An update that solves two vulnerabilities can now be installed.. # Security update for python36 Announcement ID: SUSE-SU-2025:4487-1 Release Date: 2025-12-18T14:44:31Z Rating: low References: * bsc#1251305 * bsc#1252974 Cross-References: * CVE-2025-6075 * CVE-2025-8291 CVSS scores: * CVE-2025-6075 ( SUSE ): 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-6075 ( SUSE ): 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2025-6075 ( NVD ): 1.8 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2025-8291 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-8291 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2025-8291 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for python36 fixes the following issues: * CVE-2025-6075: quadratic complexity in `os.path.expandvars()` can lead to performance degradation when values passed to it are user-controlled (bsc#1252974). * CVE-2025-8291: lack of validity checks on the ZIP64 End of Central Directory (EOCD) record allows for the creation of ZIP archives that are processed inconsistently by the `zipfile` module (bsc#1251305). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 12 SP5 LTSSExtended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-4487=1 ## Package List: * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * python36-debugsource-3.6.15-94.1 * libpython3_6m1_0-debuginfo-3.6.15-94.1 * python36-debuginfo-3.6.15-94.1 * python36-3.6.15-94.1 * libpython3_6m1_0-3.6.15-94.1 * python36-devel-3.6.15-94.1 * libpython3_6m1_0-debuginfo-32bit-3.6.15-94.1 * libpython3_6m1_0-32bit-3.6.15-94.1 * python36-base-debuginfo-3.6.15-94.1 * python36-base-3.6.15-94.1 ## References: * https://www.suse.com/security/cve/CVE-2025-6075.html * https://www.suse.com/security/cve/CVE-2025-8291.html * https://bugzilla.suse.com/show_bug.cgi?id=1251305 * https://bugzilla.suse.com/show_bug.cgi?id=1252974 . A low-severity security update for python36 on SUSE addresses two vulnerabilities affecting performance and ZIP file processing.. python36 update SUSE vulnerability performance. . Severity: Low. LinuxSecurity.com Team
**Version 1.13.5** - Fixed bug php#72660 (NULL Pointer dereference in zend_virtual_cwd). (Laruence) - Fixed bug php#68302 (impossible to compile php with zip support). (cmb) - Fixed bug php#70752 (Depacking with wrong password leaves 0 length files). (cmb). -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-ea58a428a1 2016-10-18 11:24:07.148485 -------------------------------------------------------------------------------- Name : php-pecl-zip Product : Fedora 25 Version : 1.13.5 Release : 1.fc25 URL : Summary : A ZIP archive management extension Description : Zip is an extension to create and read zip files. -------------------------------------------------------------------------------- Update Information: **Version 1.13.5** - Fixed bug php#72660 (NULL Pointer dereference in zend_virtual_cwd). (Laruence) - Fixed bug php#68302 (impossible to compile php with zip support). (cmb) - Fixed bug php#70752 (Depacking with wrong password leaves 0 length files). (cmb) -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-pecl-zip' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Security fix for CVE-2015-2331.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-4559 2015-03-26 16:38:47 -------------------------------------------------------------------------------- Name : mingw-libzip Product : Fedora 22 Version : 0.11.2 Release : 3.fc22 URL : https://libzip.org/ Summary : C library for reading, creating, and modifying zip archives Description : libzip is a C library for reading, creating, and modifying zip archives. Files can be added from data buffers, files, or compressed data copied directly from other zip archives. Changes made without closing the archive can be reverted. The API is documented by man pages. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2015-2331. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1204676 - CVE-2015-2331 php: libzip: integer overflow when processing ZIP archives https://bugzilla.redhat.com/show_bug.cgi?id=1204676 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update mingw-libzip' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Get the latest Linux and open source security news straight to your inbox.