Search for packages
| purl | pkg:deb/debian/python3.9@3.9.2-1?distro=bullseye |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1hw3-vhwb-nkcd | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2024-12718
|
| VCID-1uk5-6yqb-dyb5 | cpython: Out-of-memory when loading Plist |
CVE-2025-13837
|
| VCID-2czu-wy37-qugf | python: constant-time-defeating optimisations issue in the compare_digest function in Lib/hmac.p |
CVE-2022-48566
|
| VCID-2j3t-a3r6-vfg7 | Multiple vulnerabilities have been found in Python, the worst of which might allow attackers to access sensitive information. |
CVE-2021-3426
|
| VCID-2shb-2cvn-dyd2 | Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. |
CVE-2023-24329
|
| VCID-2v5u-2z4w-ffgx | python: incorrect IPv4 and IPv6 private ranges |
CVE-2024-4032
|
| VCID-39e1-7qrc-53av | cpython: IMAP command injection in user-controlled commands |
CVE-2025-15366
|
| VCID-4afh-28ss-mudf | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2025-4138
|
| VCID-4gsg-5e6s-63g4 | Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution. |
CVE-2021-28861
|
| VCID-4pej-k4vs-j3d2 | python: sys.path allowing code to be loaded from arbitrary locations |
CVE-2020-15801
|
| VCID-4q79-666d-rygx | python: XML External Entity in XML processing plistlib module |
CVE-2022-48565
|
| VCID-4z89-3tfk-pyge | Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. |
CVE-2023-40217
|
| VCID-5maz-1h1k-3qfj | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2025-4516
|
| VCID-757r-fs6p-qqdd | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2025-4517
|
| VCID-7ka5-7jrn-dber | Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. |
CVE-2023-6597
|
| VCID-7nj2-94zp-d3bp | python: DoS when processing malformed Apple Property List files in binary format |
CVE-2022-48564
|
| VCID-7s7y-9bw5-m3ep | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2024-6232
|
| VCID-8a7h-5rn5-gubx | A vulnerability has been discovered in GNAT Ada Suite which can lead to remote code execution. |
CVE-2020-27619
|
| VCID-8b19-pezx-6bcd | cpython: wsgiref.headers.Headers allows header newline injection in Python |
CVE-2026-0865
|
| VCID-8dtv-379a-wqfs | cpython: Excessive read buffering DoS in http.client |
CVE-2025-13836
|
| VCID-8zdt-4q7m-t7ht | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2025-4330
|
| VCID-94n7-6q4s-3udv | cpython: Header injection via newlines in data URL mediatype in Python |
CVE-2025-15282
|
| VCID-9nvp-aus1-9yed | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2024-6923
|
| VCID-9sms-mhht-n3aq | python: Mishandling of comma during folding and unicode-encoding of email headers |
CVE-2025-1795
|
| VCID-a8mv-mr3q-vygz | Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution. |
CVE-2022-42919
|
| VCID-bn83-d2qp-9bfy | cpython: Missing character filtering in Python |
CVE-2025-11468
|
| VCID-bqp2-x383-xqfh | Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution. |
CVE-2015-20107
|
| VCID-ct6h-d1eh-7bgj | python: urllib: Regular expression DoS in AbstractBasicAuthHandler |
CVE-2021-3733
|
| VCID-dexx-3ssz-nqfg | python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple |
CVE-2023-27043
|
| VCID-dkxn-j9dr-sqbp | Multiple vulnerabilities have been found in Python, the worst of which could result in the arbitrary execution of code. |
CVE-2021-3177
|
| VCID-dnv8-yrd6-c7cv | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2024-8088
|
| VCID-dv5v-71b5-budp | python: use after free in heappushpop() of heapq module |
CVE-2022-48560
|
| VCID-e6rs-jwvu-jycd | python: urllib: HTTP client possible infinite loop on a 100 Continue response |
CVE-2021-3737
|
| VCID-e6sb-bh7v-9ugg | python: cpython: URL parser allowed square brackets in domain names |
CVE-2025-0938
|
| VCID-emaw-jmek-9bcy | cpython: Python HTMLParser quadratic complexity |
CVE-2025-6069
|
| VCID-ewbq-2gm8-tyf5 | Buffer overflow in sponge queue functions ### Impact The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more. ### Patches Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a). ### Workarounds The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether. ### References See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details. |
CVE-2022-37454
GHSA-6w4m-2xhg-2658 |
| VCID-fcsb-dn49-47gy | python: Quadratic complexity in os.path.expandvars() with user-controlled template |
CVE-2025-6075
|
| VCID-gvgx-eq9r-d3d2 | Multiple vulnerabilities have been found in Python, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26116
|
| VCID-gxvd-xhmx-2uh9 | python: sensitive information can be obtained via the _asyncio._swap_current_task component. |
CVE-2023-38898
|
| VCID-h7z2-vc14-nfhq | python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS |
CVE-2020-10735
|
| VCID-hssa-umby-eud3 | python: local privilege escalation via search path in Windows |
CVE-2022-26488
|
| VCID-hz5k-rky7-nucg | Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. |
CVE-2023-41105
|
| VCID-j8hj-k7wy-yfch | python: ftplib should not use the host from the PASV response |
CVE-2021-4189
|
| VCID-js5p-py72-2kga | Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. |
CVE-2024-0450
|
| VCID-kn9b-2gxw-gqgx | cpython: email header injection due to unquoted newlines |
CVE-2026-1299
|
| VCID-mtk7-qut6-syd8 | cpython: Cpython infinite loop when parsing a tarfile |
CVE-2025-8194
|
| VCID-nqqc-u8d5-8qf6 | cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service |
CVE-2025-12084
|
| VCID-q6g1-cjz3-77e4 | cpython: Tarfile extracts filtered members when errorlevel=0 |
CVE-2025-4435
|
| VCID-qqh6-evfk-1fgy | Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution. |
CVE-2022-45061
|
| VCID-qwhz-912b-8kh5 | cpython: python: Memory race condition in ssl.SSLContext certificate store methods |
CVE-2024-0397
|
| VCID-s5yq-pjhc-fbcm | python: Default mimetype known files writeable on Windows |
CVE-2024-3220
|
| VCID-s7qf-hjkq-wkdy | Multiple vulberabilities have been discovered in Python and PyPy3, the worst of which can lead to privilege escalation. |
CVE-2023-6507
|
| VCID-sbe1-cx8r-aba1 | On Windows a directory returned by tempfile.mkdtemp() would not always have permissions set to restrict reading and writing to the temporary directory by other users, instead usually inheriting the correct permissions from the default location. Alternate configurations or users without a profile directory may not have the intended permissions. If you’re not using Windows or haven’t changed the temporary directory location then you aren’t affected by this vulnerability. On other platforms the returned directory is consistently readable and writable only by the current user. This issue was caused by Python not supporting Unix permissions on Windows. The fix adds support for Unix “700” for the mkdir function on Windows which is used by mkdtemp() to ensure the newly created directory has the proper permissions. |
CVE-2024-4030
|
| VCID-smck-sdx2-c7du | python: Improper validation of IPv6 and IPvFuture addresses |
CVE-2024-11168
|
| VCID-tbuw-2msj-tqd9 | python: Virtual environment (venv) activation scripts don't quote paths |
CVE-2024-9287
|
| VCID-tyk4-kazt-kydj | Multiple vulnerabilities have been found in Python, the worst of which could result in a Denial of Service condition. |
CVE-2019-20907
|
| VCID-uf5s-kms5-g7a9 | cpython: POP3 command injection in user-controlled commands |
CVE-2025-15367
|
| VCID-uvcx-satp-m3db | python: Unbounded memory buffering in SelectorSocketTransport.writelines() |
CVE-2024-12254
|
| VCID-v186-7sv1-ubej | Multiple vulberabilities have been discovered in Python and PyPy, the worst of which can lead to privilege escalation. |
CVE-2024-7592
|
| VCID-v6ry-7xxz-nbeu | CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c. |
CVE-2023-33595
|
| VCID-vpwj-d49q-1uh8 | Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution. |
CVE-2022-0391
|
| VCID-w6k8-js68-87g4 | Multiple vulnerabilities have been found in Python, the worst of which might allow attackers to access sensitive information. |
CVE-2021-23336
|
| VCID-ymg5-42xm-7fh9 | The “socket” module provides a pure-Python fallback to the socket.socketpair() function for platforms that don’t support AF_UNIX, such as Windows. This pure-Python implementation uses AF_INET or AF_INET6 to create a local connected pair of sockets. The connection between the two sockets was not verified before passing the two sockets back to the user, which leaves the server socket vulnerable to a connection race from a malicious local peer. Platforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included. |
CVE-2024-3219
|
| VCID-z48d-eyxz-bycq | Multiple vulnerabilities have been found in Python and PyPy, the worst of which could result in arbitrary code execution. |
CVE-2021-29921
|
| VCID-zh1r-7rzh-2bez | cpython: Header injection in http.cookies.Morsel in Python |
CVE-2026-0672
|
| VCID-znkr-fxtj-4uc7 | cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked |
CVE-2025-8291
|