Release date:
2026-09-01 16:13:08 UTC
Description:
* SECURITY UPDATE: option injection via Mercurial revision passed as a bare argument
- debian/patches/CVE-2023-5752.patch: pass the revision as --rev= so it
cannot be interpreted as an hg option
- CVE-2023-5752
* SECURITY UPDATE: arbitrary file write via unchecked symlink targets in tar extraction
- debian/patches/CVE-2025-8869.patch: reject symlink members whose target is
absent from the archive or resolves outside the destination directory
- CVE-2025-8869
* SECURITY UPDATE: path traversal via sibling-prefix directory containment check
- debian/patches/CVE-2026-1703.patch: compare whole path components instead of
using os.path.commonprefix
- CVE-2026-1703
* SECURITY UPDATE: archive format confusion for files matching both zip and tar signatures
- debian/patches/CVE-2026-3219.patch: order format detection by confidence and
refuse archives with an ambiguous signature
- CVE-2026-3219
* SECURITY UPDATE: arbitrary file write via entry point name escaping the scripts directory
- debian/patches/CVE-2026-8643.patch: reject console script names that do not
resolve inside the scripts directory
- CVE-2026-8643
* SECURITY UPDATE: directory escape via Link.filename decoding the URL path twice
- debian/patches/CVE-2026-13346.patch: decode the URL path once and reduce the
file name to a single path component
- CVE-2026-13346
* SECURITY UPDATE: revision hijacking via unicode separators in git references
- debian/patches/CVE-2021-3572.patch: split git show-ref output on plain
newlines/ASCII spaces instead of all unicode separators
- CVE-2021-3572
Updated packages:
-
alt-python27-pip_20.2.4-7_all.deb
sha:21b458dbe9eb39e80dba47b7be31e6e6edbc3b68
-
alt-python27-pip-wheel_20.2.4-7_all.deb
sha:9d99479e5719470e118a417ce88e323a13eef39c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
