Security update for python3, python3-base, python3-doc
This update for python3, python3-base, python3-doc fixes the following issues:
Security issues fixed:
- CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high
CPU usage (bsc#1273148).
- CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974).
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2
This update for python3 fixes the following issues:
- CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the
`configparser` module is used (bsc#1269066).
- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously
crafted wheel archives (bsc#1257599).
- CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467).
- CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted
Unicode input (bsc#1267581).
- CVE-2026-4360: in the Tarfile.extract() function, t
This update for python3 fixes the following issues:
- CVE-2026-7210: insufficient entropy used for Expat hash-flooding protection allows a crafted XML document to trigger
hash flooding (bsc#1264962).
- CVE-2026-8328: server-supplied PASV host address is trusted by `ftpcp()` and allows for SSRF (bsc#1265268).
- CVE-2026-11940: tarfile extraction filter bypass via a crafted archive allows escaping the destination directory and
enables arbitrary file reads and writes (bsc#1268977).
This update for python3 fixes the following issues:
- CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611).
- CVE-2026-3479: improper resource argument validation can allow path traversal (bsc#1259989).
- CVE-2026-3644: incomplete control character validation in http.cookies (bsc#1259734).
- CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735).
- CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command
line option injection (bsc#1260026).
This update for python3 fixes the following issues:
- CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).
This update for python3 fixes the following issues:
- CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable
characters (bsc#1257029).
- CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel
(bsc#1257031).
- CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
- CV
This update for python3 fixes the following issues:
Security fixes:
- CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction
with filter='data' (bsc#1244032)
- CVE-2025-4330: Fixed extraction filter bypass for linking outside extraction directory (bsc#1244060)
- CVE-2007-4559: Fixed python tarfile module directory traversal (bsc#1203750)
- CVE-2024-12718: Fixed bypass extraction filter to modify file metadata outside extraction directory
(bsc#1244056)
- CVE-2025-4138: Fixed symlinking targets to not point outside the destination directory, and the modification
of some file metadata (bsc#