Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
114f9a77 by Salvatore Bonaccorso at 2025-09-29T22:00:11+02:00
Track fixed version for some pypy3 issues with unstable upload
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -38188,7 +38188,7 @@ CVE-2025-4517 (Allows arbitrary filesystem writes
outside the extraction directo
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17,
but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
[experimental] - pypy3 7.3.20+dfsg-1
- - pypy3 <unfixed>
+ - pypy3 7.3.20+dfsg-2
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <no-dsa> (Minor issue)
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
@@ -38211,7 +38211,7 @@ CVE-2025-4435 (When using a TarFile.errorlevel = 0and
extracting with a filter t
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17,
but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
[experimental] - pypy3 7.3.20+dfsg-1
- - pypy3 <unfixed>
+ - pypy3 7.3.20+dfsg-2
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <no-dsa> (Minor issue)
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
@@ -38237,7 +38237,7 @@ CVE-2025-4330 (Allows the extraction filter to be
ignored, allowing symlink targ
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17,
but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
[experimental] - pypy3 7.3.20+dfsg-1
- - pypy3 <unfixed>
+ - pypy3 7.3.20+dfsg-2
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <no-dsa> (Minor issue)
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
@@ -38261,7 +38261,7 @@ CVE-2025-4138 (Allows the extraction filter to be
ignored, allowing symlink targ
- python3.9 <not-affected> (Vulnerable code got backported to 3.9.17,
but dropped from sid with 3.9.13)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
[experimental] - pypy3 7.3.20+dfsg-1
- - pypy3 <unfixed>
+ - pypy3 7.3.20+dfsg-2
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <no-dsa> (Minor issue)
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
@@ -38370,7 +38370,7 @@ CVE-2024-12718 (Allows modifying some file metadata
(e.g. last modified) with fi
- python3.9 <not-affected> (Vulnerable code introduced in 3.12)
- python2.7 <not-affected> (Vulnerable code introduced in 3.12)
[experimental] - pypy3 7.3.20+dfsg-1
- - pypy3 <unfixed>
+ - pypy3 7.3.20+dfsg-2
[trixie] - pypy3 <no-dsa> (Minor issue)
[bookworm] - pypy3 <no-dsa> (Minor issue)
[bullseye] - pypy3 <not-affected> (Vulnerable code backported down to
stdlib-3.9.17; embedding 3.6.9)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/114f9a77191039eb562e53ec38e87ab0c239a5f8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/114f9a77191039eb562e53ec38e87ab0c239a5f8
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
