{"id":"SUSE-SU-2025:4433-1","aliases":[],"status":"published","title":"Security update for python39","description":"This update for python39 fixes the following issues:\n\n* Update to 3.9.25:\n- Security\n    - gh-137836: Add support of the “plaintext” element, RAWTEXT\n      elements “xmp”, “iframe”, “noembed” and “noframes”, and\n      optionally RAWTEXT element “noscript” in\n      html.parser.HTMLParser.\n    - gh-136063: email.message: ensure linear complexity for\n      legacy HTTP parameters parsing. Patch by Bénédikt Tran.\n- Library\n    - gh-98793: Fix argument typechecks in\n      _overlapped.WSAConnect() and\n      _overlapped.Overlapped.WSASendTo() functions. bpo-44817:\n      Ignore WinError 53 (ERROR_BAD_NETPATH), 65\n      (ERROR_NETWORK_ACCESS_DENIED) and 161 (ERROR_BAD_PATHNAME)\n      when using ntpath.realpath().\n- Core and Builtins\n    - gh-120384: Fix an array out of bounds crash in\n      list_ass_subscript, which could be invoked via some\n      specificly tailored input: including concurrent\n      modification of a list object, where one thread assigns\n      a slice and another clears it.\n    - gh-120298: Fix use-after free in list_richcompare_impl\n      which can be invoked via some specificly tailored evil\n      input.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-12-17T13:20:25Z","modified":"2026-03-23T04:51:32Z","fixes":[{"ecosystem":"openSUSE:Leap 15.6","package":"python39","fixed_in":["3.9.25-150300.4.87.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python39-core","fixed_in":["3.9.25-150300.4.87.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python39-documentation","fixed_in":["3.9.25-150300.4.87.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python39","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.25-150300.4.87.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python39-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.25-150300.4.87.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python39-documentation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.25-150300.4.87.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254433-1/","tags":["advisory"]}],"sources":{"osv":[{"id":"SUSE-SU-2025:4433-1","title":"Security update for python39","description":"This update for python39 fixes the following issues:\n\n* Update to 3.9.25:\n- Security\n    - gh-137836: Add support of the “plaintext” element, RAWTEXT\n      elements “xmp”, “iframe”, “noembed” and “noframes”, and\n      optionally RAWTEXT element “noscript” in\n      html.parser.HTMLParser.\n    - gh-136063: email.message: ensure linear complexity for\n      legacy HTTP parameters parsing. Patch by Bénédikt Tran.\n- Library\n    - gh-98793: Fix argument typechecks in\n      _overlapped.WSAConnect() and\n      _overlapped.Overlapped.WSASendTo() functions. bpo-44817:\n      Ignore WinError 53 (ERROR_BAD_NETPATH), 65\n      (ERROR_NETWORK_ACCESS_DENIED) and 161 (ERROR_BAD_PATHNAME)\n      when using ntpath.realpath().\n- Core and Builtins\n    - gh-120384: Fix an array out of bounds crash in\n      list_ass_subscript, which could be invoked via some\n      specificly tailored input: including concurrent\n      modification of a list object, where one thread assigns\n      a slice and another clears it.\n    - gh-120298: Fix use-after free in list_richcompare_impl\n      which can be invoked via some specificly tailored evil\n      input.\n","status":"published","published":"2025-12-17T13:20:25Z","modified":"2026-03-23T04:51:32.917059Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}