python3-base (SUSE:Linux Enterprise Server 12 SP1-LTSS) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 12 SP1-LTSS package python3-base, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (15)

• CVE-2019-9636 — CVSS 9.8 (critical): Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during…
• CVE-2016-0718 — CVSS 9.8 (critical): Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input…
• CVE-2016-9063 — CVSS 9.8 (critical): An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
• CVE-2017-1000158 — CVSS 9.8 (critical): CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting…
• CVE-2018-1000802 — CVSS 9.8 (critical): Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command…
• CVE-2019-10160 — CVSS 9.8 (critical): A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions…
• CVE-2016-4472 — CVSS 8.1 (high): The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a…
• CVE-2019-9674 — CVSS 7.5 (high): Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.
• CVE-2018-14647 — CVSS 7.5 (high): Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial…
• CVE-2018-20406 — CVSS 7.5 (high): Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a "resize to twice…
• CVE-2019-5010 — CVSS 7.5 (high): An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially…
• CVE-2017-9233 — CVSS 7.5 (high): XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an…
• CVE-2020-8492 — CVSS 6.5 (medium): Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct…
• CVE-2019-18348 — CVSS 6.1 (medium): An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the…
• CVE-2012-0876 — CVSS 4.3 (medium): The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions…