OL CVE Issue Summary:
Directory traversal vulnerability in the extract() and extractall() functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files using .. in filenames in a TAR archive

OL CVE Issue Summary:

A use-after-free in XML Reader path when DTD validation and XInclude expansion are both enabled. A crafted document can trigger XML Reader backtracking and reprocessing of an XInclude node, which may invalidate or free nodes while validation still references them.

OL CVE Issue Summary:
chown in GNU coreutils is vulnerable to a race condition when using the POSIX
"-R -L" options to follow symlinks recursively.
In the presence of symlinks, the recursive directory traversal is not guaranteed
to be performed depth-first. As a result, the "new owner" may be able to
introduce a symlink at a point in the traversal that has yet to be reached.
When it is reached, chown will be performed on the target of that symlink --
a situation that is often exploitable to gain root privileges.

chgrp is implemented with chown and is vulnerable in the same way when used
on group-writable paths.

OL CVE Issue Summary:

Directory traversal vulnerability in the extract() and extractall()
functions in the tarfile module in Python allows user-assisted remote
attackers to overwrite arbitrary files using .. in filenames in a TAR
archive