Summary
[3.9.25-7.0.1]
- Remove upstream URL reference
[3.9.25-7]
- Security fixes for CVE-2026-4786 and CVE-2026-6100
Resolves: RHEL-167919, RHEL-168161
[3.9.25-6]
- Security fix for CVE-2026-4519
Resolves: RHEL-158117
[3.9.25-5]
- Rebuilding previous fixes for different build target
Related: RHEL-143117, RHEL-143174, RHEL-144897
[3.9.25-4]
- Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
Resolves: RHEL-143117
Resolves: RHEL-143174
Resolves: RHEL-144897
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | python-unversioned-command | 0:3.9.25-7.0.1.el9_8 |
| Oracle Linux · 9 | python3 | 0:3.9.25-7.0.1.el9_8 |
| Oracle Linux · 9 | python3-debug | 0:3.9.25-7.0.1.el9_8 |
| Oracle Linux · 9 | python3-devel | 0:3.9.25-7.0.1.el9_8 |
| Oracle Linux · 9 | python3-idle | 0:3.9.25-7.0.1.el9_8 |
| Oracle Linux · 9 | python3-libs | 0:3.9.25-7.0.1.el9_8 |
| Oracle Linux · 9 | python3-test | 0:3.9.25-7.0.1.el9_8 |
| Oracle Linux · 9 | python3-tkinter | 0:3.9.25-7.0.1.el9_8 |
Vulnerabilities 3
-
Critical 9.1
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under …
-
High 7.0
webbrowser.open() allows leading dashes in URLs
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
-
High 7.0
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()" API could have commands injected into the underlying shell. See CVE-2026-4519 for details.