[Git][security-tracker-team/security-tracker][master] python3.15 fixed in sid

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
91b4ce94 by Moritz Muehlenhoff at 2026-10-14T16:33:09+02:00
python3.15 fixed in sid

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -21173,7 +21173,7 @@ CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP re
 	[trixie] - u-boot <no-dsa> (Minor issue)
 	NOTE: Fixed by: https://source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287ab4ee5fa (v2026.07)
 CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a race con ...)
-	- python3.15 <unfixed>
+	- python3.15 3.15.0~rc3-1
 	- python3.14 <unfixed>
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -21184,6 +21184,7 @@ CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a ra
 	[bookworm] - pypy3 <postponed> (Minor issue)
 	NOTE: https://github.com/python/cpython/issues/157579
 	NOTE: https://github.com/python/cpython/pull/157580
+	NOTE: https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970 (v3.15.0rc3)
 CVE-2026-11796 (Asset Suite allows unauthenticated users to access PropertiesReloadSer ...)
 	NOT-FOR-US: Hitachi Energy
 CVE-2026-10518 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
@@ -47567,7 +47568,7 @@ CVE-2026-87984 (An arbitrary file write vulnerability in Mistral Vibe, introduce
 CVE-2026-87983 (An arbitrary file read vulnerability in Mistral Vibe, introduced in ve ...)
 	NOT-FOR-US: Mistral Vibe
 CVE-2026-87910 (When tarfile extracts a link on a system that doesn't support links, i ...)
-	- python3.15 <unfixed>
+	- python3.15 3.15.0~rc3-1
 	- python3.14 <unfixed>
 	- python3.13 <unfixed>
 	[trixie] - python3.13 <no-dsa> (Minor issue)
@@ -47579,6 +47580,7 @@ CVE-2026-87910 (When tarfile extracts a link on a system that doesn't support li
 	NOTE: https://github.com/python/cpython/issues/157265
 	NOTE: https://github.com/python/cpython/pull/157266
 	NOTE: https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2 (main)
+	NOTE: https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5 (v3.15.0rc3)
 	NOTE: Same code situation as with CVE-2025-4435.
 CVE-2026-87859 (morgan is an HTTP request logger middleware for Node.js. In versions b ...)
 	- node-morgan 1.12.1+~1.9.10-1 (bug #1147520)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/91b4ce94f47352a05c4458f59d0cedfcdb3cf8ca

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/91b4ce94f47352a05c4458f59d0cedfcdb3cf8ca
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/f4219f9a/attachment.htm>