Ubuntu alert USN-7886-2 (python3.13)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7886-2] Python vulnerabilities
Date:
             
 
Wed, 26 Nov 2025 20:42:03 +0000
Message-ID:
             
 
<E1vOMKx-0000Eo-VD@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7886-2
November 26, 2025

python3.13 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 25.04

Summary:

Several security issues were fixed in Python.

Software Description:
- python3.13: An interactive high-level object-oriented language

Details:

USN-7886-1 fixed vulnerabilities in Python. This update provides the
corresponding updates for python3.13 in Ubuntu 25.04 and Ubuntu 25.10.

Original advisory details:

 It was discovered that Python inefficiently handled expanding system
 environment variables. An attacker could possibly use this issue to cause
 Python to consume excessive resources, leading to a denial of service.
 (CVE-2025-6075)

 Caleb Brown discovered that Python incorrectly handled the ZIP64 End of
 Central Directory (EOCD) Locator record offset value. An attacker could
 possibly use this issue to obfuscate malicious content. (CVE-2025-8291)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  libpython3.13                   3.13.7-1ubuntu0.1
  python3.13                      3.13.7-1ubuntu0.1

Ubuntu 25.04
  libpython3.13                   3.13.3-1ubuntu0.4
  python3.13                      3.13.3-1ubuntu0.4

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7886-2
  https://ubuntu.com/security/notices/USN-7886-1
  CVE-2025-6075, CVE-2025-8291

Package Information:
  https://launchpad.net/ubuntu/+source/python3.13/3.13.7-1u...
  https://launchpad.net/ubuntu/+source/python3.13/3.13.3-1u...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmknZfAACgkQcpJm3tlz
hgESoxAArU32zz22BbHi4agcadoe/+yIsfAdVJAgMAHDnmDSBX3VtoiVukIKtzdI
shKCdhbABW7PIUOLBZfTruohleU+9d9poK9XN078Wsy/z5fV6q4W06bCW3TFc+5z
fAv/BahGfgd2CbZjzF24ij8vwsjjXLi1u1DvxgH6t6sWDgus6yXzbN+M0nmtrbqK
uFh1xamQi0cRmbwFGUGlot7kug8J3gr0uGydqWm75iMGhmLTtYTR2c7znWsDttAk
ea/Shsk6rugLzpMdYa5o4lCU3tvr2LQ4r0Be6oSJAGJBavMIPxNuqfHSl27Oyck0
VIYcOojlylQsuiLmyAcJI3M6+55InmzBMtSPKvh67U1Ie8jPkTR0Y2Rx1sMDHht+
0HtMWslU2hx5Q6JNClB98xBNKj41LiU7GDfo5tb3YgpHGBPSB0GUZPIO13sOmdGp
iGMTdz2BIa0JdBaKXvq10c7ujgFzUtru1gl0Co2xcAVcsex5snwbMlEIKGUZ6fX5
B0jY1A4FJh6tcyj5vLQeIZBm1B1iUN3K6RojFnAhHtcZ5Sxnh97irxhNZButhhYp
SiJBjnQ+o7kYy1RaTgp+AL3puxw1Gmm48UKFRsHm2XoOjHacsPmrXoLBnJ+Sc/xD
FdLIfYMn+uBrO2QUQcik6aP/y67DZeBDmsphBTtbbUiJXlcPcgI=
=X5bi
-----END PGP SIGNATURE-----