Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

openSUSE Python312 Security Update Highlights Path Traversal Issue

opensuse
Calendar Grey April 13, 2026
Dist Opensuse Esm H88
Update for python312 fixes five issues including path traversal and C stack overflow vulnerabilities in openSUSE.
An update that solves five vulnerabilities can now be installed.

Description

This update for python312 fixes the following issues:

* CVE-2025-13462: incorrect parsing of TarInfo when GNU long name and type

AREGTYPE are combined can lead to misinterpretation of tar archives

(bsc#1259611).

* CVE-2026-3479: improper resource argument validation in `pkgutil.get_data()`

can lead to path traversal (bsc#1259989).

* CVE-2026-3644: incomplete control character validation in http.cookies can

lead to input validation bypass (bsc#1259734).

* CVE-2026-4224: parsing XML with deeply nested DTD content models can lead to

C stack overflow (bsc#1259735).

* CVE-2026-4519: failure to sanitize leading dashes in URLs in the

`webbrowser.open()` API can lead to web browser command line option

injection (bsc#1260026).

Topics%20covered

Topics Covered

security advisory important input validation path traversal OpenSUSE c stack overflow

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6

zypper in -t patch SUSE-2026-1292=1 openSUSE-SLE-15.6-2026-1292=1

* SUSE Linux Enterprise Server 15 SP6 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1292=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1292=1

Package List

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)

* python312-core-debugsource-3.12.13-150600.3.53.1

* python312-tk-debuginfo-3.12.13-150600.3.53.1

* python312-curses-debuginfo-3.12.13-150600.3.53.1

* python312-tools-3.12.13-150600.3.53.1

* libpython3_12-1_0-debuginfo-3.12.13-150600.3.53.1

* python312-base-3.12.13-150600.3.53.1

* python312-devel-3.12.13-150600.3.53.1

* python312-dbm-debuginfo-3.12.13-150600.3.53.1

* python312-base-debuginfo-3.12.13-150600.3.53.1

* python312-debugsource-3.12.13-150600.3.53.1

* python312-3.12.13-150600.3.53.1

* python312-debuginfo-3.12.13-150600.3.53.1

* python312-dbm-3.12.13-150600.3.53.1

* python312-doc-3.12.13-150600.3.53.1

* python312-testsuite-3.12.13-150600.3.53.1

* python312-testsuite-debuginfo-3.12.13-150600.3.53.1

* python312-idle-3.12.13-150600.3.53.1

* python312-tk-3.12.13-150600.3.53.1

* python312-doc-devhelp-3.12.13-150600.3.53.1

* python312-curses-3.12.13-150600.3.53.1

* libpython3_12-1_0-3.12.13-150600.3.53.1

* openSUSE Leap 15.6 (x86_64)

*...

Read the Full Advisory

References

* bsc#1259611

* bsc#1259734

* bsc#1259735

* bsc#1259989

* bsc#1260026

## References:

* https://www.suse.com/security/cve/CVE-2025-13462.html

* https://www.suse.com/security/cve/CVE-2026-3479.html

* https://www.suse.com/security/cve/CVE-2026-3644.html

* https://www.suse.com/security/cve/CVE-2026-4224.html

* https://www.suse.com/security/cve/CVE-2026-4519.html

* https://bugzilla.suse.com/show_bug.cgi?id=1259611

* https://bugzilla.suse.com/show_bug.cgi?id=1259734

* https://bugzilla.suse.com/show_bug.cgi?id=1259735

* https://bugzilla.suse.com/show_bug.cgi?id=1259989

* https://bugzilla.suse.com/show_bug.cgi?id=1260026

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:1292-1
Release Date: 2026-04-13T08:10:53Z
Affected Products: * openSUSE Leap 15.6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server for SAP Applications 15 SP6

Topics%20covered

Topics Covered

security advisory important input validation path traversal OpenSUSE c stack overflow

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here