Victor Stinner

When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.

في أنظمة Windows، تفتقر الدالة `sock recvfrom into()` الموجودة ضمن `asyncio.ProacterEventLoop` إلى فحص حدود مخزن البيانات المؤقت عند استخدام المعلمة `nbytes`. يمكن أن تؤدي هذه الثغرة إلى كتابة خارج حدود المخزن المؤقت إذا تجاوزت البيانات المستلمة عبر الشبكة حجم المخزن المؤقت، مما قد يؤدي إلى تلف الذاكرة أو تعطل النظام أو تنفيذ تعليمات برمجية عشوائية. لا تتأثر الأنظمة الأساسية غير التي تعمل بنظام Windows بهذه الثغرة.

إن الإصلاح غير الكامل لمشكلة سابقة تتعلق بالتحقق من صحة أحرف التحكم في `http.cookies.Morsel` يسمح لأحرف التحكم بتجاوز عملية التحقق من صحة المدخلات. لم يعالج الإصلاح المشكلة بشكل كامل، مما ترك `Morsel.update()`، و`|= operator`، ومسارات فك الترميز معرضة للخطر. بالإضافة إلى ذلك، تفتقر الدالة `BaseCookie.js output()` إلى التحقق من صحة المخرجات الموجود في `BaseCookie.output()`.

An issue in the Linux kernel on the AArch64 architecture ignores the top byte in the address passed to the `brk` system call, potentially moving the memory break downwards when the application expects it to move upwards. This has been observed to cause heap corruption with the GNU C Library `malloc` implementation. The issue is related to a buffer overflow in memory, which can be exploited to cause a denial of service.

The issue is related to insufficient neutralization of special elements in a request, which may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem lies in the Lib/webbrowser.py component of the Python interpreter, where strings are not properly validated before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attacks via a crafted URL. However, a software maintainer indicates that exploitation is impossible due to the code relying on subprocess.Popen and the default shell=False setting.