Release date:
2026-07-23 11:27:18 UTC
Description:
* SECURITY UPDATE: reject control characters in imaplib IMAP4 commands
- debian/patches/CVE-2025-15366.patch: guard IMAP4._command()
- CVE-2025-15366
* SECURITY UPDATE: reject control characters in poplib POP3 commands
- debian/patches/CVE-2025-15367.patch: guard POP3._putcmd()
- CVE-2025-15367
* SECURITY UPDATE: control-character injection via http.cookies paths
- debian/patches/CVE-2026-3644.patch: guard Morsel.update()/|=/unpickle/js_output
- CVE-2026-3644
* SECURITY UPDATE: uncontrolled recursion in pyexpat content model
- debian/patches/CVE-2026-4224.patch: recursion guard in conv_content_model()
- CVE-2026-4224
* SECURITY UPDATE: webbrowser argument injection via leading-dash URL
- debian/patches/CVE-2026-4519.patch: reject URLs starting with '-'
- CVE-2026-4519
Updated packages:
-
alt-python310_3.10.20-3_amd64.deb
sha:1853dc71a3851801df27c56f723960dd1e81176d
-
alt-python310-debug_3.10.20-3_amd64.deb
sha:075335d2315f07a3591413e7de068755b396ca73
-
alt-python310-devel_3.10.20-3_amd64.deb
sha:b7e5b724611a71a52da71a9be7308183c95168fe
-
alt-python310-idle_3.10.20-3_amd64.deb
sha:af1bc594f211d9aa24bce9ef0426a6778ea506d3
-
alt-python310-libs_3.10.20-3_amd64.deb
sha:116d1f64f143ab8e479c1524bab3c122cf136c35
-
alt-python310-test_3.10.20-3_amd64.deb
sha:43f75b04cd9ae3193bf9ce477e45d0aee626c295
-
alt-python310-tkinter_3.10.20-3_amd64.deb
sha:fe00ef465dcc7f8efa898fb21c4aad6a76cd30b9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
