python3.5 (3.5.2-2ubuntu0~16.04.1) xenial-security; urgency=medium

  * SECURITY UPDATE: use of HTTP_PROXY flag supplied by attacker in CGI
    scripts (aka HTTPOXY attack)
    - debian/patches/CVE-2016-1000110.patch: if running as CGI
      script, forget HTTP_PROXY in Lib/, add test to
      Lib/test/, add documentation.
    - CVE-2016-1000110
  * NOTE: backport of 3.5.2 to Ubuntu 16.04 LTS also addresses:
    - CVE-2016-0772: StartTLS stripping attack
    - CVE-2016-5636: Integer overflow when handling zipfiles

Date: 2016-11-17 18:39:17.355593+00:00
Changed-By: Steve Beattie <>
Sorry, changesfile not available.
Xenial-changes mailing list
Modify settings or unsubscribe at:

Reply via email to