Tuxcare Errata System 0.0.1 5.10 2026-09-16T19:23:14 Ubuntu 20.04 LTS * SECURITY UPDATE: Heap buffer overflow in the bundled zlib extension via Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: in zstream_buffer_ungets() (ext/zlib/zlib.c) the output buffer was expanded only when it was already full (rb_str_capacity(z->buf) <= ZSTREAM_BUF_FILLED(z)), so a large ungetc payload memmove()'d and wrote past the allocation. Make the expansion unconditional via zstream_expand_buffer_into(z, len), which guarantees capacity for filled + len before the memmove. Also backports the upstream regression test test_ungetc_buffer_underflow. - CVE-2026-27820 Critical TuxCare License Agreement CVE-2026-27820 Ubuntu 20.04 LTS * SECURITY UPDATE: denial of service in the bundled REXML gem - CVE-2025-58767: REXML::Parsers::BaseParser accepted an unlimited number of XML declarations per document, so parsing invalid XML containing multiple XML declarations caused increased execution time and memory usage. - added debian/patches/CVE-2025-58767.patch Moderate TuxCare License Agreement CVE-2025-58767 Ubuntu 20.04 LTS * SECURITY UPDATE: resolv memory exhaustion via unknown DNS resource types - debian/patches/CVE-2026-80212.patch: stop permanently registering generated Resource::Generic classes (Generic constants and Resource::ClassHash entries) for every unknown DNS (type, class) pair, and compare generic records by TypeValue/ClassValue instead of class identity; backport of upstream ruby/resolv 23f0009 (resolv 0.3.2 / 0.7.2) - Behaviour change inherited from upstream: a class obtained from Resource::Generic.create(type, class) is no longer registered, so Resolv::DNS#getresources(name, Generic.create(type, class)) now returns an empty list where it used to return the matching records; records of unknown types are still decoded as Resource::Generic - CVE-2026-80212 * SECURITY UPDATE: resolv hostname validation bypass via unchecked DNS name limits - debian/patches/CVE-2026-80213.patch: enforce the 63-octet label and 255-octet encoded-name limits when encoding, cap character- strings at 255 octets and report out-of-range length octets as DecodeError, so an over-long label can no longer wrap its length octet and resolve a different name; backport of upstream ruby/resolv b0ddbb5 (resolv 0.3.2 / 0.7.2) - CVE-2026-80213 Important TuxCare License Agreement CVE-2026-80212 CVE-2026-80213 Ubuntu 20.04 LTS * SECURITY UPDATE: resolv memory exhaustion via unknown DNS resource types - debian/patches/CVE-2026-80212.patch: stop permanently registering generated Resource::Generic classes (Generic constants and the Resource constants written through Resource::ClassHash) for every unknown DNS (type, class) pair, and the generated SvcParam::Generic classes for every unknown SvcParamKey, and compare generic records by TypeValue/ClassValue instead of class identity; backport of upstream ruby/resolv 6393c62 (resolv 0.7.2, == 23f0009 on the 0.3 branch) - Behaviour change inherited from upstream: a class obtained from Resource::Generic.create(type, class) is no longer registered, so Resolv::DNS#getresources(name, Generic.create(type, class)) now returns an empty list where it used to return the matching records; records of unknown types are still decoded as Resource::Generic - CVE-2026-80212 * SECURITY UPDATE: resolv hostname validation bypass via unchecked DNS name limits - debian/patches/CVE-2026-80213.patch: enforce the 63-octet label and 255-octet encoded-name limits when encoding, cap character- strings at 255 octets and report out-of-range length octets as DecodeError, so an over-long label can no longer wrap its length octet and resolve a different name; backport of upstream ruby/resolv b336e42 (resolv 0.7.2, == b0ddbb5 on the 0.3 branch) - CVE-2026-80213 Important TuxCare License Agreement CVE-2026-80212 CVE-2026-80213 Ubuntu 20.04 LTS * SECURITY UPDATE: resolv memory exhaustion via unknown DNS resource types - debian/patches/CVE-2026-80212.patch: stop permanently registering generated Resource::Generic classes (Generic constants and Resource::ClassHash entries) for every unknown DNS (type, class) pair, and the same for SvcParam::Generic classes and unknown SvcParamKeys, and compare generic records by TypeValue/ClassValue instead of class identity; backport of upstream ruby/resolv 23f0009 (resolv 0.3.2 / 0.7.2) - Behaviour change inherited from upstream: a class obtained from Resource::Generic.create(type, class) is no longer registered, so Resolv::DNS#getresources(name, Generic.create(type, class)) now returns an empty list where it used to return the matching records; records of unknown types are still decoded as Resource::Generic - CVE-2026-80212 * SECURITY UPDATE: resolv hostname validation bypass via unchecked DNS name limits - debian/patches/CVE-2026-80213.patch: enforce the 63-octet label and 255-octet encoded-name limits when encoding, cap character- strings at 255 octets and report out-of-range length octets as DecodeError, so an over-long label can no longer wrap its length octet and resolve a different name; backport of upstream ruby/resolv b0ddbb5 (resolv 0.3.2 / 0.7.2) - CVE-2026-80213 Important TuxCare License Agreement CVE-2026-80212 CVE-2026-80213 Ubuntu 20.04 LTS * SECURITY UPDATE: resolv memory exhaustion via unknown DNS resource types - debian/patches/CVE-2026-80212.patch: stop permanently registering generated Resource::Generic classes (Generic constants and Resource::ClassHash entries) for every unknown DNS (type, class) pair, and the same for SvcParam::Generic classes and unknown SvcParamKeys, and compare generic records by TypeValue/ClassValue instead of class identity; backport of upstream ruby/resolv 23f0009 (resolv 0.3.2 / 0.7.2) - Behaviour change inherited from upstream: a class obtained from Resource::Generic.create(type, class) is no longer registered, so Resolv::DNS#getresources(name, Generic.create(type, class)) now returns an empty list where it used to return the matching records; records of unknown types are still decoded as Resource::Generic - CVE-2026-80212 * SECURITY UPDATE: resolv hostname validation bypass via unchecked DNS name limits - debian/patches/CVE-2026-80213.patch: enforce the 63-octet label and 255-octet encoded-name limits when encoding, cap character- strings at 255 octets and report out-of-range length octets as DecodeError, so an over-long label can no longer wrap its length octet and resolve a different name; backport of upstream ruby/resolv b0ddbb5 (resolv 0.3.2 / 0.7.2) - CVE-2026-80213 Important TuxCare License Agreement CVE-2026-80212 CVE-2026-80213 Ubuntu 20.04 LTS * SECURITY UPDATE: resolv memory exhaustion via unknown DNS resource types and SvcParamKeys - debian/patches/CVE-2026-80212.patch: stop permanently registering generated Resource::Generic and SvcParam::Generic classes (as Type<n>_Class<n> / Key<n> constants and, in the RubyGems-vendored copy, as Resource::ClassHash entries) for every unknown DNS (type, class) pair and SvcParamKey, and compare generic records by TypeValue/ClassValue instead of class identity; backport of upstream ruby/resolv 6393c62 (resolv 0.7.2; 23f0009 on the 0.3 branch) - Behaviour change inherited from upstream: a class obtained from Resource::Generic.create(type, class) is no longer registered, so Resolv::DNS#getresources(name, Generic.create(type, class)) now returns an empty list where it used to return the matching records; records of unknown types are still decoded as Resource::Generic - CVE-2026-80212 * SECURITY UPDATE: resolv hostname validation bypass via unchecked DNS name limits - debian/patches/CVE-2026-80213.patch: enforce the 63-octet label and 255-octet encoded-name limits when encoding, cap character-strings at 255 octets and report out-of-range length octets as DecodeError, so an over-long label can no longer wrap its length octet and resolve a different name; backport of upstream ruby/resolv b336e42 (resolv 0.7.2; b0ddbb5 on the 0.3 branch) - CVE-2026-80213 Important TuxCare License Agreement CVE-2026-80212 CVE-2026-80213 alt-ruby35 alt-ruby35-bundled-gems alt-ruby35-default-gems alt-ruby35-devel alt-ruby35-doc alt-ruby35-libs alt-ruby35-rubygem-bigdecimal alt-ruby35-rubygem-bundler alt-ruby35-rubygem-io-console alt-ruby35-rubygem-irb alt-ruby35-rubygem-json alt-ruby35-rubygem-minitest alt-ruby35-rubygem-power-assert alt-ruby35-rubygem-psych alt-ruby35-rubygem-racc alt-ruby35-rubygem-rake alt-ruby35-rubygem-rbs alt-ruby35-rubygem-rdoc alt-ruby35-rubygem-rexml alt-ruby35-rubygem-rss alt-ruby35-rubygem-test-unit alt-ruby35-rubygem-typeprof alt-ruby35-rubygems alt-ruby35-rubygems-devel alt-ruby32 alt-ruby32-bundled-gems alt-ruby32-default-gems alt-ruby32-devel alt-ruby32-doc alt-ruby32-libs alt-ruby32-rubygem-bigdecimal alt-ruby32-rubygem-bundler alt-ruby32-rubygem-io-console alt-ruby32-rubygem-irb alt-ruby32-rubygem-json alt-ruby32-rubygem-minitest alt-ruby32-rubygem-power-assert alt-ruby32-rubygem-psych alt-ruby32-rubygem-rake alt-ruby32-rubygem-rbs alt-ruby32-rubygem-rdoc alt-ruby32-rubygem-rexml alt-ruby32-rubygem-rss alt-ruby32-rubygem-test-unit alt-ruby32-rubygem-typeprof alt-ruby32-rubygems alt-ruby32-rubygems-devel alt-ruby40 alt-ruby40-bundled-gems alt-ruby40-default-gems alt-ruby40-devel alt-ruby40-doc alt-ruby40-libs alt-ruby40-rubygem-bigdecimal alt-ruby40-rubygem-bundler alt-ruby40-rubygem-io-console alt-ruby40-rubygem-irb alt-ruby40-rubygem-json alt-ruby40-rubygem-minitest alt-ruby40-rubygem-power-assert alt-ruby40-rubygem-psych alt-ruby40-rubygem-racc alt-ruby40-rubygem-rake alt-ruby40-rubygem-rbs alt-ruby40-rubygem-rdoc alt-ruby40-rubygem-rexml alt-ruby40-rubygem-rss alt-ruby40-rubygem-test-unit alt-ruby40-rubygem-typeprof alt-ruby40-rubygems alt-ruby40-rubygems-devel alt-ruby33 alt-ruby33-bundled-gems alt-ruby33-default-gems alt-ruby33-devel alt-ruby33-doc alt-ruby33-libs alt-ruby33-rubygem-bigdecimal alt-ruby33-rubygem-bundler alt-ruby33-rubygem-io-console alt-ruby33-rubygem-irb alt-ruby33-rubygem-json alt-ruby33-rubygem-minitest alt-ruby33-rubygem-power-assert alt-ruby33-rubygem-psych alt-ruby33-rubygem-racc alt-ruby33-rubygem-rake alt-ruby33-rubygem-rbs alt-ruby33-rubygem-rdoc alt-ruby33-rubygem-rexml alt-ruby33-rubygem-rss alt-ruby33-rubygem-test-unit alt-ruby33-rubygem-typeprof alt-ruby33-rubygems alt-ruby33-rubygems-devel alt-ruby34 alt-ruby34-bundled-gems alt-ruby34-default-gems alt-ruby34-devel alt-ruby34-doc alt-ruby34-libs alt-ruby34-rubygem-bigdecimal alt-ruby34-rubygem-bundler alt-ruby34-rubygem-io-console alt-ruby34-rubygem-irb alt-ruby34-rubygem-json alt-ruby34-rubygem-minitest alt-ruby34-rubygem-power-assert alt-ruby34-rubygem-psych alt-ruby34-rubygem-racc alt-ruby34-rubygem-rake alt-ruby34-rubygem-rbs alt-ruby34-rubygem-rdoc alt-ruby34-rubygem-rexml alt-ruby34-rubygem-rss alt-ruby34-rubygem-test-unit alt-ruby34-rubygem-typeprof alt-ruby34-rubygems alt-ruby34-rubygems-devel amd64 0:3.5.0~preview1-4 amd64 0:3.1.9-4 amd64 0:2.7.0.dev-4 amd64 0:0.8.0-4 amd64 0:1.15.2-4 amd64 0:2.10.2-4 amd64 0:5.25.5-4 amd64 0:2.0.5-4 amd64 0:5.2.3-4 amd64 1:1.8.1-4 amd64 0:13.2.1-4 amd64 0:3.9.2-4 amd64 0:6.13.1-4 amd64 0:3.4.1-4 amd64 0:0.3.1-4 amd64 0:3.6.8-4 amd64 0:0.30.1-4 amd64 0:3.7.0.dev-4 amd64 0:3.5.0~preview1-5 amd64 0:3.1.9-5 amd64 0:2.7.0.dev-5 amd64 0:0.8.0-5 amd64 0:1.15.2-5 amd64 0:2.10.2-5 amd64 0:5.25.5-5 amd64 0:2.0.5-5 amd64 0:5.2.3-5 amd64 1:1.8.1-5 amd64 0:13.2.1-5 amd64 0:3.9.2-5 amd64 0:6.13.1-5 amd64 0:3.4.1-5 amd64 0:0.3.1-5 amd64 0:3.6.8-5 amd64 0:0.30.1-5 amd64 0:3.7.0.dev-5 amd64 0:3.2.11-15 amd64 0:3.1.3-15 amd64 0:2.4.19-15 amd64 0:0.6.0-15 amd64 0:1.6.2-15 amd64 0:2.6.3-15 amd64 0:5.25.1-15 amd64 0:2.0.3-15 amd64 0:5.0.1-15 amd64 0:13.0.6-15 amd64 0:2.8.2-15 amd64 0:6.5.1.1-15 amd64 0:3.4.4-15 amd64 0:0.3.1-15 amd64 0:3.5.7-15 amd64 0:0.21.3-15 amd64 0:3.4.19-15 amd64 0:4.0.6-7 amd64 0:4.0.1-7 amd64 0:4.0.16-7 amd64 0:0.8.2-7 amd64 0:1.16.0-7 amd64 0:2.18.0-7 amd64 0:6.0.0-7 amd64 0:3.0.1-7 amd64 0:5.3.1-7 amd64 1:1.8.1-7 amd64 0:13.3.1-7 amd64 0:3.10.0-7 amd64 0:7.0.4-7 amd64 0:3.4.4-7 amd64 0:0.3.2-7 amd64 0:3.7.5-7 amd64 0:0.31.1-7 amd64 0:3.3.12-14 amd64 0:3.1.5-14 amd64 0:2.5.22-14 amd64 0:0.7.1-14 amd64 0:1.13.1-14 amd64 0:2.7.2-14 amd64 0:5.20.0-14 amd64 0:2.0.3-14 amd64 0:5.1.2-14 amd64 1:1.7.3-14 amd64 0:13.1.0-14 amd64 0:3.4.0-14 amd64 0:6.6.3.1-14 amd64 0:3.4.4-14 amd64 0:0.3.1-14 amd64 0:3.6.1-14 amd64 0:0.21.9-14 amd64 0:3.5.22-14 amd64 0:3.5.0~preview1-6 amd64 0:3.1.9-6 amd64 0:2.7.0.dev-6 amd64 0:0.8.0-6 amd64 0:1.15.2-6 amd64 0:2.10.2-6 amd64 0:5.25.5-6 amd64 0:2.0.5-6 amd64 0:5.2.3-6 amd64 1:1.8.1-6 amd64 0:13.2.1-6 amd64 0:3.9.2-6 amd64 0:6.13.1-6 amd64 0:3.4.1-6 amd64 0:0.3.1-6 amd64 0:3.6.8-6 amd64 0:0.30.1-6 amd64 0:3.7.0.dev-6 amd64 0:3.4.10-12 amd64 0:3.1.8-12 amd64 0:2.6.9-12 amd64 0:0.8.1-12 amd64 0:1.14.3-12 amd64 0:2.9.1-12 amd64 0:5.25.4-12 amd64 0:2.0.5-12 amd64 0:5.2.2-12 amd64 1:1.8.1-12 amd64 0:13.2.1-12 amd64 0:3.8.0-12 amd64 0:6.14.0-12 amd64 0:3.4.4-12 amd64 0:0.3.1-12 amd64 0:3.6.7-12 amd64 0:0.30.1-12 amd64 0:3.6.9-12