|
| 1 | +.. bpo: 32551 |
| 2 | +.. date: 2018-01-16-16-05-37 |
| 3 | +.. nonce: U0z4W- |
| 4 | +.. release date: 2018-01-23 |
| 5 | +.. section: Security |
| 6 | +
|
| 7 | +The ``sys.path[0]`` initialization change for bpo-29139 caused a regression |
| 8 | +by revealing an inconsistency in how sys.path is initialized when executing |
| 9 | +``__main__`` from a zipfile, directory, or other import location. This is |
| 10 | +considered a potential security issue, as it may lead to privileged |
| 11 | +processes unexpectedly loading code from user controlled directories in |
| 12 | +situations where that was not previously the case. |
| 13 | + |
| 14 | +The interpreter now consistently avoids ever adding the import location's |
| 15 | +parent directory to ``sys.path``, and ensures no other ``sys.path`` entries |
| 16 | +are inadvertently modified when inserting the import location named on the |
| 17 | +command line. (Originally reported as bpo-29723 against Python 3.6rc1, but |
| 18 | +it was missed at the time that the then upcoming Python 3.5.4 release would |
| 19 | +also be affected) |
| 20 | + |
| 21 | +.. |
| 22 | +
|
| 23 | +.. bpo: 30657 |
| 24 | +.. date: 2017-12-01-18-51-03 |
| 25 | +.. nonce: Fd8kId |
| 26 | +.. section: Security |
| 27 | +
|
| 28 | +Fixed possible integer overflow in PyBytes_DecodeEscape, CVE-2017-1000158. |
| 29 | +Original patch by Jay Bosamiya; rebased to Python 3 by Miro Hrončok. |
| 30 | + |
| 31 | +.. |
| 32 | +
|
| 33 | +.. bpo: 30947 |
| 34 | +.. date: 2017-09-05-20-34-44 |
| 35 | +.. nonce: iNMmm4 |
| 36 | +.. section: Security |
| 37 | +
|
| 38 | +Upgrade libexpat embedded copy from version 2.2.1 to 2.2.3 to get security |
| 39 | +fixes. |
| 40 | + |
| 41 | +.. |
| 42 | +
|
| 43 | +.. bpo: 31095 |
| 44 | +.. date: 2017-08-01-18-48-30 |
| 45 | +.. nonce: bXWZDb |
| 46 | +.. section: Core and Builtins |
| 47 | +
|
| 48 | +Fix potential crash during GC caused by ``tp_dealloc`` which doesn't call |
| 49 | +``PyObject_GC_UnTrack()``. |
| 50 | + |
| 51 | +.. |
| 52 | +
|
| 53 | +.. bpo: 32072 |
| 54 | +.. date: 2017-11-18-21-13-52 |
| 55 | +.. nonce: nwDV8L |
| 56 | +.. section: Library |
| 57 | +
|
| 58 | +Fixed issues with binary plists: |
| 59 | + |
| 60 | +* Fixed saving bytearrays. |
| 61 | +* Identical objects will be saved only once. |
| 62 | +* Equal references will be load as identical objects. |
| 63 | +* Added support for saving and loading recursive data structures. |
| 64 | + |
| 65 | +.. |
| 66 | +
|
| 67 | +.. bpo: 31170 |
| 68 | +.. date: 2017-09-05-20-35-21 |
| 69 | +.. nonce: QGmJ1t |
| 70 | +.. section: Library |
| 71 | +
|
| 72 | +expat: Update libexpat from 2.2.3 to 2.2.4. Fix copying of partial |
| 73 | +characters for UTF-8 input (libexpat bug 115): |
| 74 | +https://github.com/libexpat/libexpat/issues/115 |
0 commit comments