python-uv vulnerabilities (openSUSE)
10 vulnerabilities.
-
python-uvopenSUSE zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) 7.4 High -
python-uvopenSUSE zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size 7.5 High -
python-uvopenSUSE zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE 10.0 Critical -
python-uvopenSUSE roxmltree through 0.21.1 Denial of Service via Quadratic Parsing 8.7 High -
python-uvopenSUSE quinn-proto has remote memory exhaustion from unbounded out-of-order stream reassembly 7.5 High -
python-uvopenSUSE Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing 8.7 High -
python-uvopenSUSE Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials 6.3 Medium -
python-uvopenSUSE astral-tokio-tar Vulnerable to PAX Header Desynchronization 8.1 High -
python-uvopenSUSE Tracing logging user input may result in poisoning logs with ANSI escape sequences 2.3 Low -
python-uvopenSUSE uv is vulnerable to ZIP payload obfuscation through parsing differentials 6.8 Medium