SUSE-SU-2025:4368-1

LOW3.3

Security update for python3

Published Dec 11, 2025

Modified 6 months ago

Fix available

Details

Description of the patch:

This update for python3 fixes the following issues:

CVE-2025-6075: quadratic complexity in os.path.expandvars() can lead to performance degradation when values passed to it are user-controlled (bsc#1252974).
CVE-2025-8291: lack of validity checks on the ZIP64 End of Central Directory (EOCD) record allows for the creation of ZIP archives that are processed inconsistently by the zipfile module (bsc#1251305).

Affected Packages(13 packages)

libpython3_6m1_0

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Micro 5.2

Fixed in:

3.6.15-150300.10.100.1

python3

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Micro 5.2

Fixed in:

3.6.15-150300.10.100.1

python3-base

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Micro 5.2

Fixed in:

3.6.15-150300.10.100.1

python3-curses

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP6

Fixed in:

3.6.15-150300.10.100.1

python3-dbm

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP6

Fixed in:

3.6.15-150300.10.100.1

python3-devel

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP6

Fixed in:

3.6.15-150300.10.100.1

python3-idle

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP6

Fixed in:

3.6.15-150300.10.100.1

python3-tk

SUSE Linux Enterprise Desktop 15 SP6SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP6SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP6

Fixed in:

3.6.15-150300.10.100.1

python3-tools

SUSE Linux Enterprise Module for Development Tools 15 SP6SUSE Linux Enterprise Module for Development Tools 15 SP7openSUSE Leap 15.6

Fixed in:

3.6.15-150300.10.100.1

libpython3_6m1_0-32bit

openSUSE Leap 15.6

Fixed in:

3.6.15-150300.10.100.1

References

https://bugzilla.suse.com/1251305

https://bugzilla.suse.com/1252974

https://lists.suse.com/pipermail/sle-security-updates/2025-December/023523.html

https://www.suse.com/security/cve/CVE-2025-6075/

https://www.suse.com/security/cve/CVE-2025-8291/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2025/suse-su-20254368-1/

CVSS Analysis

CVSS v3.1

3.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

3.3/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Upstream

CVE-2025-6075 CVE-2025-8291

Ecosystems(17)

SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Micro 5.2

Timeline

PublishedDec 11, 2025

ModifiedDec 11, 2025

SUSE-SU-2025:4368-1 | Mondoo Vulnerability Intelligence