USN-7583-1: python3.12 Ubuntu
CVSS: UnknownPublished
Published 19-06-2025Last modified 22-04-2026
Vulnerability summary
USN-7583-1 is a vulnerability in python3.12 Ubuntu with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 5 · Downstream 0 · Related 5Timeline
- 19-06-2025PublishedVulnerability first disclosed.
- 22-04-2026Last modifiedVulnerability information updated.
Description
python3.13, python3.12 vulnerabilities It was discovered that Python incorrectly handled tar archive extraction with the filtering option. An attacker could possibly use this issue to modify files in arbitrary filesystem locations and cause data loss.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- python3.12< 3.12.3-1ubuntu0.7
1 vendor · 1 product
References
6 linksRelated vulnerabilities
USN-8744-1ubuntupython2.7+10python2.7, python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12, python3.14 vulnerabilities
It was discovered that Python's http.cookies module incorrectly handled
control characters in certain cookie operations. An attacker could possibly
use this issue to inject arbitrary content. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)
It was discovered that the Python pyexpat module was vulnerable to
unbounded recursion in the Expat XML parser. An attacker could possibly use
this issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)
It was discovered that Python's tarfile module did not correctly apply the
filter parameter when extracting hard links. An attacker could possibly use
this issue to cause files to be extracted with an unexpected uid or gid,
bypassing the restrictions requested via filter='data'. (CVE-2026-4360)
It was discovered that Python's http.cookies module incorrectly escaped
values in the js_output() method. An attacker could possibly use this issue
to inject arbitrary JavaScript. (CVE-2026-6019)
It was discovered that Python's html.parser module incorrectly handled
repeated unterminated markup declarations. An attacker could possibly use
this issue to cause Python to consume excessive CPU resources, leading to a
denial of service. (CVE-2026-15308)USN-8509-1ubuntupython3.10+2python3.10, python3.12, python3.14 vulnerabilities
It was discovered that Python incorrectly normalized paths in the tarfile
module. An attacker could possibly use this issue to bypass path
restrictions. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04
LTS. (CVE-2025-13462)
It was discovered that Python's HTMLParser incorrectly handled certain
malformed HTML input. An attacker could possibly use this issue to cause
Python to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-69534)
It was discovered that Python's email module incorrectly quoted newlines
in headers. An attacker could possibly use this issue to inject arbitrary
email headers. This issue only affected Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2026-1299)
It was discovered that Python's http.client module did not properly
sanitize carriage return and linefeed characters when handling HTTP
CONNECT tunnel request headers. An attacker could possibly use this issue
to inject arbitrary HTTP headers. (CVE-2026-1502)
It was discovered that Python's importlib module did not generate an
audit event when loading legacy .pyc files. An attacker could possibly
use this issue to bypass auditing mechanisms. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-2297)
It was discovered that Python's unicodedata.normalize() function had
incorrect algorithmic complexity. An attacker could possibly use this
issue to cause Python to consume excessive resources, leading to a denial
of service. (CVE-2026-3276)
It was discovered that Python's http.cookies module incorrectly handled
control characters in certain cookie operations. An attacker could possibly
use this issue to inject arbitrary content. This issue only affected Ubuntu
22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-3644)
It was discovered that the Python pyexpat module was vulnerable to
unbounded recursion in the Expat XML parser. An attacker could possibly use
this issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4224)
It was discovered that Python's webbrowser module accepted leading dashes
in URLs, which could be interpreted as command-line options. An attacker
could possibly use this issue to execute arbitrary commands. This issue
only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-4519)
It was discovered that Python incorrectly handled webbrowser.open()
handlers. An attacker could possibly use this issue to execute arbitrary
commands. (CVE-2026-4786)
It was discovered that Python's remote debugging module did not properly
validate offset tables when loading debug information. An attacker could
possibly use this issue to cause Python to crash or execute arbitrary
code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-5713)
It was discovered that Python's http.cookies module incorrectly escaped
values in the js_output() method. An attacker could possibly use this issue
to inject arbitrary JavaScript. (CVE-2026-6019)
It was discovered that Python's lzma, bz2, and gzip decompressor objects
had a use-after-free vulnerability. An attacker could possibly use this
issue to cause Python to crash or execute arbitrary code. (CVE-2026-6100)
It was discovered that Python's tarfile module did not properly validate
link targets when using the data filter. An attacker could possibly use
this issue to bypass path restrictions. This issue only affected Ubuntu
24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-7774)
It was discovered that the fix for CVE-2021-4189 in Python's ftplib module
was incomplete, allowing PASV responses to be used in ftplib.ftpcp(). An
attacker could possibly use this issue to perform server-side request
forgery attacks. (CVE-2026-8328)
It was discovered that Python's bz2 module allowed reuse of a
BZ2Decompressor object after a decompression error. An attacker could
possibly use this issue to cause Python to crash or execute arbitrary
code. (CVE-2026-9669)USN-8018-2ubuntupython3.10+10python3.4, python3.5, python3.6, python3.7, python3.8, python3.9,
python3.10, python3.11, python3.12, python3.13, python3.14 regression
USN-8018-1 fixed vulnerabilities in python3. That update introduced
regressions. The patches for CVE-2025-15366 and CVE-2025-15367 caused
behavior regressions in IMAP and POP3 handling, which upstream chose to
avoid by not backporting them. Additionally, the patch for CVE-2026-0865
incorrectly rejected horizontal tabs in wsgiref headers. This update fixes
these problems.
We apologize for the inconvenience.
Original advisory details:
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6,
python3.7, python3.8, python3.9, python3.10, python3.11, python3.12,
python3.13, and python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue to cause Python to use excessive
resources, leading to a denial of service. This issue only affected
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10,
python3.11, python3.12, python3.13, and python3.14 packages.
(CVE-2025-13837)
Omar Hasan discovered that Python incorrectly parsed URL mediatypes. An
attacker could possibly use this issue to inject arbitrary HTTP headers.
(CVE-2025-15282)
Omar Hasan discovered that Python incorrectly parsed malicious IMAP
inputs. An attacker could possibly use this issue to inject arbitrary
IMAP commands. (CVE-2025-15366)
Omar Hasan discovered that Python incorrectly parsed malicious POP3
inputs. An attacker could possibly use this issue to inject arbitrary
POP3 commands. (CVE-2025-15367)
Omar Hasan discovered that Python incorrectly parsed malicious HTTP cookie
headers. An attacker could possibly use this issue to inject arbitrary
HTTP headers. (CVE-2026-0672)
Omar Hasan discovered that Python incorrectly parsed malicious HTTP header
names and values. An attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2026-0865)USN-8018-1ubuntupython3.10+10python3.14, python3.13, python3.12, python3.11, python3.10, python3.9,
python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
Denis Ledoux discovered that Python incorrectly parsed email message
headers. An attacker could possibly use this issue to inject arbitrary
headers into email messages. This issue only affected python3.6, python3.7,
python3.8, python3.9, python3.10, python3.11, python3.12, python3.13, and
python3.14 packages. (CVE-2025-11468)
Jacob Walls, Shai Berger, and Natalia Bidart discovered that Python
inefficiently parsed XML input with quadratic complexity. An attacker could
possibly use this issue to cause a denial of service. (CVE-2025-12084)
It was discovered that Python incorrectly parsed malicious plist files. An
attacker could possibly use this issue to cause Python to use excessive
resources, leading to a denial of service. This issue only affected
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10,
python3.11, python3.12, python3.13, and python3.14 packages.
(CVE-2025-13837)
Omar Hasan discovered that Python incorrectly parsed URL mediatypes. An
attacker could possibly use this issue to inject arbitrary HTTP headers.
(CVE-2025-15282)
Omar Hasan discovered that Python incorrectly parsed malicious IMAP inputs.
An attacker could possibly use this issue to inject arbitrary IMAP
commands. (CVE-2025-15366)
Omar Hasan discovered that Python incorrectly parsed malicious POP3 inputs.
An attacker could possibly use this issue to inject arbitrary POP3
commands. (CVE-2025-15367)
Omar Hasan discovered that Python incorrectly parsed malicious HTTP cookie
headers. An attacker could possibly use this issue to inject arbitrary HTTP
headers. (CVE-2026-0672)
Omar Hasan discovered that Python incorrectly parsed malicious HTTP header
names and values. An attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2026-0865)USN-7886-1ubuntupython3.10+8python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
It was discovered that Python inefficiently handled expanding system
environment variables. An attacker could possibly use this issue to cause
Python to consume excessive resources, leading to a denial of service.
(CVE-2025-6075)
Caleb Brown discovered that Python incorrectly handled the ZIP64 End of
Central Directory (EOCD) Locator record offset value. An attacker could
possibly use this issue to obfuscate malicious content. (CVE-2025-8291)USN-7710-1ubuntupython3.10+8python3.13, python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities
It was discovered that Python inefficiently parsed maliciously crafted HTML
input. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-6069)
It was discovered that Python incorrectly parsed maliciously crafted Tar
archives. An attacker could possibly use this issue to cause a denial of
service. (CVE-2025-8194)