Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1188843 > unrolled thread

Bug#1065326: bookworm-pu: package python3.11/3.11.2-6+deb12u1

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1065326: bookworm-pu: package python3.11/3.11.2-6+deb12u1 Stefano Rivera <stefanor@debian.org> - 2024-03-02 21:40 +0100
    Bug#1065326: python3.11 3.11.2-6+deb12u1 flagged for acceptance Jonathan Wiltshire <jmw@debian.org> - 2024-03-03 13:20 +0100

#1188843 — Bug#1065326: bookworm-pu: package python3.11/3.11.2-6+deb12u1

[Multipart message — attachments visible in raw view] — view raw

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: python3.11@packages.debian.org, doko@debian.org
Control: affects -1 + src:python3.11
User: release.debian.org@packages.debian.org
Usertags: pu

[ Reason ]
A use-after-free causing a SEGV was found in python 3.11, affecting the
the Zulip chat server.

The bug is known to affect python 3.11.0 - 3.11.4. And since being fixed
upstream, there have been no known related regressions.

[ Impact ]
Potential SEGV in python3. Known to be triggered by zulip's CI when
running under coverage.

[ Tests ]
The Python stdlib testsuite is extensive and passes with this patch.

There is a stand-alone reproducer that I've manually reproduced the bug
with and verified that it's fixed.

[ Risks ]
The code is pretty straight-forward. It asserts that the f_frame hasn't
already been freed before freeing.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[toc] | [next] | [standalone]

#1188902 — Bug#1065326: python3.11 3.11.2-6+deb12u1 flagged for acceptance

package release.debian.org
tags 1065326 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==============

Package: python3.11
Version: 3.11.2-6+deb12u1

Explanation: fix use-after-free crash when deallocating a frame object

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web