SUSE-SU-2026:4743-1: python36-core&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4743-1 is a vulnerability in python36-core&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 19-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for python36 This update for python36 fixes the following issues: Security issues fixed: - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1274743). - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429). - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970). - CVE-2026-3479: python: improper resource argument validation can allow path traversal (bsc#1259989). - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735). - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-13346: Arbitrary file installation via malicious package indexes (bsc#1273090 bsc#1273091 bsc#1273094). - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227). - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459). Non security issue fixed: - Update bundled setuptools wheels to setuptools-44.1.1-py2.py3-none-any.whl (bsc#1277271)

No weakness data has been published for this record.