Victor Stinner

When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especially true if the created Python is called traceback.py. The problem is that Python adds the current directory to sys.path when python -m MODULE is run, and the archive is also decompressed in the current directory. The fix removes sys.path[0] in gzip, tarfile and zipfile command line interface to prevent shadowing standard library modules from extracted files.

http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3.

On Windows systems, the `sock recvfrom into()` function within `asyncio.ProacterEventLoop` lacks a boundary check for the data buffer when the `nbytes` parameter is used. This flaw can lead to an out-of-bounds buffer write if the received network data exceeds the buffer size, potentially resulting in memory corruption, system crashes, or arbitrary code execution. Non-Windows platforms are not affected.

An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`.

An issue in the Linux kernel on the AArch64 architecture ignores the top byte in the address passed to the `brk` system call, potentially moving the memory break downwards when the application expects it to move upwards. This has been observed to cause heap corruption with the GNU C Library `malloc` implementation. The issue is related to a buffer overflow in memory, which can be exploited to cause a denial of service.

The issue is related to insufficient neutralization of special elements in a request, which may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem lies in the Lib/webbrowser.py component of the Python interpreter, where strings are not properly validated before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attacks via a crafted URL. However, a software maintainer indicates that exploitation is impossible due to the code relying on subprocess.Popen and the default shell=False setting.