Update to python-3.11.15, backport fixes for CVE-2026-4519, CVE-2026-3644, CVE-2026-4224, CVE-2026-2297 Update to python-3.11.15.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-3d13d52f58 2026-04-25 01:21:36.171100+00:00 -------------------------------------------------------------------------------- Name : mingw-python3 Product : Fedora 44 Version : 3.11.15 Release : 2.fc44 URL : https://www.python.org/ Summary : MinGW Windows python3 Description : MinGW Windows python3 -------------------------------------------------------------------------------- Update Information: Update to python-3.11.15, backport fixes for CVE-2026-4519, CVE-2026-3644, CVE-2026-4224, CVE-2026-2297 Update to python-3.11.15. -------------------------------------------------------------------------------- ChangeLog: * Fri Mar 27 2026 Sandro Mani - 3.11.15-2 - Backport fixes for CVE-2026-4519, CVE-2026-3644, CVE-2026-4224 * Fri Mar 27 2026 Sandro Mani - 3.11.15-1 - Update to 3.11.15 - Backport fix for CVE-2026-2297 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2444702 - CVE-2026-2297 mingw-python3: CPython: Logging Bypass in Legacy .pyc File Handling [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2444702 [ 2 ] Bug #2448186 - CVE-2026-3644 mingw-python3: Incomplete control character validation in http.cookies [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2448186 [ 3 ] Bug #2448202 - CVE-2026-4224 mingw-python3: Stack overflow parsing XML with deeply nested DTD content models [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2448202 [ 4 ] Bug #2449725 - CVE-2026-4519 mingw-python3: Python: Command-line option injection in webbrowser.open() via crafted URLs [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2449725 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3d13d52f58' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
An update that solves five vulnerabilities can now be installed.. # Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP4) Announcement ID: SUSE-SU-2025:3712-1 Release Date: 2025-10-22T05:39:43Z Rating: important References: * bsc#1245794 * bsc#1246075 * bsc#1248673 * bsc#1248749 * bsc#1249534 Cross-References: * CVE-2025-21971 * CVE-2025-38206 * CVE-2025-38499 * CVE-2025-38644 * CVE-2025-38678 CVSS scores: * CVE-2025-21971 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-21971 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2025-38206 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-38206 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2025-38499 ( SUSE ): 6.2 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H * CVE-2025-38499 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H * CVE-2025-38644 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-38644 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2025-38678 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves five vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_170 fixes several issues. The following security issues were fixed: * CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249534). * CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the rightuserns (bsc#1248673). * CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1245794). * CVE-2025-38644: wifi: mac80211: reject TDLS operations when station is not associated (bsc#1248749). * CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246075). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-3713=1 SUSE-2025-3710=1 SUSE-2025-3711=1 SUSE-2025-3712=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2025-3712=1 SUSE-SLE- Module-Live-Patching-15-SP4-2025-3713=1 SUSE-SLE-Module-Live- Patching-15-SP4-2025-3710=1 SUSE-SLE-Module-Live-Patching-15-SP4-2025-3711=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_170-default-debuginfo-6-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_42-debugsource-6-150400.2.1 * kernel-livepatch-5_14_21-150400_24_147-default-14-150400.2.1 * kernel-livepatch-5_14_21-150400_24_170-default-6-150400.2.1 * kernel-livepatch-5_14_21-150400_24_150-default-debuginfo-9-150400.2.1 * kernel-livepatch-5_14_21-150400_24_147-default-debuginfo-14-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_35-debugsource-14-150400.2.1 * kernel-livepatch-5_14_21-150400_24_164-default-8-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_40-debugsource-8-150400.2.1 * kernel-livepatch-5_14_21-150400_24_150-default-9-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_36-debugsource-9-150400.2.1 * kernel-livepatch-5_14_21-150400_24_164-default-debuginfo-8-150400.2.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_170-default-debuginfo-6-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_42-debugsource-6-150400.2.1 *kernel-livepatch-5_14_21-150400_24_147-default-14-150400.2.1 * kernel-livepatch-5_14_21-150400_24_170-default-6-150400.2.1 * kernel-livepatch-5_14_21-150400_24_150-default-debuginfo-9-150400.2.1 * kernel-livepatch-5_14_21-150400_24_147-default-debuginfo-14-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_35-debugsource-14-150400.2.1 * kernel-livepatch-5_14_21-150400_24_164-default-8-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_40-debugsource-8-150400.2.1 * kernel-livepatch-5_14_21-150400_24_150-default-9-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_36-debugsource-9-150400.2.1 * kernel-livepatch-5_14_21-150400_24_164-default-debuginfo-8-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2025-21971.html * https://www.suse.com/security/cve/CVE-2025-38206.html * https://www.suse.com/security/cve/CVE-2025-38499.html * https://www.suse.com/security/cve/CVE-2025-38644.html * https://www.suse.com/security/cve/CVE-2025-38678.html * https://bugzilla.suse.com/show_bug.cgi?id=1245794 * https://bugzilla.suse.com/show_bug.cgi?id=1246075 * https://bugzilla.suse.com/show_bug.cgi?id=1248673 * https://bugzilla.suse.com/show_bug.cgi?id=1248749 * https://bugzilla.suse.com/show_bug.cgi?id=1249534 . This security advisory covers critical openSUSE kernel updates addressing five important vulnerabilities.. openSUSE kernel vulnerabilities important patch security update advisory. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.