Victor Stinner

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** On Windows systems, the `sock recvfrom into()` function within `asyncio.ProacterEventLoop` lacks a boundary check for the data buffer when the `nbytes` parameter is used. This flaw can lead to an out-of-bounds buffer write if the received network data exceeds the buffer size, potentially resulting in memory corruption, system crashes, or arbitrary code execution. Non-Windows platforms are not affected. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** http.cookies (affected versions not specified) **Description** An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.4 through 5.5.6 **Description** An issue in the Linux kernel on the AArch64 architecture ignores the top byte in the address passed to the `brk` system call, potentially moving the memory break downwards when the application expects it to move upwards. This has been observed to cause heap corruption with the GNU C Library `malloc` implementation. The issue is related to a buffer overflow in memory, which can be exploited to cause a denial of service. **Recommendations** For Linux kernel versions 5.4 through 5.5.6, consider updating to a newer version to mitigate the risk of heap corruption and denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python versions through 3.6.3 **Description** The issue is related to insufficient neutralization of special elements in a request, which may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem lies in the Lib/webbrowser.py component of the Python interpreter, where strings are not properly validated before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attacks via a crafted URL. However, a software maintainer indicates that exploitation is impossible due to the code relying on subprocess.Popen and the default shell=False setting. **Recommendations** For versions through 3.6.3, consider disabling the use of the BROWSER environment variable or restricting its use to trusted sources until a patch is available. As a temporary workaround, avoid using the `BROWSER` environment variable in the affected Lib/webbrowser.py component. At the moment, there is no information about a newer version that contains a fix for this vulnerability.