Security update for python3
This update for python3 fixes the following issues: - CVE-2025-8194: Fixed denial of service caused by tar archives with negative offsets (bsc#1247249).
- Update to 3.6.15-150000.3.185.2
Published Updated
PatchFirst · Latest vulnerabilities
python3 vulnerabilities
Vulnerabilities published for python3 in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 23
Security update for python3
This update for python3 fixes the following issues: - CVE-2024-12718: Fixed extraction filter bypass that allowed file metadata modification outside extraction directory (bsc#1244056) - CVE-2025-4138: Fixed issue that might allow symlink targets to point outside the destination directory, and the modification of some file metadata (bsc#1244059) - CVE-2025-4330: Fixed extraction filter bypass that allowed linking outside extraction directory (bsc#1244060) - CVE-2025-4435: Fixed Tarfile extracts filtered members when errorlevel=0 (bsc#1244061) - CVE-2025-4517: Fixed arbitrary filesystem writes outside the extraction directory during extraction
- Update to 3.6.15-150000.3.182.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2025-4516: CPython DecodeError Handling Vulnerability (bsc#1243273) Other fixes: - Add python36-* provides/obsoletes to enable SLE-12 -> SLE-15 migration (bsc#1233012) - Update vendored ipaddress module to 3.8 equivalent - Limit buffer size for IPv6 address parsing (bsc#1244401).
- Update to 3.6.15-150000.3.179.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2025-4516: use-after-free in the unicode-escape decoder when using the error handler (bsc#1243273).
- Update to 3.6.15-150000.3.176.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307).
- Update to 3.6.15-150000.3.173.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse. (bsc#1236705)
- Update to 3.6.15-150000.3.170.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses (bsc#1233307) Other fixes: - Remove -IVendor/ from python-config (bsc#1231795)
- Update to 3.6.15-150000.3.167.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: Security fixes: - CVE-2024-9287: properly quote path names provided when creating a virtual environment (bsc#1232241) Other fixes: - Drop .pyc files from docdir for reproducible builds (bsc#1230906)
- Update to 3.6.15-150000.3.164.1
Published UpdatedSecurity update for python36
This update for python36 fixes the following issues: - CVE-2024-6232: excessive backtracking when parsing tarfile headers leads to ReDoS. (bsc#1230227)
- Update to 3.6.15-150000.3.161.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2024-5642: buffer overread when NPN is used and invalid values are sent to the OpenSSL API. (bsc#1227233)
- Update to 3.6.15-150000.3.158.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2024-6923: Fixed uncontrolled CPU resource consumption when in http.cookies module (bsc#1228780). - CVE-2024-7592: Fixed Email header injection due to unquoted newlines (bsc#1229596) Bug fixes: - %{profileopt} variable is set according to the variable %{do_profiling} (bsc#1227999) - Stop using %%defattr, it seems to be breaking proper executable attributes on /usr/bin/ scripts (bsc#1227378). - Remove %suse_update_desktop_file macro as it is not useful any more.
- Update to 3.6.15-150000.3.155.2
Published UpdatedSecurity update for python39
This update for python39 fixes the following issues: - CVE-2024-4032: Rearranging definition of private v global IP. (bsc#1226448) - CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. (bsc#1226447)
- Update to 3.6.15-150000.3.150.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2023-52425: Fixed backport so it uses features sniffing, not just comparing version number (bsc#1219559). - CVE-2024-0450: Fixed detecting the vulnerability of 'quoted-overlap' zipbomb (bsc#1221854).
- Update to 3.6.15-150000.3.147.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666).
- Update to 3.6.15-150000.3.141.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character (bsc#1210638). - CVE-2022-48566: Use CRYPTO_memcmp() for compare_digest (bsc#1214691).
- Update to 3.6.15-150000.3.138.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2023-40217: Fixed TLS handshake bypass on closed sockets (bsc#1214692).
- Update to 3.6.15-150000.3.135.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2007-4559: Fixed filter for tarfile.extractall (bsc#1203750). - Fixed unittest.mock.patch.dict returns function when applied to coroutines (bsc#1211158).
- Update to 3.6.15-150000.3.132.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471). The following non-security bugs were fixed: - Fixed a crash in the garbage collection (bsc#1188607) - Fixed email.generator.py to not replace a non-existent header (bsc#1208443, gh#python/cpython#71508).
- Update to 3.6.15-150000.3.124.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2022-45061: Fixed possible DoS when IDNA decoding extremely long domain names (bsc#1205244).
- Update to 3.6.15-150000.3.119.1
Published UpdatedSecurity update for python3
This update for python3 fixes the following issues: - CVE-2022-37454: Fixed a buffer overflow in hashlib.sha3_* implementations. (bsc#1204577) - CVE-2020-10735: Fixed a bug to limit amount of digits converting text to int and vice vera. (bsc#1203125)
- Update to 3.6.15-150000.3.116.1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.