Stan Ulbrych

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** `bz2.BZ2Decompressor` objects can be reused following a decompression error. If an application catches the resulting `OSError` and attempts to retry using the same decompressor, specially crafted input may cause the decompressor to resume from an invalid internal state. This leads to out-of-bounds writes to a stack buffer, which can result in a process crash when processing untrusted data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `tarfile.data filter` can be bypassed using crafted link entries, such as symlinks with empty or directory-like names. This allows a malicious tar archive to redirect subsequent archive members outside the intended extraction directory, causing the `tarfile.extractall()` function to write files to arbitrary locations on the system, depending on the permissions of the process performing the extraction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `unicodedata.normalize()` function can consume excessive CPU time when processing specially crafted Unicode input. This occurs when the input contains long sequences of combining characters with alternating Canonical Combining Class values, affecting all normalization forms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `xml.parsers.expat` and `xml.etree.ElementTree` modules use insufficient entropy for Expat hash-flooding protection. This allows a specially crafted XML document to trigger hash flooding, a condition where many keys are mapped to the same hash bucket, significantly slowing down processing. **Recommendations** Update libexpat to version 2.8.0 or later and apply the available software patch.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An incomplete mitigation allows for a bypass when a URL contains the string "%action". For certain browser types, this can lead to command injection into the underlying shell via the `webbrowser.open()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions CPython (affected versions not specified) Description A use-after-free (UAF) issue exists in `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This occurs when a memory allocation fails with a `MemoryError` and the decompression instance is subsequently reused, typically under memory pressure. Use-after-free is a condition where a program continues to use a memory address after it has been released. This issue does not affect the use of one-shot decompression helper functions such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()`, nor does it affect cases where decompressor instances are not reused after an error. Recommendations Avoid reusing decompressor instances across multiple decompression calls after a `MemoryError` is raised. Use helper functions such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` to perform one-shot decompression. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** http.cookies (affected versions not specified) **Description** An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Expat (affected versions not specified) **Description** The Expat parser, when used with a registered ElementDeclHandler, is susceptible to a C stack overflow when processing an inline document type definition with a deeply nested content model. This occurs during the parsing of XML documents containing complex and deeply nested DTD content models. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.