Release date:
2025-11-07 15:11:20 UTC
Description:
* SECURITY UPDATE: Traversing outside chmod directory
- debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
-2025-4435-CVE-2025-4517.patch: re-filters directory members
before chmod/chown
- CVE-2024-12718
* SECURITY UPDATE: Symlink exfiltration
- debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
-2025-4435-CVE-2025-4517.patch: properly handles different link
semantics
- CVE-2025-4138
* SECURITY UPDATE: Hardlink Fallback Attack
- debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
-2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink
extraction falls back to copying
- CVE-2025-4330
* SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members
- debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
-2025-4435-CVE-2025-4517.patch: account errorlevel
- CVE-2025-4435
* SECURITY UPDATE: PATH_MAX Attack
- debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
-2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow
attacks
- CVE-2025-4517
* TEST UPDATE: Incorrect encoding leading to an unexpected
exception in test_tarfile.py
- debian/patch/fix_test_tarfile-enconding.patch: fix encoding
Updated packages:
-
alt-python36_3.6.15-19_amd64.deb
sha:1d9e8ad28c31adc980a9cac4e3709f04eb14d833
-
alt-python36-debug_3.6.15-19_amd64.deb
sha:907886c6320db7f1adbf517241535a41618b56ed
-
alt-python36-devel_3.6.15-19_amd64.deb
sha:cfc2c5cd093f2f60f1ea89e43ba215389073610c
-
alt-python36-libs_3.6.15-19_amd64.deb
sha:86d7e971562bc67ff366f38739f802be3522b9d8
-
alt-python36-test_3.6.15-19_amd64.deb
sha:1d43020fc60b1ade72855e46094bfa1541b47897
-
alt-python36-tkinter_3.6.15-19_amd64.deb
sha:a3473021539d20d4e14b9efe6b3033874528d9f5
-
alt-python36-tools_3.6.15-19_amd64.deb
sha:9dd5b2e79d7b5dffbac6295d4681be5d78147e88
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
