Most recent entries from all

ALSA-2025:23342 — Moderate: python3.9 security update

Affected: AlmaLinux:9: python-unversioned-command, AlmaLinux:9: python3, AlmaLinux:9: python3-debug, AlmaLinux:9: python3-devel, AlmaLinux:9: python3-idle, AlmaLinux:9: python3-libs, AlmaLinux:9: python3-test, AlmaLinux:9: python3-tkinter

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642) * cpython: Python HTMLParser quadratic complexity (CVE-2025-6069) * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-11082

BIT-libpython-2025-6069 — HTMLParser quadratic complexity when processing malformed inputs

Affected: Bitnami: libpython

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

certfr-2025-avi-0622 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2025-avi-0622

EUVD-2026-343266

fkie_cve-2025-6069

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

GHSA-j5cc-6rx8-ff96

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

msrc_CVE-2025-6069 — HTMLParser quadratic complexity when processing malformed inputs

msrc_CVE-2025-6069

OESA-2025-1758 — jython security update

Affected: openEuler:24.03-LTS-SP1: jython, openEuler:24.03-LTS-SP2: jython, openEuler:20.03-LTS-SP4: jython, openEuler:22.03-LTS-SP3: jython, openEuler:22.03-LTS-SP4: jython, openEuler:24.03-LTS: jython

Jython is an implementation of the high-level, dynamic, object-oriented language Python seamlessly integrated with the Java platform. The predecessor to Jython, JPython, is certified as 100% Pure Java. Jython is freely available for both commercial and non-commercial use and is distributed with source code. Jython is complementary to Java and is especially suited for the following tasks: Embedded scripting - Java programmers can add the Jython libraries to their system to allow end users to write simple or complicated scripts that add functionality to the application. Interactive experimentation - Jython provides an interactive interpreter that can be used to interact with Java packages or with running Java applications. This allows programmers to experiment and debug any Java system using Jython. Rapid application development - Python programs are typically 2-10X shorter than the equivalent Java program. This translates directly to increased programmer productivity. The seamless interaction between Python and Java allows developers to freely mix the two languages both during development and in shipping products. Security Fix(es):

Python is an open source, object-oriented programming language from the Python Foundation. This language has the characteristics of scalability, supporting modules and packages, and supporting multiple platforms. There is a security vulnerability in Python that originates from the secondary complexity problem when handling specially crafted ma…

openSUSE-SU-2025:15285-1 — python310-3.10.18-3.1 on GA media

python310-3.10.18-3.1 on GA media

RHSA-2026:0414 — Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump cpython: Python HTMLParser quadratic complexity python: Quadratic complexity in os.path.expandvars() with user-controlled template cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications qs: qs: Denial of Service via improper input validation in array parsing tar: Tar path traversal firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing django: Potential partial directory-traversal via archive.extract() openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service libpng: LIBPNG buffer overflow glob: glob: Command Injection Vulnerability via Malicious Filenames libpng: LIBPNG heap buffer overflow node-forge: node-forge ASN.1 Unbounded Recursion libpng: LIBPNG out-of-bounds read in png_image_read_composite urllib3: urlli…

SUSE-SU-2025:02232-1 — Security update for python39

Security update for python39

UBUNTU-CVE-2025-6069

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:16.04:LTS: jython, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:18.04:LTS: jython, Ubuntu:Pro:18.04:LTS: python3.7 and 14 more

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.

WID-SEC-W-2025-1470 — Python (CPython): Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Python ausnutzen, um einen Denial of Service Angriff durchzuführen.