Alerts This Week
Warning Icon 1 537
Alerts This Week
Warning Icon 1 537

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":548,"type":"x","order":1,"pct":78.51,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.3,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.87,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.32,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -2 articles for you...
89

Fedora 43 pypy3.10 Critical Security Fix CVE-2025-56005

Security fix for CVE-2025-56005 for the bundled ply within the bundled pycparser. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-98502d7938 2026-03-29 00:48:39.566739+00:00 -------------------------------------------------------------------------------- Name : pypy3.10 Product : Fedora 43 Version : 7.3.19 Release : 11.3.10.fc43 URL : https://pypy.org/ Summary : Python 3.10 implementation with a Just-In-Time compiler Description : PyPy's implementation of Python 3.10, featuring a Just-In-Time compiler on some CPU architectures, and various optimized implementations of the standard types (strings, dictionaries, etc.). This build of PyPy has JIT-compilation enabled. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2025-56005 for the bundled ply within the bundled pycparser -------------------------------------------------------------------------------- ChangeLog: * Thu Mar 19 2026 Charalampos Stratakis - 7.3.19-11 - Security fix for CVE-2025-56005 for the bundled ply within the bundled pycparser - Fixes: rhbz#2431977 * Sat Jan 17 2026 Fedora Release Engineering - 7.3.19-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild * Wed Jan 7 2026 Miro Hron\u010dok - 7.3.19-9 - Enable JIT on riscv64 * Tue Jan 6 2026 Miro Hron\u010dok - 7.3.19-8 - Inject SBOM into the installed wheels (when using the bundled ones) * Thu Aug 14 2025 Miro Hron\u010dok - 7.3.19-5 - Don't use the gold linker - https://fedoraproject.org/wiki/Changes/DeprecateGoldLinker -------------------------------------------------------------------------------- References: [ 1 ] Bug #2431977 - CVE-2025-56005 pypy3.10: From CVEorg collector [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2431977 -------------------------------------------------------------------------------- This update can be installed with the "dnf" updateprogram. Use su -c 'dnf upgrade --advisory FEDORA-2026-98502d7938' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- . CVE-2025-56005 affects the bundled ply in PyPy 3.10. This advisory details the importance of the security update.. Fedora Update,CVE Fix,Pypy3 Security. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Mar 29, 2026 Important Fedora
197

Debian 11: DLA-3966-1 critical: pypy3 multiple security issues

Multiple vulnerabilities have been fixed in pypy3, an alternative implementation of the Python 3.x language. CVE-2020-10735 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3966-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Andrej Shadura November 26, 2024 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : pypy3 Version : 7.3.5+dfsg-2+deb11u4 CVE ID : CVE-2020-10735 CVE-2020-29651 CVE-2021-3737 CVE-2021-28861 CVE-2022-0391 CVE-2022-45061 CVE-2023-27043 CVE-2024-9287 Multiple vulnerabilities have been fixed in pypy3, an alternative implementation of the Python 3.x language. CVE-2020-10735 A flaw was found in Python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. CVE-2020-29651 A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality. python-py is a part of the pypy3 distribution. CVE-2021-3737 A flaw was found in Python. An improperly handled HTTP response in the HTTP client code of Python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability. CVE-2021-28861 Python has an open redirection vulnerability in lib/http/server.py due to no protection against multiple(/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." CVE-2022-0391 A flaw was found in Python within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. CVE-2022-45061 An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. CVE-2023-27043 The email module of Python incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py. CVE-2024-9287 A vulnerability has been found in the `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.v For Debian 11 bullseye, these problems have been fixed in version 7.3.5+dfsg-2+deb11u4. We recommend that you upgrade your pypy3 packages. For the detailed security status of pypy3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/pypy3 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The Debian LTS Advisory DLA-3966-2 covers various security flaws found in pypy3, such as potential denial of service and additional risks.. Debian LTS, pypy3 security, software vulnerabilities, system updates. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Nov 26, 2024 Critical Debian LTS
197

Debian 11 Bullseye DLA-3948-1 Critical: pypy3 Permissions Issue

Brief introduction CVE-2023-6597 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3948-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Andrej Shadura November 07, 2024 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : pypy3 Version : 7.3.5+dfsg-2+deb11u3 CVE ID : CVE-2023-6597 CVE-2023-24329 CVE-2023-40217 CVE-2024-0450 Debian Bug : Brief introduction CVE-2023-6597 An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can run privileged programs are potentially able to modify permissions of files referenced by symlinks in some circumstances. CVE-2023-24329 An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-40217 An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) CVE-2024-0450 An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive. For Debian 11 bullseye, these problems have been fixed in version 7.3.5+dfsg-2+deb11u3. We recommend that you upgrade your pypy3 packages. For the detailed security status of pypy3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/pypy3 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS Advisory DLA-3949-1 highlights vulnerabilities in python3, which have implications for several CVE entries.. Debian Security Advisory,pypy3 update,Critical Threats,Permissions Issues. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Nov 07, 2024 Critical Debian LTS
91

Gentoo: GLSA-202405-01 High: Python And PyPy3 Privilege Escalation

Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202405-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Python, PyPy3: Multiple Vulnerabilities Date: May 04, 2024 Bugs: #884653, #897958, #908018, #912976, #919475, #927299 ID: 202405-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. Background ========== Python is an interpreted, interactive, object-oriented, cross-platform programming language. Affected packages ================= Package Vulnerable Unaffected ------------------- -------------- --------------- dev-lang/python < 3.10.14:3.10 > = 3.10.14:3.10 < 3.11.8:3.11 > = 3.11.8:3.11 < 3.12.1:3.12 > = 3.12.1:3.12 < 3.8.19:3.8 > = 3.8.19:3.8 < 3.9.19:3.9 > = 3.9.19:3.9 dev-python/pypy3 < 7.3.16 > = 7.3.16 dev-python/pypy3_10 < 7.3.16 > = 7.3.16 dev-python/pypy3_9 < 7.3.16 > = 7.3.16 Description =========== Multiple vulnerabilities have been discovered in Python, PyPy3. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Python, PyPy3 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-lang/python-3.12.1:3.12" # emerge --ask --oneshot --verbose ">=dev-lang/python-3.11.9:3.11" # emerge --ask --oneshot --verbose "> =dev-lang/python-3.10.14:3.10" # emerge --ask --oneshot --verbose "> =dev-lang/python-3.9.19:3.9" # emerge --ask --oneshot --verbose "> =dev-lang/python-3.8.19:3.8" # emerge --ask --oneshot --verbose "> =dev-python/pypy3-7.3.16" # emerge --ask --oneshot --verbose "> =dev-python/pypy3_10-7.3.16" # emerge --ask --oneshot --verbose "> =dev-python/pypy3_9-7.3.16" References ========== [ 1 ] CVE-2023-6507 https://nvd.nist.gov/vuln/detail/CVE-2023-6507 [ 2 ] CVE-2023-6597 https://nvd.nist.gov/vuln/detail/CVE-2023-6597 [ 3 ] CVE-2023-24329 https://nvd.nist.gov/vuln/detail/CVE-2023-24329 [ 4 ] CVE-2023-40217 https://nvd.nist.gov/vuln/detail/CVE-2023-40217 [ 5 ] CVE-2023-41105 https://nvd.nist.gov/vuln/detail/CVE-2023-41105 [ 6 ] CVE-2024-0450 https://nvd.nist.gov/vuln/detail/CVE-2024-0450 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202405-01 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . Several weaknesses identified in Python and PyPy3 present significant dangers, among which is the potential for privilege escalation. Update recommended.. python security,pypy3 threats,gentoo advisory. . LinuxSecurity.com Team

Calendar 2 May 04, 2024 Gentoo
89

Fedora 38: FEDORA-2023-81bb8e3b99 Critical: pypy3 URL Bypass

Security fix for CVE-2023-24329. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-81bb8e3b99 2023-05-31 17:29:34.390134 --------------------------------------------------------------------------------Name : pypy3.9 Product : Fedora 38 Version : 7.3.11 Release : 4.3.9.fc38 URL : https://pypy.org/ Summary : Python 3.9 implementation with a Just-In-Time compiler Description : PyPy's implementation of Python 3.9, featuring a Just-In-Time compiler on some CPU architectures, and various optimized implementations of the standard types (strings, dictionaries, etc.). This build of PyPy has JIT-compilation enabled. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2023-24329 --------------------------------------------------------------------------------ChangeLog: * Mon May 29 2023 Charalampos Stratakis - 7.3.11-4.3.9 - Security fix for CVE-2023-24329 Resolves: rhbz#2174020 --------------------------------------------------------------------------------References: [ 1 ] Bug #2174020 - CVE-2023-24329 pypy3.9: python: urllib.parse url blocklisting bypass [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2174020 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-81bb8e3b99' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . Ubuntu 22.10 introduces a patch for Python 3.10 patch addressing critical vulnerability in file handling. Upgrade today for enhanced protection.. Fedora Security, PyPy3 Update, Python JIT, Security Advisory, Security Fix. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 May 31, 2023 Critical Fedora
87

Debian Bullseye DSA-5269-1 pypy3 Critical: Buffer Overflow Fix

Nicky Mouha discovered a buffer overflow in the sha3 module of PyPy, a fast, compliant alternative implementation of the Python language. For the stable distribution (bullseye), this problem has been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5269-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff November 02, 2022 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : pypy3 CVE ID : CVE-2022-37454 Nicky Mouha discovered a buffer overflow in the sha3 module of PyPy, a fast, compliant alternative implementation of the Python language. For the stable distribution (bullseye), this problem has been fixed in version 7.3.5+dfsg-2+deb11u2. We recommend that you upgrade your pypy3 packages. For the detailed security status of pypy3 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/pypy3 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . A critical vulnerability in the sha3 component of PyPy has been addressed for Debian bullseye. It is recommended to update the pypy3 packages immediately.. Debian Security Advisory,pypy3 security,buffer overflow,software update. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Nov 02, 2022 Critical Debian
89

Fedora 36: Moderate pypy3.7 Security Patch for CVE-2015-20107 Released

Security fix for CVE-2015-20107. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-20e87fb0d1 2022-07-08 01:15:45.190384 --------------------------------------------------------------------------------Name : pypy3.7 Product : Fedora 36 Version : 7.3.9 Release : 2.3.7.fc36 URL : https://pypy.org/ Summary : Python 3.7 implementation with a Just-In-Time compiler Description : PyPy's implementation of Python 3.7, featuring a Just-In-Time compiler on some CPU architectures, and various optimized implementations of the standard types (strings, dictionaries, etc.). This build of PyPy has JIT-compilation enabled. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2015-20107 --------------------------------------------------------------------------------ChangeLog: * Tue Jun 28 2022 Charalampos Stratakis - 7.3.9-2.3.7 - Security fix for CVE-2015-20107 - Fixes: rhbz#2075390 --------------------------------------------------------------------------------References: [ 1 ] Bug #2076530 - CVE-2015-20107 pypy3.7: python(mailcap): findmatch() function does not sanitise the second argument [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2076530 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-20e87fb0d1' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure . Safety patch issued for Fedora 36 targeting CVE-2015-20107 in the PyPy 3.7 framework to enhance system integrity.. Fedora Update, PyPy Security, Python Implementation. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Jul 07, 2022 Important Fedora
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":548,"type":"x","order":1,"pct":78.51,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.3,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.87,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.32,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here