:

Updated packages:

libruby2.5_2.5.1-1ubuntu1.16+tuxcare.els1_amd64.deb
sha:3ad55f9b83467f4f4c74fb048d870108ccf82d86
ruby2.5_2.5.1-1ubuntu1.16+tuxcare.els1_amd64.deb
sha:dd14f329c8fce87097cd38d7441f7f701e9f6fd3
ruby2.5-dev_2.5.1-1ubuntu1.16+tuxcare.els1_amd64.deb
sha:02e790272d73949116fbe5c59d4bc5cb2f21ad60
ruby2.5-doc_2.5.1-1ubuntu1.16+tuxcare.els1_all.deb
sha:44f038efaef9ebd0e0fa810f3cd8dba92791607d

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.