[CLSA-2026:1781167796] Fix CVE(s): CVE-2026-27820
Type:
security
Severity:
Critical
Release date:
2026-06-11 08:50:24 UTC
Description:
* SECURITY UPDATE: Heap buffer overflow in the bundled zlib extension via Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: in zstream_buffer_ungets() (ext/zlib/zlib.c) the output buffer was expanded only when it was already full (rb_str_capacity(z->buf) <= ZSTREAM_BUF_FILLED(z)), so a large ungetc payload memmove()'d and wrote past the allocation. Make the expansion unconditional via zstream_expand_buffer_into(z, len), which guarantees capacity for filled + len before the memmove. Also backports the upstream regression test test_ungetc_buffer_underflow. - CVE-2026-27820
CVEs fixed:
Updated packages:
  • alt-ruby30_3.0.7-173_amd64.deb
    sha:10f30611dd13c4de8207f4eb3ed9538454c8a142
  • alt-ruby30-default-gems_3.0.7-173_amd64.deb
    sha:ccbcf83298c45cd75c25454e3819a03acf01e3e9
  • alt-ruby30-devel_3.0.7-173_amd64.deb
    sha:123a6b8363df1f4d4415e3df00a561dc83102776
  • alt-ruby30-doc_3.0.7-173_amd64.deb
    sha:9a33ca0e82cb8689459ca144e1490ee4b58206c2
  • alt-ruby30-libs_3.0.7-173_amd64.deb
    sha:3a61e55840c42f96a2fb2d56c5b316d0288cd793
  • alt-ruby30-rubygem-bigdecimal_3.0.0-173_amd64.deb
    sha:000e28174508c1dcdd648b1b2c3f468da9da8699
  • alt-ruby30-rubygem-bundler_2.2.33-173_amd64.deb
    sha:706288a6ed694a2d271aaec6e421c48ae108d221
  • alt-ruby30-rubygem-io-console_0.5.7-173_amd64.deb
    sha:1de8ab5daa8b5fd16ad3f09d4cdb2df6ba3a8085
  • alt-ruby30-rubygem-irb_1.3.5-173_amd64.deb
    sha:213244109c5cf5d9be84bad07eb209c3bdff9a21
  • alt-ruby30-rubygem-json_2.5.1-173_amd64.deb
    sha:901f07207a15128e5f8b3e05baf3813fee84bb63
  • alt-ruby30-rubygem-minitest_5.14.2-173_amd64.deb
    sha:1f370b1e1d917d1077f22f8249e36a24f35ba3c1
  • alt-ruby30-rubygem-power-assert_1.2.1-173_amd64.deb
    sha:137f06d8b30091b880218fdbc2dbf73c6f677ac3
  • alt-ruby30-rubygem-psych_3.3.2-173_amd64.deb
    sha:23f890c5b89db6037c372f6e3c51896b6f437ea3
  • alt-ruby30-rubygem-rake_13.0.3-173_amd64.deb
    sha:eca29b1933622a58ea4415c7f2e4ea72700667c2
  • alt-ruby30-rubygem-rbs_1.4.0-173_amd64.deb
    sha:acfca0af9592fdd44d90616ef4b31b111ee79ac7
  • alt-ruby30-rubygem-rdoc_6.3.4.1-173_amd64.deb
    sha:4aa249b42e775e7b64b234546496c7c2d247240b
  • alt-ruby30-rubygem-rexml_3.2.5-173_amd64.deb
    sha:4c38232f968e0d4d075955b09d237fd3009e5866
  • alt-ruby30-rubygem-rss_0.2.9-173_amd64.deb
    sha:62f60f8d045e37c6fc24205fef0108b7621d6c19
  • alt-ruby30-rubygem-test-unit_3.3.7-173_amd64.deb
    sha:dca9471f6162b0c862c628cc219cd464d64d82fa
  • alt-ruby30-rubygem-typeprof_0.15.2-173_amd64.deb
    sha:9b3a2fcf506ae655c6274c36193ef470f62499de
  • alt-ruby30-rubygems_3.2.33-173_amd64.deb
    sha:ee6c0ba238d9de2915051f43b98dd5dec439a626
  • alt-ruby30-rubygems-devel_3.2.33-173_amd64.deb
    sha:9113684b0bdc2a0aa0fc09914ccd009fbaa19e3a
  • alt-ruby30_3.0.7-173_arm64.deb
    sha:fe98ca66b63d4a126e38da470f2325750b62078d
  • alt-ruby30-default-gems_3.0.7-173_arm64.deb
    sha:9a178c1d00aa5d5c26109d7dde88166b4d9dcd6d
  • alt-ruby30-devel_3.0.7-173_arm64.deb
    sha:2b284091a7d4268fab34e9c35e112155c73b03fc
  • alt-ruby30-doc_3.0.7-173_arm64.deb
    sha:2689d02a1f51f2457293a70af6ee5cbbc7bf899e
  • alt-ruby30-libs_3.0.7-173_arm64.deb
    sha:689ae1df5fc2998cadc31cf8c9fb6dad29597063
  • alt-ruby30-rubygem-bigdecimal_3.0.0-173_arm64.deb
    sha:ac77bd4c8da16cd082133dd6e01e068c8a6241a7
  • alt-ruby30-rubygem-bundler_2.2.33-173_arm64.deb
    sha:a9903f3cb150e29266f7affb12f68d01743a6090
  • alt-ruby30-rubygem-io-console_0.5.7-173_arm64.deb
    sha:3009f8025ddab1c926689103d1b1e6606a2efb2a
  • alt-ruby30-rubygem-irb_1.3.5-173_arm64.deb
    sha:6c6c9f7bbdfb3b8747c34f155b2d41d11a1ac770
  • alt-ruby30-rubygem-json_2.5.1-173_arm64.deb
    sha:9c2c8aad80542fd7e63e55a21a99b80208a1bcd8
  • alt-ruby30-rubygem-minitest_5.14.2-173_arm64.deb
    sha:75320693fa92ca6da81bc4af6052988ab062500c
  • alt-ruby30-rubygem-power-assert_1.2.1-173_arm64.deb
    sha:457e2c7b750c80e26d9ae0ae32bd530e574e98a9
  • alt-ruby30-rubygem-psych_3.3.2-173_arm64.deb
    sha:6ef7a0cbc323e81b8289c3d8847a598941120b15
  • alt-ruby30-rubygem-rake_13.0.3-173_arm64.deb
    sha:9e86eeac0b5e5d8b344b1ddd941fe84b1ba9d9a9
  • alt-ruby30-rubygem-rbs_1.4.0-173_arm64.deb
    sha:02f2d7dfccbc4a955e2538764721b05e34ec6152
  • alt-ruby30-rubygem-rdoc_6.3.4.1-173_arm64.deb
    sha:132aa019f816c4d7df7aff6f1316cf8400763c3d
  • alt-ruby30-rubygem-rexml_3.2.5-173_arm64.deb
    sha:eb485910f43c36d0cba2eafde26bcf79b43b7f2c
  • alt-ruby30-rubygem-rss_0.2.9-173_arm64.deb
    sha:4a150931ff3093ade805af48de9d994b7c1809cb
  • alt-ruby30-rubygem-test-unit_3.3.7-173_arm64.deb
    sha:b5609a682bb4b2f48c8a537376d1cf7321bdcb8a
  • alt-ruby30-rubygem-typeprof_0.15.2-173_arm64.deb
    sha:c5a1b946cd22bf9396f579f077ff7c97fe62e125
  • alt-ruby30-rubygems_3.2.33-173_arm64.deb
    sha:c033e11585c45763046af6840a2e14afe88e1796
  • alt-ruby30-rubygems-devel_3.2.33-173_arm64.deb
    sha:71bae820c901f1ca192bbdf01ac981ecdf48e745
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.