CLSA-2026-1789636518
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789636518.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789636518
- Upstream
CVE (2)
- Published
- 2026-09-17T09:15:29Z
- Modified
- 2026-10-26T09:32:04Z
- Summary
- Fix CVE(s): CVE-2026-11972, CVE-2026-9669
- Details
-
- SECURITY UPDATE: quadratic parse time in the tarfile module when a
streaming archive declares an offset past the end of the stream
- debian/patches/CVE-2026-11972.patch: stop the forward-seek loop in _Stream.seek() as soon as read() returns no data, in Lib/tarfile.py, so a crafted mode="r|" archive can no longer keep the parser reading an exhausted stream.
- CVE-2026-11972
- SECURITY UPDATE: out-of-bounds write when a bz2 decompressor is reused
after a decompression error
- debian/patches/CVE-2026-9669.patch: record the libbzip2 error in the BZ2Decompressor object and refuse any further decompress() call with ValueError, in Modules/_bz2module.c, so retrying with the same object can no longer re-enter BZ2_bzDecompress() on a bz_stream left in an invalid internal state.
- CVE-2026-9669
- SECURITY UPDATE: quadratic parse time in the tarfile module when a
streaming archive declares an offset past the end of the stream
- References