Release date:
2026-07-23 14:47:41 UTC
Description:
* SECURITY UPDATE: reject control characters in imaplib IMAP4 commands
- debian/patches/CVE-2025-15366.patch: guard IMAP4._command()
- CVE-2025-15366
* SECURITY UPDATE: reject control characters in poplib POP3 commands
- debian/patches/CVE-2025-15367.patch: guard POP3._putcmd()
- CVE-2025-15367
* SECURITY UPDATE: control-character injection via http.cookies paths
- debian/patches/CVE-2026-3644.patch: guard Morsel.update()/|=/unpickle/js_output
- CVE-2026-3644
* SECURITY UPDATE: uncontrolled recursion in pyexpat content model
- debian/patches/CVE-2026-4224.patch: recursion guard in conv_content_model()
- CVE-2026-4224
* SECURITY UPDATE: webbrowser argument injection via leading-dash URL
- debian/patches/CVE-2026-4519.patch: reject URLs starting with '-'
- CVE-2026-4519
Updated packages:
-
alt-python310_3.10.20-3_amd64.deb
sha:342ae0132043a39c1ec24d83029ef83fdc371b7f
-
alt-python310-debug_3.10.20-3_amd64.deb
sha:28ac16c19ca2d1f5da35a674728a60a5858b9d6e
-
alt-python310-devel_3.10.20-3_amd64.deb
sha:a009bd212de9d581c44f7708a49c335fee8cf910
-
alt-python310-idle_3.10.20-3_amd64.deb
sha:180034e736aa583accf692d3ff79eb7f5b152646
-
alt-python310-libs_3.10.20-3_amd64.deb
sha:9844a43f29dc85e750fd5ccee62a380ea6657fbd
-
alt-python310-test_3.10.20-3_amd64.deb
sha:fdf4117044c1917e95335109d241ca85185ca23e
-
alt-python310-tkinter_3.10.20-3_amd64.deb
sha:283a800468cb8d6716e351c6167bf5827bf0a0ee
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
