mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-29 22:17:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

python3: fix CVE-2026-9669

Browse Source 
bz2.BZ2Decompressor objects could be reused after a decompression error.
If an application caught the resulting OSError and retried with the same
decompressor, crafted input could cause the decompressor to resume from an
invalid internal state and perform out-of-bounds writes to a stack buffer.
This could crash the process when processing untrusted data.

This CVE has a CVSS 4.0 score of 8.2. The patch (5755d0f08394) is
referenced in the CVEList database.

(From OE-Core rev: 226831c16d13133e89d3405b5e2298bb6571bed6)

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Benjamin Robin (Schneider Electric)
2026-07-20 10:01:03 +02:00
committed by Paul Barker
parent 96f1bb2af7
commit 0c2fa146c5
2 changed files with 97 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/python/python3_3.12.13.bb
View File

@@ -46,6 +46,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://CVE-2026-4224.patch \
file://CVE-2026-11940.patch \
file://CVE-2026-11972.patch \
file://CVE-2026-9669.patch \
"
SRC_URI:append:class-native = " \