[CLSA-2026:1781100853] Fix CVE(s): CVE-2025-58767, CVE-2026-27820
Type:
security
Severity:
Critical
Release date:
2026-06-10 14:14:41 UTC
Description:
* SECURITY UPDATE: rexml denial of service via multiple XML declarations - debian/patches/CVE-2025-58767.patch: validate XML declarations in bundled rexml-3.3.9 (require version, restrict to version/encoding/ standalone attributes, reject duplicates) and add Source#skip_spaces fast path; backport of upstream rexml commit 5859bdea (PR #282). - CVE-2025-58767 * SECURITY UPDATE: heap buffer overflow in Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: make the gzip output buffer expansion unconditional in zstream_buffer_ungets() so a large ungetc payload cannot memmove/write past the allocation (ext/zlib/zlib.c), plus regression test test_ungetc_buffer_underflow (test/zlib/test_zlib.rb). - CVE-2026-27820
CVEs fixed:
Updated packages:
  • alt-ruby31_3.1.7-10_amd64.deb
    sha:44dda4c394ae88ec231f56a8dfb33b9707c56a49
  • alt-ruby31-bundled-gems_3.1.7-10_amd64.deb
    sha:d339f88efe78f3b6b536840393ba256e5cda6009
  • alt-ruby31-default-gems_3.1.7-10_amd64.deb
    sha:99d9f00e5bcf4dd1ce7ed89a1c08a1354473c966
  • alt-ruby31-devel_3.1.7-10_amd64.deb
    sha:a9c6ba97bc9ae87602d505a2728c763a1a0c80e2
  • alt-ruby31-doc_3.1.7-10_amd64.deb
    sha:b6bcb5b9468b07d4c018826738d706ba098c27fc
  • alt-ruby31-libs_3.1.7-10_amd64.deb
    sha:4be390d4faf30c487a682111bbc672ac2fc74036
  • alt-ruby31-rubygem-bigdecimal_3.1.1-10_amd64.deb
    sha:357ae20d7e6577f9613dd2effb82f43fadf94c18
  • alt-ruby31-rubygem-bundler_2.3.27-10_amd64.deb
    sha:23a9edd64b0f43ea232012c86a5021cae484eb82
  • alt-ruby31-rubygem-io-console_0.5.11-10_amd64.deb
    sha:5f4beeeb038adca79b8bf6480ec63f316fb3cd54
  • alt-ruby31-rubygem-irb_1.4.1-10_amd64.deb
    sha:d046a068468d3ccba29a3dbe762babeeb121aea7
  • alt-ruby31-rubygem-json_2.6.1-10_amd64.deb
    sha:ad582ee2ff6ee8ea3e51a83d95f8b65e8db17565
  • alt-ruby31-rubygem-minitest_5.15.0-10_amd64.deb
    sha:745e0bbcada0842fd90660db4d8fd3546f05f1e7
  • alt-ruby31-rubygem-power-assert_2.0.1-10_amd64.deb
    sha:27c841956bf307752cd1f7c03109ed33bd5bb752
  • alt-ruby31-rubygem-psych_4.0.4-10_amd64.deb
    sha:9ee929504ffb9b9bff577a5d681843eff8ba5b79
  • alt-ruby31-rubygem-rake_13.0.6-10_amd64.deb
    sha:d141d15142ebd57de86394f20f08f8a496b2a334
  • alt-ruby31-rubygem-rbs_2.7.0-10_amd64.deb
    sha:c6979b9833efcfc3a745b219478e83c0f8139a37
  • alt-ruby31-rubygem-rdoc_6.4.1.1-10_amd64.deb
    sha:23624f565a46ce76c14a196841cd6dcc2f24bf4a
  • alt-ruby31-rubygem-rexml_3.3.9-10_amd64.deb
    sha:ebe0d3b3c8035c64ccfca62ecd500fcdcdb152d7
  • alt-ruby31-rubygem-rss_0.3.1-10_amd64.deb
    sha:96d24c917f7f2101bcec95a5c7dfe03f725b7a22
  • alt-ruby31-rubygem-test-unit_3.5.3-10_amd64.deb
    sha:58f89a91d7187d8f4d93446cebdeeb64caa43b32
  • alt-ruby31-rubygem-typeprof_0.21.3-10_amd64.deb
    sha:42056244d503ca6a2b41ec3ea3ecc4927d642b92
  • alt-ruby31-rubygems_3.3.27-10_amd64.deb
    sha:bec9f8c328af97babb09c64423403e6ae90b2ee0
  • alt-ruby31-rubygems-devel_3.3.27-10_amd64.deb
    sha:6de046c26d2fffa09f49c497c42248ecde8ddef8
  • alt-ruby31_3.1.7-10_arm64.deb
    sha:651c8ed93bcbe70aa022cd05ad26413dff944209
  • alt-ruby31-bundled-gems_3.1.7-10_arm64.deb
    sha:09dfa06d7a3f52759cba211e8985b13342acce18
  • alt-ruby31-default-gems_3.1.7-10_arm64.deb
    sha:a7999bc80ed9fcbeee57594911651c15460d0e2c
  • alt-ruby31-devel_3.1.7-10_arm64.deb
    sha:759c4707be62c2589a167ca5f243e4352d43f3ef
  • alt-ruby31-doc_3.1.7-10_arm64.deb
    sha:79ed832d5082ebe60be0e93c72d283a0eac2eeb0
  • alt-ruby31-libs_3.1.7-10_arm64.deb
    sha:3889888b2b69aab116e67a754bcfa2df31825c8c
  • alt-ruby31-rubygem-bigdecimal_3.1.1-10_arm64.deb
    sha:00ff93c6422bdd767d070084fb0ae158db53caaf
  • alt-ruby31-rubygem-bundler_2.3.27-10_arm64.deb
    sha:839312be4c059350b24cbeea7bbe388a67c252d7
  • alt-ruby31-rubygem-io-console_0.5.11-10_arm64.deb
    sha:34eeb10fce95f7818cf05745bfa62c34745aef56
  • alt-ruby31-rubygem-irb_1.4.1-10_arm64.deb
    sha:d9831a163c3e179f9ea869b28a24eeb2b7e4e442
  • alt-ruby31-rubygem-json_2.6.1-10_arm64.deb
    sha:4e7e69dee0f413feb0b8b253d8dda5fadd75127c
  • alt-ruby31-rubygem-minitest_5.15.0-10_arm64.deb
    sha:d7a98d63be1025801fb8028733e4aeddeaf1ba7f
  • alt-ruby31-rubygem-power-assert_2.0.1-10_arm64.deb
    sha:40792e8068e8843dd96061751d7294460711a19d
  • alt-ruby31-rubygem-psych_4.0.4-10_arm64.deb
    sha:6cf9b925f0d3eef166af890628f41cd71db7e5fd
  • alt-ruby31-rubygem-rake_13.0.6-10_arm64.deb
    sha:b9ab240b8b644e62545208563aec129967cd76e4
  • alt-ruby31-rubygem-rbs_2.7.0-10_arm64.deb
    sha:8f087276c18b47ea992225392f762638acb47dc3
  • alt-ruby31-rubygem-rdoc_6.4.1.1-10_arm64.deb
    sha:bf942e534ff3efebaf00a3b1d3bf6586c21fde71
  • alt-ruby31-rubygem-rexml_3.3.9-10_arm64.deb
    sha:dda17225a9e21c0a7d7cab29a2e8734f882fbdc2
  • alt-ruby31-rubygem-rss_0.3.1-10_arm64.deb
    sha:cf2ae8e6fb1b7ccb1e024d95c4231f075d15df25
  • alt-ruby31-rubygem-test-unit_3.5.3-10_arm64.deb
    sha:e46b2de117377d3cd23faab420ff89d6ef5d44ef
  • alt-ruby31-rubygem-typeprof_0.21.3-10_arm64.deb
    sha:ad28cb4d6d24aabbccf1cd474a15368fbe19c5bb
  • alt-ruby31-rubygems_3.3.27-10_arm64.deb
    sha:cd5740db483d1411375c505f011c58204c95f6cc
  • alt-ruby31-rubygems-devel_3.3.27-10_arm64.deb
    sha:c31baf259ca409a5c778ba5052e723f3855ee597
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.