USN-7886-2

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-7886-2
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7886-2.json
JSON Data
https://api.osv.dev/v1/vulns/USN-7886-2
Upstream
Related
Published
2025-11-26T20:22:31.466822Z
Modified
2026-02-04T03:08:26.765077Z
Summary
python3.13 vulnerabilities
Details

USN-7886-1 fixed vulnerabilities in Python. This update provides the corresponding updates for python3.13 in Ubuntu 25.04 and Ubuntu 25.10.

Original advisory details:

It was discovered that Python inefficiently handled expanding system environment variables. An attacker could possibly use this issue to cause Python to consume excessive resources, leading to a denial of service. (CVE-2025-6075)

Caleb Brown discovered that Python incorrectly handled the ZIP64 End of Central Directory (EOCD) Locator record offset value. An attacker could possibly use this issue to obfuscate malicious content. (CVE-2025-8291)

References

Affected packages

Ubuntu:25.10 / python3.13

Package

Name
python3.13
Purl
pkg:deb/ubuntu/python3.13@3.13.7-1ubuntu0.1?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.13.7-1ubuntu0.1

Affected versions

3.*
3.13.3-1
3.13.3-2
3.13.3-4
3.13.4-1
3.13.5-1
3.13.5-2
3.13.6-1
3.13.7-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "idle-python3.13"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "libpython3.13"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "libpython3.13-dev"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "libpython3.13-minimal"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "libpython3.13-stdlib"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "libpython3.13-testsuite"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-dev"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-examples"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-full"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-gdbm"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-minimal"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-nopie"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-tk"
        },
        {
            "binary_version": "3.13.7-1ubuntu0.1",
            "binary_name": "python3.13-venv"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map 
{
    "cves": [],
    "ecosystem": "Ubuntu:25.10"
}
source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7886-2.json"