Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Python 2.7 on Debian could corrupt memory on bad data
published 1 month ago
Summary
The Python 2.7 libraries used in Debian can be tricked into writing outside the program's memory when a compressed file is processed after an error. This could let an attacker cause the program to crash or behave unpredictably. Updating the Python packages to the latest version fixes the issue.
What to do
- Update debian idle-python2.7 to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian libpython2.7 to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian libpython2.7-dev to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian libpython2.7-minimal to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian libpython2.7-stdlib to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian libpython2.7-testsuite to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian python2.7 to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian python2.7-dev to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian python2.7-doc to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian python2.7-examples to version 2.7.16-2+deb10u4+tuxcare.els5.
- Update debian python2.7-minimal to version 2.7.16-2+deb10u4+tuxcare.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Debian:10 | debian | idle-python2.7 |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | libpython2.7 |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | libpython2.7-dev |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | libpython2.7-minimal |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | libpython2.7-stdlib |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | libpython2.7-testsuite |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | python2.7 |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | python2.7-dev |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | python2.7-doc |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | python2.7-examples |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
| TuxCare:Debian:10 | debian | python2.7-minimal |
< 2.7.16-2+deb10u4+tuxcare.els5 Fix: upgrade to 2.7.16-2+deb10u4+tuxcare.els5
|
Original advisory text
Fix CVE(s): CVE-2026-9669
* SECURITY UPDATE: out-of-bounds stack write when a bz2 decompressor or
BZ2File handle is reused after a decompression error
- debian/patches/CVE-2026-9669.patch: record the bzlib error code on
BZ2DecompObject and refuse further decompress() calls with
ValueError in Modules/bz2module.c, so that crafted input can no
longer make BZ2_bzDecompress() resume from an invalid internal
state; also make the error sticky for the C BZ2File read paths,
which re-entered the errored stream in the same way, and add
regression tests for both
- CVE-2026-9669
BZ2File handle is reused after a decompression error
- debian/patches/CVE-2026-9669.patch: record the bzlib error code on
BZ2DecompObject and refuse further decompress() calls with
ValueError in Modules/bz2module.c, so that crafted input can no
longer make BZ2_bzDecompress() resume from an invalid internal
state; also make the error sticky for the C BZ2File read paths,
which re-entered the errored stream in the same way, and add
regression tests for both
- CVE-2026-9669
References
- https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1789461197.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9669 Vendor Advisory
Timeline
Published15 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789461197 · OSV
Track software like this
Free during beta